Pith. sign in

REVIEW 4 major objections 7 minor 89 references

Frozen autoencoders make one-shot federated learning private by default

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-09 06:40 UTC pith:KXELCQWR

load-bearing objection Clean DP framework for one-shot FL with additive latent statistics; single-Gaussian assumption is the main untested limit the 4 major comments →

arxiv 2607.07565 v1 pith:KXELCQWR submitted 2026-07-08 cs.LG cs.AI

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning

Maximilian Andreas Hoefler , Karsten Mueller , Wojciech Samek This is my paper
classification cs.LG cs.AI
keywords federated learningdifferential privacyone-shot federated learningsynthetic data generationautoencodersecure aggregationknowledge transferdata heterogeneity
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that a publicly pretrained autoencoder provides a shared latent space good enough that clients in a federated setting need only compute and upload class-conditional sums of latent vectors and their outer products — lightweight additive statistics — for the server to reconstruct synthetic data that trains a competitive classifier. The central mechanism is that these statistics are additive: they combine across clients without information loss, so the result is identical regardless of how data is partitioned, making the method invariant to both data heterogeneity and the number of clients. The server adds calibrated Gaussian noise to the aggregated sums, achieving formal (ε,δ)-differential privacy by construction, then samples from the resulting per-class Gaussians and decodes them back to pixel-space images. Because the noise is injected into low-dimensional latent vectors rather than high-dimensional model parameters, even a modest privacy budget yields a favorable signal-to-noise ratio. The paper shows that this approach outperforms non-private one-shot FL baselines across four image datasets and multiple heterogeneity settings, scales to 1000 clients without degradation, and produces synthetic images reusable for any downstream architecture.

Core claim

The paper identifies a specific structural property: when clients encode their private data through a frozen public autoencoder and compute per-class sums of latent vectors and their outer products, these sums are exactly additive across clients. This additivity means the server recovers the same global class-conditional statistics regardless of how data is distributed — a property the authors call heterogeneity invariance and client-count invariance. Combined with secure aggregation (which hides individual contributions) and the analytic Gaussian mechanism (which adds calibrated noise to the aggregated sums), this yields a one-shot pipeline with formal differential privacy where the noise's

What carries the argument

The load-bearing object is the class-conditional latent statistic triple (sum of clipped latents, sum of outer products, sample count) computed per client in a frozen autoencoder's latent space. These triples are additive across clients, compatible with secure aggregation, and have bounded sensitivity (2R for the mean sum, 2R² for the second-moment sum under within-class replacement), enabling clean differential privacy accounting via the analytic Gaussian mechanism with parallel composition across classes.

Load-bearing premise

The method models each class as a single Gaussian in the autoencoder's latent space. If a class contains distinct subpopulations (for example, a 'dog' class with both terriers and retrievers that occupy different regions of latent space), the single Gaussian averages these modes together, and the resulting synthetic samples may not preserve the structure needed for accurate classification. The paper discusses using Gaussian mixture models instead but notes that mixture-models

What would settle it

Test on a dataset where classes are known to be multimodal in a standard autoencoder's latent space — for instance, a fine-grained classification task where 'bird' includes owls, parrots, and penguins. If the single-Gaussian model collapses these modes and downstream accuracy drops significantly relative to a centralized non-private baseline, the core assumption is violated.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the additivity property holds as claimed, any frozen public encoder with a low-dimensional latent space could serve as the backbone for a one-shot private FL pipeline, making the approach applicable beyond image compression autoencoders — for instance, to text or tabular domains where pretrained encoders exist.
  • Heterogeneity invariance, if structural rather than empirical, means that the hardest FL settings (pathological splits, thousands of clients) become no harder than the easiest, removing a major practical barrier to cross-device deployment.
  • The pixel-space synthetic output decouples the generation step from downstream model choice, so a single round of client communication could serve multiple downstream tasks — classification, detection, segmentation — without additional privacy cost.
  • The privacy-utility tradeoff depends on latent dimension d, not on dataset size or model complexity, which suggests that progress in autoencoder compression directly translates to better private federated learning without any change to the federated protocol.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The single-Gaussian-per-class assumption is the method's structural ceiling: if a class has distinct subpopulations in latent space (e.g., 'dog' containing both terriers and retrievers), the Gaussian averages these modes, and the synthetic data may lose the inter-class separation that downstream classification depends on. The paper acknowledges this but does not test on datasets with known intra-c
  • The method's invariance to client count and heterogeneity is a mathematical consequence of additivity, not an empirical finding — but it holds exactly only before DP noise is added. With fewer total samples per class, the effective noise (σ_μ / n_c) grows, so the invariance is approximate in practice, with degradation governed by total sample count rather than partition.
  • The reliance on a public pretrained autoencoder creates a trust dependency: if the autoencoder was trained on data that overlaps with client data, the encoder's representations may leak structural information about the private data through the choice of latent space itself, a risk not addressed by the DP guarantee on transmitted statistics.
  • Extending the approach to unsupervised settings — where no class labels exist to condition the statistics on — would require a fundamentally different aggregation mechanism, since the additivity property depends on grouping by shared class identity.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes FedKT-CSD, a one-shot federated learning (OSFL) method where clients encode private images via a frozen public autoencoder, compute per-class latent statistics (sums and outer-product sums), and transmit them via secure aggregation. The server adds calibrated differential privacy (DP) noise, recovers class-conditional Gaussian distributions, samples latents, and decodes them into a synthetic image dataset. The DP analysis (Proposition 4.1) uses the analytic Gaussian mechanism with sensitivity bounds derived from clipping, basic composition within each class, and parallel composition across classes. Experiments on four image datasets show the method outperforming non-private OSFL baselines and remaining invariant to heterogeneity and client count.

Significance. The paper addresses a well-motivated gap: achieving formal (ε,δ)-DP in one-shot FL without sacrificing utility. The DP derivation is clean and from first principles: sensitivity is bounded by the public clipping radius R (Eq. 11), noise is calibrated via the analytic Gaussian mechanism (Balle & Wang 2018), and composition uses standard theorems. The additive-statistics design enabling exact partition invariance and secure aggregation is a genuine architectural strength. The empirical claim that a DP method outperforms non-private OSFL baselines is strong and is supported by consistent results across four datasets and multiple heterogeneity settings. Code is publicly available, which is commendable.

major comments (4)
  1. §8, single-Gaussian-per-class assumption: The central empirical claim—that additive class-conditional latent statistics produce synthetic data sufficient for competitive downstream classification—depends on a single per-class Gaussian adequately capturing each class's latent distribution. Section 8 acknowledges this limitation and dismisses GMMs because per-component assignments are not additively aggregable. However, no experiment tests a regime where a single class contains visually distinct sub-populations (e.g., CIFAR-100 superclass groupings such as 'large carnivores' containing lions, tigers, and wolves). If a class is multimodal in the autoencoder's latent space, the single-Gaussian model averages the modes, potentially collapsing inter-sub-class structure. The paper does not measure latent-space multimodality for any class on any dataset, nor does it compare against an oracle (e.
  2. g., centrally computed) GMM to bound the performance gap. This is load-bearing for the generality claim and should be empirically validated, at least on one dataset with known intra-class multimodality.
  3. Table 1 and §5.1, heterogeneity invariance claim: The paper states that the three heterogeneity columns are 'identical up to DP noise' and that this is a structural guarantee. However, the reported numbers (e.g., EuroSAT: 80.96, 80.74, 80.46) show small but non-trivial variation. The paper attributes this to 'downstream training variance' (§7), but no error bars or confidence intervals are reported for any result in Table 1. Without variance estimates, it is unclear whether the differences are within noise or reflect a systematic (if small) effect. This matters because the invariance claim is a headline property of the method. Adding standard deviations across multiple seeds would resolve this.
  4. §4.3 and Appendix G, threat model consistency: Proposition 4.1 claims (ε,δ)-DP for the released statistics. Appendix G clarifies that secure aggregation hides individual contributions but the server recovers exact global sums before DP noise is added, requiring a trusted server. The main text (§3.3) states 'the server aggregates these statistics via secure aggregation' and adds noise afterward, which is consistent with Appendix G. However, §1 and the abstract imply a stronger privacy posture ('privacy by design') without clearly stating the trusted-server assumption in the main body. The threat model should be stated explicitly in §4 or §3 so that readers understand the DP guarantee applies to the released noisy statistics, not to the intermediate global sums.
minor comments (7)
  1. §3.4, Eq. (6): The bias correction adds σ²_μ / n²_c I_d. The text explains this corrects for the upward bias in E[μ^DP_c (μ^DP_c)^T], but the derivation is stated in prose without a numbered equation for the expectation. A brief inline derivation or reference would improve clarity.
  2. Table 2: The 'Upload (1×)' row reports 327.5 KB for d=128, 10 classes. This is consistent with K×(d + d(d+1)/2 + 1) floats, but the table caption or a footnote should clarify that this assumes the client holds all 10 classes; under heterogeneity, a client holding fewer classes would upload less.
  3. §5.4, Table 3: DP-LoRA LDM is described as fine-tuning a latent diffusion model 'pretrained on the full ImageNet dataset.' For the federated setting, it would help to clarify whether the pretraining is on the same dataset being evaluated (potential leakage) or on a disjoint subset.
  4. Figure 3d: The x-axis label 'Privacy budget ε' is clear, but the y-axis label 'Accuracy (%)' lacks context about which dataset (ImageNette is mentioned in the caption but not on the axis). Minor, but adding the dataset name to the figure title would help.
  5. §8: 'single Gaussian per class could limit the quality of generated data' — this sentence is missing an article ('a single Gaussian').
  6. Appendix C: The comparison with FedPFT is described as 'our interpretation of their described mechanism.' If FedPFT's exact noise mechanism differs, this should be verified or the comparison framed more carefully to avoid misrepresentation.
  7. References: The citation for Luo et al. (2024) (CCVR) points to 'NIPS '21' in the bibliography but is cited as 2024 in the text. This appears to be a mismatch.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the careful and constructive review. The referee correctly identifies three areas where the manuscript can be strengthened: (1) empirical validation of the single-Gaussian-per-class assumption under known intra-class multimodality, (2) addition of error bars to support the heterogeneity invariance claim, and (3) clarification of the trusted-server threat model in the main text. We agree with all three points and will revise accordingly. Below we address each comment in detail.

read point-by-point responses

  1. Referee: §8, single-Gaussian-per-class assumption: The paper does not test a regime where a single class contains visually distinct sub-populations, nor compare against an oracle GMM. This is load-bearing for the generality claim.

    Authors: The referee is correct that the single-Gaussian assumption is a core modeling choice whose limitations should be empirically tested, particularly in regimes with known intra-class multimodality. We agree that CIFAR-100 superclass groupings (e.g., 'large carnivores' containing lions, tigers, and wolves) provide a natural testbed. In the revision, we will add an experiment on at least one dataset with known intra-class multimodality, measuring latent-space multimodality per class and comparing our single-Gaussian approach against a centrally computed (oracle) GMM to bound the performance gap. We will also add a brief discussion of when the single-Gaussian model is expected to suffice versus when it may fail. We note that our method's competitive performance on CIFAR-100 (100 classes, some of which likely exhibit latent multimodality) already provides indirect evidence that the assumption is not catastrophically limiting in practice, but we agree that a direct test is needed to substantiate the generality claim. revision: yes

  2. Referee: Table 1 and §5.1, heterogeneity invariance claim: No error bars or confidence intervals are reported. Without variance estimates, it is unclear whether the small differences across heterogeneity settings are within noise.

    Authors: The referee is correct. The heterogeneity invariance claim is a structural property of the additive aggregation scheme—the global sums are mathematically identical regardless of partitioning—but the reported numbers do show small variations (e.g., EuroSAT: 80.96, 80.74, 80.46) due to downstream training variance and independent DP noise realizations. Without error bars, the reader cannot verify that these differences are within noise. In the revision, we will re-run all Table 1 results for our method across at least 5 seeds and report standard deviations. We expect the variation to be consistent with downstream training stochasticity, but we agree the data should be shown. revision: yes

  3. Referee: §4.3 and Appendix G, threat model consistency: The main text implies 'privacy by design' without clearly stating the trusted-server assumption. The threat model should be stated explicitly in the main body.

    Authors: The referee correctly identifies an inconsistency between the main text and Appendix G. Appendix G clearly states that secure aggregation hides individual contributions but the server recovers exact global sums before DP noise is added, requiring a trusted (honest-but-curious) server. However, the abstract and §1 use the phrase 'privacy by design' without explicitly stating this assumption, which could mislead readers into thinking the DP guarantee covers intermediate global sums. In the revision, we will add an explicit threat model statement in §3 or §4 clarifying that: (1) the DP guarantee applies to the released noisy statistics and all downstream outputs, (2) secure aggregation hides individual client contributions from the server, but (3) the server does recover exact global sums before noise injection, requiring a trusted server for this step. We will also note that distributed noise addition could remove this requirement and mention it as a direction for future work, as already discussed in Appendix G. The phrase 'privacy by design' will be qualified to refer to the architectural design (public frozen autoencoder, additive statistics enabling clean DP accounting) rather than implying a fully untrusted server. revision: yes

Circularity Check

0 steps flagged

No significant circularity found; DP guarantee and heterogeneity invariance follow from standard external results and mathematical additivity, not from self-citation or definitional reduction.

full rationale

The paper's two principal theoretical claims are derived from independent, non-circular foundations. (1) The (ε,δ)-DP guarantee (Proposition 4.1) follows from: sensitivity bounds Δ_μ = 2R and Δ_Σ = 2R² derived from the public clipping radius R (Eq. 10–11), noise calibrated by the analytic Gaussian mechanism of Balle & Wang (2018, an independent external reference), and composition/post-processing via standard theorems from Dwork & Roth (2014). No step reduces to a self-cited or self-defined result. (2) The heterogeneity invariance claim follows directly from the additivity of sums: Eq. 2 defines per-client sums, Eq. 3 aggregates them, and the global sums are identical regardless of partitioning — a mathematical fact, not a fitted or self-referential assertion. The empirical performance claims are genuine experimental comparisons against external baselines on four datasets. The two self-citations (Hoefler et al. 2024, 2025) appear only in related-work context and are not load-bearing for any derivation. The single-Gaussian-per-class modeling assumption is acknowledged as a limitation (Section 8) and is not presented as a derived result. No circularity is present.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The paper introduces no new mathematical objects, particles, forces, or dimensions. All components (autoencoder, Gaussian mechanism, secure aggregation, Dirichlet heterogeneity simulation) are established. The framework itself is a novel composition of existing parts, not a new entity.

free parameters (5)
  • Clipping radius R = α√d = α=3, d=128, R≈33.9
    Set data-independently from the autoencoder prior p(z)=N(0,I_d) where norms concentrate near √d. α=3 is chosen to cover the vast majority of latents. Not fitted to private data, but is a tunable parameter affecting the privacy-utility tradeoff.
  • Privacy budget split (ε/2, δ/2) per statistic = Equal split between mean and covariance sums
    Equal allocation is a standard default; no optimization over the split is performed. Affects noise magnitude on each statistic.
  • PSD projection threshold τ = 10⁻⁶
    Small constant to ensure positive definiteness for sampling. Does not affect the central claim.
  • Number of synthetic samples per class N_c = Varied in ablation; saturation at ~10k total
    Not a fitted parameter in the traditional sense; the paper shows accuracy plateaus once the synthetic dataset covers the learned Gaussian distributions. More samples incur no additional privacy cost.
  • Autoencoder architecture and latent dimension d = DC-AE f32c32, d=128, 64×64 resolution (selected from Table 5 ablation)
    Selected post hoc from ablation as the best configuration balancing representational capacity and noise tolerance. This is a hyperparameter choice, not a derived quantity.
axioms (5)
  • domain assumption Class labels are public information; the privacy guarantee protects feature content, not class membership.
    Stated in Section 3.1 and Section 4. This enables parallel composition across classes (Theorem D.1) and the within-class replacement adjacency model. The add/remove extension (Appendix F) partially addresses this but is empirically unvalidated.
  • ad hoc to paper A single per-class Gaussian in the autoencoder latent space adequately captures the class-conditional distribution for downstream classification.
    Section 3.4-3.5 model each class as N(μ_c, Σ_c). Section 8 acknowledges this is a limitation: 'single Gaussian per class could limit the quality of generated data.' The paper does not test on datasets with known intra-class multimodality.
  • domain assumption The pretrained autoencoder (DC-AE, trained on natural images) provides a useful latent representation for the target domain.
    Section 5 evaluates on EuroSAT (satellite) and BloodMNIST (microscopy), which are out-of-distribution for the autoencoder. Results are competitive, providing partial validation. However, the paper does not test on domains further from natural images (e.g., audio spectrograms, tabular data).
  • domain assumption The server is honest-but-curious and correctly executes the DP mechanism after secure aggregation.
    Section G (Appendix): 'our threat model assumes that the server is trusted to execute the DP mechanism on the aggregated statistics after secure aggregation.' Distributed noise addition is left for future work.
  • standard math The analytic Gaussian mechanism (Balle & Wang 2018) provides valid DP calibration for the experimental regime (ε=10, δ=10⁻⁵).
    Proposition 4.1 invokes this as an established result. The reference is independent (no author overlap). The mechanism is valid for all ε > 0.

pith-pipeline@v1.1.0-glm · 24629 in / 4105 out tokens · 498501 ms · 2026-07-09T06:40:03.032216+00:00 · methodology

0 comments
read the original abstract

One-shot federated learning (OSFL) addresses the communication overhead of federated learning by limiting training to a single round, but doing so without sacrificing model quality is non-trivial, particularly when client data distributions diverge. Recent work has addressed this challenge by aggregating client knowledge on the server through the construction of transferable synthetic datasets or distillates. However, most of these methods lack formal privacy guarantees, leaving a gap in jointly achieving low communication, robustness to heterogeneity, and rigorous privacy. We propose FedKT-CSD (Federated Knowledge Transfer via Collaborative Synthetic Data), a framework inspired by neural image compression that closes this gap by leveraging publicly pretrained autoencoders as a shared latent space. Each client encodes its private data in a single forward pass, computes class-conditional latent statistics, and transmits these to the server. The server aggregates these statistics via secure aggregation, adds calibrated differential privacy noise, and decodes a synthetic dataset for training a global model and further downstream tasks. This design provides formal $(\varepsilon,\delta)$-differential privacy by construction, while keeping client-side computation and communication lightweight. Despite operating under privacy constraints, FedKT-CSD is competitive with and even outperforms non-private baselines across diverse datasets and heterogeneity settings, and scales to a large number of clients. Our code is available at: https://github.com/an7123/FedKT-CSD

Figures

Figures reproduced from arXiv: 2607.07565 by Karsten Mueller, Maximilian Andreas Hoefler, Wojciech Samek.

Figure 1
Figure 1. Figure 1: Overview of FedKT-CSD. Each client holds private images from a heterogeneous subset of classes. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Synthetic EuroSAT images generated by FedKT-CSD ( [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Ablation studies on ImageNette. (a) Different number of clients. (b) Different heterogeneity [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Synthetic images generated by FedKT-CSD ( [PITH_FULL_IMAGE:figures/full_fig_p020_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

89 extracted references · 89 canonical work pages · 7 internal anchors

  1. [1]

    Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS) , pages=

    Communication-efficient learning of deep networks from decentralized data , author=. Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS) , pages=. 2017 , organization=

    work page 2017

  2. [2]

    Federated Learning with Non-IID Data

    Federated learning with non-iid data , author=. arXiv preprint arXiv:1806.00582 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  3. [3]

    Advances in Neural Information Processing Systems , volume=

    Dense: Data-free one-shot federated learning , author=. Advances in Neural Information Processing Systems , volume=

    work page

  4. [4]

    Personalized Federated Learning with Theoretical Guarantees: A Model-Agnostic Meta-Learning Approach , url =

    Fallah, Alireza and Mokhtari, Aryan and Ozdaglar, Asuman , booktitle =. Personalized Federated Learning with Theoretical Guarantees: A Model-Agnostic Meta-Learning Approach , url =

    work page

  5. [5]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Personalized federated learning with Moreau envelopes , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

    work page

  6. [6]

    International Conference on Learning Representations , year=

    Personalized Federated Learning with First Order Model Optimization , author=. International Conference on Learning Representations , year=

    work page

  7. [7]

    FedPHP: Federated Personalization with Inherited Private Models

    Li, Xin-Chun and Zhan, De-Chuan and Shao, Yunfeng and Li, Bingshuai and Song, Shaoming. FedPHP: Federated Personalization with Inherited Private Models. Machine Learning and Knowledge Discovery in Databases. Research Track. 2021

    work page 2021

  8. [8]

    PartialFed: Cross-Domain Personalized Federated Learning via Partial Initialization , url =

    Sun, Benyuan and Huo, Hongxing and YANG, YI and Bai, Bo , booktitle =. PartialFed: Cross-Domain Personalized Federated Learning via Partial Initialization , url =

    work page

  9. [9]

    Proceedings of the AAAI Conference on Artificial Intelligence , author=

    Personalized Cross-Silo Federated Learning on Non-IID Data , volume=. Proceedings of the AAAI Conference on Artificial Intelligence , author=. 2021 , month=. doi:10.1609/aaai.v35i9.16960 , number=

    work page doi:10.1609/aaai.v35i9.16960 2021

  10. [10]

    IJCAI: proceedings of the conference , volume=

    Adapt to adaptation: Learning personalization for cross-silo federated learning , author=. IJCAI: proceedings of the conference , volume=

    work page

  11. [11]

    AAAI Conference on Artificial Intelligence , year=

    FedProto: Federated Prototype Learning across Heterogeneous Clients , author=. AAAI Conference on Artificial Intelligence , year=

    work page

  12. [12]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    Federated Learning from Pre-Trained Models: A Contrastive Learning Approach , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

    work page

  13. [13]

    Proceedings of the 35th International Conference on Neural Information Processing Systems , articleno =

    Luo, Mi and Chen, Fei and Hu, Dapeng and Zhang, Yifan and Liang, Jian and Feng, Jiashi , title =. Proceedings of the 35th International Conference on Neural Information Processing Systems , articleno =. 2024 , isbn =

    work page 2024

  14. [14]

    Advances in neural information processing systems , volume=

    Fedfed: Feature distillation against data heterogeneity in federated learning , author=. Advances in neural information processing systems , volume=

    work page

  15. [15]

    Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    Deep learning with differential privacy , author=. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    work page 2016

  16. [16]

    Proceedings of the AAAI Conference on Artificial Intelligence , year=

    FedTGP: Trainable Global Prototypes with Adaptive-Margin-Enhanced Contrastive Learning for Data and Model Heterogeneity in Federated Learning , author=. Proceedings of the AAAI Conference on Artificial Intelligence , year=

    work page

  17. [17]

    Differentially Private Federated Learning: A Client Level Perspective

    Differentially private federated learning: A client level perspective , author=. arXiv preprint arXiv:1712.07557 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  18. [18]

    2021 IEEE 37th International Conference on Data Engineering (ICDE) , pages=

    Feature inference attack on model predictions in vertical federated learning , author=. 2021 IEEE 37th International Conference on Data Engineering (ICDE) , pages=. 2021 , organization=

    work page 2021

  19. [19]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =

    Zhang, Lin and Shen, Li and Ding, Liang and Tao, Dacheng and Duan, Ling-Yu , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =. 2022 , pages =

    work page 2022

  20. [20]

    FedAUX: Leveraging Unlabeled Auxiliary Data in Federated Learning , year=

    Sattler, Felix and Korjakow, Tim and Rischke, Roman and Samek, Wojciech , journal=. FedAUX: Leveraging Unlabeled Auxiliary Data in Federated Learning , year=

    work page

  21. [21]

    Proceedings of the 38th International Conference on Machine Learning , pages =

    Data-Free Knowledge Distillation for Heterogeneous Federated Learning , author =. Proceedings of the 38th International Conference on Machine Learning , pages =. 2021 , editor =

    work page 2021

  22. [22]

    Proceedings of the 35th International Conference on Machine Learning , pages =

    Optimizing the Latent Space of Generative Networks , author =. Proceedings of the 35th International Conference on Machine Learning , pages =. 2018 , editor =

    work page 2018

  23. [23]

    Proceedings of the 33rd International Conference on Automata, Languages and Programming - Volume Part II , pages =

    Dwork, Cynthia , title =. Proceedings of the 33rd International Conference on Automata, Languages and Programming - Volume Part II , pages =. 2006 , isbn =. doi:10.1007/11787006_1 , abstract =

    work page doi:10.1007/11787006_1 2006

  24. [24]

    2009 , publisher=

    Learning Multiple Layers of Features From Tiny Images , author=. 2009 , publisher=

    work page 2009

  25. [25]

    IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , year=

    Deep Residual Learning for Image Recognition , author=. IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , year=

    work page

  26. [26]

    International Conference on Advances in Neural Information Processing Systems (NeurIPS) , year=

    Ensemble Distillation for Robust Model Fusion in Federated Learning , author=. International Conference on Advances in Neural Information Processing Systems (NeurIPS) , year=

    work page

  27. [27]

    Journal of Machine Learning Research , year=

    Visualizing Data Using T-SNE , author=. Journal of Machine Learning Research , year=

    work page

  28. [28]

    Conference on Empirical Methods in Natural Language Processing (EMNLP) , year=

    Information-Theoretic Probing with Minimum Description Length , author=. Conference on Empirical Methods in Natural Language Processing (EMNLP) , year=

    work page

  29. [29]

    2017 , eprint=

    A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasets , author=. 2017 , eprint=

    work page 2017

  30. [30]

    2023 , eprint=

    Synthetic data shuffling accelerates the convergence of federated learning under data heterogeneity , author=. 2023 , eprint=

    work page 2023

  31. [31]

    International Conference on Artificial Intelligence and Statistics , pages=

    On the Generalization Ability of Unsupervised Pretraining , author=. International Conference on Artificial Intelligence and Statistics , pages=. 2024 , organization=

    work page 2024

  32. [32]

    Proceedings of the thirteenth international conference on artificial intelligence and statistics , pages=

    Why does unsupervised pre-training help deep learning? , author=. Proceedings of the thirteenth international conference on artificial intelligence and statistics , pages=. 2010 , organization=

    work page 2010

  33. [33]

    IEEE Transactions on Neural Networks and Learning Systems , volume=

    Understanding how pretraining regularizes deep learning algorithms , author=. IEEE Transactions on Neural Networks and Learning Systems , volume=. 2021 , publisher=

    work page 2021

  34. [34]

    Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages =

    Deep learning with differential privacy , author =. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages =. 2016 , organization=

    work page 2016

  35. [35]

    Journal of Machine Learning Research , volume =

    Rademacher and Gaussian complexities: risk bounds and structural results , author =. Journal of Machine Learning Research , volume =

    work page

  36. [36]

    Machine learning , volume =

    A theory of learning from different domains , author =. Machine learning , volume =. 2010 , publisher =

    work page 2010

  37. [37]

    2014 , issue_date =

    Dwork, Cynthia and Roth, Aaron , title =. 2014 , issue_date =. doi:10.1561/0400000042 , journal =

    work page doi:10.1561/0400000042 2014

  38. [38]

    Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence , pages =

    Differential privacy preservation for deep auto-encoders: an application of human behavior prediction , author =. Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence , pages =

    work page

  39. [39]

    2023 , isbn =

    Ponomareva, Natalia and Vassilvitskii, Sergei and Xu, Zheng and McMahan, Brendan and Kurakin, Alexey and Zhang, Chiyaun , title =. 2023 , isbn =. doi:10.1145/3580305.3599561 , booktitle =

    work page doi:10.1145/3580305.3599561 2023

  40. [40]

    A General Approach to Adding Differential Privacy to Iterative Training Procedures

    A general approach to adding differential privacy to iterative training procedures , author=. arXiv preprint arXiv:1812.06210 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  41. [41]

    Federated Learning via Decentralized Dataset Distillation in Resource-Constrained Edge Environments , year=

    Song, Rui and Liu, Dai and Chen, Dave Zhenyu and Festag, Andreas and Trinitis, Carsten and Schulz, Martin and Knoll, Alois , booktitle=. Federated Learning via Decentralized Dataset Distillation in Resource-Constrained Edge Environments , year=

    work page

  42. [42]

    The Twelfth International Conference on Learning Representations , year=

    Enhancing One-Shot Federated Learning Through Data and Ensemble Co-Boosting , author=. The Twelfth International Conference on Learning Representations , year=

    work page

  43. [43]

    Machine Learning , volume=

    A theory of learning from different domains , author=. Machine Learning , volume=

    work page

  44. [44]

    Journal of Machine Learning Research , volume=

    Rademacher and Gaussian complexities: Risk bounds and structural results , author=. Journal of Machine Learning Research , volume=

    work page

  45. [45]

    Where to Begin? On the Impact of Pre-Training and Initialization in Federated Learning

    Where to begin? on the impact of pre-training and initialization in federated learning , author=. arXiv preprint arXiv:2206.15387 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  46. [46]

    Communications of the ACM , volume=

    Generative adversarial networks , author=. Communications of the ACM , volume=. 2020 , publisher=

    work page 2020

  47. [47]

    Advances in neural information processing systems , volume=

    Maximum likelihood training of score-based diffusion models , author=. Advances in neural information processing systems , volume=

    work page

  48. [48]

    2021 , eprint=

    Distilled One-Shot Federated Learning , author=. 2021 , eprint=

    work page 2021

  49. [49]

    The Eleventh International Conference on Learning Representations , year=

    On the Importance and Applicability of Pre-Training for Federated Learning , author=. The Eleventh International Conference on Learning Representations , year=

    work page

  50. [50]

    International Conference on Machine Learning , pages=

    Scaffold: Stochastic controlled averaging for federated learning , author=. International Conference on Machine Learning , pages=. 2020 , organization=

    work page 2020

  51. [51]

    Federated Learning with Personalization Layers

    Federated learning with personalization layers , author=. arXiv preprint arXiv:1912.00818 , year=

    work page internal anchor Pith review Pith/arXiv arXiv 1912

  52. [52]

    Proceedings of the 38th International Conference on Machine Learning , pages =

    Exploiting Shared Representations for Personalized Federated Learning , author =. Proceedings of the 38th International Conference on Machine Learning , pages =. 2021 , editor =

    work page 2021

  53. [53]

    International conference on machine learning , pages=

    Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising , author=. International conference on machine learning , pages=. 2018 , organization=

    work page 2018

  54. [54]

    International Conference on Learning Representations , year=

    FedBABU: Toward enhanced representation for federated image classification , author=. International Conference on Learning Representations , year=

    work page

  55. [55]

    International Conference on Learning Representations , year=

    On bridging generic and personalized federated learning for image classification , author=. International Conference on Learning Representations , year=

    work page

  56. [56]

    The Eleventh International Conference on Learning Representations , year=

    Personalized federated learning with feature alignment and classifier collaboration , author=. The Eleventh International Conference on Learning Representations , year=

    work page

  57. [57]

    Advances in Neural Information Processing Systems , volume=

    Federated multi-task learning under a mixture of distributions , author=. Advances in Neural Information Processing Systems , volume=

    work page

  58. [58]

    Advances in Neural Information Processing Systems , volume=

    Personalized federated learning with gaussian processes , author=. Advances in Neural Information Processing Systems , volume=

    work page

  59. [59]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Data-free learning of student networks , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

    work page

  60. [60]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Dreaming to distill: Data-free knowledge transfer via deepinversion , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    work page

  61. [61]

    The Eleventh International Conference on Learning Representations , year=

    Data-Free One-Shot Federated Learning Under Very High Statistical Heterogeneity , author=. The Eleventh International Conference on Learning Representations , year=

    work page

  62. [62]

    Wichmann and Wieland Brendel , title =

    Robert Geirhos and Patricia Rubisch and Claudio Michaelis and Matthias Bethge and Felix A. Wichmann and Wieland Brendel , title =. International Conference on Learning Representations (ICLR) , year =

    work page

  63. [63]

    IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages =

    Anh Nguyen and Jason Yosinski and Jeff Clune , title =. IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages =. 2015 , doi =

    work page 2015

  64. [64]

    IEEE/CVF International Conference on Computer Vision Workshops (ICCVW) , pages =

    Yuanwei Wu and Ziming Zhang and Guanghui Wang , title =. IEEE/CVF International Conference on Computer Vision Workshops (ICCVW) , pages =. 2019 , url =

    work page 2019

  65. [65]

    Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 2 , pages =

    Yosinski, Jason and Clune, Jeff and Bengio, Yoshua and Lipson, Hod , title =. Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 2 , pages =. 2014 , publisher =

    work page 2014

  66. [66]

    Zeiler and Rob Fergus , title =

    Matthew D. Zeiler and Rob Fergus , title =. European Conference on Computer Vision (ECCV) , pages =. 2014 , doi =

    work page 2014

  67. [67]

    Advances in Neural Information Processing Systems , volume=

    One-shot federated learning via synthetic distiller-distillate communication , author=. Advances in Neural Information Processing Systems , volume=

    work page

  68. [68]

    Proceedings of the Computer Vision and Pattern Recognition Conference (CVPR) , month =

    Chen, Haokun and Li, Hang and Zhang, Yao and Bi, Jinhe and Zhang, Gengyuan and Zhang, Yueqi and Torr, Philip and Gu, Jindong and Krompass, Denis and Tresp, Volker , title =. Proceedings of the Computer Vision and Pattern Recognition Conference (CVPR) , month =. 2025 , pages =

    work page 2025

  69. [69]

    2024 , eprint=

    Federated Generative Learning with Foundation Models , author=. 2024 , eprint=

    work page 2024

  70. [70]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    An Upload-Efficient Scheme for Transferring Knowledge From a Server-Side Pre-trained Generator to Clients in Heterogeneous Federated Learning , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    work page

  71. [71]

    Journal of Machine Learning Research , year =

    Jianqing Zhang and Yang Liu and Yang Hua and Hao Wang and Tao Song and Zhengui Xue and Ruhui Ma and Jian Cao , title =. Journal of Machine Learning Research , year =

    work page

  72. [72]

    ArXiv , year=

    Training Production Language Models without Memorizing User Data , author=. ArXiv , year=

    work page

  73. [73]

    Proceedings of the 41st International Conference on Machine Learning , articleno =

    Hou, Charlie and Shrivastava, Akshat and Zhan, Hongyuan and Conway, Rylan and Le, Trang and Sagar, Adithya and Fanti, Giulia and Lazar, Daniel , title =. Proceedings of the 41st International Conference on Machine Learning , articleno =. 2024 , publisher =

    work page 2024

  74. [74]

    Locally Differentially Private Document Generation Using Zero Shot Prompting

    Utpala, Saiteja and Hooker, Sara and Chen, Pin-Yu. Locally Differentially Private Document Generation Using Zero Shot Prompting. Findings of the Association for Computational Linguistics: EMNLP 2023. 2023. doi:10.18653/v1/2023.findings-emnlp.566

    work page doi:10.18653/v1/2023.findings-emnlp.566 2023

  75. [75]

    2025 , eprint=

    Private Text Generation by Seeding Large Language Model Prompts , author=. 2025 , eprint=

    work page 2025

  76. [76]

    Boosting Federated Learning with Diffusion Models for Non-IID and Imbalanced Data , year=

    Hoefler, Maximilian Andreas and Mazouka, Tatsiana and Mueller, Karsten and Samek, Wojciech , booktitle=. Boosting Federated Learning with Diffusion Models for Non-IID and Imbalanced Data , year=

    work page

  77. [77]

    Deep Compression Autoencoder for Efficient High-Resolution Diffusion Models

    Deep Compression Autoencoder for Efficient High-Resolution Diffusion Models , author=. arXiv preprint arXiv:2410.10733 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  78. [78]

    EfficientViT-SAM: Accelerated Segment Anything Model Without Accuracy Loss

    EfficientViT-SAM: Accelerated Segment Anything Model Without Performance Loss , author=. arXiv preprint arXiv:2402.05008 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  79. [79]

    International Conference on Learning Representations , year=

    Variational image compression with a scale hyperprior , author=. International Conference on Learning Representations , year=

    work page

  80. [80]

    Journal of Artificial Intelligence Research , volume=

    Differentially Private Neural Tangent Kernels (DP-NTK) for Privacy-Preserving Data Generation , author=. Journal of Artificial Intelligence Research , volume=

    work page

Showing first 80 references.