LAPA-based Dynamic Privacy Optimization for Wireless Federated Learning in Heterogeneous Environments

Abbas Jamalipour; Erwu Liu; Lijuan Lai; Pengcheng Sun; Rui Wang; Wei Ni; Yuanzhe Geng

REVIEW 5 major objections 5 minor 37 references

LAPA-based Dynamic Privacy Optimization for Wireless Federated Learning in Heterogeneous Environments

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Under the LAPA rule, per-device privacy budgets plus ambient channel noise let wireless federated learning hit its differential privacy targets with accuracy close to the no-privacy baseline.

desk verdict A well-written integration of known DP and power-control methods for wireless FL, but the privacy analysis has a load-bearing error that under-scales the noise, so the central guarantee does not hold. read the letter →

arxiv 2505.19823 v1 pith:PRZC7J57 submitted 2025-05-26 cs.LG cs.AI

Pengcheng Sun , Erwu Liu , Wei Ni , Rui Wang , Yuanzhe Geng , Lijuan Lai , Abbas Jamalipour This is my paper · ORCID

classification cs.LGcs.AI

keywords federatedlearningwirelesscommunicationdifferentialprivacynon-IIDdatabudgetallocationtransmitpoweroptimizationdeepdeterministicpolicygradientconvergenceanalysis

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to strip away the usual accuracy penalty that differential privacy imposes on federated learning when the devices hold non-IID data and communicate over wireless channels. It proposes LAPA, a rule that gives each device its own privacy budget each round, sized by how close that device's gradient direction lies to the global gradient, and that requires no information beyond the gradients FL already exchanges. It then argues that because the privacy-leakage risk falls roughly exponentially as training progresses, the system can stop injecting artificial noise after a switching round and let the inherent channel noise satisfy the differential privacy requirement, with a DDPG-trained controller choosing device transmit powers to position the switch. The central support is Theorem 1, a convergence upper bound for the whole scheme, and experiments that show final accuracy close to the no-privacy baseline while the stated DP constraints are met.

What carries the argument

The central object is the LAPA allocation rule \[ \epsilon_{k}^{[t+1]} = \frac{f(\tilde{\vartheta}$_k^{{[t]}}$)}{\sum_{k'} f(\tilde{\vartheta}_{k'}^{[t]})} \$epsilon^{{[t]}}$, \] where $\tilde{\vartheta}$_k^{{[t]}}$$ is a smoothed angular deviation between device $k$'s local gradient and the global gradient and $f$ is a monotone exponential mapping. That rule converts data-distribution contribution into a personalized privacy budget with no extra uplink transmission. The switching condition in Eq. (23) is the identity that does the main work: it equates the summed channel-noise standard deviations with the summed required artificial-noise scales, defining the round $T_{\mathrm{th}}$ after which environmental noise alone is declared sufficient for DP. The convergence bound in Eq. (24) is the analysis workhorse; it turns the switching decision into a transmission-power optimization problem that the DDPG controller solves.

What would settle it

Compute, at the DDPG-selected transmit powers, each device's effective channel-noise standard deviation $\sigma_{n_0}/(p_k\|\mathbf{h}_k\|)$ at the switching round and compare it with that device's required DP scale $c\$\Delta$ s_k/\$epsilon_k^{{[T_{\mathrm{th}}$}]}$; if any device falls short, the post-switch privacy guarantee fails. A related empirical check is a per-device DP audit on a non-IID deployment in which one device has a weak channel, asking whether its gradients satisfy $(\epsilon,\delta)$-DP after $T_{\mathrm{th}}$ without artificial noise.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the wireless channel's ambient noise can be budgeted as a privacy resource rather than treated as an impairment. Under the LAPA allocation, each device's added noise scale is set to $\$sigma_k^{{(t)}}$ \ge c \$\Delta$ s_k / \$epsilon_k^{{(t)}}$$, with $\epsilon_k$ allocated round by round from a total budget according to a smoothed angular contribution; aggregation weights are separately set by Wasserstein distance between label distributions and an SINR selection threshold. Theorem 1 then bounds the expected training loss by $A^T$ times the initial suboptimality plus two additive noise terms, one from channel noise that persists all rounds and one from artificial DP noise that is active only up to switching round $T_{\mathrm{th}}$. The paper reads this bound as a simultaneous privacy and convergence guarantee, and it uses the bound as the objective for optimizing transmit power, with DDPG finding the power allocation that positions the privacy switch. The experimental section reports that LAPA reaches accuracy near the no-DP baseline on MNIST and Fashion-MNIST, and that the dynamic noise control adds further gains over fixed power settings.

Load-bearing premise

The load-bearing premise is that after the switching round, the channel noise alone—not just its sum across devices—meets each device's differential privacy requirement; if Eq. (23) holds only in aggregate, stopping artificial noise can leave individual devices with weaker protection than their allocated budget.

Editorial extensions

If this is right

Under assumptions A1–A4, the convergence bound in Theorem 1 holds with rate $A = 1 + \mu L \lambda^2 \delta^2 \sum_k G_k^2 - 2\lambda\mu$, and the condition $A<1$ gives the explicit learning-rate rule $\lambda < 2/(L\delta^2\sum_k G_k^2)$, which makes the learning rate shrink as data heterogeneity grows.
Because the LAPA budget allocation reads only gradients already exchanged, the privacy mechanism adds zero communication overhead to the FL protocol.
After the switching round $T_{\mathrm{th}}$, artificial noise is removed, so the remaining perturbation is only channel noise; this is the mechanism by which the scheme claims to keep convergence close to the no-privacy baseline.
The DDPG-based power control produces a feasible, online way to choose $T_{\mathrm{th}}$, since the switching time has no closed-form expression in terms of power.
The Wasserstein-distance aggregation weights and SINR-based device selection are claimed as independent improvements for non-IID FL, with reported accuracy gains over FedAvg and the angle-based BEDA baseline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A consequence the paper leaves implicit is that the privacy accounting after switching must be per device, not aggregate: Eq. (23) sums noise scales, whereas $(\epsilon,\delta)$-DP is a per-device property, so a direct audit would check each device's effective channel noise at round $T_{\mathrm{th}}$ against its calibrated DP scale.
The observed case where LAPA's artificial noise slightly improves on the no-DP baseline under a small learning rate suggests a broader principle—calibrated noise can act as a regularizer against underfitting—but the paper only reports it as an experimental phenomenon, not a theorem.
The same switching logic could be re-evaluated online when channel statistics change mid-training, turning the one-time switch $T_{\mathrm{th}}$ into a trigger that monitors per-round channel noise; that extension is not in the paper.
The convergence bound could also be used to co-select participating devices and clipping thresholds, since both enter through $G_k$ and $\Delta s_k$, as a way to further reduce the privacy noise burden.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First, the substance: the paper's contribution is a single system that combines adaptive per-device privacy budgets, channel-noise-aware power control, and data/communication-aware aggregation weights. Each piece is known, but the combination is new and the experimental comparisons against ARB and uniform DP show consistent gains on MNIST and Fashion-MNIST in non-IID settings. The writing is clear and the literature coverage is honest, including the closest work [30]. That earns real credit.

The problem is the privacy analysis. Eq. (18) reports the sensitivity of the local gradient as 2λC/|D_k|. The transmitted quantity in Eq. (19) is the clipped gradient g_k, not λ times it, and the sensitivity of the clipped-averaged gradient is 2C/|D_k|. Including the learning rate under-scales the Gaussian noise by a factor of λ — roughly 100x at λ=0.01 — so the scheme does not provide the stated DP guarantee. This is not a cosmetic slip; Theorem 1 uses the same too-small scale, so the convergence bound describes a different system. Eq. (23) is a second load-bearing issue: it decides when to stop artificial noise by equating the sum of channel-noise standard deviations to the sum of required DP scales. Differential privacy is per device; each device needs its own channel noise to meet its own budget. A sum equality can hold while some devices have no effective channel noise, leaving them unprotected. The convergence proof in the appendix also has an algebraic error: Eq. (50) starts the recursion from w[0] instead of w[Tth]. That is likely fixable, but as written it's wrong.

Two smaller gaps: the 'no additional communication overhead' claim conflicts with the need for the devices' label distributions to compute the Wasserstein aggregation weights, and the simulations omit comparison with [30], the paper they are most directly extending. I'd also like error bars on at least the main comparisons.

Net: reject in its current form. The core privacy guarantee is not established, and the error is in the main mechanism, not a boundary case. But the problem is real, the integration is sensible, and with a corrected sensitivity and a per-device switching condition the paper could become a solid systems contribution. Worth a serious referee, but the referee should be told to check the DP calibration first.

Referee Report

5 major / 5 minor

Summary. The manuscript considers a wireless federated learning (FL) system with non-IID data, a semi-honest parameter server, and per-device differential privacy. It proposes a Lightweight Adaptive Privacy Allocation (LAPA) strategy that assigns per-round, per-device privacy budgets from a PID-like gradient-progress measure and a device-contribution angle, then clips local gradients and adds Gaussian noise. A DDPG controller optimizes transmit powers and a switching round Tth after which artificial noise is stopped and only channel noise is claimed to satisfy DP. The paper also introduces Wasserstein-distance/SINR-based aggregation weights and states a convergence upper bound (Theorem 1, Eq. (24)) that is said to simultaneously provide privacy and convergence guarantees. Experiments on MNIST and Fashion-MNIST compare the proposed mechanism with several baselines.

Significance. If the theoretical claims were sound, the paper would make a useful contribution to wireless FL by showing that adaptive privacy budgets and channel noise can be jointly exploited without sacrificing accuracy. The aggregation-weight design and the DDPG-based power control are plausible, and the experimental comparison covers informative baselines. However, the core privacy accounting, the artificial-noise switching condition, and the convergence proof contain load-bearing errors. As written, the claimed privacy and convergence guarantees are not established, and the reported numerical results follow from the incorrect noise calibration. I do not see machine-checked proofs or released code that would independently support the derivations.

major comments (5)

[Section III-B, Eq. (18)] The stated sensitivity Δs_k = 2λC/|D_k| is not the sensitivity of the quantity released in Eq. (19). Eq. (19) transmits the clipped local gradient g_k^t; under per-example clipping to l2-norm C, the sensitivity of the averaged clipped gradient is 2C/|D_k|. The learning rate λ should not appear in this sensitivity unless the transmitted quantity is the learning-rate-scaled update λg_k^t, in which case Eq. (19) and Theorem 1 are written for a different signal. With λ=0.01 in Section V-A, the Gaussian noise scale calibrated after Eq. (19) is too small by a factor of λ, and this error propagates into Theorem 1 and Constraint (28b). The argmin-distance expression in Eq. (18) also does not define the l2 sensitivity of the released gradient.
[Section IV-A, Eq. (23)] The stopping rule equates sums of standard deviations over devices, but differential privacy is a per-device property. After round Tth, each device k needs its own channel-noise scale σ_n0/(p_k||h_k||) to be at least c Δs_k / ϵ_k^{Tth}. Equality of the sums can hold while some devices have channel noise far below their required scale, so those devices receive no privacy guarantee once artificial noise stops. The same sum condition is used as Constraint (28b); consequently the DDPG optimizer can satisfy the constraint while leaving individual devices unprotected. Eq. (23) and (28b) should be replaced by per-device inequalities, with Tth determined by the binding device(s).
[Appendix I and Eq. (24)] The convergence proof uses Δs_k^2 and the channel-noise variance terms as if these were the total per-device noise power. For a q-dimensional gradient, Gaussian mechanism noise has per-coordinate variance σ^2, so E||η_k^t||^2 = q σ^2. Thus the artificial-noise and channel-noise contributions in Eqs. (47), (48), (50), and (24) are missing the gradient-dimension factor q. The convergence upper bound and the DDPG objective in (28) therefore understate the actual noise by the model size. Unless q=1, Theorem 1 does not describe the simulated system.
[Appendix I, Eqs. (43)-(45)] The inequality E||Σ_k G_k ∇F_k(w)||^2 ≤ Σ_k G_k^2 E||∇F_k(w)||^2 is not valid. If all local gradients are equal to a common vector v and Σ_k G_k = 1, the left-hand side is ||v||^2 while the right-hand side is (Σ_k G_k^2)||v||^2, which is strictly smaller for non-degenerate weights. The valid Cauchy-Schwarz/Jensen bound gives Σ_k G_k E||∇F_k||^2, not the squared-weight version. Because this step defines A = 1 + μLλ^2δ^2Σ_k G_k^2 − 2λμ and the learning-rate condition in Eq. (27), Theorem 1's rate and the subsequent optimization are built on an invalid inequality.
[Section III-B, Eq. (12)] The budget schedule assumes that the Risk of Privacy Leakage decays approximately exponentially with training progress. This is a load-bearing premise imported from [33], a paper sharing the first author, and it is neither derived nor independently verified in this manuscript. Because the LAPA schedule, the switching round Tth, and the reported experiments all depend on this premise, the paper should provide direct evidence or an ablation that isolates and validates the exponential-decay assumption.

minor comments (5)

[Section V-A] The phrase "with a batch size of 0.1" is unclear; a batch size is normally an integer, and this value appears to be a typo or a shorthand for a fraction of the dataset.
[Section III-B, Eq. (12)] The constraint is written with T before T is defined, and the text following Eq. (11) uses "RoLP" where "RoPL" is meant. Also, if e[t] is negative, exp(−e[t]) can exceed 1 and the stated sum constraint ϵ[t] ≤ ϵT is asserted but not enforced; the budget allocation should explicitly enforce nonnegative remaining budget.
[Section IV-B, Assumption A1] Assumption A1 is written as ∥F_k(w) − F_k(w′)∥ ≤ L∥w − w′∥, which is not the standard L-smoothness condition; the inequality should involve gradients, i.e., ∥∇F_k(w) − ∇F_k(w′)∥ ≤ L∥w − w′∥.
[Section IV-B, Assumption A2] In the strong-convexity inequality, the linear term should be (w[t+1] − w[t])^T ∇F_k(w[t]) for each local function; as written it uses ∇F(w[t]) for the global function, which is inconsistent notation.
[Abstract and Section III-B] The claim that the method works "without transmitting any additional information beyond gradients" is overstated: the base station must still communicate per-device privacy budgets and the switching round Tth to the devices, which is control information beyond the gradients themselves.

Circularity Check

1 steps flagged · score 4.0 of 10

The LAPA budget schedule rests on an exponential RoPL trend imported from a self-cited prior paper, but the convergence theorem and experimental comparisons are not circular.

self citation load bearing [Section III-B, before Eq. (12)]
"Section III-C of [33] points out that the RoPL changes with the progress of FL. Specifically, in the early stages of training, devices face a higher RoPL, while this risk decreases rapidly as the training process converges, following an approximately exponential trend. Therefore, the privacy budget in each FL iteration can be allocated according to the training progress. ... ϵ[t] = exp(−e[t]) · ϵT − ϵc / T − t + 1."

The exponential RoPL-decay premise is the only stated justification for the functional form of the LAPA budget schedule in Eq. (12), and it is imported from reference [33], which shares the first author of the present paper. The paper neither re-derives the trend nor validates it on its own data before using it to set per-round privacy budgets. This makes the core allocation rule rest on a self-citation rather than on an independent derivation. It does not, however, force the convergence theorem, which is derived from Assumptions A1-A4 and the stated noise variances, and the experimental comparisons are against external benchmarks.

full rationale

The convergence analysis in Theorem 1 is not circular: it is derived in Appendix I from explicit smoothness, strong-convexity, and local-dissimilarity assumptions together with the noise variances set by the DP calibration, and the experimental comparisons are made against external benchmark algorithms rather than by refitting the claimed privacy constants. The main circularity concern is limited to the LAPA schedule: Eq. (12) adopts an exponential dependence on training progress that is justified solely by a self-cited prior result ([33], co-authored by P. Sun), with no independent derivation or verification supplied in this paper. A separate correctness issue, namely that Eq. (23) enforces only a sum condition while differential privacy is per-device, is a validity problem rather than a circularity and is not scored here. On balance, the central claim retains substantial independent content, so the score is 4 rather than higher.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities, forces, particles, or dimensions. It introduces algorithms and heuristics, but these are not 'invented entities' in the sense of the ledger. The free parameters listed are the ones the central claims depend on, and the axioms are the background assumptions required for the convergence and privacy results.

free parameters (4)

PID coefficients Kp, Ks = not specified
Coefficients in Eq. (11) shape the privacy budget schedule; no values or tuning procedure are given.
Decay factor beta = not specified
Controls the contribution mapping f in Eq. (15); value is chosen by hand and not reported.
Clipping threshold C = not specified
Required for DP sensitivity in Eq. (18); value is not stated in the simulation setup.
SINR/SER selection threshold = epsilon_SER = 10^-1, 10^-2, 10^-3
The best threshold in Section V-B is selected by comparing three values, which is a post-hoc choice affecting reported accuracy.

assumptions (4)

domain assumption A1-A4: local loss functions are L-smooth, mu-strongly convex, twice differentiable, and delta-locally dissimilar.
Standard FL convergence assumptions used to derive Theorem 1. They may not hold for the CNN and cross-entropy loss used in simulations.
ad hoc to paper RoPL decays approximately exponentially with training progress.
Used to justify Eq. (12); taken from the authors' prior work [33] without independent evidence in this paper.
domain assumption Channel noise is independent of the data and can serve as DP noise.
Assumed in Section IV-A when stopping artificial noise after Tth; the noise must be calibrated per-device, which the paper does not ensure.
domain assumption Perfect CSI and full SIC cancellation at the BS.
Assumed in Section II-B to derive the decoded signal and SINR expressions; unrealistic in practical systems.

how reviews work

0 comments

Cite this review

Pith. "Pith review of LAPA-based Dynamic Privacy Optimization for Wireless Federated Learning in Heterogeneous Environments." pith.science (2026). https://pith.science/paper/PRZC7J57

@misc{pith2026250519823,
  author       = {Pith},
  title        = {Pith review of: LAPA-based Dynamic Privacy Optimization for Wireless Federated Learning in Heterogeneous Environments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PRZC7J57}},
  note         = {Machine review of arXiv:2505.19823}
}

read the original abstract

Federated Learning (FL) is a distributed machine learning paradigm based on protecting data privacy of devices, which however, can still be broken by gradient leakage attack via parameter inversion techniques. Differential privacy (DP) technology reduces the risk of private data leakage by adding artificial noise to the gradients, but detrimental to the FL utility at the same time, especially in the scenario where the data is Non-Independent Identically Distributed (Non-IID). Based on the impact of heterogeneous data on aggregation performance, this paper proposes a Lightweight Adaptive Privacy Allocation (LAPA) strategy, which assigns personalized privacy budgets to devices in each aggregation round without transmitting any additional information beyond gradients, ensuring both privacy protection and aggregation efficiency. Furthermore, the Deep Deterministic Policy Gradient (DDPG) algorithm is employed to optimize the transmission power, in order to determine the optimal timing at which the adaptively attenuated artificial noise aligns with the communication noise, enabling an effective balance between DP and system utility. Finally, a reliable aggregation strategy is designed by integrating communication quality and data distribution characteristics, which improves aggregation performance while preserving privacy. Experimental results demonstrate that the personalized noise allocation and dynamic optimization strategy based on LAPA proposed in this paper enhances convergence performance while satisfying the privacy requirements of FL.

Figures

Figures reproduced from arXiv: 2505.19823 by the authors.

**Figure 2.** dynamic noise control mechanism. aggregation, leading to accumulated training errors. Both cases degrades the accuracy of FL. IV. DYNAMIC NOISE CONTROL OPTIMIZATION A. Dynamic Noise Control Mechanism The aforementioned LAPA algorithm introduces artificial noise throughout the entire training process of FL to ensure compliance with DP requirements. However, continuously relying on artificial noise may introduce exces… view at source ↗

**Figure 3.** Device distribution in the simulation environment. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: First, it can be observed that under Non-IID data distribution, both the proposed aggregation strategy based on Wasserstein distance (Configuration 1) and the angle-based aggregation strategy in Benchmark 2 significantly improve FL accuracy compared to the traditional…

**Figure 5.** Figure 5: FL performance of different privacy allocation strate [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

**Figure 4.** Figure 4: Comparison of different aggregation strategies in a [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 6.** Figure 6: FL convergence performance of different privacy allocation strategies under varying degrees of data heterogeneity. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

**Figure 7.** Figure 7: Superiority of the proposed dynamic noise control [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 31 canonical work pages

[30]

Time-varying noise perturbation and power control for differential-privacy-preserving wireless federated learning,

D. Q. Nguyen and T. Kim, “Time-varying noise perturbation and power control for differential-privacy-preserving wireless federated learning,” in Proceedings of Asilomar Conference on Signals, Systems, and Com- puters, pp. 656–660. IEEE, 2023

work page 2023
[33]

Shield against gradient leakage attacks: Adaptive privacy-preserving federated learning,

J. Hu, Z. Wang, Y . Shen, B. Lin, P. Sun, X. Pang, J. Liu, and K. Ren, “Shield against gradient leakage attacks: Adaptive privacy-preserving federated learning,” IEEE/ACM Transactions on Networking , vol. 32, no. 2, pp. 1407–1422, 2023

work page 2023
[1]

Improving on-device speaker verification using federated learning with privacy

F. Granqvist, M. Seigel, R. Van Dalen, A. Cahill, S. Shum, and M. Paulik, “Improving on-device speaker verification using federated learning with privacy,” ArXiv preprint at arXiv:2008.02651 , 2020

work page Pith review arXiv 2008
[2]

Training Keyword Spotting Models on Non-IID Data with Federated Learning

A. Hard, K. Partridge, C. Nguyen, N. Subrahmanya, A. Shah, P. Zhu, I. L. Moreno, and R. Mathews, “Training keyword spotting models on non-iid data with federated learning,” ArXiv preprint at arXiv:2005.10406, 2020

work page Pith review arXiv 2005
[3]

Federated learning of predictive models from federated electronic health records,

T. S. Brisimi, R. Chen, T. Mela, A. Olshevsky, I. C. Paschalidis, and W. Shi, “Federated learning of predictive models from federated electronic health records,” International Journal of Medical Informatics, vol. 112, pp. 59–67, 2018

work page 2018
[4]

Predicting adverse drug reactions on distributed health data using federated learning,

O. Choudhury, Y . Park, T. Salonidis, A. Gkoulalas-Divanis, I. Sylla, and A. k Das, “Predicting adverse drug reactions on distributed health data using federated learning,” in Proceedings of AMIA Annual Symposium , vol. 2019, p. 313, 2020

work page 2019
[5]

Privacy-first health research with federated learning,

A. Sadilek, L. Liu, D. Nguyen, M. Kamruzzaman, S. Serghiou, B. Rader, A. Ingerman, S. Mellem, P. Kairouz, E. O. Nsoesie et al., “Privacy-first health research with federated learning,” NPJ Digital Medicine , vol. 4, no. 1, p. 132, 2021

work page 2021
[6]

Federated learning for open banking,

G. Long, Y . Tan, J. Jiang, and C. Zhang, “Federated learning for open banking,” in Federated Learning: Privacy and Incentive , pp. 240–254, 2020

work page 2020

Show all 37 references

[7]

Ffd: A federated learning based method for credit card fraud detection,

W. Yang, Y . Zhang, K. Ye, L. Li, and C.-Z. Xu, “Ffd: A federated learning based method for credit card fraud detection,” in Proceedings of Big Data–BigData 2019: 8th International Congress , pp. 18–32. Springer, 2019

2019
[8]

Deep leakage from gradients,

L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in Neural Information Processing Systems , vol. 32, 2019

2019
[9]

idlg: Improved deep leakage from gradients,

B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” ArXiv preprint at arXiv:2001.02610 , 2020

2001 arXiv
[10]

See through gradients: Image batch recovery via gradinversion,

H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 16 337–16 346, 2021

2021
[11]

Beyond inferring class representatives: User-level privacy leakage from federated learning,

Z. Wang, M. Song, Z. Zhang, Y . Song, Q. Wang, and H. Qi, “Beyond inferring class representatives: User-level privacy leakage from federated learning,” in Proceedings of IEEE Conference on Computer Communi- cations (ICCC), pp. 2512–2520. IEEE, 2019

2019
[12]

Inverting gradients-how easy is it to break privacy in federated learning?

J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Ad- vances in Neural Information Processing Systems , vol. 33, pp. 16 937– 16 947, 2020

2020
[13]

Systematic evaluation of privacy risks of ma- chine learning models,

L. Song and P. Mittal, “Systematic evaluation of privacy risks of ma- chine learning models,” in Proceedings of USENIX Security Symposium (USENIX Security 21) , pp. 2615–2632, 2021

2021
[14]

Ml-leaks: Model and data independent membership inference at- tacks and defenses on machine learning models,

A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference at- tacks and defenses on machine learning models,” ArXiv preprint at arXiv:1806.01246, 2018

2018 arXiv
[15]

Practical blind membership inference attack via differential comparisons,

B. Hui, Y . Yang, H. Yuan, P. Burlina, N. Z. Gong, and Y . Cao, “Practical blind membership inference attack via differential comparisons,” ArXiv preprint at arXiv:2101.01341 , 2021

2021 arXiv
[16]

Machine learning models that remember too much,

C. Song, T. Ristenpart, and V . Shmatikov, “Machine learning models that remember too much,” in Proceedings of ACM SIGSAC Conference on Computer and Communications Security , pp. 587–601, 2017

2017
[17]

Deep models under the gan: information leakage from collaborative deep learning,

B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” in Proceedings of ACM SIGSAC Conference on Computer and Communications Security , pp. 603–618, 2017. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUS...

2017
[18]

Property inference attacks on fully connected neural networks using permutation invariant representations,

K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” in Proceedings of ACM SIGSAC Conference on Computer and Communications Security , pp. 619–633, 2018

2018
[19]

Model inversion attacks that exploit confidence information and basic countermeasures,

M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceed- ings of ACM SIGSAC Conference on Computer and Communications Security, pp. 1322–1333, 2015

2015
[20]

The algorithmic foundations of differential privacy,

C. Dwork, A. Roth et al. , “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science , vol. 9, no. 3–4, pp. 211–407, 2014

2014
[21]

A hybrid approach to privacy-preserving federated learning,

S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y . Zhou, “A hybrid approach to privacy-preserving federated learning,” in Proceedings of ACM Workshop on Artificial Intelligence and Security, pp. 1–11, 2019

2019
[22]

Differentially private fed- erated learning: A client level perspective,

R. C. Geyer, T. Klein, and M. Nabi, “Differentially private fed- erated learning: A client level perspective,” ArXiv preprint at arXiv:1712.07557, 2017

2017 arXiv
[23]

Federated learning with differential privacy: Algorithms and performance analysis,

K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V . Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 3454–3469, 2020

2020
[24]

Pflf: Privacy-preserving federated learning framework for edge computing,

H. Zhou, G. Yang, H. Dai, and G. Liu, “Pflf: Privacy-preserving federated learning framework for edge computing,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 1905–1918, 2022

1905
[25]

Reschedule gradients: Temporal non-iid resilient federated learning,

X. You, X. Liu, N. Jiang, J. Cai, and Z. Ying, “Reschedule gradients: Temporal non-iid resilient federated learning,” IEEE Internet of Things Journal, vol. 10, no. 1, pp. 747–762, 2022

2022
[26]

A socially optimal data marketplace with differentially private federated learning,

P. Sun, G. Liao, X. Chen, and J. Huang, “A socially optimal data marketplace with differentially private federated learning,” IEEE/ACM Transactions on Networking , 2024

2024
[27]

Privacy-preserving asynchronous grouped federated learning for iot,

T. Zhang, A. Song, X. Dong, Y . Shen, and J. Ma, “Privacy-preserving asynchronous grouped federated learning for iot,” IEEE Internet of Things Journal, vol. 9, no. 7, pp. 5511–5523, 2021

2021
[28]

Joint communication and learning design of differential privacy for federated learning over multi- cell networks,

L. Lin, Z. Zhao, Z. Yang, and Z. Zhang, “Joint communication and learning design of differential privacy for federated learning over multi- cell networks,” in Proceedings of IEEE International Conference on Communications Workshops (ICC Workshops) , pp. 770–775. IEEE, 2023

2023
[29]

P2cefl: Privacy-preserving and communication efficient federated learning with sparse gradient and dithering quantization,

G. Wang, Q. Qi, R. Han, L. Bai, and J. Choi, “P2cefl: Privacy-preserving and communication efficient federated learning with sparse gradient and dithering quantization,” IEEE Transactions on Mobile Computing, 2024

2024
[31]

Our data, ourselves: Privacy via distributed noise generation,

C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, and M. Naor, “Our data, ourselves: Privacy via distributed noise generation,” in Proceedings of Advances in cryptology-EUROCRYPT 2006: 24th Annual Interna- tional Conference on the Theory and Applications of Cryptographic Techn...

2006
[32]

Local differential private data aggregation for discrete distribution estimation,

S. Wang, L. Huang, Y . Nie, X. Zhang, P. Wang, H. Xu, and W. Yang, “Local differential private data aggregation for discrete distribution estimation,” IEEE Transactions on Parallel and Distributed Systems , vol. 30, no. 9, pp. 2046–2059, 2019

2019
[34]

Rescuedp: Real-time spatio-temporal crowd-sourced data publishing with differ- ential privacy,

Q. Wang, Y . Zhang, X. Lu, Z. Wang, Z. Qin, and K. Ren, “Rescuedp: Real-time spatio-temporal crowd-sourced data publishing with differ- ential privacy,” in Proceedings of IEEE International Conference on Computer Communications (ICCC) , pp. 1–9. IEEE, 2016

2016
[35]

Federated optimization in heterogeneous networks,

T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Machine Learning and Systems, vol. 2, pp. 429–450, 2020

2020
[36]

Fast-convergent federated learning with adaptive weighting,

H. Wu and P. Wang, “Fast-convergent federated learning with adaptive weighting,” IEEE Transactions on Cognitive Communications and Net- working, vol. 7, no. 4, pp. 1078–1088, 2021

2021
[37]

Deep learning with differential privacy,

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Tal- war, and L. Zhang, “Deep learning with differential privacy,” inProceed- ings of ACM SIGSAC Conference on Computer and Communications Security, pp. 308–318, 2016

2016

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [30]

Time-varying noise perturbation and power control for differential-privacy-preserving wireless federated learning,

D. Q. Nguyen and T. Kim, “Time-varying noise perturbation and power control for differential-privacy-preserving wireless federated learning,” in Proceedings of Asilomar Conference on Signals, Systems, and Com- puters, pp. 656–660. IEEE, 2023

work page 2023

[2] [33]

Shield against gradient leakage attacks: Adaptive privacy-preserving federated learning,

J. Hu, Z. Wang, Y . Shen, B. Lin, P. Sun, X. Pang, J. Liu, and K. Ren, “Shield against gradient leakage attacks: Adaptive privacy-preserving federated learning,” IEEE/ACM Transactions on Networking , vol. 32, no. 2, pp. 1407–1422, 2023

work page 2023

[3] [1]

Improving on-device speaker verification using federated learning with privacy

F. Granqvist, M. Seigel, R. Van Dalen, A. Cahill, S. Shum, and M. Paulik, “Improving on-device speaker verification using federated learning with privacy,” ArXiv preprint at arXiv:2008.02651 , 2020

work page Pith review arXiv 2008

[4] [2]

Training Keyword Spotting Models on Non-IID Data with Federated Learning

A. Hard, K. Partridge, C. Nguyen, N. Subrahmanya, A. Shah, P. Zhu, I. L. Moreno, and R. Mathews, “Training keyword spotting models on non-iid data with federated learning,” ArXiv preprint at arXiv:2005.10406, 2020

work page Pith review arXiv 2005

[5] [3]

Federated learning of predictive models from federated electronic health records,

T. S. Brisimi, R. Chen, T. Mela, A. Olshevsky, I. C. Paschalidis, and W. Shi, “Federated learning of predictive models from federated electronic health records,” International Journal of Medical Informatics, vol. 112, pp. 59–67, 2018

work page 2018

[6] [4]

Predicting adverse drug reactions on distributed health data using federated learning,

O. Choudhury, Y . Park, T. Salonidis, A. Gkoulalas-Divanis, I. Sylla, and A. k Das, “Predicting adverse drug reactions on distributed health data using federated learning,” in Proceedings of AMIA Annual Symposium , vol. 2019, p. 313, 2020

work page 2019

[7] [5]

Privacy-first health research with federated learning,

A. Sadilek, L. Liu, D. Nguyen, M. Kamruzzaman, S. Serghiou, B. Rader, A. Ingerman, S. Mellem, P. Kairouz, E. O. Nsoesie et al., “Privacy-first health research with federated learning,” NPJ Digital Medicine , vol. 4, no. 1, p. 132, 2021

work page 2021

[8] [6]

Federated learning for open banking,

G. Long, Y . Tan, J. Jiang, and C. Zhang, “Federated learning for open banking,” in Federated Learning: Privacy and Incentive , pp. 240–254, 2020

work page 2020