REVIEW 5 major objections 5 minor 42 references
The Gradient Puppeteer: Adversarial Domination in Gradient Leakage Attacks through Model Poisoning
T0 review · 5 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read A malicious server can poison federated-learning model parameters so every image in a client's batch is reconstructible from the shared gradient while the poisoned model passes D-SNR client checks.
desk verdict EGGV is a novel attack recipe with a real empirical gap, but the theory is over-sold and the evaluation needs controls before the headline PSNR claims can be trusted. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing identity is the per-sample contribution coefficient $\lambda_i^k$, defined by the gradient ratio $$\frac{\nabla_{W^k}\ell(F(x,\$\theta$),y)}{\nabla_{b^k}\ell(F(x,\$\theta$),y)} = \sum_{i=1}^{B}\lambda_i^k x_i,\qquad \sum_{i=1}^{B}\lambda_i^k = 1,$$ which expresses the class-$k$ weighted average input recoverable from an FC layer's gradient as a convex combination of the batch samples. The paper's analysis uses $\lambda$ to show that existing AGLAs work by concentrating weight on a small trigger-like subset, and the D-SNR detection metric exploits the resulting gradient imbalance. EGGV replaces that mechanism with a balanced-encoding mechanism: a fixed-position gradient projector $\Pi$ samples the same gradient coordinates every iteration, and a decoder $D(\cdot;\phi)$ is trained jointly with $\theta$ on $L(\theta,\phi)=\|x-D(\Pi(\nabla_\theta\ell(F(x,\theta),y)),\phi)\|_2^2$. The decoder acts as a differentiable proxy for full gradient inversion, letting the attacker optimize model parameters toward the point of maximum leakage without running an expensive nested inversion for every parameter update.
What would settle it
Take a client dataset far outside the auxiliary distribution (for example, chest X-rays instead of CIFAR images), poison a ResNet18 model with EGGV's exact procedure and projection positions, collect one batch of eight client gradients, and run IG on them; if the minimum per-sample PSNR drops to nearly zero for any batch or the poisoned model's D-SNR equals or exceeds that of a He-initialized model, the complete-coverage and stealthiness claims are contradicted.
Extended reading notes
Core claim
The central claim is that EGGV is the first active gradient leakage attack that combines complete batch coverage with stealth. The attack works by treating the gradient as an encoded latent representation and jointly optimizing the model parameters $\theta$ and a decoder $D(\cdot;\phi)$ so that a projected version of the gradient, $\Pi(\nabla_\theta\ell(F(x,\theta),y))$, can be inverted back to the input $x$ with small $\ell^2$ error. A malicious server performs this optimization on an auxiliary dataset, distributes the poisoned model, and then runs any existing passive gradient inversion method on the gradients clients upload. The paper reports that on CIFAR100 with batch size 8, EGGV reconstructs every sample with minimum PSNR 20.38, while the two previous state-of-the-art AGLAs reconstruct only one sample, and that EGGV's D-SNR values match those of normal initialization methods. The theoretical part gives an existence guarantee for optimal poisoned parameters and a bound showing that per-sample gradient norms stay uniform enough to keep D-SNR small.
Load-bearing premise
The attack rests on transferability: parameters optimized to leak a public auxiliary dataset, through the jointly trained decoder and the fixed projection positions, will also make gradients computed on clients' private data leak every sample, a transfer the paper assumes rather than proves.
Editorial extensions
If this is right
- A malicious server can turn any communication round of federated learning into a data-leak event, not just the initialization round, because EGGV's poisoned parameters look like ordinary trained weights rather than suspicious zeros or ones.
- Any existing passive gradient-inversion method, such as iDLG or IG, becomes capable of full-batch reconstruction when applied to EGGV-poisoned gradients, so the attacker does not need to design a new inverter.
- Client-side defenses based on D-SNR miss this attack, because the variance bound in Theorem 3 keeps the poisoned model's per-sample gradient norms close to those of a naturally initialized model.
- The $\lambda$ decomposition explains prior AGLAs' failures as a single phenomenon: concentrating $\lambda$ on a few samples sacrifices the majority and creates the gradient imbalance that detection exploits.
Reading between the lines
- Beyond the paper: a natural defense is to reverse EGGV's objective and monitor per-sample gradient uniformity, since natural batches usually show variation and a batch whose gradient norms are too even may be under a balanced-poisoning attack.
- Beyond the paper: the same joint model-decoder training could be redirected to privacy auditing, where deployment checkpoints are probed by trying to invert projected gradients on a public set and rejected if reconstruction error falls below a threshold.
- Beyond the paper: the $\lambda$ weights are a general per-sample influence measure, so the backdoor-theoretic framework could be applied to data-influence analysis or to measuring how much any single sample dominates a class neuron's gradient outside the attack setting.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a new theoretical framing of active gradient leakage attacks (AGLAs) as backdoor poisoning, arguing that existing attacks bias the gradient toward a small subset of samples, which explains their limited coverage and detectability. It then introduces Enhanced Gradient Global Vulnerability (EGGV), a poisoning method that trains a model together with a linear decoder on an auxiliary dataset to uniformly enrich the gradient space, and claims that the resulting poisoned model enables any existing passive gradient leakage attack (PGLA) to reconstruct all samples in a client batch while evading the D-SNR detection metric. The paper provides two theorems (Theorems 2 and 3) as theoretical guarantees and reports experiments on CIFAR10, CIFAR100, and TinyImageNet showing large improvements over Fishing and SEER in reconstruction quality and stealthiness.
Significance. If the claims are substantiated, a full-batch reconstruction attack that also evades the D-SNR client-side check would be a meaningful advance for federated learning privacy, since prior AGLAs recover only a subset of samples and are detectable. The empirical gap over baselines is large and consistent across datasets in Tables II-V, and the cross-distribution auxiliary-dataset experiment in Table V is a useful step toward realism. However, the paper's theoretical guarantees are not currently load-bearing: Theorem 2's conclusion is definitional, and Theorem 3's proof contains a gap. The absence of code, seeds, error bars, and a decoder-free control leaves the central mechanism insufficiently isolated. The paper would need substantial revision of the theory and additional experiments before its central claims can be accepted.
major comments (5)
- [Section V-E, Theorem 3] The proof of Theorem 3 is not valid as written. First, Equation (22) asserts a uniform per-sample bound ||x_i - x'_i|| <= delta for all i from the global minimum of the batch-averaged loss L(theta, phi) in Equation (17); a minimum of an average squared error does not imply a per-sample bound. Second, Equation (23) uses the inverse Lipschitz constant L_D^{-1} of the decoder, but Assumption 3 only postulates Lipschitz continuity and linearity of D, not injectivity or a lower Lipschitz bound; a linear map can be rank-deficient, in which case the projected gradients of different samples may collapse to the same point and the displayed inequality does not follow. Third, the step from bounded gradient-norm differences to a D-SNR bound relies on an unproved monotonicity claim attributed to [17]. The stealthiness guarantee therefore is not established.
- [Section V-D, Theorem 2] The 'maximum vulnerability' conclusion in Theorem 2 is circular. The loss L(theta, phi) in Equation (17) is defined as the reconstruction error of a jointly trained decoder D, so the minimizer (theta*, phi*) is, by construction, the point at which this particular decoder reconstructs the auxiliary data best. The theorem only shows, via Weierstrass, that a minimizer exists on the compact parameter space; it does not show that at theta* the gradients are invertible by the decoder-free PGLAs used at attack time (iDLG, IG), nor that the property transfers to an unseen client distribution. The empirical results may support this transfer, but the theory as stated does not.
- [Algorithm 1, line 11] The loop condition 'while L(theta_t, phi_t) < epsilon do' appears inverted. The surrounding text says that epsilon is an acceptable error, which implies the loop should continue while the loss is larger than epsilon and terminate when it falls below. As written, if the initial loss is already below epsilon the poisoning loop never runs, and if it is above epsilon the loop is not guaranteed to terminate. This is a concrete reproducibility issue that should be corrected.
- [Section VI, Tables II and III] There is an unexplained metric inconsistency between the two main tables on CIFAR100. Table II reports EGGV max PSNR as 22.86605, while Table III reports EGGV+IG PSNR as 31.55152 on the same dataset. The reconstruction method, iteration count, batch size, and metric-averaging protocol differ, but the paper does not reconcile these numbers. In addition, no error bars, seeds, or code are provided, and Table III reports negative PSNR and SSIM values for He+iDLG (e.g., PSNR -1.15507, SSIM -0.00052), which are not meaningful for normalized images and need explanation. These issues make it difficult to assess the robustness of the claimed gains.
- [Section V-A and Section VI] The central transferability claim is not isolated by the experiments. Step I optimizes L(theta, phi) with a jointly trained decoder on an auxiliary dataset, but Step III discards the decoder and reconstructs using iDLG or IG, which are not part of the training objective. There is no control that replaces the decoder with a random or frozen decoder, nor a control that removes the decoder objective and directly optimizes some other proxy of gradient invertibility. Without such controls, the large empirical improvements could stem from parameter scaling, initialization side effects, or other artifacts rather than from the proposed mechanism. The cross-distribution results in Table V are suggestive, but they do not replace a mechanism-level ablation.
minor comments (5)
- [Equation (2)] The notation for D-SNR is under-specified: theta^{lw} is said to denote the weights of all dense and convolutional layers, but the denominator and the role of the per-layer maximum are not explained in enough detail for a reader to reproduce the metric from the formula alone.
- [Algorithm 1] The acceptable error epsilon is introduced in the algorithm input but is never defined in the experimental setup, and it is unclear what value is used and how termination is implemented in practice.
- [Section VI-C, Figure references] The text refers to the '3D surface plot at the top of Figure 5' when discussing the relationship between gradient vulnerability and model accuracy, but Figure 5 is the D-SNR bar chart; the 3D surface plot appears to be Figure 8. The cross-reference should be corrected.
- [Table III] The table header contains the typo 'Interation' for 'Iteration', and the caption does not state the batch size used for the reported PSNR/SSIM/LPIPS values.
- [Section II-B] The text says 'we assume the malicious client can take some publicly available datasets as the auxiliary dataset'; in the threat model the adversary is the server, so this should read 'malicious server'.
Circularity Check
EGGV's two theoretical guarantees reduce to the training loss by construction: Theorem 2 equates vulnerability with the minimized loss L, and Theorem 3 assumes the uniform per-sample reconstruction error it is meant to prove; the empirical attack results, however, are independently evaluated with external PGLAs and do not reduce to the same loss.
-
self definitional
[Section V-D, Theorem 2, Eqs. (17)-(18) and proof.]
"At θ = θ∗, ϕ= ϕ∗, the gradient ∇θℓ(F (x, θ), y) encodes the maximum amount of feature from the input data x, making the gradient space most susceptible to leakage. ... At θ = θ∗ and ϕ = ϕ∗, the loss function L(θ, ϕ) attains its global minimum, which indicates that the reconstruction error is minimized. ... Therefore, at θ = θ∗ and ϕ = ϕ∗, the risk of data leakage from the gradient space to the input data x is maximized."
Vulnerability is operationalized as the very loss being minimized: L(θ, ϕ) = ||x − D(Π(∇θℓ(F(x,θ),y)), ϕ)||². The theorem proves only that a continuous L on a compact domain has a minimizer (Weierstrass); calling that minimizer 'most susceptible to leakage' restates the definition of L. It does not establish vulnerability under the independent inversion operators R (iDLG/IG) used in Step III, nor that the minimum on the auxiliary batch transfers to clients' private data. The 'maximum vulnerability' conclusion is therefore equivalent to 'the argmin of L minimizes L'.
-
fitted input called prediction
[Section V-E, Theorem 3, Eqs. (21)-(26) and proof.]
"At the optimal (θ∗, ϕ∗), the reconstruction loss (Equation (17)) attains its minimum, ensuring uniform reconstruction errors across the batch: ∥xi − x′ i∥2 ≤ δ, ∀i, (22) ... Given the Lipschitz continuity of decoder D with constant LD, we have: ∥Π(∇θ∗ℓ(F (xi, θ∗), yi)) − Π(∇θ∗ℓ(F (xj, θ∗), yj))∥2 ≤ 2L−1 D δ."
The 'ensuring uniform reconstruction errors' assertion (Eq. 22) is exactly the per-sample guarantee needed to conclude gradient uniformity and hence D-SNR stealthiness; it is not a consequence of the batch-averaged loss attaining a minimum (a small average loss can coexist with large per-sample errors). The proof then assumes a Lipschitz inverse of the decoder (the L_D^{-1} factor) without proving D is injective or invertible on projected gradients. Thus the predicted stealthiness is not derived from first principles but re-imports the fitted training objective as an unproven uniform-error assumption, with no argument transferring this auxiliary-trained property to client gradients decoded by PGLAs.
full rationale
The paper contains two theoretical steps that reduce by construction. Theorem 2 labels the minimizer of the poisoning loss L as the point of 'maximum gradient vulnerability'; since vulnerability is measured by L itself, the statement is a tautology rather than an external guarantee. Theorem 3's stealthiness proof assumes uniform per-sample reconstruction error (Eq. 22) at the optimum and then uses it to bound D-SNR; that assumption is the conclusion in disguise and is not implied by the batch loss. These are load-bearing because the contributions section advertises 'theoretical guarantees for the existence of optimal poisoned parameters for gradient leakage and the stealthiness of the proposed attack.' However, the empirical claims are not circular: reconstruction quality in Tables II-IV is measured with iDLG and IG, which are different inversion operators from the trained decoder D, and D-SNR is an external metric from [17]. Those experiments could have failed, and the reported gains over Random/Xavier/He and Fishing/SEER are independent evidence. The circularity is thus partial: the theory is definitionally forced, while the headline attack performance retains independent empirical content. A score of 6 reflects partial circularity rather than a fully definitional derivation.
Assumptions & free parameters
free parameters (4)
- Projection ratio rho =
0.4% (default)
- Fixed projection positions p1...pL =
Not specified
- Decoder architecture (linear layer) =
Linear layer
- Poisoning learning rates alpha1, alpha2 and iteration count N =
Not reported
assumptions (4)
- ad hoc to paper Parameter spaces Theta and Phi are non-empty compact sets (Assumptions 1 and 3).
- ad hoc to paper The decoder D is linear, continuous, and Lipschitz with constant L_D, and the projector Pi preserves norm differences up to a constant M_Pi.
- ad hoc to paper Uniform per-sample reconstruction error at the optimum (Eq 22: ||x_i - x'_i|| <= delta for all i).
- domain assumption D-SNR is monotonically decreasing in gradient variance.
Cite this review
Pith. "Pith review of The Gradient Puppeteer: Adversarial Domination in Gradient Leakage Attacks through Model Poisoning." pith.science (2026). https://pith.science/paper/BN75O5WQ
@misc{pith2026250204106,
author = {Pith},
title = {Pith review of: The Gradient Puppeteer: Adversarial Domination in Gradient Leakage Attacks through Model Poisoning},
year = {2026},
howpublished = {\url{https://pith.science/paper/BN75O5WQ}},
note = {Machine review of arXiv:2502.04106}
}
read the original abstract
In Federated Learning (FL), clients share gradients with a central server while keeping their data local. However, malicious servers could deliberately manipulate the models to reconstruct clients' data from shared gradients, posing significant privacy risks. Although such active gradient leakage attacks (AGLAs) have been widely studied, they suffer from two severe limitations: (i) coverage: no existing AGLAs can reconstruct all samples in a batch from the shared gradients; (ii) stealthiness: no existing AGLAs can evade principled checks of clients. In this paper, we address these limitations with two core contributions. First, we introduce a new theoretical analysis approach, which uniformly models AGLAs as backdoor poisoning. This analysis approach reveals that the core principle of AGLAs is to bias the gradient space to prioritize the reconstruction of a small subset of samples while sacrificing the majority, which theoretically explains the above limitations of existing AGLAs. Second, we propose Enhanced Gradient Global Vulnerability (EGGV), the first AGLA that achieves complete attack coverage while evading client-side detection. In particular, EGGV employs a gradient projector and a jointly optimized discriminator to assess gradient vulnerability, steering the gradient space toward the point most prone to data leakage. Extensive experiments show that EGGV achieves complete attack coverage and surpasses state-of-the-art (SOTA) with at least a 43% increase in reconstruction quality (PSNR) and a 45% improvement in stealthiness (D-SNR).
Figures
Figures from the paper (5 more)
Reference graph
Works this paper leans on
-
[17]
Hiding in plain sight: Disguising data stealing attacks in federated learning,
K. Garov, D. I. Dimitrov, N. Jovanovi ´c, and M. Vechev, “Hiding in plain sight: Disguising data stealing attacks in federated learning,” in International Conference on Learning Representations , 2024
work page 2024
-
[1]
Communication-efficient learning of deep networks from decentralized data,
B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282
2017
-
[2]
Towards federated learning at scale: System design,
K. A. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V . Ivanov, C. M. Kiddon, J. Kone ˇcn´y, S. Mazzocchi, B. McMahan, T. V . Overveldt, D. Petrou, D. Ramage, and J. Roselander, “Towards federated learning at scale: System design,” in SysML 2019, 2019, to appear. [Online]. Available: https://arxiv.org/abs/1902.01046
arXiv 2019
-
[3]
Project adam: Building an efficient and scalable deep learning training system,
T. Chilimbi, Y . Suzue, J. Apacible, and K. Kalyanaraman, “Project adam: Building an efficient and scalable deep learning training system,” in 11th USENIX symposium on operating systems design and implementation (OSDI 14), 2014, pp. 571–582
work page 2014
-
[4]
Deep leakage from gradients,
L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019
2019
-
[5]
M. V . Nowak, T. P. Bott, D. Khachaturov, F. Puppe, A. Krenzer, and A. Hekalo, “Qbi: Quantile-based bias initialization for efficient private data reconstruction in federated learning,” arXiv preprint arXiv:2406.18745, 2024
work page Pith review arXiv 2024
-
[6]
R-gap: Recursive gradient attack on privacy,
J. Zhu and M. B. Blaschko, “R-gap: Recursive gradient attack on privacy,” in International Conference on Learning Representations , 2021
work page 2021
-
[7]
Using highly compressed gradients in federated learning for data reconstruction attacks,
H. Yang, M. Ge, K. Xiang, and J. Li, “Using highly compressed gradients in federated learning for data reconstruction attacks,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 818–830, 2022
work page 2022
Show all 42 references
-
[8]
Gradient obfuscation gives a false sense of security in federated learning,
K. Yue, R. Jin, C.-W. Wong, D. Baron, and H. Dai, “Gradient obfuscation gives a false sense of security in federated learning,” in 32nd USENIX Security Symposium (USENIX Security 23) . Anaheim, CA: USENIX Association, Aug. 2023, pp. 6381–6398. [Online]. Available: https://www....
2023
-
[9]
When the curious abandon honesty: Federated learning is not private,
F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “When the curious abandon honesty: Federated learning is not private,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE Computer Society, 2023, pp. 175–199
2023
-
[10]
Loki: Large-scale data reconstruction attack against federated learning through model manipulation,
J. C. Zhao, A. Sharma, A. R. Elkordy, Y . H. Ezzeldin, S. Avestimehr, and S. Bagchi, “Loki: Large-scale data reconstruction attack against federated learning through model manipulation,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2023, pp. 30–30
2024
-
[11]
Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,
L. H. Fowl, J. Geiping, W. Czaja, M. Goldblum, and T. Goldstein, “Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,” in International Conference on Learning Representations, 2021
2021
-
[12]
idlg: Improved deep leakage from gradients,
B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” arXiv preprint arXiv:2001.02610 , 2020
2001 arXiv
-
[13]
Inverting gradients-how easy is it to break privacy in federated learning?
J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems , vol. 33, pp. 16 937–16 947, 2020
2020
-
[14]
See through gradients: Image batch recovery via gradinversion,
H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 16 337–16 346
2021
-
[15]
Sok: Gradient leakage in federated learning,
J. Du, J. Hu, Z. Wang, P. Sun, N. Z. Gong, and K. Ren, “Sok: Gradient leakage in federated learning,” arXiv preprint arXiv:2404.05403 , 2024
2024 arXiv
-
[16]
Fishing for user data in large-batch federated learning via gradient magnification,
Y . Wen, J. A. Geiping, L. Fowl, M. Goldblum, and T. Goldstein, “Fishing for user data in large-batch federated learning via gradient magnification,” in International Conference on Machine Learning . PMLR, 2022, pp. 23 668–23 684
2022
-
[18]
Gradient-based learning applied to document recognition,
Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998
1998
-
[19]
User-level label leakage from gradients in federated learning,
A. Wainakh, F. Ventola, T. M ¨ußig, J. Keim, C. G. Cordero, E. Zimmer, T. Grube, K. Kersting, and M. M ¨uhlh¨auser, “User-level label leakage from gradients in federated learning,” Proceedings on Privacy Enhancing Technologies, vol. 2022, no. 2, pp. 227–244
2022
-
[20]
Instance-wise batch label restoration via gradients in federated learning,
K. Ma, Y . Sun, J. Cui, D. Li, Z. Guan, and J. Liu, “Instance-wise batch label restoration via gradients in federated learning,” in The Eleventh International Conference on Learning Representations , 2023
2023
-
[21]
Towards eliminating hard label constraints in gradient inversion attacks,
Y . Wang, J. Liang, and R. He, “Towards eliminating hard label constraints in gradient inversion attacks,” in The Twelfth International Conference on Learning Representations
-
[22]
Gradient inversion with generative image prior,
J. Jeon, K. Lee, S. Oh, J. Ok et al., “Gradient inversion with generative image prior,” Advances in neural information processing systems , vol. 34, pp. 29 898–29 908, 2021
2021
-
[23]
Auditing privacy defenses in federated learning via generative gradient leakage,
Z. Li, J. Zhang, L. Liu, and J. Liu, “Auditing privacy defenses in federated learning via generative gradient leakage,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 132–10 142
2022
-
[24]
Federated learning vulnerabilities: Privacy attacks with denoising diffusion probabilistic models,
H. Gu, X. Zhang, J. Li, H. Wei, B. Li, and X. Huang, “Federated learning vulnerabilities: Privacy attacks with denoising diffusion probabilistic models,” in Proceedings of the ACM on Web Conference 2024 , 2024, pp. 1149–1157
2024
-
[25]
Compromise privacy in large- batch federated learning via malicious model parameters,
S. Zhang, J. Huang, Z. Zhang, and C. Qi, “Compromise privacy in large- batch federated learning via malicious model parameters,” in International Conference on Algorithms and Architectures for Parallel Processing . Springer, 2022, pp. 63–80
2022
-
[26]
Eluding secure aggregation in federated learning via model inconsistency,
D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in federated learning via model inconsistency,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2429–2443
2022
-
[27]
Rectified linear units improve restricted boltzmann machines,
V . Nair and G. E. Hinton, “Rectified linear units improve restricted boltzmann machines,” in Proceedings of the 27th international conference on machine learning (ICML-10) , 2010, pp. 807–814
2010
-
[28]
Transformers: State-of-the-art natural language processing,
T. Wolf, L. Debut, V . Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, J. Davison, S. Shleifer, P. von Platen, C. Ma, Y . Jernite, J. Plu, C. Xu, T. Le Scao, S. Gugger, M. Drame, Q. Lhoest, and A. Rush, “Transformers: State-of-the-art natura...
2020
-
[29]
Kaggle: Your machine learning and data science community,
Kaggle, “Kaggle: Your machine learning and data science community,” https://www.kaggle.com, 2023
2023
-
[30]
Openml: Networked science in machine learning,
J. Vanschoren, J. van Rijn, B. Bischl, and L. Torgo, “Openml: Networked science in machine learning,” ACM SIGKDD Explorations Newsletter , vol. 15, pp. 49–60, 12 2013
2013
-
[31]
Understanding the difficulty of training deep feedforward neural networks,
X. Glorot and Y . Bengio, “Understanding the difficulty of training deep feedforward neural networks,” in Proceedings of the thirteenth international conference on artificial intelligence and statistics . JMLR Workshop and Conference Proceedings, 2010, pp. 249–256
2010
-
[32]
Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,
K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” in Proceedings of the IEEE international conference on computer vision , 2015, pp. 1026–1034
2015
-
[33]
Rudin, Principles of Mathematical Analysis , ser
W. Rudin, Principles of Mathematical Analysis , ser. International series in pure and applied mathematics. McGraw-Hill, 1976. [Online]. Available: https://books.google.com.sg/books?id=kwqzPAAACAAJ
1976
-
[34]
Bartle and D
R. Bartle and D. Sherbert, Introduction to Real Analysis . Wiley,
-
[35]
Deep residual learning for image recognition,
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778
2016
-
[36]
Learning multiple layers of features from tiny images,
A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009
2009
-
[37]
Tiny imagenet visual recognition challenge,
Y . Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015
2015
-
[38]
Image quality metrics: Psnr vs. ssim,
A. Hore and D. Ziou, “Image quality metrics: Psnr vs. ssim,” in 2010 20th international conference on pattern recognition . IEEE, 2010, pp. 2366–2369
2010
-
[39]
The unreasonable effectiveness of deep features as a perceptual metric,
R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595
2018
-
[40]
Image quality assessment: from error visibility to structural similarity,
Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” IEEE transactions on image processing , vol. 13, no. 4, pp. 600–612, 2004
2004
-
[41]
Visualizing data using t-sne
L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008. 13 Kunlan Xiang pursued her M.S. degree from 2022 to 2024 at the School of Computer Science, University of Electronic Science and Technology of China (...
2008
-
[2011]
Available: https://books.google.com.sg/books?id= YawbAAAAQBAJ
[Online]. Available: https://books.google.com.sg/books?id= YawbAAAAQBAJ
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.