Pith. sign in

REVIEW 4 major objections 4 minor 44 references

Free Privacy Protection for Wireless Federated Learning: Enjoy It or Suffer from It?

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Random bit flips, deliberate and channel-induced, can certify Rényi differential privacy for wireless federated learning when only fraction bits are transmitted.

desk verdict The fixed-point encoding is a real idea, but Theorem 1's DP proof uses an expected bit-level distance instead of a worst-case sensitivity, so the 'free privacy' claim is not established. read the letter →

arxiv 2506.12749 v2 pith:3A3BFARB submitted 2025-06-15 cs.LG

Weicai Li , Tiejun Lv , Xiyu Zhao , Xin Yuan , Wei Ni This is my paper · ORCID
classification cs.LG
keywords wirelessfederatedlearningRényidifferentialprivacybit-flippingmechanismchannelnoiseasIEEE754floating-pointconversionbit-leveldistanceconvergenceanalysisdigitalcommunication
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Wireless federated learning usually treats channel errors as a nuisance: bit flips in IEEE 754 floating-point numbers can corrupt sign or exponent bits catastrophically, so systems retransmit or discard packets. This paper argues the opposite: the same noise, if shaped correctly, can be the privacy mechanism itself. The paper proposes a channel-native bit-flipping DP mechanism that converts each model parameter from floating-point to a fixed-point form, transmits only the fraction bits, and lets random flips—both deliberate and channel-induced—obfuscate the model. It proves that, with an end-to-end bit-error rate above a threshold tied to an expected bit-level distance, the mechanism satisfies $(\lambda,\epsilon)$-Rényi differential privacy, and it bounds the resulting convergence penalty. If correct, WFL gains formal privacy protection without paying the utility cost of additive Gaussian noise, and noisy channels become a resource rather than a failure.

What carries the argument

The load-bearing object is the pair consisting of the fixed-point conversion (7) and the expected bit-level distance (15)-(16). The conversion encodes each model parameter $\omega_{t,n}$ as a fixed-point number by adding the constant $3\times 2^{(c_{30}\cdots c_{23})_2-126}$ derived from the public norm bound $\nu_\infty$; this makes all elements share the same positive sign and exponent, so only the 23 fraction bits of each parameter enter the transmitted bitstream. The expected bit-level distance $\bar{\kappa}_{\Delta\omega_{\max,n}}$ is the sum over all transmitted bits of their binary weights $2^{(k\bmod 23)-23}$ times the probability $q_k$ that the bit differs between two adjacent-dataset encodings, averaged over the sphere $\|x\|_2=\Delta\omega_{\max,n}$. This quantity plays the role of sensitivity in the Rényi-divergence bound: Theorem 1 converts it into a required end-to-end BER, and the same expected distance, together with the variance of Lemma 1, feeds the convergence-bias bound in Theorem 2.

What would settle it

Enumerate or randomly search pairs of adjacent datasets whose local-model difference lies on the sphere $\|x\|_2=\Delta\omega_{\max,n}$, compute the exact bit-level distance of their fraction-bit encodings, and record the maximum rather than the average. Feed the worst-case pair through the bit-flipping mechanism at the BER set by Theorem 1 and numerically evaluate the order-$\lambda$ Rényi divergence; a divergence above $\epsilon/K$ would refute the privacy claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that bit-level perturbation can be a rigorous privacy mechanism for digital WFL. Theorem 1 states that applying the bit-flipping mechanism $M_{\mathrm{BF}}(u(D_n), p_{t,n})$ for $K$ communication rounds satisfies $(\lambda,\epsilon)$-Rényi DP whenever the end-to-end bit-error rate satisfies $p_{t,n} \geq \left[1+\left(\frac{(\lambda-1)\epsilon}{K \bar{\kappa}_{\Delta\omega_{\max,n}}}\right)^{1/(\lambda-1)}\right]^{-1}$. The argument rests on a new floating-point-to-fixed-point conversion: every parameter is shifted by a public constant derived from the $\ell_\infty$-norm bound $\nu_\infty$, so all parameters share one sign and exponent, and only the 23 fraction bits per dimension need be transmitted. Because sign and exponent bits are never sent, the catastrophic failure mode of IEEE 754 transmission disappears, and random flips in the fraction bits become the noise source of a DP mechanism. Bit-level sensitivity is measured by the expected bit-level distance $\bar{\kappa}_{\Delta\omega_{\max,n}}$, the average Hamming weight of the difference between the encoded bitstreams of two models separated by the classical sensitivity $\Delta\omega_{\max,n}$. The paper also proves (Theorem 2) that the induced bias has bounded variance and that the FedAvg-style convergence bound reduces to the standard no-privacy bound as the bit-error rate goes to zero.

Load-bearing premise

The privacy proof leans on one load-bearing premise: the expected bit-level distance $\bar{\kappa}_{\Delta\omega_{\max,n}}$, estimated by averaging over randomly sampled parameter differences on the sphere of radius the classical sensitivity, is treated as an upper bound on the bit-level sensitivity for every adjacent dataset pair; if any pair's encoded bitstreams differ more than that average, the claimed $\epsilon$ is exceeded.

Editorial extensions

If this is right

  • Digital WFL with a known channel BER can meet a target $(\lambda,\epsilon)$-Rényi DP budget without injecting Gaussian noise into the model; the channel flips supply the obfuscation.
  • The same privacy budget is spread over $K$ rounds, so longer training lowers the per-round BER required by Theorem 1, inversely through $K$.
  • The conversion cuts per-parameter transmissions from 32 to 23 bits and removes the risk of sign/exponent corruption, so retransmission or dropping of erroneous models is no longer the only safe option.
  • When the channel alone is too clean, the client adds artificial flips at probability $p_{t,n,A}$ chosen from the end-to-end BER relation, so privacy holds for any channel condition, including error-free ones.
  • The convergence bound in Theorem 2 shows the utility penalty is governed by the maximum end-to-end BER $p_{\max}$ and the bit-level bias term; as $p_{\max}\to 0$ and $X_{\mathrm{BF}}\to 0$, the bound collapses to the standard FedAvg bound with no privacy noise.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • (Editorial inference) Because the mechanism is a weighted randomized response on bits, the per-bit weights $2^{(k\bmod 23)-23}$ are what let it outperform uniform bit-flipping; a uniform randomized-response version would need a much higher BER to hit the same $\epsilon$, which is a testable prediction.
  • (Editorial inference) An adaptive transmitter could treat the Theorem 1 BER threshold as a control target: choosing modulation order, coding rate, or transmit power to sit exactly at the threshold turns the channel's instantaneous state into a privacy-budget actuator.
  • (Editorial inference) The guarantee is composition-based, so running fewer than $K$ rounds, early stopping, or dropping clients yields a realized privacy level stronger than the target rather than a violation of the promised $\epsilon$.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a channel-native bit-flipping differential privacy (DP) mechanism for wireless federated learning (WFL). The authors design a floating-point-to-fixed-point conversion that transmits only the fraction bits of model parameters, thereby avoiding catastrophic sign/exponent bit errors. Privacy is provided by a combination of deliberate bit flips at the transmitter and inherent communication-noise bit errors. The central claim is Theorem 1: the mechanism satisfies (λ, ε)-Rényi DP when the end-to-end bit error rate p_{t,n} is at least a threshold that depends on a newly introduced 'expected bit-level distance' κ̄_{Δω_max,n}. The paper also provides a convergence analysis (Theorem 2) and experiments on F-MNIST and Fed-CIFAR100 showing that the proposed mechanism outperforms channel-agnostic Gaussian mechanisms.

Significance. If valid, the paper would make a notable contribution by showing that inherent wireless channel noise can be harnessed for DP in digital WFL, and the fixed-point conversion avoiding sign/exponent corruption is a useful engineering idea. The convergence analysis is a value-added component, and the experimental comparison is reasonably thorough. However, the central privacy claim is not established: the proof of Theorem 1 replaces the worst-case sensitivity required by Definition 1 with an expectation over sampled parameter differences, which is a load-bearing error that invalidates the main technical contribution.

major comments (4)
  1. [Section V-B, Theorem 1 and Appendix B] Theorem 1 uses the expected bit-level distance κ̄_{Δω_max,n} (Eq. (15)) as the sensitivity in the Rényi divergence bound, but Definition 1 requires the divergence bound to hold for every pair of adjacent datasets D_n and D'_n. The proof in Appendix B upper-bounds the per-bit divergence by a term linear in q_k and then sums to κ̄; this is an average over model-parameter differences sampled from the sphere ‖x‖_2 = Δω_max (Eq. (16), Sec. VII-A). For a pair of adjacent datasets whose encoded bitstreams differ in the most significant fraction bit, the per-bit contribution is 2^{-1}, which can exceed the reported κ̄ = 0.02 by an order of magnitude. For such a pair, the chosen p_{t,n} from Eq. (38) does not enforce D_λ ≤ ε, so the claimed (λ, ε)-Rényi DP guarantee does not hold for all adjacent datasets.
  2. [Section V-A and Section VII-A] The privacy parameter p_{t,n} in Eq. (38) is a function of κ̄_{Δω_max,n}, which is itself estimated from 10,000 samples of the device's own model parameters (Sec. VII-A, Eq. (26)). This makes the privacy budget data-dependent: the mechanism's claimed ε depends on an empirical estimate of a quantity derived from the very data the mechanism is supposed to protect. A standard (λ, ε)-Rényi DP guarantee under Definition 1 requires the mechanism's parameters to be fixed independent of the dataset, or at least to be a certified upper bound; an empirical average does not satisfy this requirement.
  3. [Appendix B, Inequality (36)] The key inequality (36), which the proof uses to upper-bound the Rényi divergence, is stated to hold under conditions 0 < q_k < 1, 0 < p < 0.5, λ > 1 and is described as 'verified numerically' rather than proved. A numerically verified inequality is not a rigorous proof step, and the theorem's privacy claim depends directly on this inequality. Without a proof (or a counterexample analysis), the derivation of (37) and hence (38) is incomplete.
  4. [Section V-A, Eq. (15)-(16)] The definition of κ̄_{Δω_max,n} relies on a probability q_k that a bit's difference attains its maximum value due to 'inherent randomness' such as dropout and random seeds. However, differential privacy requires a worst-case guarantee over adjacent datasets, not an average over model-training randomness. The 'expected bit-level distance' is therefore not a valid sensitivity: a specific adjacent pair may have a bit-level distance much larger than the expectation, and the Rényi divergence between the mechanism's outputs for that pair can exceed the bound computed from κ̄. Remark 1 even states that using the maximum bit-level distance 'may overestimate the privacy risk,' which inverts the requirement for a DP upper bound: an upper bound must be a worst case, not an average.
minor comments (4)
  1. [Definition 2] The mechanism M_BF in Definition 2 is written as a function of κ̄_{Δω_max,n}, λ, and ε, but the actual operation of the mechanism only depends on u(D) and the bit-flipping probability p. Including κ̄, λ, and ε as arguments is confusing, since they only serve to select p.
  2. [Section V-A, text after Eq. (16)] The sentence 'The nominator on the right-hand side (RHS) of (16) gives the volume of R' should say the denominator gives the volume and the numerator gives the integral of κ over R; the reciprocal of the denominator is the probability density.
  3. [Remark 1] Remark 1's statement that using the maximum bit-level distance 'may overestimate the privacy risk' is at odds with the standard definition of sensitivity, where an upper bound must hold for all adjacent pairs. The manuscript should clarify that for a formal DP guarantee, taking the maximum is the correct conservative choice.
  4. [Section VII-B, default settings] The experiments set the communication BER p_{t,n,C} to be uniformly random in [0, 0.02], but the theoretical analysis assumes a fixed p_{t,n,C} per round. The paper should specify whether the end-to-end BER p_{t,n} is computed from the realized BER or from an average, as this affects the validity of the comparisons.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 1's privacy threshold is solved directly from the empirically fitted expected bit-level distance, so the claimed (λ,ε)-DP guarantee reduces to a data-dependent fit rather than a worst-case sensitivity.

  1. fitted input called prediction [Theorem 1 (Sec. V-B); Eq. (38); Sec. VII-A Eq. (26); Appendix B.]
    "With the expected bit-level distance ¯κ∆ωmax,n defined, applying the proposed bit-flipping mechanism MBF(u(Dn), pt,n) defined in Definition 2 for K communication rounds satisfies (λ, ϵ)-Rényi DP when the end-to-end BER is pt,n ≥ [1 + (((λ−1)ϵ)/(K¯κ∆ωmax,n))^{1/(λ−1)}]^{-1}."

    Privacy threshold in Theorem 1 is obtained by solving κ̄/(λ−1)[((1−p)/p)^{λ−1}−1] ≤ ϵ/K for p (Eq. 38), so the promised ϵ is by construction a function of κ̄. But κ̄ is not a worst-case sensitivity: Eq. (15)-(16) define it as an expectation over the domain R, and Sec. VII-A evaluates it via Eq. (26) by averaging κ(·) over 10,000 samples from the model's own parameter set W and the sphere ∥x∥2=Δωmax. Definition 1 requires the divergence bound for every adjacent pair; an empirical average can be far below a pair differing in a high-weight fraction bit. Remark 1 rejects the maximum ('may overestimate the privacy risk'), confirming the average replaces the required worst case. The claimed DP guarantee therefore reduces to the fitted, data-dependent κ̄.

full rationale

No other circular steps are present. The floating-point-to-fixed-point conversion and the convergence analysis are not circular: Theorem 2 follows from standard FedAvg inequalities plus the bias/variance computations in Lemma 2, and it does not rely on the privacy theorem. The paper's self-citations are not load-bearing. The circularity is confined to the central privacy claim: Theorem 1's (λ,ε)-Rényi DP guarantee is algebraically equivalent to the empirically fitted expected bit-level distance κ̄, and κ̄ is not the worst-case bit-level distance required by Definition 1 over all adjacent datasets. The paper itself states that using the maximum would overestimate privacy risk, which confirms that the average was deliberately substituted for the worst case. As a result, the claimed 'free privacy' guarantee is partially circular: the privacy budget is a function of a fitted, data-dependent quantity rather than an exogenous worst-case sensitivity.

Assumptions & free parameters 4 free parameters · 7 assumptions · 1 invented entities

The central claim depends on a newly invented, empirically fitted sensitivity metric (κ̄) and on several domain assumptions about channel knowledge, public norm bounds, and the threat model. These are not independently verified.

free parameters (4)
  • κ̄_Δωmax,n (expected bit-level distance) = 0.02 (F-MNIST), 0.025 (Fed-CIFAR100)
    Estimated from 10,000 sampled parameter differences (Sec. VII-A). The DP bound in Theorem 1 uses this value directly; underestimation breaks the privacy guarantee.
  • ν∞ (maximum ℓ∞ norm of model parameters) = 0.5 (F-MNIST), 1 (Fed-CIFAR100)
    Measured from pre-trained models (Sec. VII-B1). It sets the fixed-point conversion constant and the range of transmitted fraction bits.
  • ν2 (maximum ℓ2 norm of model parameters) = 16 (F-MNIST), 128 (Fed-CIFAR100)
    Measured from pre-trained models; enters the convergence bound (22).
  • G (gradient clipping threshold) = 1 by default (median of unclipped gradient norms)
    Used to compute sensitivity Δω_max = 2ηG/|D_n| and the norm bounds; set empirically per Sec. VI Remark 5.
assumptions (7)
  • standard math Standard properties of Rényi divergence and composition over independent bits are used to decompose the divergence of the whole bitstream into per-bit terms (Eq. (29)).
    Invoked in Appendix B; this is standard information-theoretic background.
  • domain assumption The threat model is an honest-but-curious server that can see or infer local models, with no encryption or with encryption whose bit-error propagation is modeled (Sec. III-B, Remark 3).
    The privacy claim only holds under this threat model; if the server is malicious or encryption hides bit errors, the analysis changes.
  • domain assumption Clients know the channel BER p_{t,n,C} from channel reciprocity or prior knowledge (Sec. IV-B2).
    The artificial flip probability p_{t,n,A} is computed from p_{t,n,C}; unknown channel BER makes the mechanism impossible to calibrate.
  • ad hoc to paper The expected bit-level distance κ̄, estimated from samples, can serve as the sensitivity bound for DP (Eq. (15)-(16), Sec. VII-A).
    This is the load-bearing assumption. DP requires a supremum over adjacent datasets; κ̄ is an average over a sampled sphere, so it is not a valid worst-case sensitivity.
  • ad hoc to paper Inequality (36) holds for 0<p<0.5, λ>1, 0<q_k<1, verified numerically rather than proved.
    Stated in Appendix B after Eq. (36); no analytical proof is given.
  • domain assumption After gradient clipping, all model parameters are bounded in [-ν∞, ν∞], and ν∞ is publicly shared without leaking private information (Sec. IV-A).
    The fixed-point conversion and the common exponent reconstruction rely on this public bound.
  • standard math Assumption 1 from [41]: µ-strong convexity, α-smoothness, and zero stochastic gradient variance (full-batch) for convergence.
    Used in Theorem 2; standard FL convergence assumptions, but σ_n=0 is only valid for full-batch, while experiments use SGD.
invented entities (1)
  • Expected bit-level distance κ̄_Δωmax,n
    purpose: Serves as the sensitivity metric in the Rényi DP bound (Theorem 1).
    A new metric defined in Eq. (15)-(16) and estimated empirically; no external evidence shows it upper-bounds worst-case leakage, so the entire privacy guarantee rests on this unverified construct.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Free Privacy Protection for Wireless Federated Learning: Enjoy It or Suffer from It?." pith.science (2026). https://pith.science/paper/3A3BFARB

@misc{pith2026250612749,
  author       = {Pith},
  title        = {Pith review of: Free Privacy Protection for Wireless Federated Learning: Enjoy It or Suffer from It?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3A3BFARB}},
  note         = {Machine review of arXiv:2506.12749}
}
read the original abstract

Inherent communication noises have the potential to preserve privacy for wireless federated learning (WFL) but have been overlooked in digital communication systems predominantly using floating-point number standards, e.g., IEEE 754, for data storage and transmission. This is due to the potentially catastrophic consequences of bit errors in floating-point numbers, e.g., on the sign or exponent bits. This paper presents a novel channel-native bit-flipping differential privacy (DP) mechanism tailored for WFL, where transmit bits are randomly flipped and communication noises are leveraged, to collectively preserve the privacy of WFL in digital communication systems. The key idea is to interpret the bit perturbation at the transmitter and bit errors caused by communication noises as a bit-flipping DP process. This is achieved by designing a new floating-point-to-fixed-point conversion method that only transmits the bits in the fraction part of model parameters, hence eliminating the need for transmitting the sign and exponent bits and preventing the catastrophic consequence of bit errors. We analyze a new metric to measure the bit-level distance of the model parameters and prove that the proposed mechanism satisfies (\lambda,\epsilon)-R\'enyi DP and does not violate the WFL convergence. Experiments validate privacy and convergence analysis of the proposed mechanism and demonstrate its superiority to the state-of-the-art Gaussian mechanisms that are channel-agnostic and add Gaussian noise for privacy protection.

Figures

Figures reproduced from arXiv: 2506.12749 by the authors.

Figure 1
Figure 1. The workflows of the local model transmission of device [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. An illustration of the model parameters ωt,n(Dn), ωt,n(D ′ n), and x. The blue sphere denotes the domain of the model parameters ωt,n(Dn). The red sphere denotes the domain of x. 2) Evaluation of κ¯∆ωmax,n : To evaluate κ¯∆ωmax,n , we define x ∈ RM×1 with x = ωt,n(Dn)−ωt,n(D′ n ). Let xm de￾note the m-th element of x. Hence, ∥x∥2 = qPM m=1 |xm| 2 = ∆ωmax,n. By definition, κ¯∆ωmax,n can be written as κ¯∆ωmax,n= R · ·… view at source ↗
Figure 3
Figure 3. evaluates the impacts of the model size M and the classical sensitivity ∆ωmax on the estimated expected bit￾level distance κ¯∆ωmax . In general, κ¯∆ωmax grows with M and ∆ωmax, while exhibiting some fluctuations. This is because, given ∆ωmax, enlarging M increases the ℓ1-norms of the distances between bitstreams. Then, κ¯∆ωmax also increases, since κ¯∆ωmax is no smaller than the expectation of the ℓ1- norms; see Rem… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of the proposed channel-native mechanism with [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 7
Figure 7. Figure 7: Accuracy of ResNet18 model on Fed-CIFAR100 dataset [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: The statistical properties of perturbed values [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 40 canonical work pages

  1. [1]

    Pile: Robust privacy-preserving federated learning via verifiable perturbations,

    X. Tanget al., “Pile: Robust privacy-preserving federated learning via verifiable perturbations,”IEEE Trans. Dependable Secure Comput., pp. 1–18, 2023

    work page 2023

  2. [2]

    A differentially private federated learning model against poisoning attacks in edge computing,

    J. Zhouet al., “A differentially private federated learning model against poisoning attacks in edge computing,”IEEE Trans. Dependable Secure Comput., vol. 20, no. 3, pp. 1941–1958, 2023

    work page 1941

  3. [3]

    Private empirical risk minimiza- tion: Efficient algorithms and tight error bounds,

    R. Bassily, A. Smith, and A. Thakurta, “Private empirical risk minimiza- tion: Efficient algorithms and tight error bounds,” inProc. 55th Annual Symposium on Foundations of Computer Science, 2014, pp. 464–473

    work page 2014

  4. [4]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellowet al., “Deep learning with differential privacy,” inProc. ACM Conf. Comput. Commun. Secur., New York, USA, 2016, p. 308–318

    work page 2016

  5. [5]

    Xception: Deep learning with depthwise separable convo- lutions,

    F. Chollet, “Xception: Deep learning with depthwise separable convo- lutions,” inProc. IEEE Conf. Comput. Vis. Pattern Recognit., 2017, pp. 1251–1258

    work page 2017

  6. [6]

    Information-theoretic bounds for differentially private mechanisms,

    G. Barthe and B. Kopf, “Information-theoretic bounds for differentially private mechanisms,” inProc. IEEE 24th Comput. Secur. Foundations Symp. (CSF), 2011, pp. 191–204

    work page 2011

  7. [7]

    Differentially private mixture of generative neural networks,

    G. Acs, L. Melis, C. Castelluccia, and E. De Cristofaro, “Differentially private mixture of generative neural networks,”IEEE Trans. Knowl. Data Eng., vol. 31, no. 6, pp. 1109–1121, 2018. 15

    work page 2018

  8. [8]

    Rényi differential privacy,

    I. Mironov, “Rényi differential privacy,” inProc. IEEE 30th Comput. Secur. Foundations Symp. (CSF), Aug. 2017

    work page 2017

Show all 44 references
  1. [9]

    Differentially private data publishing and analysis: A survey,

    T. Zhu, G. Li, W. Zhou, and S. Y . Philip, “Differentially private data publishing and analysis: A survey,”IEEE Trans. Knowl. Data Eng., vol. 29, no. 8, pp. 1619–1638, 2017

    2017

  2. [10]

    On the practicality of differential privacy in federated learning by tuning iteration times,

    Y . Fuet al., “On the practicality of differential privacy in federated learning by tuning iteration times,”arXiv preprintarXiv:2101.04163, 2021

    2021 arXiv

  3. [11]

    Privacy-preserving and byzantine-robust federated learning,

    C. Donget al., “Privacy-preserving and byzantine-robust federated learning,”IEEE Trans. Dependable Secure Comput., pp. 1–16, 2023

    2023

  4. [12]

    Local differential privacy based federated learning for internet of things,

    Y . Zhaoet al., “Local differential privacy based federated learning for internet of things,”IEEE Internet Things J., pp. 1–1, 2020

    2020

  5. [13]

    Privacy for free: Wireless federated learning via uncoded transmission with adaptive power control,

    D. Liu and O. Simeone, “Privacy for free: Wireless federated learning via uncoded transmission with adaptive power control,”IEEE J. Sel. Areas Commun., vol. 39, no. 1, pp. 170–185, 2021

    2021

  6. [14]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Weiet al., “Federated learning with differential privacy: Algorithms and performance analysis,”IEEE Trans. Inf. Forensics Secur., vol. 15, pp. 3454–3469, 2020

    2020

  7. [15]

    Amplitude-varying perturbation for balancing privacy and utility in federated learning,

    X. Yuan, W. Ni, M. Dinget al., “Amplitude-varying perturbation for balancing privacy and utility in federated learning,”IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 1884–1897, 2023

    2023

  8. [16]

    Nyquist noise in a fractal resistor network,

    A. Hansen and M. Nelkin, “Nyquist noise in a fractal resistor network,” Physical Review B, vol. 33, no. 1, p. 649, 1986

    1986

  9. [17]

    Communication and energy efficient wireless feder- ated learning with intrinsic privacy,

    Z. Zhanget al., “Communication and energy efficient wireless feder- ated learning with intrinsic privacy,”IEEE Trans. Dependable Secure Comput., vol. 21, no. 4, pp. 4035–4047, 2024

    2024

  10. [18]

    Federated learning in unreliable and resource-constrained cellular wireless networks,

    M. Salehi and E. Hossain, “Federated learning in unreliable and resource-constrained cellular wireless networks,”IEEE Trans. Commun., vol. 69, no. 8, pp. 5136–5151, Aug. 2021

    2021

  11. [19]

    Decentralized wireless federated learning with differential privacy,

    S. Chen, D. Yuet al., “Decentralized wireless federated learning with differential privacy,”IEEE Trans. Industrial Informatics, vol. 18, no. 9, pp. 6273–6282, 2022

    2022

  12. [20]

    Bit-aware randomized response for local differential privacy in federated learning,

    P. Lai, H. Phan, L. Xiong, K. Tran, M. Thai, T. Sun, F. Dernoncourt, J. Gu, N. Barmpalios, and R. Jain, “Bit-aware randomized response for local differential privacy in federated learning,” 2022. [21]IEEE Standard for Floating-Point Arithmetic, 2019

    2022

  13. [22]

    Model compression for communication efficient federated learning,

    S. M. Shah and V . K. N. Lau, “Model compression for communication efficient federated learning,”IEEE Trans. Neural Netw. Learn. Syst., vol. 34, no. 9, pp. 5937–5951, 2023

    2023

  14. [23]

    Hierarchical federated learning with quantization: Convergence analysis and system design,

    L. Liu, J. Zhang, S. Song, and K. B. Letaief, “Hierarchical federated learning with quantization: Convergence analysis and system design,” IEEE Trans. Wireless Commun., vol. 22, no. 1, pp. 2–18, 2023

    2023

  15. [24]

    On model transmission strategies in federated learning with lossy communications,

    X. Su, Y . Zhou, L. Cuiet al., “On model transmission strategies in federated learning with lossy communications,”IEEE Trans. Parallel Distrib. Syst., vol. 34, no. 4, pp. 1173–1185, Apr. 2023

    2023

  16. [25]

    On analog gradient descent learning over multiple access fading channels,

    T. Sery and K. Cohen, “On analog gradient descent learning over multiple access fading channels,”IEEE Trans. Signal Process., vol. 68, pp. 2897–2911, 2020

    2020

  17. [26]

    Optimal adaptive power control for over-the-air federated edge learning under fading channels,

    X. Yu, B. Xiao, W. Ni, and X. Wang, “Optimal adaptive power control for over-the-air federated edge learning under fading channels,”IEEE Trans. Commun., vol. 71, no. 9, pp. 5199–5213, 2023

    2023

  18. [27]

    Imperfect csi: A key factor of uncertainty to over-the-air federated learning,

    J. Yao, Z. Yang, W. Xu, D. Niyato, and X. You, “Imperfect csi: A key factor of uncertainty to over-the-air federated learning,”IEEE Wireless Commun. Lett., vol. 12, no. 12, pp. 2273–2277, 2023

    2023

  19. [28]

    Joint privacy enhancement and quantization in federated learning,

    N. Langet al., “Joint privacy enhancement and quantization in federated learning,”IEEE Trans. Signal Process., vol. 71, pp. 295–310, 2023

    2023

  20. [29]

    Revisiting gradient clipping: Stochastic bias and tight convergence guarantees,

    A. Koloskovaet al., “Revisiting gradient clipping: Stochastic bias and tight convergence guarantees,” inProc. 40th Int. Conf. Machine Learning, vol. 202, 23–29 Jul 2023, pp. 17 343–17 363

    2023

  21. [30]

    On defensive neural networks against inference attack in federated learning,

    H. Leeet al., “On defensive neural networks against inference attack in federated learning,” inProc. IEEE Int. Conf. Commun. (ICC), Montreal, QC, Canada, 2021, pp. 1–6

    2021

  22. [31]

    A survey on advanced encryption standard,

    S. K. Raoet al., “A survey on advanced encryption standard,”Int. J. Science and Research, vol. 6, no. 1, pp. 711–724, 2017

    2017

  23. [32]

    A comparative survey on data encryption techniques: Big data perspective,

    P. Mattaet al., “A comparative survey on data encryption techniques: Big data perspective,” inProc. ICAMM, vol. 46, 2021, pp. 11 035–11 039

    2021

  24. [33]

    A survey on homomorphic encryption schemes: Theory and implementation,

    A. Acaret al., “A survey on homomorphic encryption schemes: Theory and implementation,”ACM Computing Surveys (Csur), vol. 51, no. 4, pp. 1–35, 2018

    2018

  25. [34]

    Simon and M

    M. Simon and M. Alouini,Digital Communication over Fading Channels, ser. Wiley Series in Telecommunications and Signal Processing. Wiley, 2005. [Online]. Available: https://books.google.com.au/books?id=OYrDN0Q6BacC

    2005

  26. [35]

    Goldsmith,Wireless Communications

    A. Goldsmith,Wireless Communications. Cambridge University Press, 2005

    2005

  27. [36]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Rothet al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

    2014

  28. [37]

    Rényi differential privacy of the sampled gaussian mechanism,

    I. Mironov, K. Talwar, and L. Zhang, “Rényi differential privacy of the sampled gaussian mechanism,”CoRR, vol. abs/1908.10530, 2019. [Online]. Available: http://arxiv.org/abs/1908.10530

    1908 arXiv

  29. [38]

    Distributed machine learning in coalition environments: Overview of techniques,

    T. Tuoret al., “Distributed machine learning in coalition environments: Overview of techniques,” inProc. Int. Conf. Info. Fusion (FUSION), July 2018, pp. 814–821

    2018

  30. [39]

    Decentralized federated learning over imperfect communication channels,

    W. Li, T. Lv, W. Niet al., “Decentralized federated learning over imperfect communication channels,”IEEE Trans. Commun., vol. 72, no. 11, pp. 6973–6991, 2024

    2024

  31. [40]

    Local SGD converges fast and communicates little,

    S. U. Stich, “Local SGD converges fast and communicates little,” in International Conference on Learning Representations, 2019

    2019

  32. [41]

    On the convergence of fedavg on Non-IID data,

    X. Li, K. Huang, W. Yanget al., “On the convergence of fedavg on Non-IID data,” inProc. ICLR, 2020

    2020

  33. [42]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Renet al., “Deep residual learning for image recognition,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Las Vegas, US, June 2016

    2016

  34. [43]

    The discrete gaussian for differential privacy,

    C. L. Canonne, G. Kamath, and T. Steinke, “The discrete gaussian for differential privacy,”arXiv preprint arXiv:2004.00010, 2021. Weicai Li(Graduate Student Member, IEEE) re- ceived the B.E. degree in communication engineer- ing from Beijing University of Posts and Telecom- mu...

    2004 arXiv

  35. [2019]

    Wei Niis a Mechatronics Program Advisor and Professor (Honorary) at Macquarie University, Syd- ney, New South Wales, Australia

    Her research interests include wireless fed- erated learning, distributed computing, and privacy- preserving. Wei Niis a Mechatronics Program Advisor and Professor (Honorary) at Macquarie University, Syd- ney, New South Wales, Australia. His research in- terests include channe...

  36. [2020]

    with the School of Information and Communication Engineering at BUPT

    She is pursuing her Ph.D. with the School of Information and Communication Engineering at BUPT. From June 2023 to December 2024, she was a Visiting Scholar at Macquarie University. Her re- search interests include wireless federated learning, distributed computing, and privacy...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.