PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction

James Joshi; Peilin He

REVIEW 4 major objections 6 minor 84 references

PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a federated, privacy-preserving variant of the Residual Dense Spatial Network reconstructs encrypted lossy images with quality matching centralized training, by noising only high-frequency DCT coefficients and…

desk verdict The privacy guarantee is mathematically invalid because Eq. (2) releases the exact low-frequency DCT part; the rest is an incremental FL-plus-watermark system. read the letter →

arxiv 2507.00230 v3 pith:TK4FANCQ submitted 2025-06-30 cs.LG cs.CR

Peilin He , James Joshi This is my paper

classification cs.LGcs.CR

keywords federatedlearninglocaldifferentialprivacyencryptedlossyimagereconstructionresidualdensespatialnetworkmodelwatermarkingDCT-domainnoisesuper-resolutionintegrity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Image super-resolution is usually trained on one centralized dataset, which is risky when the images are sensitive. This paper proposes a federated-learning alternative in which each client trains a Residual Dense Spatial Network locally and only shares noisy model activations with the server, so raw images never leave the device. The key privacy trick is to transform activations with a 2D discrete cosine transform, add calibrated Gaussian noise only to the high-frequency coefficients, and leave the low-frequency structure intact; the paper claims this delivers formal local differential privacy at a privacy budget around $\epsilon=2.75$ with PSNR drops under 0.4 dB on standard benchmarks. A coordinated sparse watermark, embedded by all clients into an identical pseudorandomly chosen set of parameters, is meant to prove that the aggregated model has not been tampered with. If these claims hold, the framework would give telemedicine, remote sensing, and cloud photo services a practical way to reconstruct encrypted compressed images collaboratively without trusting a central data host.

What carries the argument

The central object is the DCT-domain activation perturbation: for a hidden activation $H$, the client computes $C = T H T^{\top}$, partitions the spectrum by a fixed threshold $\tau$ into low-frequency (structure) and high-frequency (detail) sets, clips $H$ by L2 norm $C_{\mathrm{max}}$, adds Gaussian noise of scale $\sigma = \frac{2C_{\mathrm{max}}\sqrt{2\ln(1.25/\delta)}}{\epsilon}$ to the high-frequency coefficients, and reconstructs the noisy activation as $\tilde{H}=H_L + T^{\top}\operatorname{reshape}(\tilde{f})T$. The orthonormality of $T$ is what makes the L2 sensitivity invariant across the transform, so the Gaussian mechanism's guarantee transfers to the DCT domain. The watermark machinery is a secret-keyed PRF that selects a sparse carrier set $J$ and sign pattern $w$, with a quadratic regularization loss $\frac{\lambda}{|J|}\sum_{j\in J}(\theta_j w_j - \beta)^2$, yielding a test statistic $S = \frac{1}{|J|}\sum_{j\in J}\theta_j w_j$ whose concentration separates watermarked from unmarked models.

What would settle it

Compute or measure the actual sensitivity of the full released activation $\tilde{H}$ with respect to a single training sample, not just the high-frequency projection; or run a membership-inference attack using $H_L$ alone at $\epsilon=2.75$, $\delta=10^{-5}$. If the attack achieves non-trivial advantage, or the true sensitivity exceeds $2C_{\mathrm{max}}$, the mechanism is not $(\epsilon,\delta)$-DP as claimed.

Watch

Extended reading notes

Core claim

The paper's central claim is that privacy and integrity can be added to learned lossy-image reconstruction without sacrificing quality, by shifting the problem from protecting whole models to protecting a carefully chosen slice of the computation. For a hidden activation $H$, the client clips it to L2 norm $C_{\mathrm{max}}$, applies an orthonormal 2D DCT, splits the spectrum at a fixed frequency threshold $\tau$, adds Gaussian noise of standard deviation $\sigma = \frac{2C_{\mathrm{max}}\sqrt{2\ln(1.25/\delta)}}{\epsilon}$ to the high-frequency coefficients, and reconstructs the noisy activation $\tilde{H}=H_L + T^{\top}\operatorname{reshape}(\tilde{f})T$ for the remaining forward and backward passes. Because the DCT is an isometry, the paper argues the L2 sensitivity of the noised projection is exactly $2C_{\mathrm{max}}$, so the Gaussian mechanism yields per-round $(\epsilon,\delta)$-local differential privacy, with rounds composed through the moments accountant. In parallel, a secret-keyed PRF picks an identical sparse carrier set $J$ in every client; the clients nudge those coordinates toward a shared secret sign pattern, and the aligned perturbations accumulate in FedAvg so the aggregate score $S = \frac{1}{|J|}\sum_{j\in J} \theta_j w_j$ separates watermarked from unmarked models with the reported probabilities. Empirically, the framework reports PSNR/SSIM statistically indistinguishable from the centralized RDSN and a 6.56% wall-clock saving.

Load-bearing premise

The formal privacy guarantee assumes that releasing the un-noised low-frequency activation $H_L$ leaks nothing about the input; if an adversary can infer private content from those low-frequency coefficients, the claimed $(\epsilon,\delta)$-local differential privacy does not hold.

Editorial extensions

If this is right

With the reported privacy budget $\epsilon=2.75$, reconstruction quality on Set5, Set14, BSDS100, and Urban100 stays within about 0.4 dB PSNR of the un-noised federated model across scaling factors 2, 3, and 4.
Training time drops from 82,800 to 77,368 seconds (about 6.56%) while adding local differential privacy and watermark verification, so the privacy protections are not bought with extra epochs.
A coordinated watermark with $|J|\geq 500$ and per-client SNR $\ll 1$ should survive aggregation, with false-positive probability below $10^{-6}$ and missed-detection below $10^{-3}$, letting any key-holder verify the global model before use.
The multi-party EtLC layer means a client can act as sender or receiver of encrypted, compressed, low-resolution images and reconstruct them with the verified global model, extending the two-party EtLC paradigm.
Scaling the client pool from 5 to 15 clients degrades PSNR/SSIM only marginally under DP, suggesting the framework's cost grows sublinearly with federation size.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the privacy proof bounds only the high-frequency projection and leaves $H_L$ exactly intact, a natural next experiment is measuring how much training-data information survives in $H_L$ alone (e.g., via reconstruction or membership-inference probes); quantifying that leakage would reveal the gap between the formal and practical guarantees.
The frequency-splitting trick is architecture-agnostic and could be transferred to other learned reconstruction networks (MRI, remote sensing, video) where high frequencies are perceptually secondary; the same $\tau$, $C_{\mathrm{max}}$ calibration would need retuning per task.
The watermark's secrecy rests entirely on the shared PRF key $mk$; an obvious extension is a hierarchical or threshold key-sharing scheme so that no single compromised client can forge or erase the global watermark.
For heterogeneous clients with very different local data distributions, the fixed $\tau$ and $C_{\mathrm{max}}$ may not be optimal; an adaptive, privacy-budgeted allocation of noise across frequency bands could extend the quality-privacy plateau beyond $\epsilon=2.75$.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First, the thing to know: PPFL-RDSN's central DP claim collapses on inspection. In Section III-B, Step 9, the client sends eH = H_L + T^T(reshape(f~))T. H_L is the exact, deterministic low-frequency DCT component of the clipped activation. The Gaussian noise in Step 4 only perturbs the high-frequency part f(X). For two neighboring inputs whose activations differ only in the low-frequency DCT subspace, H_L differs while the noised high-frequency part has the same distribution. An adversary who sees eH can read the exact low-frequency coefficients and distinguish the two inputs with probability 1. That violates (ε,δ)-DP for any finite ε with δ<1. The sensitivity bound on f(X) doesn't help because it doesn't bound H_L. This is not a tuning issue; it's a structural gap in the proof.

What is new: the concrete combination—federated training of an RDSN, frequency-domain Gaussian LDP, and a coordinated sparse PRF-keyed watermark—is a reasonable engineering idea, and the paper is clear about the pipeline. The reconstruction numbers in Tables I and II suggest FL-RDSN roughly matches the centralized RDSN, and the watermarking ablation shows negligible utility loss. The threat model section is unusually explicit about what it does and doesn't defend against.

Soft spots beyond the fatal DP flaw: the privacy budget ε=2.75 is chosen after sweeping ε on the test benchmarks and picking the plateau, so the reported DP-utility tradeoff is a fit, not a prediction. The efficiency claim compares 10 client L40 GPUs against 2 L40 GPUs for the baseline, so the 6.56% training-time improvement is not apples-to-apples. The watermarking robustness section reports PSNR differences but never gives watermark detection rates for pruning/fine-tuning/noise, so the "robustness" claim is unsupported by the presented evidence. No code or data is released. The limitation paragraph is honest about scope but doesn't flag the exact-H_L privacy leak.

Who this is for: readers working on federated image reconstruction might take the watermark coordination trick as a starting point. As a privacy-preserving method with a formal guarantee, it does not hold up. I would reject it; the invalid DP core is load-bearing, and the remaining contributions are modest. Send it back only if the authors replace the exact low-frequency release with a genuinely private mechanism and rework the comparisons.

Referee Report

4 major / 6 minor

Summary. The paper proposes PPFL-RDSN, a federated learning framework for super-resolution reconstruction of encrypted or lossy images. It combines FedAvg with a local differential privacy mechanism that adds Gaussian noise to high-frequency DCT coefficients of client activations (Section III-B), together with a coordinated sparse watermarking scheme for model integrity (Section III-C). The authors report PSNR/SSIM results close to those of the centralized baseline, claim a wall-clock training improvement of about 6.56%, and argue that the method provides formal (epsilon,delta)-LDP guarantees and watermark-based protection against model substitution. The manuscript also extends the encryption-then-lossy-compression paradigm to a multi-party setting and includes an explicit threat model and a Limitations paragraph.

Significance. If the privacy and efficiency claims were valid, the framework would be a useful contribution to privacy-preserving federated image reconstruction, combining FL, frequency-domain local differential privacy, and watermarking in one pipeline. The paper has some strengths: it states a clear threat model, explicitly disclaims defenses against poisoning and backdoor attacks, provides pseudocode for the client update and watermarking algorithms, and includes an honest Limitations section. However, the central technical claim is not sound: the released activation includes exact low-frequency DCT coefficients that are not covered by the DP proof, so the mechanism does not satisfy (epsilon,delta)-DP for any finite epsilon with delta < 1. In addition, the reported utility result is obtained by sweeping the privacy budget on the test benchmarks, and the efficiency comparison uses different amounts of hardware for the two systems. No code, machine-checked proofs, or falsifiable predictions are provided. Because the main advertised contribution is the privacy guarantee, the paper does not currently meet the bar for acceptance in a serious journal.

major comments (4)

[Section III-B, Steps 3–9 and Eq. (2)] The DP claim is invalid. The Gaussian mechanism is applied only to f(X)=vec(T Ĥ Tᵀ)_{S_H}, with claimed sensitivity 2C_max, but the released activation is eH = H_L + Tᵀ(reshape(ef))T, where H_L = Tᵀ C_L T is an exact, data-dependent function of the clipped activation. For neighboring inputs whose activations differ only in the low-frequency DCT subspace (for example, a global brightness shift), the low-frequency parts differ deterministically while the noised high-frequency part can be identical. The event S = {y : y_L = H_L(X)} then has probability 1 under X and probability 0 under X′, so the (ε,δ)-DP inequality forces δ ≥ 1 for every finite ε, regardless of the noise scale σ. Consequently, the gradient updates sent to the server are not protected, and the claim in Section III-A that the mechanism “satisfies local (ε, δ)-differential privacy” is unsupported. This is a load-bearing structural gap, not a tuning issue.
[Section IV-C, Table II and Figure 2] The privacy budget ε=2.75 is selected by sweeping ε∈[0.25,4] on the test benchmarks and choosing the plateau visible in the PSNR/SSIM curves of Figure 2; Table II then reports performance only at this selected value. This makes the headline “negligible quality loss at ε=2.75” result a test-set fit rather than a predictive evaluation. The paper should reserve a validation split for hyperparameter selection and report the utility of the final model on a genuinely held-out test set; without this, the claimed utility–privacy trade-off is not established.
[Section IV-A, Baseline timing] The wall-clock comparison is not apples-to-apples. The centralized baseline was re-run on two NVIDIA L40 GPUs (82,800 s), while the PPFL-RDSN simulation allocates 10 clients, with each client bound to its own NVIDIA L40 GPU (10 GPUs in total). Reporting a saving from 82,800 s to 77,368 s therefore does not account for the fivefold increase in GPU resources; the total GPU-hours consumed are substantially larger for PPFL-RDSN. The claim of “reducing computational burdens” and the “improving training efficiency by approximately 6.56%” statement in the introduction are not supported by this comparison.
[Section III-C, Statistical verification] The watermark detection analysis is not supported. The Hoeffding bound requires that X_j = θ_j w_j are independent, zero-mean, and bounded by σ under the null hypothesis, but none of these conditions is established for trained neural-network weights: after training, the θ_j are strongly dependent, and the value of σ is never defined. The parameters δ=β/2, λ≪β, and |J|≥500 are then inserted into the formula to obtain the stated rates Pr_H0[S>β/2]<10^{-6} and Pr_H1[S≤β/2]<10^{-3}, so these rates are consequences of unverified assumptions rather than measured or proven properties of the actual model distribution. The paper should either justify the independence and boundedness assumptions (empirically or analytically) or replace the exact tail bounds with empirical false-positive and false-negative rates.

minor comments (6)

[Figures 3 and 4 captions] The caption of Figure 3 says “Effect of privacy budgets” although the figure varies the number of clients, and Figure 4’s caption is similarly imprecise; both captions should be corrected.
[Figures 2–4, text body] Several figure captions and axis labels contain rendering artifacts such as “PS/glyph1197R” and “E psilon” instead of PSNR and Epsilon; these should be fixed before resubmission.
[Section II-A] The formulas for the residual path and dense connectivity contain unfinished notation, including a “??” placeholder and undefined subscripts in y_l = H_l([x0, x1, ..., x_{l−1}]); these equations should be cleaned up and defined precisely.
[Section III-B and IV-A] The statement that “Opacus is modified to provide record-level DP” is not accompanied by any description of the modification, making the privacy accounting non-reproducible; the modifications should be specified or the dependency stated exactly.
[Sections I, III-A, and V] The manuscript is internally inconsistent about the threat of model poisoning: the introduction and conclusion mention protection against “model poisoning” while Section III-A explicitly states that the design does not defend against poisoning and backdoor attacks. These claims should be aligned.
[Section III-C] The symbol λ is overloaded: it denotes the watermark regularization weight in the objective and Algorithm 2, but in the statistical verification analysis it is also used as an upper bound on adversarial bias. These two uses should be assigned distinct symbols.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported reconstruction quality is an empirical benchmark result, and neither the watermark detection bounds nor the LDP accuracy claims reduce by construction to their own inputs.

full rationale

The paper's central claims are empirical and architectural rather than derived from a self-referential chain. The reconstruction-quality results at epsilon = 2.75 are obtained by sweeping the privacy budget on the evaluation benchmarks and selecting a plateau; this is test-set hyperparameter tuning, not a fitted parameter renamed as a prediction, and the paper does not claim to predict the accuracy from first principles. The watermark verification statistic S is a direct functional of the training objective that embeds the watermark, so detecting the embedded watermark is a definitional property of the scheme rather than a circular derivation; the Hoeffding bounds and threshold choices are standard concentration arguments, not reductions of the conclusion to the hypothesis. The LDP proof in Section III-B is mathematically unsound because Eq. (2) releases the exact low-frequency component H_L alongside the noised high-frequency part, so the released activation cannot satisfy the claimed differential privacy guarantee; however, this is a correctness and formal-verification gap, not a circularity. There are no load-bearing self-citations, no imported uniqueness theorems from the authors' prior work, and no ansatz smuggled in via citation. The Limitations section explicitly notes adaptive frequency protection, richer collusion models, and Byzantine-robust aggregation as extensions, which is consistent with an honest empirical proposal. Consequently, no step of the paper's derivation is equivalent to its own inputs by construction.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The paper introduces no new physical entities. The free parameters are the privacy and watermark hyperparameters, several of which are tuned on evaluation data. The central privacy claim rests on a flawed assumption about which components of the released activation are noised.

free parameters (7)

Cmax (L2 clipping bound) = not specified in text
Clipping norm for activations; determines sensitivity Δ2f = 2Cmax in Eq. (1). Chosen by hand without sensitivity analysis.
τ (frequency partition threshold) = τ = 8 (example)
Separates low- and high-frequency DCT coefficients; only high-frequency coefficients receive noise. A fixed threshold is a design choice that controls the privacy/utility trade-off.
ε (privacy budget) = 2.75
Selected by sweeping ε in [0.25,4] and choosing the value with the best PSNR plateau on the test benchmarks (Section IV-C). This is tuning the privacy parameter to the evaluation data.
λ (watermark regularization weight) = 1e-4
Weight of the watermark loss; tuned so that validation accuracy drop stays below 0.1% (Section III-C).
β (watermark target strength) = not specified
Target correlation for watermarked coordinates; chosen to satisfy detection thresholds in Algorithm 2, but concrete value not reported.
p (watermark sparsity) = 10^-4 to 10^-2
Fraction of coordinates selected for the carrier set J; sets the trade-off between detectability and stealth.
Local epochs per round = 47 (as converged)
Reported as the point at which PPFL-RDSN 'converges'; used in the wall-clock comparison against a 1000-epoch centralized baseline.

assumptions (6)

standard math The 2-D DCT matrix T is orthonormal, making the transform an isometry for Frobenius and L2 norms.
Used in Section III-B to argue that clipping in the spatial domain bounds sensitivity in the DCT domain.
standard math The Gaussian mechanism and post-processing properties of differential privacy hold as stated in Dwork and Roth.
Invoked in Section III-B to calibrate noise and claim DP for the released projection.
ad hoc to paper The released activation eH = H_L + T^T(noise)T with exact low-frequency part H_L is covered by the DP guarantee derived for the high-frequency projection f(X) only.
This is the flawed assumption that breaks the privacy claim; the released output includes unnoised, input-sensitive low-frequency coefficients.
ad hoc to paper In the watermark analysis, the products X_j = θ_j w_j are independent, zero-mean, and bounded by σ under the null hypothesis.
Used in Section III-C to apply Hoeffding's inequality; no justification is given for zero-mean or the specific bound σ, and σ is not defined.
domain assumption The shared PRF key mk remains secret from the untrusted aggregator and all adversaries.
Required for the coordinated watermark to be hidden and unforgeable; collusion between server and any client would leak the key.
domain assumption All clients have synchronized, mutually authenticated key exchange for the EtLC module.
The Local EtLC subsystem assumes pre-established shared secret keys and uses HPKE/MLS/X3DH for key management, which are standard but not evaluated.

how reviews work

0 comments

Cite this review

Pith. "Pith review of PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction." pith.science (2026). https://pith.science/paper/TK4FANCQ

@misc{pith2026250700230,
  author       = {Pith},
  title        = {Pith review of: PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TK4FANCQ}},
  note         = {Machine review of arXiv:2507.00230}
}

read the original abstract

Reconstructing high-quality images from low-resolution inputs using Residual Dense Spatial Networks (RDSNs) is crucial yet challenging. It is even more challenging in centralized training where multiple collaborating parties are involved, as it poses significant privacy risks, including data leakage and inference attacks, as well as high computational and communication costs. We propose a novel Privacy-Preserving Federated Learning-based RDSN (PPFL-RDSN) framework specifically tailored for encrypted lossy image reconstruction. PPFL-RDSN integrates Federated Learning (FL), local differential privacy, and robust model watermarking techniques to ensure that data remains secure on local clients/devices, safeguards privacy-sensitive information, and maintains model authenticity without revealing underlying data. Empirical evaluations show that PPFL-RDSN achieves comparable performance to the state-of-the-art centralized methods while reducing computational burdens, and effectively mitigates security and privacy vulnerabilities, making it a practical solution for secure and privacy-preserving collaborative computer vision applications.

Figures

Figures reproduced from arXiv: 2507.00230 by the authors.

**Figure 1.** An Overview of the PPFL-RDSN Framework enhancement while maintaining data privacy and integrity throughout the federated learning process. A. Threat Modeling and Mitigation We analyze three classes of adversaries: 1) a honest-butcurious aggregator, 2) honest-but-curious clients (who may collude for inference while still following the protocol), and 3) a passive network eavesdropper. We focus the threat model on att… view at source ↗

**Figure 3.** Effect of privacy budgets on the overall PSNR and SSIM for different ϵ values. [2] Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Deep convolutional autoencoder-based lossy image compression,” in 2018 Picture Coding Symposium (PCS). IEEE, 2018, pp. 253–257. [3] M. Akc¸akaya, B. Yaman, H. Chung, and J. C. Ye, “Unsupervised deep learning methods for biological image reconstruction and enhancement: An overview from a si… view at source ↗

**Figure 4.** Effect of the number of epochs on the overall PSNR and SSIM for different ϵ values. [9] C. Dwork, “Differential privacy,” in International colloquium on automata, languages, and programming. Springer, 2006, pp. 1–12. [10] ——, “Differential privacy: A survey of results,” in International conference on theory and applications of models of computation. Springer, 2008, pp. 1–19. [11] C. Dwork, G. N. Rothblum, and S. V… view at source ↗

Figures from the paper (3 more)

**Figure 7.** Figure 7: Reconstruction samples using PPFL-RDSN, scaling [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

**Figure 5.** Figure 5: Performance comparison for PSNR between State-of-the-Art and our FL-RDSN [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Performance comparison for SSIM between State-of-the-Art and our FL-RDSN [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

84 extracted references · 50 canonical work pages

[1]

Image Reconstruction Using Deep Learning

P.-Y . Liu and E. Y . Lam, “Image reconstruction using deep learning,” arXiv preprint arXiv:1809.10410, 2018. 5 10 15 Clients 34 35 36 37 38 39PS/glyph1197R P S/glyph1197R vs C lient /glyph1197o. ( = 2.75, S.F . = 2) Set5 Set14 B100 Urban100 (a)clientto PSNR,ς= 2 5 10 15 Clients 0.93 0.94 0.95 0.96SSIM SSIM vs C lient /glyph1197o. ( = 2.75, S.F . = 2) Set...

work page Pith review arXiv 2018
[2]

Deep convolutional autoencoder-based lossy image compression,

Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Deep convolutional autoencoder-based lossy image compression,” in2018 Picture Coding Symposium (PCS). IEEE, 2018, pp. 253–257

2018
[3]

Unsupervised deep learning methods for biological image reconstruction and enhancement: An overview from a signal processing perspective,

M. Akc ¸akaya, B. Yaman, H. Chung, and J. C. Ye, “Unsupervised deep learning methods for biological image reconstruction and enhancement: An overview from a signal processing perspective,”IEEE Signal Pro- cessing Magazine, vol. 39, no. 2, pp. 28–44, 2022

2022
[4]

Centralized machine learning versus federated averaging: A comparison using mnist dataset,

S. Peng, Y . Yang, M. Mao, and D.-S. Park, “Centralized machine learning versus federated averaging: A comparison using mnist dataset,” KSII Transactions on Internet and Information Systems (TIIS), vol. 16, no. 2, pp. 742–756, 2022

2022
[5]

Recent advances of differen- tial privacy in centralized deep learning: A systematic survey,

L. Demelius, R. Kern, and A. Tr ¨ugler, “Recent advances of differen- tial privacy in centralized deep learning: A systematic survey,”arXiv preprint arXiv:2309.16398, 2023

work page arXiv 2023
[6]

Gradient centralization: A new optimization technique for deep neural networks,

H. Yong, J. Huang, X. Hua, and L. Zhang, “Gradient centralization: A new optimization technique for deep neural networks,” inComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16. Springer, 2020, pp. 635–652

2020
[7]

Federated Learning Versus Classical Machine Learning: A Convergence Comparison

M. Asad, A. Moustafa, and T. Ito, “Federated learning versus clas- sical machine learning: A convergence comparison,”arXiv preprint arXiv:2107.10976, 2021

work page Pith review arXiv 2021
[8]

Communication-efficient learning of deep networks from decentralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273– 1282. 0 20 40 Epochs 34 36 38PS/glyph1197R P S/glyph1197R vs E pochs. ( = 2.75, S.F . = 2) Set5 Set14 B100 Urban100 (a)epochto PSNR,ς= 2 0 20 40 Epochs ...

work page 2017

Show all 84 references

[9]

Differential privacy,

C. Dwork, “Differential privacy,” inInternational colloquium on au- tomata, languages, and programming. Springer, 2006, pp. 1–12

2006
[10]

Differential privacy: A survey of results,

——, “Differential privacy: A survey of results,” inInternational con- ference on theory and applications of models of computation. Springer, 2008, pp. 1–19

2008
[11]

Boosting and differential privacy,

C. Dwork, G. N. Rothblum, and S. Vadhan, “Boosting and differential privacy,” in2010 IEEE 51st Annual Symposium on Foundations of Computer Science. IEEE, 2010, pp. 51–60

2010
[12]

Gaussian differential privacy,

J. Dong, A. Roth, and W. J. Su, “Gaussian differential privacy,”Journal of the Royal Statistical Society Series B: Statistical Methodology, vol. 84, no. 1, pp. 3–37, 2022

2022
[13]

X. Yi, R. Paulet, E. Bertino, X. Yi, R. Paulet, and E. Bertino,Homo- morphic encryption. Springer, 2014

2014
[14]

A survey on homomorphic encryption schemes: Theory and implementation,

A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomorphic encryption schemes: Theory and implementation,”ACM Computing Surveys (Csur), vol. 51, no. 4, pp. 1–35, 2018

2018
[15]

Homomorphic encryption,

M. Ogburn, C. Turner, and P. Dahal, “Homomorphic encryption,” Procedia Computer Science, vol. 20, pp. 502–509, 2013

2013
[16]

Somewhat practical fully homomorphic encryption,

J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,”Cryptology ePrint Archive, 2012

2012
[17]

Cramer, I

R. Cramer, I. B. Damg ˚ardet al.,Secure multiparty computation. Cambridge University Press, 2015

2015
[18]

Secure multiparty computation,

Y . Lindell, “Secure multiparty computation,”Communications of the ACM, vol. 64, no. 1, pp. 86–96, 2020

2020
[19]

Secure multi-party computation,

O. Goldreich, “Secure multi-party computation,”Manuscript. Prelimi- nary version, vol. 78, no. 110, pp. 1–108, 1998

1998
[20]

A novel encryption-then-lossy-compression scheme of color images using customized residual dense spatial network,

C. Wang, T. Zhang, H. Chen, Q. Huang, J. Ni, and X. Zhang, “A novel encryption-then-lossy-compression scheme of color images using customized residual dense spatial network,”IEEE Transactions on Multimedia, 2022

2022
[21]

Lossy compression and iterative reconstruction for encrypted image,

X. Zhang, “Lossy compression and iterative reconstruction for encrypted image,”IEEE transactions on information forensics and security, vol. 6, no. 1, pp. 53–58, 2010

2010
[22]

A new lossy compression scheme for encrypted gray-scale images,

R. Hu, X. Li, and B. Yang, “A new lossy compression scheme for encrypted gray-scale images,” in2014 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). Ieee, 2014, pp. 7387–7390

2014
[23]

Encryption-then- compression systems using grayscale-based image encryption for jpeg images,

T. Chuman, W. Sirichotedumrong, and H. Kiya, “Encryption-then- compression systems using grayscale-based image encryption for jpeg images,”IEEE Transactions on Information Forensics and security, vol. 14, no. 6, pp. 1515–1525, 2018

2018
[24]

Compressive sampling and lossy compression,

V . K. Goyal, A. K. Fletcher, and S. Rangan, “Compressive sampling and lossy compression,”IEEE Signal Processing Magazine, vol. 25, no. 2, pp. 48–56, 2008

2008
[25]

Lossy compression of noisy images,

O. K. Al-Shaykh and R. M. Mersereau, “Lossy compression of noisy images,”IEEE Transactions on Image Processing, vol. 7, no. 12, pp. 1641–1652, 1998

1998
[26]

Rethinking lossy compression: The rate- distortion-perception tradeoff,

Y . Blau and T. Michaeli, “Rethinking lossy compression: The rate- distortion-perception tradeoff,” inInternational Conference on Machine Learning. PMLR, 2019, pp. 675–685

2019
[27]

Residual dense net- work for image super-resolution,

Y . Zhang, Y . Tian, Y . Kong, B. Zhong, and Y . Fu, “Residual dense net- work for image super-resolution,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 2472–2481

2018
[28]

U-net: Convolutional networks for biomedical image segmentation,

O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” inMedical image computing and computer-assisted intervention–MICCAI 2015: 18th international con- ference, Munich, Germany, October 5-9, 2015, proceedings, part III 18. ...

2015
[29]

Theory of deep convolutional neural networks: Downsam- pling,

D.-X. Zhou, “Theory of deep convolutional neural networks: Downsam- pling,”Neural Networks, vol. 124, pp. 319–327, 2020

2020
[30]

An encryption-then-compression system for jpeg standard,

K. Kurihara, S. Shiota, and H. Kiya, “An encryption-then-compression system for jpeg standard,” in2015 Picture Coding Symposium (PCS). IEEE, 2015, pp. 119–123

2015
[31]

Federated learning: Challenges, methods, and future directions,

T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,”IEEE signal processing magazine, vol. 37, no. 3, pp. 50–60, 2020

2020
[32]

On the convergence of fedavg on non-iid data,

X. Li, K. Huang, W. Yang, S. Wang, and Z. Zhang, “On the convergence of fedavg on non-iid data,”arXiv preprint arXiv:1907.02189, 2019

1907 arXiv
[33]

Revisiting distributed synchronous sgd,

J. Chen, X. Pan, R. Monga, S. Bengio, and R. Jozefowicz, “Revisiting distributed synchronous sgd,”arXiv preprint arXiv:1604.00981, 2016

2016 arXiv
[34]

Asynchronous decentralized parallel stochastic gradient descent,

X. Lian, W. Zhang, C. Zhang, and J. Liu, “Asynchronous decentralized parallel stochastic gradient descent,” inInternational Conference on Machine Learning. PMLR, 2018, pp. 3043–3052

2018
[35]

Federated learning with hierarchical clustering of local updates to improve training on non-iid data,

C. Briggs, Z. Fan, and P. Andras, “Federated learning with hierarchical clustering of local updates to improve training on non-iid data,” in2020 International Joint Conference on Neural Networks (IJCNN). IEEE, 2020, pp. 1–9

2020
[36]

Timely communication in federated learning,

B. Buyukates and S. Ulukus, “Timely communication in federated learning,” inIEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2021, pp. 1–6

2021
[37]

Federated learning: Opportunities and challenges,

P. M. Mammen, “Federated learning: Opportunities and challenges,” arXiv preprint arXiv:2101.05428, 2021

2021 arXiv
[38]

How to backdoor federated learning,

E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inInternational conference on artificial intelligence and statistics. PMLR, 2020, pp. 2938–2948

2020
[39]

A survey on federated learning,

C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,”Knowledge-Based Systems, vol. 216, p. 106775, 2021

2021
[40]

Federated learning: Strategies for improving communication efficiency,

J. Konecn `y, H. B. McMahan, F. X. Yu, P. Richt ´arik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,”arXiv preprint arXiv:1610.05492, vol. 8, 2016

2016 arXiv
[41]

Federated learning on non-iid data: A survey,

H. Zhu, J. Xu, S. Liu, and Y . Jin, “Federated learning on non-iid data: A survey,”Neurocomputing, vol. 465, pp. 371–390, 2021

2021
[42]

Threats to federated learning: A survey,

L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” arXiv preprint arXiv:2003.02133, 2020

2003 arXiv
[43]

Communication-efficient federated learning,

M. Chen, N. Shlezinger, H. V . Poor, Y . C. Eldar, and S. Cui, “Communication-efficient federated learning,”Proceedings of the Na- tional Academy of Sciences, vol. 118, no. 17, p. e2024789118, 2021

2021
[44]

Federated learning for internet of things: Recent advances, taxonomy, and open challenges,

L. U. Khan, W. Saad, Z. Han, E. Hossain, and C. S. Hong, “Federated learning for internet of things: Recent advances, taxonomy, and open challenges,”IEEE Communications Surveys & Tutorials, vol. 23, no. 3, pp. 1759–1799, 2021

2021
[45]

Specificity- preserving federated learning for mr image reconstruction,

C.-M. Feng, Y . Yan, S. Wang, Y . Xu, L. Shao, and H. Fu, “Specificity- preserving federated learning for mr image reconstruction,”IEEE Trans- actions on Medical Imaging, vol. 42, no. 7, pp. 2010–2021, 2022

2010
[46]

Federated learning of generative image priors for mri reconstruction,

G. Elmas, S. U. Dar, Y . Korkmaz, E. Ceyani, B. Susam, M. Ozbey, S. Avestimehr, and T. C ¸ ukur, “Federated learning of generative image priors for mri reconstruction,”IEEE Transactions on Medical Imaging, vol. 42, no. 7, pp. 1996–2009, 2022

1996
[47]

Multi-institutional collaborations for improving deep learning-based magnetic resonance image reconstruction using federated learning,

P. Guo, P. Wang, J. Zhou, S. Jiang, and V . M. Patel, “Multi-institutional collaborations for improving deep learning-based magnetic resonance image reconstruction using federated learning,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2...

2021
[48]

Dpadapter: Improving differentially private deep learning through noise tolerance pre-training,

Z. Wang, R. Zhu, D. Zhou, Z. Zhang, J. Mitchell, H. Tang, and X. Wang, “Dpadapter: Improving differentially private deep learning through noise tolerance pre-training,”arXiv preprint arXiv:2403.02571, 2024

2024 arXiv
[49]

Fine-tuning language models with differential privacy through adaptive noise allocation,

X. Li, R. Zmigrod, Z. Ma, X. Liu, and X. Zhu, “Fine-tuning language models with differential privacy through adaptive noise allocation,” arXiv preprint arXiv:2410.02912, 2024

2024 arXiv
[50]

Adaptive laplace mechanism: Differential privacy preservation in deep learning,

N. Phan, X. Wu, H. Hu, and D. Dou, “Adaptive laplace mechanism: Differential privacy preservation in deep learning,” in2017 IEEE inter- national conference on data mining (ICDM). IEEE, 2017, pp. 385–394

2017
[51]

Secure random sampling in differential privacy,

N. Holohan and S. Braghin, “Secure random sampling in differential privacy,” inComputer Security–ESORICS 2021: 26th European Sympo- sium on Research in Computer Security, Darmstadt, Germany, October 4–8, 2021, Proceedings, Part II 26. Springer, 2021, pp. 523–542

2021
[52]

On significance of the least significant bits for differential privacy,

I. Mironov, “On significance of the least significant bits for differential privacy,” inProceedings of the 2012 ACM conference on Computer and communications security, 2012, pp. 650–661

2012
[53]

Precision-based attacks and interval refining: how to break, then fix, dif- ferential privacy on finite computers,

S. Haney, D. Desfontaines, L. Hartman, R. Shrestha, and M. Hay, “Precision-based attacks and interval refining: how to break, then fix, dif- ferential privacy on finite computers,”arXiv preprint arXiv:2207.13793, 2022

2022 arXiv
[54]

Widespread underestimation of sensitivity in differentially private libraries and how to fix it,

S. Casacuberta, M. Shoemate, S. Vadhan, and C. Wagaman, “Widespread underestimation of sensitivity in differentially private libraries and how to fix it,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 471–484

2022
[55]

Practical black-box attacks against machine learning,

N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519

2017
[56]

How to prove yourself: Practical solutions to identification and signature problems,

A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification and signature problems,” inConference on the theory and application of cryptographic techniques. Springer, 1986, pp. 186–194

1986
[57]

Membership inference attacks against machine learning models,

R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” 2017. [Online]. Available: https://arxiv.org/abs/1610.05820

2017 arXiv
[58]

Model inversion attacks that exploit confidence information and basic countermeasures,

M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

2015
[59]

Property inference attacks on fully connected neural networks using permutation invariant representations,

K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” inProceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 619– 633

2018
[60]

The algorithmic foundations of differential privacy,

C. Dwork, A. Rothet al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

2014
[61]

Advances and open problems in federated learning,

P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummingset al., “Advances and open problems in federated learning,”Foundations and trends® in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021

2021
[62]

Transferability in ma- chine learning: from phenomena to black-box attacks using adversarial samples,

N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in ma- chine learning: from phenomena to black-box attacks using adversarial samples,”arXiv preprint arXiv:1605.07277, 2016

2016 arXiv
[63]

How to backdoor federated learning,

E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” 2019. [Online]. Available: https://arxiv.org/abs/1807.00459

2019 arXiv
[64]

Local differential privacy for deep learning,

P. C. M. Arachchige, P. Bertok, I. Khalil, D. Liu, S. Camtepe, and M. Atiquzzaman, “Local differential privacy for deep learning,”IEEE Internet of Things Journal, vol. 7, no. 7, pp. 5827–5842, 2019

2019
[65]

Ldp-fed: Federated learning with local differential privacy,

S. Truex, L. Liu, K.-H. Chow, M. E. Gursoy, and W. Wei, “Ldp-fed: Federated learning with local differential privacy,” inProceedings of the third ACM international workshop on edge systems, analytics and networking, 2020, pp. 61–66

2020
[66]

Privacy-preserving face recognition with learnable privacy budgets in frequency domain,

J. Ji, H. Wang, Y . Huang, J. Wu, X. Xu, S. Ding, S. Zhang, L. Cao, and R. Ji, “Privacy-preserving face recognition with learnable privacy budgets in frequency domain,” inEuropean Conference on Computer Vision. Springer, 2022, pp. 475–491

2022
[67]

Privacy preserving face recognition utilizing differential privacy,

P. M. Arachchige, P. Bertok, I. Khalil, D. Liu, and S. Camtepe, “Privacy preserving face recognition utilizing differential privacy,”Computers and Security, vol. 97, pp. 1–12, 2020

2020
[68]

Embedding watermarks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” inProceedings of the 2017 ACM on International Conference on Multimedia Retrieval, ser. ICMR ’17. ACM, Jun. 2017, p. 269–277. [Online]. Available: http://dx.doi.org/10.1145/3078...

2017
[69]

Robust watermarking for deep neural networks via bi-level optimization,

P. Yang, Y . Lao, and P. Li, “Robust watermarking for deep neural networks via bi-level optimization,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 14 841–14 850

2021
[70]

Embedding water- marks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” inProceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269–277

2017
[71]

A systematic review on model watermarking for neural networks,

F. Boenisch, “A systematic review on model watermarking for neural networks,”Frontiers in big Data, vol. 4, p. 729663, 2021

2021
[72]

Fedipr: Ownership verification for federated deep neural network models,

B. Li, L. Fan, H. Gu, J. Li, and Q. Yang, “Fedipr: Ownership verification for federated deep neural network models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 4, pp. 4521– 4536, 2022

2022
[73]

A downsampling method addressing the modifiable areal unit problem in remote sensing,

A. M ˆırt,, J. Reiche, J. Verbesselt, and M. Herold, “A downsampling method addressing the modifiable areal unit problem in remote sensing,” Remote Sensing, vol. 14, no. 21, p. 5538, 2022

2022
[74]

Opacus: User-friendly differential privacy library in PyTorch,

A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testuggine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao, G. Cormode, and I. Mironov, “Opacus: User-friendly differential privacy library in PyTorch,”arXiv preprint arXiv:2109.12298, 2021

2021 arXiv
[75]

Adam: A method for stochastic optimization,

P. K. Diederik, “Adam: A method for stochastic optimization,”(No Title), 2014

2014
[76]

Enhancing communication efficiency and training time uniformity in federated learning through multi-branch networks and the oort algorithm,

P.-H. Juan and J.-L. Wu, “Enhancing communication efficiency and training time uniformity in federated learning through multi-branch networks and the oort algorithm,”Algorithms, vol. 17, p. 52,
[77]

Chacha20 and poly1305 for ietf protocols,

Y . Nir and A. Langley, “Chacha20 and poly1305 for ietf protocols,” Tech. Rep., 2018

2018
[78]

Hybrid public key encryption (hpke),

R. L. Barnes, K. Bhargavan, B. Lipp, and C. A. Wood, “Hybrid public key encryption (hpke),” RFC 9180, May 2022. [Online]. Available: https://www.rfc-editor.org/rfc/rfc9180

2022
[79]

The messaging layer security (mls) protocol,

E. Rescorla, R. Barnes, K. Cohn-Gordon, R. Misoczki, A. D. McGrew et al., “The messaging layer security (mls) protocol,” RFC 9420, July
[80]

The x3dh key agreement protocol,

M. Marlinspike and T. Perrin, “The x3dh key agreement protocol,” Signal Specification, 2016, pDF available at https://signal.org/docs/specifications/x3dh/x3dh.pdf. [Online]. Available: https://signal.org/docs/specifications/x3dh/

2016
[81]

Available: https://www.rfc-editor.org/rfc/rfc9420

[Online]. Available: https://www.rfc-editor.org/rfc/rfc9420
[82]

Ntire 2017 challenge on single image super-resolution: Dataset and study,

E. Agustsson and R. Timofte, “Ntire 2017 challenge on single image super-resolution: Dataset and study,” inThe IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR) Workshops, July 2017. APPENDIX A. Comparisons In this section, we draw a comparison between our mo...

2017
[83]

Divertible protocols and atomic proxy cryptography,

M. Blaze, G. Bleumer, and M. Strauss, “Divertible protocols and atomic proxy cryptography,” inAdvances in Cryptology – EUROCRYPT ’98, ser. Lecture Notes in Computer Science, vol. 1403. Springer, 1998, pp. 127–144

1998
[2024]

Available: https://api.semanticscholar.org/CorpusID: 267234091

[Online]. Available: https://api.semanticscholar.org/CorpusID: 267234091

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Image Reconstruction Using Deep Learning

P.-Y . Liu and E. Y . Lam, “Image reconstruction using deep learning,” arXiv preprint arXiv:1809.10410, 2018. 5 10 15 Clients 34 35 36 37 38 39PS/glyph1197R P S/glyph1197R vs C lient /glyph1197o. ( = 2.75, S.F . = 2) Set5 Set14 B100 Urban100 (a)clientto PSNR,ς= 2 5 10 15 Clients 0.93 0.94 0.95 0.96SSIM SSIM vs C lient /glyph1197o. ( = 2.75, S.F . = 2) Set...

work page Pith review arXiv 2018

[2] [2]

Deep convolutional autoencoder-based lossy image compression,

Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Deep convolutional autoencoder-based lossy image compression,” in2018 Picture Coding Symposium (PCS). IEEE, 2018, pp. 253–257

2018

[3] [3]

Unsupervised deep learning methods for biological image reconstruction and enhancement: An overview from a signal processing perspective,

M. Akc ¸akaya, B. Yaman, H. Chung, and J. C. Ye, “Unsupervised deep learning methods for biological image reconstruction and enhancement: An overview from a signal processing perspective,”IEEE Signal Pro- cessing Magazine, vol. 39, no. 2, pp. 28–44, 2022

2022

[4] [4]

Centralized machine learning versus federated averaging: A comparison using mnist dataset,

S. Peng, Y . Yang, M. Mao, and D.-S. Park, “Centralized machine learning versus federated averaging: A comparison using mnist dataset,” KSII Transactions on Internet and Information Systems (TIIS), vol. 16, no. 2, pp. 742–756, 2022

2022

[5] [5]

Recent advances of differen- tial privacy in centralized deep learning: A systematic survey,

L. Demelius, R. Kern, and A. Tr ¨ugler, “Recent advances of differen- tial privacy in centralized deep learning: A systematic survey,”arXiv preprint arXiv:2309.16398, 2023

work page arXiv 2023

[6] [6]

Gradient centralization: A new optimization technique for deep neural networks,

H. Yong, J. Huang, X. Hua, and L. Zhang, “Gradient centralization: A new optimization technique for deep neural networks,” inComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16. Springer, 2020, pp. 635–652

2020

[7] [7]

Federated Learning Versus Classical Machine Learning: A Convergence Comparison

M. Asad, A. Moustafa, and T. Ito, “Federated learning versus clas- sical machine learning: A convergence comparison,”arXiv preprint arXiv:2107.10976, 2021

work page Pith review arXiv 2021

[8] [8]

Communication-efficient learning of deep networks from decentralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273– 1282. 0 20 40 Epochs 34 36 38PS/glyph1197R P S/glyph1197R vs E pochs. ( = 2.75, S.F . = 2) Set5 Set14 B100 Urban100 (a)epochto PSNR,ς= 2 0 20 40 Epochs ...

work page 2017