Pith. sign in

REVIEW 3 major objections 4 minor 34 references

Secure Distributed Learning for CAVs: Defending Against Gradient Leakage with Leveled Homomorphic Encryption

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Selectively encrypting the most sensitive gradients with leveled homomorphic encryption can prevent deep gradient-leakage attacks while keeping federated model accuracy nearly intact.

desk verdict Reasonable accuracy/overhead benchmark for selective CKKS, but the privacy claim is hollow because the server holds the secret key and no DLG attack is ever run. read the letter →

arxiv 2506.07894 v1 pith:RHXB257P submitted 2025-06-09 cs.CR

Muhammad Ali Najjar , Ren-Yi Huang , Dumindu Samaraweera , Prashant Shekhar This is my paper · ORCID
classification cs.CR
keywords federatedlearninghomomorphicencryptiongradientleakagedeepfromgradientsselectiveCKKSconnectedandautonomousvehiclesprivacy-preservingmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes that federated learning can be made resistant to gradient-leakage attacks without paying the full cost of encrypting every parameter. It builds a pipeline in which each client trains a local model, identifies the most sensitive gradients by magnitude, encrypts only those with a leveled homomorphic encryption scheme (CKKS), and sends both encrypted and plaintext updates to the server. The server aggregates the encrypted parts homomorphically, adds the plaintext parts normally, and decrypts once to update the global model. Using a standard image benchmark and four CNN architectures, the paper reports near-identical accuracy under full encryption and manageable overhead under selective encryption. If the claims hold, this gives connected-vehicle and other resource-constrained federated deployments a way to stop deep gradient-leakage attacks while keeping model utility.

What carries the argument

The load-bearing object is a selective CKKS encryption procedure wrapped into Algorithm 1. CKKS is a leveled homomorphic encryption scheme that supports approximate addition and multiplication on encrypted vectors of real numbers, so an aggregator can add encrypted gradients without seeing them. Clients generate sensitivity maps from gradient magnitudes, select the top r percent of parameters, encrypt those with CKKS, and send an encrypted-plaintext tuple; the server homomorphically sums the encrypted portion, sums the plaintext portion, decrypts the aggregate, and combines both to update the global model. The implementation uses a polynomial modulus degree of 8192, a scaling factor of 52 bits, and a 172-bit ciphertext modulus, chosen to support the fixed multiplicative depth without bootstrapping.

What would settle it

Have the server, in possession of its own secret key, run a DLG reconstruction against a single client's ciphertext before aggregation; if recognizable training images are recovered, the claimed defense against gradient leakage fails. A second check is to run DLG on the unencrypted fraction at the tested encryption ratios and see whether reconstruction remains possible.

Watch

Extended reading notes

Core claim

The central claim is that a complete federated-learning pipeline using leveled homomorphic encryption can effectively mitigate Deep Leakage from Gradients while preserving model accuracy. The authors argue that encrypting model updates with CKKS, a leveled homomorphic encryption scheme for approximate arithmetic on encrypted real vectors, ensures that adversaries cannot access meaningful information from intercepted gradients, and that a selective strategy encrypting only the top-ranked sensitive parameters keeps the cryptographic overhead practical. The reported experiments on CIFAR-10 show that moving from 0% to 100% encryption produces only a slight drop in accuracy for ResNet34, EfficientNetB0, and MobileNetV2, while MobileNetV1 degrades more sharply, and that test accuracy does not simply track model size.

Load-bearing premise

The whole privacy guarantee rests on the premise that a server holding the secret key cannot or will not access meaningful information from individual encrypted gradients, even though the protocol gives the server that key and requires it to decrypt the aggregate.

Editorial extensions

If this is right

  • If the central claim is correct, gradient-leakage attacks of the DLG type cannot reconstruct client training data from the encrypted fraction of the model update, removing the main privacy failure mode of plaintext federated learning.
  • Selective encryption by gradient-magnitude sensitivity means the overhead of homomorphic encryption scales with the encryption ratio rather than with model size, which is what makes the approach plausible on resource-constrained vehicles.
  • Accuracy and generalization under encryption are architecture-dependent: MobileNetV2 and ResNet34 hold accuracy at 100% encryption, while MobileNetV1 shows a larger accuracy drop and a widening generalization gap.
  • Under the described pipeline the server must decrypt the aggregated ciphertext with the secret key, so the privacy guarantee as argued covers outside adversaries and honest-but-curious servers that follow the protocol, not a server that abuses the key.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A consequence the authors do not spell out is that the described protocol does not protect client updates from a malicious or compromised server: since the server holds the secret key and decrypts after aggregation, it could instead decrypt each client's ciphertext before aggregation and inspect individual gradients.
  • The selective-encryption choice itself may leak: the pattern of which parameters are encrypted is derived from gradient magnitudes, so a server that sees the plaintext portion and the encryption mask can infer which parts of the gradient are large, and might use the plaintext portion alone to run a partial DLG reconstruction.
  • A testable extension would measure reconstruction fidelity from the plaintext fraction alone; if DLG can already reconstruct recognizable data from the unencrypted part, the defense would need to be paired with perturbation or a higher encryption ratio.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a federated learning pipeline that integrates CKKS-leveled homomorphic encryption (via TenSEAL) with a selective-encryption strategy, encrypting only the top-r% of gradients ranked by magnitude-based sensitivity maps. The authors evaluate four CNN architectures (EfficientNetB0, MobileNetV1, MobileNetV2, ResNet34) on CIFAR-10 in an IID setting, reporting accuracy, generalization gap, model-size trade-offs, and radar-plot summaries across encryption ratios. The abstract and Section III claim that this pipeline "effectively mitigates DLG attacks while preserving model accuracy," and the implementation is open-sourced. The paper also surveys HE schemes and CAV-related adversarial threats.

Significance. If the central privacy claim held, the selective-encryption approach would be a practically relevant contribution to HE-based federated learning in resource-constrained settings. The paper's strengths include a reproducible open-source implementation, a comparative evaluation across several modern architectures, and a clear accounting of accuracy/efficiency trade-offs under different encryption ratios. However, the claimed DLG mitigation is not supported by the experiments, and the protocol as described gives the server the secret key, which structurally undermines the stated privacy guarantee against honest-but-curious servers. The accuracy and efficiency findings may stand on their own as an empirical study, but they do not establish the paper's headline privacy contribution.

major comments (3)
  1. [Section IV.B and Algorithm 1] The protocol gives the server the CKKS secret key: Section IV.B step 4 states "the server decrypts the combined model updates using the secret key," and Algorithm 1 line 17 decrypts using "ski or shared mechanism." In CKKS, decryption of an individual ciphertext is the same operation as decryption of an aggregate ciphertext, so an honest-but-curious server holding the key can decrypt any client's encrypted update. This directly contradicts Section III's claim that adversaries, "including potentially honest but prudent servers, cannot access meaningful information from intercepted gradients." Additionally, Algorithm 1 line 12 sends an "(Encrypted, Plaintext) gradient tuple," so the non-encrypted fraction is available to the server in plaintext. Even if the implementation only decrypts the aggregate as written, the presence of the secret key on the server makes the claimed confidentiality guarantee vacuous. This key-management flaw is load-bearing: no DLG experiment is needed to show that a server holding the decryption key can read the ciphertexts.
  2. [Section VI] The paper's central contribution, as stated in the abstract, is "the development of a full HE-based FL pipeline that effectively mitigates DLG attacks while preserving model accuracy." Section VI, however, contains only accuracy comparisons, generalization gaps, model-size versus accuracy plots, and normalized radar plots. There is no attack evaluation: no DLG attack is run, no reconstruction metric (e.g., MSE, SSIM, or cosine similarity between reconstructed and original inputs) is reported, and no comparison of attack success with and without encryption is provided. The experimental section therefore does not support the privacy claim; at best it supports the accuracy-preservation half of the contribution.
  3. [Section IV.B and Section V] The selective-encryption strategy is motivated as a way to "maintain privacy protection" while reducing overhead, but the paper never quantifies how much information leaks from the unencrypted fraction or how the encryption ratio r trades off against reconstruction resistance. The threat-model discussion in Section III includes an adversarial server and malicious clients, yet the experiments in Section V use only benign clients and report no adversarial measurements. Without a measured relationship between r and DLG success, the claim that selective encryption provides meaningful privacy protection is unsupported.
minor comments (4)
  1. [Section VI.D] There is a typo in the definition of Eloss(r): "average traning loss" should be "average training loss." Also, the normalized metrics Ecomp, Egen, and Eloss are relative to the min/max across all models and scenarios; the text should state explicitly that these are relative rankings, not absolute efficiency measures.
  2. [Algorithm 1] The key-management flow is unclear: line 2 generates per-client key pairs (pki, ski), line 3 broadcasts pki to all clients, and line 17 refers to "ski or shared mechanism." The paper should specify whether each client has its own key, whether the server holds any key, and how aggregation is possible if the server does not hold a decryption key.
  3. [Section II.C] The statement "Li et al. [9] demonstrated the feasibility of employing HE schemes in federated settings" appears to cite the wrong reference: [9] is a general federated learning challenges paper, not a work specifically demonstrating HE feasibility. Please verify and replace with an appropriate citation.
  4. [General] The text contains several typographical issues, including "CA Vs" with inconsistent spacing in the title and abstract, "EffecientnetB0" in the Figure 12 caption, and the GitHub repository name "Federated-Learning-PyTorch-HE-Smap" (likely "SMap"). These should be corrected in revision.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the paper's accuracy and efficiency claims are empirical measurements, and its privacy claim is weakened by a key-management flaw rather than by a self-referential derivation.

full rationale

The paper contains no derivation chain in which an output is equivalent to an input by construction. The accuracy results in Section VI are empirical measurements on CIFAR-10 with and without CKKS encryption, not predictions derived from fitted parameters. The radar-plot metrics in Section VI.D are explicitly normalized summaries of the measured data ('Each axis is constructed directly from the experimental data, without additional assumptions'), so they are descriptive rather than circular. The selective-encryption sensitivity map is adopted from prior work on pruning importance estimation, and while the text says 'Building on our previous findings,' the cited reference [33] is an external pruning paper, not a self-citation carrying the argument. The only self-citation is [1], a background survey by two of the authors; it supports the general existence of gradient-leakage threats but is not load-bearing, since the DLG attack itself is independently cited to [2]. The serious weakness in the paper is not circularity: the protocol gives the server the CKKS secret key (Algorithm 1, line 17; Section IV.B step 4), so an honest-but-curious or compromised server can decrypt individual client ciphertexts, and unencrypted gradient fractions are sent to the same server. That is an internal security-model flaw, not a circular step, and it should be evaluated as a correctness risk rather than as a circularity score. Accordingly, the circularity score is 1, reflecting only the minor presence of a background self-citation with no reduction of the central claim to its own inputs.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central privacy claim depends on chosen encryption parameters (N=8192, Qbits=172, scale=52), a manually selected encryption ratio, and two unverified assumptions: that magnitude-based sensitivity identifies privacy-critical gradients, and that a server holding the secret key will not decrypt individual updates. No new entities are introduced.

free parameters (4)
  • encryption_ratio_r = 0%, 10%, 50%, 100%
    The fraction of top-magnitude gradients encrypted is an input to Algorithm 1 and is swept across values; no rule selects it from privacy or utility requirements.
  • CKKS_polynomial_modulus_degree_N = 8192
    Chosen by hand for stated 128-bit security and TenSEAL limits; it directly controls accuracy, noise budget, and runtime.
  • CKKS_ciphertext_modulus_bits_Q = 172 (60+52+60)
    Chosen to support multiplicative depth; not derived from task requirements.
  • CKKS_scaling_factor_bits = 52 (Delta = 2^52)
    Chosen by hand to balance precision and noise; it affects the numerical error that the accuracy results depend on.
assumptions (3)
  • domain assumption Magnitude-based sensitivity maps identify the parameters whose exposure is most privacy-critical.
    Section IV.B adopts magnitude ranking based on [33], but no experiment measures whether the encrypted subset contains the information DLG would exploit.
  • ad hoc to paper The server, despite holding or sharing the secret key, will not decrypt individual client updates.
    Section IV.B step 4 and Algorithm 1 line 17 let the server decrypt; the paper's threat model assumes this does not break privacy, which is an unstated and questionable assumption.
  • domain assumption CKKS approximate arithmetic with the chosen parameters introduces no accuracy loss beyond what is reported.
    The accuracy comparison assumes the encryption noise is the only cause of any observed gap; no formal error bound or multiple-seed analysis is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure Distributed Learning for CAVs: Defending Against Gradient Leakage with Leveled Homomorphic Encryption." pith.science (2026). https://pith.science/paper/RHXB257P

@misc{pith2026250607894,
  author       = {Pith},
  title        = {Pith review of: Secure Distributed Learning for CAVs: Defending Against Gradient Leakage with Leveled Homomorphic Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RHXB257P}},
  note         = {Machine review of arXiv:2506.07894}
}
read the original abstract

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, making it a promising approach for privacy-preserving machine learning in domains like Connected and Autonomous Vehicles (CAVs). However, recent studies have shown that exchanged model gradients remain susceptible to inference attacks such as Deep Leakage from Gradients (DLG), which can reconstruct private training data. While existing defenses like Differential Privacy (DP) and Secure Multi-Party Computation (SMPC) offer protection, they often compromise model accuracy. To that end, Homomorphic Encryption (HE) offers a promising alternative by enabling lossless computation directly on encrypted data, thereby preserving both privacy and model utility. However, HE introduces significant computational and communication overhead, which can hinder its practical adoption. To address this, we systematically evaluate various leveled HE schemes to identify the most suitable for FL in resource-constrained environments due to its ability to support fixed-depth computations without requiring costly bootstrapping. Our contributions in this paper include a comprehensive evaluation of HE schemes for real-world FL applications, a selective encryption strategy that targets only the most sensitive gradients to minimize computational overhead, and the development of a full HE-based FL pipeline that effectively mitigates DLG attacks while preserving model accuracy. We open-source our implementation to encourage reproducibility and facilitate adoption in safety-critical domains.

Figures

Figures reproduced from arXiv: 2506.07894 by the authors.

Figure 1
Figure 1. An overview of the federated learning workflow in distributed [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Security challenges in federated learning for distributed connected [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 2
Figure 2. How federated aggregation operates at the server when model [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: An overview of adversarial reconstruction of sensitive input data from [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Comparison of training accuracy with and without homomorphic [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Comparison of testing accuracy versus model name with and without [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Relative drop in test accuracy (in percentage) for each model when [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Generalization gap (TrainAccuracyr − TestAccuracyr ) for each model at encryption ratios 0%, 10%, 50%, and 100%. Smaller values indicate better generalization. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 10
Figure 10. Figure 10: Performance trade-off analysis of MobileNetV2 under selective [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: Performance trade-off analysis of MobileNetV1 under selective [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]
Figure 12
Figure 12. Figure 12: Performance trade-off analysis of EffecientnetB0 under selective [PITH_FULL_IMAGE:figures/full_fig_p009_12.png]
Figure 13
Figure 13. Figure 13: Performance trade-off analysis of Resnet34 under selective encryp [PITH_FULL_IMAGE:figures/full_fig_p010_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 21 canonical work pages

  1. [1]

    Exploring threats, defenses, and privacy-preserving techniques in federated learning: A survey,

    R.-Y . Huang, D. Samaraweera, and J. M. Chang, “Exploring threats, defenses, and privacy-preserving techniques in federated learning: A survey,” Computer, vol. 57, no. 4, pp. 46–56, 2024

    work page 2024

  2. [2]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

    2019

  3. [3]

    A method for obtaining digital signatures and public-key cryptosystems,

    R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” Communications of the ACM, vol. 21, no. 2, pp. 120–126, 1978

    1978

  4. [4]

    Public-key cryptosystems based on composite degree residu- osity classes,

    P. Paillier, “Public-key cryptosystems based on composite degree residu- osity classes,” in International conference on the theory and applications of cryptographic techniques , pp. 223–238, Springer, 1999

    work page 1999

  5. [5]

    Fully homomorphic encryption using ideal lattices,

    C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, pp. 169–178, 2009

    work page 2009

  6. [6]

    (leveled) fully ho- momorphic encryption without bootstrapping,

    Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “(leveled) fully ho- momorphic encryption without bootstrapping,” ACM Transactions on Computation Theory (TOCT) , vol. 6, no. 3, pp. 1–36, 2014

    2014

  7. [7]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in cryptology– ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptology and information security, Hong kong, China, December 3-7, 2017, proceedings, part i 23 , pp. 409–437, Springer, 2017

    work page 2017

  8. [8]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics , pp. 1273–1282, PMLR, 2017

    2017

Show all 34 references
  1. [9]

    Federated learning: Challenges, methods, and future directions,

    T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,” IEEE signal processing magazine, vol. 37, no. 3, pp. 50–60, 2020. 10

    2020

  2. [10]

    Scaffold: Stochastic controlled averaging for federated learn- ing,

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learn- ing,” in International conference on machine learning , pp. 5132–5143, PMLR, 2020

    2020

  3. [11]

    A survey on homomorphic encryption schemes: Theory and implementation,

    A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomorphic encryption schemes: Theory and implementation,” ACM Computing Surveys (Csur) , vol. 51, no. 4, pp. 1–35, 2018

    2018

  4. [12]

    Fully homomorphic encryption without bootstrapping,

    Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “Fully homomorphic encryption without bootstrapping,” in ITCS, pp. 309–325, 2012

    2012

  5. [13]

    Somewhat practical fully homomorphic encryption,

    J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,” Cryptology ePrint Archive , 2012

    2012

  6. [14]

    Does fully homomorphic encryption need compute acceleration?,

    L. de Castro, R. Agrawal, R. Yazicigil, A. Chandrakasan, V . Vaikun- tanathan, C. Juvekar, and A. Joshi, “Does fully homomorphic encryption need compute acceleration?,” arXiv preprint arXiv:2112.06396 , 2021

    2021 arXiv

  7. [15]

    {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “ {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning,” in 2020 USENIX annual technical conference (USENIX ATC 20) , pp. 493–506, 2020

    2020

  8. [16]

    Privacy preserving machine learning with ho- momorphic encryption and federated learning,

    H. Fang and Q. Qian, “Privacy preserving machine learning with ho- momorphic encryption and federated learning,” Future Internet, vol. 13, no. 4, p. 94, 2021

    2021

  9. [17]

    Fedml-he: An efficient homomorphic-encryption-based privacy- preserving federated learning system,

    W. Jin, Y . Yao, S. Han, J. Gu, C. Joe-Wong, S. Ravi, S. Avestimehr, and C. He, “Fedml-he: An efficient homomorphic-encryption-based privacy- preserving federated learning system,” arXiv preprint arXiv:2303.10837, 2023

    2023 arXiv

  10. [18]

    A survey on cyber-security of connected and autonomous vehicles (cavs),

    X. Sun, F. R. Yu, and P. Zhang, “A survey on cyber-security of connected and autonomous vehicles (cavs),” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 7, pp. 6240–6259, 2021

    2021

  11. [19]

    Federated learning for intrusion detection systems in internet of vehicles: a general taxonomy, applications, and future directions,

    J. Alsamiri and K. Alsubhi, “Federated learning for intrusion detection systems in internet of vehicles: a general taxonomy, applications, and future directions,” Future Internet, vol. 15, no. 12, p. 403, 2023

    2023

  12. [20]

    Analyzing fed- erated learning through an adversarial lens,

    A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing fed- erated learning through an adversarial lens,” in International conference on machine learning , pp. 634–643, PMLR, 2019

    2019

  13. [21]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866 , 2018

    2018 arXiv

  14. [22]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , pp. 1605–1622, 2020

    2020

  15. [23]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) , pp. 3–18, IEEE, 2017

    2017

  16. [24]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” arXiv preprint arXiv:2001.02610 , 2020

    2001 arXiv

  17. [25]

    Securing con- nected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward,

    A. Qayyum, M. Usama, J. Qadir, and A. Al-Fuqaha, “Securing con- nected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward,” IEEE Communications Surveys & Tutorials, vol. 22, no. 2, pp. 998–1026, 2020

    2020

  18. [26]

    Autonomous vehicle: Security by design,

    A. Chattopadhyay, K.-Y . Lam, and Y . Tavva, “Autonomous vehicle: Security by design,” IEEE Transactions on Intelligent Transportation Systems, vol. 22, no. 11, pp. 7015–7029, 2020

    2020

  19. [27]

    Attacks on machine learning: Adversarial examples in connected and autonomous vehicles,

    P. Sharma, D. Austin, and H. Liu, “Attacks on machine learning: Adversarial examples in connected and autonomous vehicles,” in 2019 IEEE International Symposium on Technologies for Homeland Security (HST), pp. 1–7, IEEE, 2019

    2019

  20. [28]

    Microsoft SEAL (release 4.1)

    “Microsoft SEAL (release 4.1).” https://github.com/Microsoft/SEAL, Jan. 2023. Microsoft Research, Redmond, W A

    2023

  21. [29]

    Design and implementation of helib: a homomorphic encryption library,

    S. Halevi and V . Shoup, “Design and implementation of helib: a homomorphic encryption library,” Cryptology ePrint Archive , 2020

    2020

  22. [30]

    PALISADE Lattice Cryptography Library (release 1.11.3)

    “PALISADE Lattice Cryptography Library (release 1.11.3).” https:// palisade-crypto.org/, May 2021

    2021

  23. [31]

    Tenseal: A library for encrypted tensor operations using homomorphic encryption,

    A. Benaissa, B. Retiat, B. Cebere, and A. E. Belfedhal, “Tenseal: A library for encrypted tensor operations using homomorphic encryption,” arXiv preprint arXiv:2104.03152 , 2021

    2021 arXiv

  24. [32]

    Agrawal and A

    R. Agrawal and A. Joshi, On architecting fully homomorphic encryption- based computing systems . Springer, 2023

    2023

  25. [33]

    Importance estimation for neural network pruning,

    P. Molchanov, A. Mallya, S. Tyree, I. Frosio, and J. Kautz, “Importance estimation for neural network pruning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 11264– 11272, 2019

    2019

  26. [34]

    Pyfhel: Python for homomorphic encryp- tion libraries,

    A. Ibarrondo and A. Viand, “Pyfhel: Python for homomorphic encryp- tion libraries,” in Proceedings of the 9th on Workshop on Encrypted Computing & Applied Homomorphic Cryptography , pp. 11–16, 2021. 11

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.