Pith. sign in

REVIEW 3 major objections 4 minor 54 references

Comparing privacy notions for protection against reconstruction attacks in machine learning

T0 review · 3 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Bayes' capacity, not DP's epsilon, predicts reconstruction attack success in DP-SGD.

desk verdict Useful RDP accounting for VMF, but the Bayes-capacity comparison rests on an unverified range condition; the empirical correlation is suggestive, not conclusive. read the letter →

arxiv 2502.04045 v1 pith:PQDK2LXY submitted 2025-02-06 cs.LG cs.CRcs.ITmath.IT

Sayan Biswas , Mark Dras , Pedro Faustini , Natasha Fernandes , Annabelle McIver , Catuscia Palamidessi , Parastoo Sadeghi This is my paper · ORCID
classification cs.LGcs.CRcs.ITmath.IT
keywords differentialprivacymetricRényiBayescapacityreconstructionattacksDP-SGDvonMises-Fishermechanismfederatedlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard $(\epsilon,\delta)$ parameters of differential privacy, and their R\'enyi-DP refinements, do not tell you how well a private training algorithm resists reconstruction attacks, and proposes Bayes' capacity as the right measure instead. It develops the theory for DP-SGD with two noise mechanisms—Gaussian noise and von Mises-Fisher directional noise—shows how to place both on a common R\'enyi-DP footing, and proves that the reconstruction risk of the whole gradient pipeline equals the Bayes capacity of its noise-adding stage alone when that stage sees the full range of preprocessed gradients. The experiments then show that mechanisms matched under R\'enyi-DP have very different reconstruction outcomes, while mechanisms with similar Bayes capacity have similar reconstruction outcomes regardless of mechanism. If correct, this gives practitioners a way to compare privacy mechanisms for reconstruction threats that is not available from $(\epsilon,\delta)$ alone.

What carries the argument

Bayes' capacity is the central object: $C_{\mathsf{Bayes}}(M)=\sum_{y\in\mathcal{Y}}\max_{x\in\mathcal{X}}M_{x,y}$ for discrete channels, with the natural integral analogue for continuous densities. It measures the maximum multiplicative leakage of a channel under a one-try, uniform-prior attack, and the Miracle Theorem guarantees it bounds leakage for any prior and gain function. In this paper it carries the argument because a deterministic pre-processing $C$ cancels in $C\cdot D$ (Lemma 1), leaving the noise channel $D$ as the sole determinant of reconstruction risk. The paper also derives closed forms for Gaussian noise (Theorem 5) and VMF noise (Theorem 6), turning the abstract measure into a concrete mechanism-comparison tool.

What would settle it

Measure the set of averaged clipped gradients produced by the MLP on a real training run and test whether it covers the whole ball $B_R^p$; if it does not, Theorem 4's equality is violated, and a direct gradient-inversion attack on two mechanisms with equal or inverted capacities would show whether the end-to-end MSE/SSIM ordering still matches the $C_{\mathsf{Bayes}}(D)$ ordering.

Watch

Extended reading notes

Core claim

The central discovery is that reconstruction risk in DP-SGD factors through the noise-adding step alone. For a deterministic preprocessing channel $C$ whose columns are all nonzero and a noise channel $D$ whose domain is exactly the range of $C$, the Bayes capacity of the composed channel $C\cdot D$ equals $C_{\mathsf{Bayes}}(D)$. Thus the gradient-averaging and clipping steps can be ignored when measuring one-try reconstruction leakage, and two mechanisms can be compared purely by the Bayes capacity of their noise. This is why, in the experiments, orderings by $C_{\mathsf{Bayes}}$ track inversion-attack success across both Gaussian and VMF mechanisms while orderings by $(\epsilon,\delta)$ do not.

Load-bearing premise

The comparison can rank mechanisms directly only if the deterministic pre-processing of gradients in DP-SGD—clipping and averaging—actually lets the noise channel receive every value in its domain; if real gradients fill only a low-dimensional subset, the equality becomes an upper bound and noise-only rankings can mis-order true risk.

Editorial extensions

If this is right

  • For a fixed architecture and data distribution, reconstruction safety of DP-SGD reduces to comparing $C_{\mathsf{Bayes}}$(Gaussian noise) with $C_{\mathsf{Bayes}}$(VMF noise), without needing to model the deterministic gradient steps.
  • Mechanisms that look equivalent under R\'enyi-DP can differ substantially in reconstruction resistance: in the experiments, Gaussian gave higher accuracy while VMF gave stronger protection against inversion at the same $\epsilon$.
  • Bayes capacity orders mechanisms by measured reconstruction success across both mechanisms, whereas $(\epsilon,\delta)$ does not; reporting Bayes capacity alongside the DP budget would give a more honest picture of reconstruction risk.
  • The R\'enyi-DP conversion for VMF, including subsampling amplification and epoch composition, lets metric-privacy mechanisms be slotted into standard DP-SGD privacy accounting and compared with Gaussian on one scale.
  • When the range condition of Theorem 4 fails, $C_{\mathsf{Bayes}}(D)$ still serves as an upper bound on the reconstruction risk of the full pipeline, so it can be used as a conservative screening tool.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the same factoring argument suggests that any deliberate restriction of the gradient pre-processing—smaller clipping norms, different averaging, or architectural constraints—could lower end-to-end reconstruction risk even when the noise channel is unchanged, and the gap between $C_{\mathsf{Bayes}}(C\cdot D)$ and $C_{\mathsf{Bayes}}(D)$ would quantify that extra protection.
  • The authors do not test this, but a direct screening protocol follows: compute $C_{\mathsf{Bayes}}(D)$ for candidate noise mechanisms first, order them, and only run expensive inversion attacks on mechanisms whose capacities are close, since ordering should already predict reconstruction difficulty.
  • Because Bayes capacity is an upper bound on one-try leakage, a mechanism that scores lower under this measure should also dominate against weaker reconstruction heuristics, so the comparison could serve as a first-pass safety check in federated learning deployments.
  • A testable extension is to keep $C_{\mathsf{Bayes}}(D)$ fixed while varying clipping norms or batch sizes; the theory predicts unchanged reconstruction risk when the range condition holds and measurable changes when it fails, giving a way to empirically detect when noise-only ranking is insufficient.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a framework for comparing privacy mechanisms in federated learning against gradient-based reconstruction attacks, focusing on the Gaussian mechanism (DP-SGD) and the VMF mechanism (metric privacy). It derives Rényi differential privacy guarantees for VMF, uses them to convert VMF parameters into (epsilon, delta)-DP, and thereby compares the two mechanisms under common privacy budgets. As an alternative measure, the paper proposes Bayes' capacity, showing via a channel-composition argument (Theorem 4) that the reconstruction risk of the full DP-SGD pipeline equals the Bayes capacity of the noise-adding mechanism alone. Closed-form Bayes capacities are derived for Gaussian and VMF noise, and experiments on MNIST and Fashion-MNIST with the IGA attack show that Bayes capacity correlates better with reconstruction MSE than do the DP parameters. The paper concludes that Bayes' capacity is a more appropriate measure than (epsilon, delta)-DP for comparing reconstruction protection.

Significance. The work makes two concrete contributions that are likely to be useful to the community even if the theoretical framing needs repair. First, the RDP analysis of the VMF mechanism, including the monotonicity properties, subsampling amplification, and composition accounting, is new and fills a gap in comparing metric privacy with DP. Second, the empirical finding that equivalent RDP parameters lead to very different reconstruction protection under IGA, and that a Bayes-capacity measure tracks MSE across mechanisms while epsilon does not, is a valuable reproducibility and extension of earlier observations. The detailed proofs and extensive experiments show care. However, the central theoretical simplification—that the reconstruction risk of the composed channel C·D equals the Bayes capacity of D alone—is applied without verifying the required range condition, and the gap between the theory and the experimental setting is load-bearing. The paper is clearly written and the empirical study is solid, but the theoretical claims need significant revision before the manuscript can be accepted.

major comments (3)
  1. [Theorem 4 / Lemma 1 / Section V-D] The equality CBayes(C·D) = CBayes(D) in Theorem 4 requires, as stated, that the range of C be the entire domain of D. For the MLP used in the experiments (p = 13,700 parameters, 256-dimensional inputs), the set of achievable averaged clipped gradients, and the set of normalized gradients for VMF, are low-dimensional submanifolds of the ball B^p_R and the sphere S^{p-1}, respectively, not the full domains over which the capacities are computed. The paper never verifies the range condition, and it is false in this setting. Consequently, at best Lemma 3 gives CBayes(C·D) ≤ CBayes(D), and the slack can differ between the Gaussian and VMF mechanisms. Definition 6, which orders mechanisms solely by CBayes(D), is therefore not established as a measure of reconstruction risk. The manuscript should either verify the range condition for the experimental network, prove that the ordering by the full-domain capacity is preserved under the upper bound, or explicitly reframe the theoretical results as upper bounds and adjust the conclusions accordingly.
  2. [Theorem 5 / Theorem 6] The closed-form Bayes capacities in Theorems 5 and 6 are derived by taking the pointwise supremum over all of B^p_R and S^{p-1}, respectively. In the proof of Theorem 5 (Appendix B-F), the supremum for y inside the ball is attained at x = y, which requires that every x in the ball is a possible input to the noise channel. Similarly, the proof of Theorem 6 asserts "Since S^{p-1} ⊆ X" without argument. These assumptions are not stated in the theorems and are not satisfied by the gradient preprocessing in the experiments, where the feasible inputs to the noise channel form a proper subset. The formulas are therefore upper bounds on the true Bayes capacity of the composed mechanism, not exact values, and this distinction should be explicit in the theorem statements and in the interpretation of Figure 4.
  3. [Section V-D] The statement that the VMF mechanism "has the same C" as the Gaussian mechanism is not accurate: Algorithm 2 includes a norm-scaling step (line 10) before the VMF noise (line 11). If V includes this scaling, as the theorem statements suggest, then the input domain of V is the unit sphere rather than the ball, and the preprocessing differs from that of the Gaussian case. If instead the scaling is considered part of C, then the two mechanisms do not share the same preprocessor. Either way, the comparison in Definition 6 should be formulated with respect to the actual channels C·G and C'·V, and the difference in feasible input domains should be discussed explicitly, since it directly affects the range condition of Theorem 4.
minor comments (4)
  1. [Theorem 5] The notation R is used inconsistently: the theorem statement says "R is the number of layers in the network", while the proof uses R as the radius of the ball B^p_R. Since the radius equals the number of layers under per-layer clipping to unit norm, this should be stated explicitly to avoid confusion.
  2. [Definition 7] The claim that the continuous Bayes' capacity is well-defined "since the pointwise supremum of measurable functions is measurable" is not true for arbitrary families of measurable functions; it requires additional structure such as joint measurability and a sigma-compact parameter space. For the Gaussian and VMF kernels the conclusion holds, but the justification should be corrected.
  3. [Algorithm 1] The noise addition in line 10 is written as (1/L) N(0, B^2 σ^2), which differs from the standard DP-SGD formulation in [4], where the noise is added to the averaged gradient without the extra 1/L factor. Please clarify the scaling convention or cite a reference for this particular form, as it affects the mapping between σ and the RDP guarantees.
  4. [Figure 4] The caption states that "similar Bayes' capacities give similar MSEs", but the numerical capacity values are not reported and the axis scale is not visible in the figure. Reporting the exact capacity values or using a clear log-scale axis would make this claim verifiable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the Bayes-capacity identity is a stated algebraic lemma, capacities are computed from mechanism parameters rather than fitted to the measured MSE, and self-citations are motivational rather than load-bearing.

full rationale

The paper's central theoretical move is Theorem 4, which equates the reconstruction risk (defined in Eq. 12 as a one-try, uniform-prior max-gain leakage of C·D) with CBayes(D). This is not circular: the risk is defined independently as a Bayesian adversary's posterior gain and only afterwards identified with the Bayes capacity of the composed channel (Eq. 13). The equality CBayes(C·D)=CBayes(D) is stated as Lemma 1 with explicit conditions (C deterministic with no zero columns; in Theorem 4, range C = domain D) and is an algebraic property of column maxima rather than an input to the derivation. The closed-form capacities in Theorems 5 and 6 are computed from the mechanism parameters alone, not fitted to the measured MSE, and the empirical comparison in Section VII-C is a genuine test of whether capacity predicts reconstruction error. The RDP conversions and the VMF RDP formula are taken from prior literature (e.g., [22], [24], [28], [45]) and do not presuppose the paper's conclusion. The paper cites its own earlier work ([15], [40], [47]) for motivation and for a preliminary version of the attack model, but none of those citations is load-bearing in the sense of substituting for a proof or forbidding alternatives; the central claims are substantiated by the paper's own derivations and experiments. A real limitation, acknowledged implicitly by the range condition in Theorem 4, is that the equality may degrade to an upper bound for a real MLP whose achievable averaged clipped gradients form a proper subset of the ball; the paper itself notes that capacities are not robust for all attacks and recommends refinement relations when they hold. That is a correctness/assumption gap, not circularity.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central comparison rests on standard DP and RDP machinery, a new continuous capacity definition, and several domain assumptions about DP-SGD channels. The most consequential assumption is that the gradient preprocessing channel is surjective onto the noise mechanism's input domain; this is stated but not verified.

free parameters (4)
  • VMF concentration parameter kappa (experimental values 75 to 500) = 75, 100, 125, 150, 175, 200, 225, 250, 275, 300, 325, 350, 375, 400, 500
    Chosen to match target epsilon levels via the paper's RDP conversion; utility, privacy, and Bayes capacity results all depend on these values.
  • Gaussian noise multiplier sigma (experimental values 1.23 to 0.174) = 1.23, 0.660, 0.544, 0.461, 0.435, 0.420, 0.367, 0.321, 0.287, 0.282, 0.245, 0.229, 0.214, 0.204, 0.174
    Chosen to match the same target epsilon levels as the VMF settings; the comparison and capacity values depend on these parameters.
  • Clipping bound C and radius R for Gaussian input domain = 1
    Set to 1 to align with experiments; the Gaussian Bayes capacity integral is taken over the ball B^p_R, so capacity values depend on this choice.
  • Sub-sampling probability gamma and number of epochs N in privacy accounting = gamma = 128/60000, N = 3
    Used in the RDP-to-(epsilon, delta) conversion examples and experiments; not fitted to outcomes but determines the epsilon mapping used for comparison.
assumptions (6)
  • standard math Rényi divergence formula for two VMF distributions with equal concentration kappa and worst-case antipodal centres (from Kitagawa and Rowley, Proposition 3.1)
    Used in Proposition 1 to derive the VMF RDP guarantee; accepted from cited literature.
  • domain assumption The VMF mechanism satisfies epsilon d_theta-privacy on the unit sphere (Weggenmann and Kerschbaum)
    Basis for treating VMF as a metric-private mechanism; imported from the cited work.
  • standard math RDP composition and privacy amplification theorems from cited works apply unchanged to VMF-based DP-SGD
    Used in Section III-A for privacy accounting; standard results treated as black boxes.
  • domain assumption Adversary is Bayesian with uniform prior over the support of possible batches and uses a one-try exact-match gain function
    Assumed in Section IV-C to map reconstruction attacks to Bayes capacity; the paper acknowledges the uniform-prior limitation in Section VII-C.
  • domain assumption The deterministic preprocessing channel C (clipping and averaging) has no zero columns and the range of C is the domain of the noise channel D
    Needed for Lemma 1 and Theorem 4 to conclude CBayes(C·D) = CBayes(D); not verified for real neural-network gradient sets, which may cover only a lower-dimensional subset of B^p_R.
  • ad hoc to paper Continuous Bayes capacity integral (Definition 7) is the right generalization and is finite for Gaussian and VMF densities
    The paper introduces this definition; it is natural, but cross-mechanism comparisons inherit dependence on the chosen output measure and parametrization.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Comparing privacy notions for protection against reconstruction attacks in machine learning." pith.science (2026). https://pith.science/paper/PQDK2LXY

@misc{pith2026250204045,
  author       = {Pith},
  title        = {Pith review of: Comparing privacy notions for protection against reconstruction attacks in machine learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PQDK2LXY}},
  note         = {Machine review of arXiv:2502.04045}
}
abstract

Within the machine learning community, reconstruction attacks are a principal concern and have been identified even in federated learning (FL), which was designed with privacy preservation in mind. In response to these threats, the privacy community recommends the use of differential privacy (DP) in the stochastic gradient descent algorithm, termed DP-SGD. However, the proliferation of variants of DP in recent years\textemdash such as metric privacy\textemdash has made it challenging to conduct a fair comparison between different mechanisms due to the different meanings of the privacy parameters $\epsilon$ and $\delta$ across different variants. Thus, interpreting the practical implications of $\epsilon$ and $\delta$ in the FL context and amongst variants of DP remains ambiguous. In this paper, we lay a foundational framework for comparing mechanisms with differing notions of privacy guarantees, namely $(\epsilon,\delta)$-DP and metric privacy. We provide two foundational means of comparison: firstly, via the well-established $(\epsilon,\delta)$-DP guarantees, made possible through the R\'enyi differential privacy framework; and secondly, via Bayes' capacity, which we identify as an appropriate measure for reconstruction threats.

Figures

Figures reproduced from arXiv: 2502.04045 by the authors.

Figure 1
Figure 1. Reconstruction results, in terms of SSIM or MSE, across the datasets under different privacy settings by the Inverting [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. Utility results, in terms of accuracy, across the datasets under different privacy settings. [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Reconstruction images for both datasets by the Inverting Gradients Attack (IGA). [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Bayes’ capacity is a better predictor for MSE than is [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Comparing leakage measures: ϵ vs Bayes’ capacity for Gaussian and VMF mechanisms. useful than DP as a measure of capturing the vulnerability against reconstruction attacks. Finally, to justify this theory, we plotted the Bayes’ capacity versus values of ϵ for both mech…
Figure 6
Figure 6. Figure 6: Reconstruction images for both datasets by the Deep [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 35 canonical work pages

  1. [47]

    Bayes' capacity as a measure for reconstruction attacks in federated learning

    S. Biswas, M. Dras, P. Faustini, N. Fernandes, A. McIver, C. Palamidessi, and P. Sadeghi, “Bayes’ capacity as a measure for reconstruction attacks in federated learning,” arXiv preprint arXiv:2406.13569, 2024

    work page Pith review arXiv 2024

  2. [1]

    The algorithmic foundations of differential privacy,

    C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Found. Trends Theor. Comput. Sci. , vol. 9, no. 3–4, pp. 211– 407, aug 2014. [Online]. Available: https://doi.org/10.1561/0400000042

    doi:10.1561/0400000042 2014

  3. [2]

    Broadening the scope of differential privacy using metrics,

    K. Chatzikokolakis, M. E. Andr ´es, N. E. Bordenabe, and C. Palamidessi, “Broadening the scope of differential privacy using metrics,” in Privacy Enhancing Technologies - 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings , ser. Lecture Notes in Computer Science, E. D. Cristofaro and M. K. Wright, Eds., vol. 7981....

    doi:10.1007/978-3-642-39077-7 2013

  4. [3]

    Stochastic gradient descent with differentially private updates,

    S. Song, K. Chaudhuri, and A. D. Sarwate, “Stochastic gradient descent with differentially private updates,” in 2013 IEEE Global Conference on Signal and Information Processing , 2013, pp. 245–248

    work page 2013

  5. [4]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’16. New York, NY , USA: Association for Computing Machinery, 2016, pp. 308–318. [Online]. Available: https://doi.org/10.1145/297...

    arXiv 2016

  6. [5]

    Back to the drawing board: Revisiting the design of optimal location privacy-preserving mechanisms,

    S. Oya, C. Troncoso, and F. P ´erez-Gonz´alez, “Back to the drawing board: Revisiting the design of optimal location privacy-preserving mechanisms,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . ACM, 2017, pp. 1959–1972. [Online]. Available: http://doi.acm.org/10.1145/3133956.3134004

    arXiv 2017

  7. [6]

    Privic: A privacy-preserving method for incremental collection of location data,

    S. Biswas and C. Palamidessi, “Privic: A privacy-preserving method for incremental collection of location data,” Proceedings on Privacy Enhancing Technologies, vol. 2024, no. 1, pp. 582–596, 2023

    work page 2024

  8. [7]

    A privacy- preserving querying mechanism with high utility for electric vehicles,

    U. I. Atmaca, S. Biswas, C. Maple, and C. Palamidessi, “A privacy- preserving querying mechanism with high utility for electric vehicles,” IEEE Open Journal of Vehicular Technology, vol. 5, pp. 262–277, 2024

    work page 2024

Show all 54 references
  1. [8]

    Differentially private obfuscation of facial images,

    W. L. Croft, J.-R. Sack, and W. Shi, “Differentially private obfuscation of facial images,” in Machine Learning and Knowledge Extraction , A. Holzinger, P. Kieseberg, A. M. Tjoa, and E. Weippl, Eds. Cham: Springer International Publishing, 2019, pp. 229–249

    2019

  2. [9]

    Differentially private facial obfuscation via generative adversarial networks,

    ——, “Differentially private facial obfuscation via generative adversarial networks,” Future Generation Computer Systems , vol. 129, pp. 358– 379, 2022. [Online]. Available: https://www.sciencedirect.com/science/ article/pii/S0167739X21004763

    2022

  3. [10]

    Generalised differential privacy for text document processing,

    N. Fernandes, M. Dras, and A. McIver, “Generalised differential privacy for text document processing,” in Principles of Security and Trust - 8th International Conference, POST 2019, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2019, ...

    2019 doi

  4. [11]

    Leveraging hierarchical representations for preserving privacy and utility in text,

    O. Feyisetan, T. Diethe, and T. Drake, “Leveraging hierarchical representations for preserving privacy and utility in text,” in 2019 IEEE International Conference on Data Mining, ICDM 2019, Beijing, China, November 8-11, 2019 , J. Wang, K. Shim, and X. Wu, Eds. IEEE, 2019, pp....

    2019

  5. [12]

    Differential privacy in natural language processing the story so far,

    O. Klymenko, S. Meisenbacher, and F. Matthes, “Differential privacy in natural language processing the story so far,” in Proceedings of the Fourth Workshop on Privacy in Natural Language Processing, O. Feyisetan, S. Ghanavati, P. Thaine, I. Habernal, and F. Mireshghallah, Eds....

    2022

  6. [13]

    Group privacy for personalized federated learning,

    F. Galli, S. Biswas, K. Jung, T. Cucinotta, and C. Palamidessi, “Group privacy for personalized federated learning,” in Workshop on Federated Learning: Recent Advances and New Challenges (in Conjunction with NeurIPS 2022) , 2022. [Online]. Available: https://openreview.net/for...

    2022

  7. [14]

    Ad- vancing personalized federated learning: Group privacy, fairness, and beyond,

    F. Galli, K. Jung, S. Biswas, C. Palamidessi, and T. Cucinotta, “Ad- vancing personalized federated learning: Group privacy, fairness, and beyond,” SN Computer Science , vol. 4, no. 6, p. 831, 2023

    2023

  8. [15]

    Directional privacy for deep learning,

    P. Faustini, N. Fernandes, S. Tonni, A. McIver, and M. Dras, “Directional privacy for deep learning,” 2023, accepted for presentation at the 5th AAAI Workshop on Privacy-Preserving Artificial Intelligence. [Online]. Available: https://ppai-workshop.github.io/

    2023

  9. [16]

    Differential privacy for directional data,

    B. Weggenmann and F. Kerschbaum, “Differential privacy for directional data,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’21. New York, NY , USA: Association for Computing Machinery, 2021, pp. 1205–1222. [Online]. Availa...

    2021

  10. [17]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. D. Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019 . IEEE, 2019, pp. 691–706. [Online]. Available: https://d...

    2019

  11. [18]

    Reconstructing training data with informed adversaries,

    B. Balle, G. Cherubin, and J. Hayes, “Reconstructing training data with informed adversaries,” in 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 . IEEE, 2022, pp. 1138–1156. [Online]. Available: https://doi.org/10.1109/SP46214.202...

    2022

  12. [19]

    R ´enyi differential privacy,

    I. Mironov, “R ´enyi differential privacy,” in 2017 IEEE 30th Computer Security Foundations Symposium (CSF) , 2017, pp. 263–275

    2017

  13. [20]

    Comparing systems: Max-case refinement orders and application to differential privacy,

    K. Chatzikokolakis, N. Fernandes, and C. Palamidessi, “Comparing systems: Max-case refinement orders and application to differential privacy,” in Proc. CSF. IEEE Press, 2019

    2019

  14. [21]

    M. S. Alvim, K. Chatzikokolakis, A. McIver, C. Morgan, C. Palamidessi, and G. Smith, The Science of Quantitative Information Flow . Springer, 2020

    2020

  15. [22]

    R ´enyi differential privacy,

    I. Mironov, “R ´enyi differential privacy,” in 30th IEEE Computer Security Foundations Symposium, CSF 2017, Santa Barbara, CA, USA, August 21-25, 2017 . IEEE Computer Society, 2017, pp. 263–275. [Online]. Available: https://doi.org/10.1109/CSF.2017.11

    2017 doi

  16. [23]

    R \’enyi differential privacy of the sampled gaussian mechanism,

    I. Mironov, K. Talwar, and L. Zhang, “R \’enyi differential privacy of the sampled gaussian mechanism,” arXiv preprint arXiv:1908.10530 , 2019

    1908 arXiv

  17. [24]

    Poission subsampled r´enyi differential privacy,

    Y . Zhu and Y .-X. Wang, “Poission subsampled r´enyi differential privacy,” in International Conference on Machine Learning . PMLR, 2019, pp. 7634–7642

    2019

  18. [25]

    Privacy amplification by sub- sampling: Tight analyses via couplings and divergences,

    B. Balle, G. Barthe, and M. Gaboardi, “Privacy amplification by sub- sampling: Tight analyses via couplings and divergences,” Advances in neural information processing systems , vol. 31, 2018

    2018

  19. [26]

    Subsampled r ´enyi differential privacy and analytical moments accountant,

    Y .-X. Wang, B. Balle, and S. P. Kasiviswanathan, “Subsampled r ´enyi differential privacy and analytical moments accountant,” in The 22nd In- ternational Conference on Artificial Intelligence and Statistics . PMLR, 2019, pp. 1226–1235

    2019

  20. [27]

    A better bound gives a hundred rounds: Enhanced privacy guarantees via f- divergences,

    S. Asoodeh, J. Liao, F. P. Calmon, O. Kosut, and L. Sankar, “A better bound gives a hundred rounds: Enhanced privacy guarantees via f- divergences,” in 2020 IEEE International Symposium on Information Theory (ISIT), 2020, pp. 920–925

    2020

  21. [28]

    The discrete gaussian for differential privacy,

    C. Canonne, G. Kamath, and T. Steinke, “The discrete gaussian for differential privacy,” Journal of Privacy and Confidentiality , vol. 12, no. 1, Jul. 2022. [Online]. Available: https://journalprivacyconfidential ity.org/index.php/jpc/article/view/784

    2022

  22. [29]

    Evaluating differentially private machine learning in practice,

    B. Jayaraman and D. Evans, “Evaluating differentially private machine learning in practice,” in 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019 , N. Heninger and P. Traynor, Eds. USENIX Association, 2019, pp. 1895–1912

    2019

  23. [30]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada , H. M. Wallach, H. Larochelle, A. Beyg...

    2019

  24. [31]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” CoRR, vol. abs/2001.02610, 2020. [Online]. Available: http://arxiv.org/abs/2001.02610

    2001 arXiv

  25. [32]

    Inverting gradients - how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” in Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, Decem...

    2020

  26. [33]

    Evaluating gradient inversion attacks and defenses in federated learning,

    Y . Huang, S. Gupta, Z. Song, K. Li, and S. Arora, “Evaluating gradient inversion attacks and defenses in federated learning,” in Advances in Neural Information Processing Systems , M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. Curran Ass...

    2021

  27. [34]

    Learning to invert: Simple adaptive attacks for gradient inversion in federated learning,

    R. Wu, X. Chen, C. Guo, and K. Q. Weinberger, “Learning to invert: Simple adaptive attacks for gradient inversion in federated learning,” in Uncertainty in Artificial Intelligence, UAI 2023, July 31 - 4 August 2023, Pittsburgh, PA, USA , ser. Proceedings of Machine Learning Re...

    2023

  28. [35]

    Reconstructing training data from model gradient, provably,

    Z. Wang, J. Lee, and Q. Lei, “Reconstructing training data from model gradient, provably,” in Proceedings of The 26th International Conference on Artificial Intelligence and Statistics , ser. Proceedings of Machine Learning Research, F. Ruiz, J. Dy, and J.-W. van de Meent, Eds...

    2023

  29. [36]

    Sok: Gradient leakage in federated learning,

    J. Du, J. Hu, Z. Wang, P. Sun, N. Z. Gong, and K. Ren, “Sok: Gradient leakage in federated learning,” 2024

    2024

  30. [37]

    On the Foundations of Quantitative Information Flow,

    G. Smith, “On the Foundations of Quantitative Information Flow,” in FOSSACS, ser. LNCS, vol. 5504. Springer, 2009, pp. 288–302

    2009

  31. [38]

    An operational approach to information leakage,

    I. Issa, A. B. Wagner, and S. Kamath, “An operational approach to information leakage,” IEEE Transactions on Information Theory, vol. 66, no. 3, pp. 1625–1657, 2020

    2020

  32. [39]

    Information radius,

    R. Sibson, “Information radius,” Zeitschrift f ¨ur Wahrscheinlichkeitsthe- orie und verwandte Gebiete , vol. 14, no. 2, pp. 149–160, 1969

    1969

  33. [40]

    Explaining epsilon in dif- ferential privacy through the lens of information theory,

    N. Fernandes, A. McIver, and P. Sadeghi, “Explaining epsilon in dif- ferential privacy through the lens of information theory,” arXiv preprint arXiv:2210.12916, 2022

    2022 arXiv

  34. [41]

    Closed-form bounds for dp-sgd against record-level inference attacks

    G. Cherubin, B. K ¨opf, A. Paverd, S. Tople, L. Wutschitz, and S. Zanella- B´eguelin, “Closed-form bounds for dp-sgd against record-level inference attacks.”

  35. [42]

    Bounding training data reconstruction in private (deep) learning,

    C. Guo, B. Karrer, K. Chaudhuri, and L. van der Maaten, “Bounding training data reconstruction in private (deep) learning,” in International Conference on Machine Learning . PMLR, 2022, pp. 8056–8071

    2022

  36. [43]

    Bounding training data reconstruction in DP-SGD,

    J. Hayes, B. Balle, and S. Mahloujifar, “Bounding training data reconstruction in DP-SGD,” in Thirty-seventh Conference on Neural Information Processing Systems , 2023. [Online]. Available: https: //openreview.net/forum?id=7LZ4tZrYlx

    2023

  37. [44]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” inTheory of Cryptography, S. Halevi and T. Rabin, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 265–284

    2006

  38. [45]

    von mises-fisher distributions and their statistical divergence,

    T. Kitagawa and J. Rowley, “von mises-fisher distributions and their statistical divergence,” arXiv preprint arXiv:2202.05192 , 2022

    2022 arXiv

  39. [46]

    The composition theorem for differential privacy,

    P. Kairouz, S. Oh, and P. Viswanath, “The composition theorem for differential privacy,”IEEE Transactions on Information Theory, vol. 63, no. 6, pp. 4037–4049, 2017

    2017

  40. [48]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021 . Computer Vision Foundation / IEEE, 20...

    2021

  41. [49]

    Mea- suring information leakage using generalized gain functions,

    S. A. M’rio, K. Chatzikokolakis, C. Palamidessi, and G. Smith, “Mea- suring information leakage using generalized gain functions,” in 2012 IEEE 25th Computer Security Foundations Symposium . IEEE, 2012, pp. 265–279

    2012

  42. [50]

    The mnist database of handwritten digit images for machine learning research,

    L. Deng, “The mnist database of handwritten digit images for machine learning research,” IEEE Signal Processing Magazine , vol. 29, no. 6, pp. 141–142, 2012

    2012

  43. [51]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” ArXiv, vol. abs/1708.07747, 2017

    2017 arXiv

  44. [52]

    Opacus: User-friendly differential privacy library in pytorch,

    A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testuggine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao, G. Cormode, and I. Mironov, “Opacus: User-friendly differential privacy library in pytorch,” CoRR, vol. abs/2109.12298, 2021. [Online]. Available: https:/...

    2021 arXiv

  45. [53]

    Image quality assess- ment: from error visibility to structural similarity,

    Z. Wang, A. Bovik, H. Sheikh, and E. Simoncelli, “Image quality assess- ment: from error visibility to structural similarity,” IEEE Transactions on Image Processing , vol. 13, no. 4, pp. 600–612, 2004

    2004

  46. [54]

    Privacy assessment on reconstructed images: Are existing evaluation metrics faithful to human perception?

    X. Sun, N. Gazagnadou, V . Sharma, L. Lyu, H. Li, and L. Zheng, “Privacy assessment on reconstructed images: Are existing evaluation metrics faithful to human perception?” in Thirty-seventh Conference on Neural Information Processing Systems , 2023. [Online]. Available: https:...

    2023

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.