Pith. sign in

REVIEW 1 major objections 4 minor 1 cited by

Towards Trustworthy Federated Learning with Untrusted Participants

T0 review · 1 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that pairwise shared randomness among workers is enough to get central-DP-level utility with an untrusted server and Byzantine workers, and proves it for the CAFCOR algorithm.

desk verdict Solid theory paper: first Byzantine-robust analysis of SecLDP with an untrusted server, with a rate that genuinely interpolates between LDP and CDP for small f; the experiments are weaker than the theory and use privacy budgets outside the theorem's range. read the letter →

arxiv 2505.01874 v2 pith:522BISPZ submitted 2025-05-03 cs.LG cs.CRcs.DC

Youssef Allouah , Rachid Guerraoui , John Stephan This is my paper · ORCID
classification cs.LGcs.CRcs.DC
keywords federatedlearningdifferentialprivacyByzantinerobustnessSecLDPcorrelatednoisesharedrandomnessrobustaggregation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that robust and private federated learning does not require a trusted central server: it suffices that each pair of participants share a random seed the server does not know. Under this relaxed privacy model (secret-based local differential privacy, SecLDP), the proposed CAFCOR algorithm adds pairwise-canceling Gaussian noise to clipped gradients and aggregates the noisy momenta with a new filter, CAF, that needs only an upper bound on the number of malicious workers. The paper proves an (epsilon, delta)-SecLDP guarantee against an honest-but-curious server colluding with up to f malicious workers, and a convergence error that matches central differential privacy up to constants when the number of malicious workers is constant, and beats local differential privacy whenever f is sublinear in n. If correct, this closes most of the utility gap between the no-trust and full-trust regimes while keeping Byzantine robustness.

What carries the argument

The load-bearing object is the pair (SecLDP, CAF). SecLDP is the privacy relaxation that conditions the differential-privacy guarantee on the subset of pairwise secrets revealed to the server; its power is that a single withheld seed acts as an independent noise source for the honest workers. CAF is the Covariance bound-Agnostic Filter: an iterative weighting algorithm that down-weights the input vector contributing most to variance along the worst-case direction, tracks the weighted mean with the smallest top eigenvalue of the empirical covariance, and stops once the total weight drops below $n-2f$. It requires only the bound $f$ on corrupt inputs, runs in $O(f(nd^2+d^3))$ time, and its robustness error depends on the maximum eigenvalue of the honest covariance rather than its trace, which removes a factor of $d$ compared with trimmed mean or median aggregations.

What would settle it

Give the server all pairwise seeds ($S_{\mathrm{known}} = S$) and rerun CAFCOR: if the per-iteration Rényi divergence between adjacent datasets then exceeds the expression in Theorem 4.1, or if a membership-inference attack succeeds at the local-DP rate rather than the SecLDP rate, the central claim is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that the trust assumption can be moved from the server to the participants' pairwise shared randomness. Under secret-based local differential privacy (SecLDP), in which each pair of workers shares a random seed that the honest-but-curious server does not see, the CAFCOR algorithm makes the server observe gradients masked by correlated Gaussian noise that cancels only among honest workers. The paper proves that with noise scale $\sigma_{\mathrm{cor}}^2 = \sigma_{\mathrm{ind}}^2 = \Theta(1/(n\varepsilon^2))$, Algorithm 1 is $(\varepsilon,\delta)$-SecLDP against a server colluding with any $q \le f$ malicious workers (Theorem 4.1), and that its excess loss on the honest loss is $O((f+1)C^2 d \log(1/\delta)/(n^2\varepsilon^2) + f C^2\log(1/\delta)/(n\varepsilon^2) + (f/n) G_{\mathrm{cov}}^2)$ asymptotically in the number of iterations (Corollary 4.1). This rate matches central DP when $f=O(1)$ and beats local DP whenever $f$ is sublinear in $n$.

Load-bearing premise

The entire privacy guarantee rests on the server being honest-but-curious and on it not learning the pairwise random seeds shared by honest (and by non-colluding malicious) workers; if the server obtains those seeds, the correlated noise cancels and the guarantee degrades to local differential privacy.

Editorial extensions

If this is right

  • With a constant number of malicious workers ($f=O(1)$), CAFCOR's excess loss matches central differential privacy up to constants, as the leading term becomes $O(C^2 d\log(1/\delta)/(n^2\varepsilon^2))$.
  • Whenever $f$ grows sublinearly in $n$, the SecLDP rate remains strictly better than the local-DP minimax rate $\Theta(d/(n\varepsilon^2))$.
  • If pairwise shared randomness is unavailable, setting $\sigma_{\mathrm{cor}} = 0$ recovers a state-of-the-art LDP algorithm with the same $\tilde{\Theta}(d/(n\varepsilon^2))$ rate.
  • The CAF filter is essential to the trade-off: with coordinate-wise trimmed mean in its place, the convergence rate degrades to $\tilde{O}(fd/(n\varepsilon^2))$, which is $n$ times worse.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: SecLDP interpolates between LDP and CDP through the fraction of secrets withheld from the server, so tuning which pairwise seeds are exposed could yield a smooth privacy-utility trade-off curve for systems that trust some workers more than others.
  • Editorial inference: because CAF assumes only the bound $f$ and not a bound on the honest covariance, the correlated-noise-plus-filter recipe may transfer to other robust estimators (e.g., geometric median variants) as long as the Gaussian concentration argument that controls the momentum drift is preserved.
  • Editorial inference: an actively malicious server is the natural stress test for the seed-secrecy assumption; making the one-time seed exchange verifiable with lightweight cryptographic commitments would defend the SecLDP model without changing the proven rates.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 4 minor

Summary. This paper studies federated learning with an untrusted, honest-but-curious server and up to f Byzantine workers. It proposes CAFCOR, which combines correlated Gaussian noise (generated from pairwise shared randomness seeds) with a new robust aggregation rule called CAF. The main theoretical results are: (Theorem 4.1) a per-iteration Rényi privacy analysis yielding (ε,δ)-SecLDP against a server colluding with q ≤ f malicious workers, under an explicit noise condition; (Proposition 4.1) a high-dimensional robustness guarantee for CAF that does not require a bound on the honest covariance; and (Theorem 4.2 and Corollary 4.1) convergence rates for strongly convex and non-convex losses, giving an excess-error trade-off of O((f+1)d/(n^2 ε^2) + f/(n ε^2) + (f/n)G_cov^2) asymptotically in T. This rate matches central DP when f=O(1) and beats LDP when f is sublinear in n. The paper also reports experiments on MNIST and Fashion-MNIST comparing CAFCOR against LDP, CDP, and several robust aggregators.

Significance. If the central claim holds, the paper makes a significant contribution: it shows that pairwise shared randomness suffices to approach central-DP utility without a trusted server, while retaining Byzantine robustness. The privacy proof in Theorem 4.1 is a substantive new derivation: it computes the exact Rényi divergence for the correlated-noise covariance via Sherman-Morrison and handles partial collusion (q ≤ f) in a way not done in prior SecLDP analyses. The CAF filter is a novel, covariance-agnostic variant of the Filter algorithm, and the empirical section compares against multiple attacks and baselines. The main caveats are that the termination/complexity argument for CAF has a genuine gap (Major Comment 1) and that the experiments are run outside the theorem's privacy regime (Major Comment 2).

major comments (1)
  1. [§4.2 (Algorithm 2, Proposition 4.1)] Section 5 and Figure 1: the reported privacy budgets (ε=26.4, 27.8, 39.6 with δ=10^-4) are all larger than log(1/δ)≈9.21, while Theorem 4.1 only applies for ε∈(0, log(1/δ)). The paper does not acknowledge this mismatch or provide experiments in the theorem's valid regime. As a result, the abstract's claim that empirical results validate CAFCOR's practicality is not backed by tests within the proven privacy range. Please add experiments with ε in (0, log(1/δ)) or explain why the privacy estimate outside that range should be trusted (e.g., via the exact Rényi accountant of Lemma A.4).
minor comments (4)
  1. [Corollary 4.1] The heterogeneity term in the stated bound for ϱ is written as (f/n)G_cov^2, but Theorem 4.2 gives κ G_cov^2/μ; the factor 1/μ is omitted. Please state the dependence on problem constants (including μ) explicitly.
  2. [Appendix A (Lemma A.4)] The d-dimensional extension of the Rényi divergence computation is described as straightforward, but no formal statement is given. Please provide the reduction (e.g., showing that the covariance becomes A ⊗ I_d and the sensitivity vector is 2C e_i ⊗ u) to make the proof self-contained.
  3. [§4.2] The claim that the O(f nd log d) power-method variant satisfies Proposition 4.1 up to constants is made without proof; please add a brief justification or a precise reference.
  4. [§5 (Reproducibility)] The paper states that the authors 'intend to publicly release' the code; for a journal version, please release the code or provide a link, or describe the experimental setup in sufficient detail to allow replication.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; CAFCOR's proofs are self-contained derivations, and the self-citations are definitional or stylistic, not load-bearing.

full rationale

I walked the claimed derivation chain. Definition 2.2 imports the SecLDP formalism from Allouah et al. (2024), but that is a modeling choice, not evidence for the algorithm's guarantee. Theorem 4.1 is proved in Appendix A: Lemma A.4 computes the exact Rényi divergence of the correlated-noise mechanism using the Sherman-Morrison formula, and Lemma A.3 converts to DP via Mironov's standard composition results; no step substitutes the conclusion for an assumption. Corollary 4.1 chooses sigma_cor and sigma_ind explicitly to satisfy the privacy condition derived in Theorem 4.1 and then plugs them into the convergence rate of Theorem 4.2, which is an honest calculation, not a fit renamed as a prediction. The utility analysis is likewise self-contained: Proposition 4.1 is established by a termination argument and an external lemma from Zhu et al. (2022), and Lemmas C.1-C.3 are fully proved in Appendix C.6 using a covering argument and Gaussian concentration (Lemmas C.4 and C.6). Although the proof outline follows Allouah et al. (2023c), the paper reproduces all steps, and the comparison with SMEA/trimmed mean is not used to derive the main bound. The empirical section is a benchmark check, and the privacy budgets there lie outside the theorem's epsilon range, which is a scope mismatch rather than circularity. I therefore find no reduction of the central claims to their inputs.

Assumptions & free parameters 4 free parameters · 8 assumptions · 0 invented entities

The central claim depends on standard smoothness and bounded-variance assumptions, the honest-but-curious server model, and the secrecy of pairwise shared randomness. No new physical entities are introduced. The noise variances are free parameters set by the privacy budget, not fitted to data.

free parameters (4)
  • DP noise variances sigma_ind^2 and sigma_cor^2 = sigma_ind^2 = sigma_cor^2 = 32 C^2 T log(1/delta) / (epsilon^2 (n-f)) in Corollary 4.1
    Set by the privacy condition of Theorem 4.1; not fitted to data, but chosen to hit the target epsilon.
  • Clipping threshold C = C = 2.25 (MNIST), C = 1 (Fashion-MNIST), C = 5 (Section 5.2)
    Input hyperparameter that defines the gradient bound; in theory it is the Assumption 2.3 constant.
  • Learning rate gamma and momentum beta = gamma = 0.075, beta = 0.85 (MNIST); gamma = 0.3, beta = 0.9 (Fashion-MNIST)
    Hand-tuned hyperparameters; in theory beta_t = 1 - 24 L gamma_t.
  • Batch size b and iterations T = b = 50 or 100; T = 30 or 400 depending on experiment
    Standard experimental choices.
assumptions (8)
  • domain assumption Assumption 2.1: Bounded heterogeneity with parameter G_cov: (1/|H|) sum over honest i of <v, grad L_i(theta) - grad L_H(theta)>^2 <= G_cov^2 for all theta and all ||v|| <= 1.
    Used in Lemma C.1 to bound the momentum drift and hence the noise floor of the utility bound.
  • domain assumption Assumption 2.2: Bounded stochastic gradient variance with parameter sigma.
    Used in the convergence proof (Lemmas C.1, C.2, C.5).
  • domain assumption Assumption 2.3: Bounded per-example gradient norm C, so clipping is inactive and sensitivity is C.
    Needed for the DP sensitivity analysis and for the utility analysis to ignore clipping.
  • standard math L_H is L-smooth (and mu-strongly convex in one theorem); stochastic gradients are unbiased.
    Standard smooth optimization assumptions used throughout Appendix C.
  • domain assumption The server is honest-but-curious and does not deviate from the protocol; only the f malicious workers send arbitrary messages.
    Foundation of the threat model; a malicious server would break the privacy analysis.
  • domain assumption Each pair of participants shares a random seed, established before training over a secure channel, and the server does not know honest participants' seeds.
    This is the defining premise of SecLDP and is what makes the correlated noise un-cancelable.
  • standard math RDP composition and RDP-to-DP conversion (Mironov 2017).
    Used in the proof of Theorem 4.1.
  • standard math Zhu et al. 2022 Lemma 2.2: closeness of a filtered weighted mean to the good-set mean.
    Used in the proof of Proposition 4.1; a standard robust-statistics result.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Trustworthy Federated Learning with Untrusted Participants." pith.science (2026). https://pith.science/paper/522BISPZ

@misc{pith2026250501874,
  author       = {Pith},
  title        = {Pith review of: Towards Trustworthy Federated Learning with Untrusted Participants},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/522BISPZ}},
  note         = {Machine review of arXiv:2505.01874}
}
read the original abstract

Resilience against malicious participants and data privacy are essential for trustworthy federated learning, yet achieving both with good utility typically requires the strong assumption of a trusted central server. This paper shows that a significantly weaker assumption suffices: each pair of participants shares a randomness seed unknown to others. In a setting where malicious participants may collude with an untrusted server, we propose CafCor, an algorithm that integrates robust gradient aggregation with correlated noise injection, using shared randomness between participants. We prove that CafCor achieves strong privacy-utility trade-offs, significantly outperforming local differential privacy (DP) methods, which do not make any trust assumption, while approaching central DP utility, where the server is fully trusted. Empirical results on standard benchmarks validate CafCor's practicality, showing that privacy and robustness can coexist in distributed systems without sacrificing utility or trusting the server.

Figures

Figures reproduced from arXiv: 2505.01874 by the authors.

Figure 1
Figure 1. Comparison of CAFCOR and DSGD under four privacy threat models on (Fashion-)MNIST. There are n = 100 workers, including f = 5 and 10 malicious workers executing ALIE (Baruch et al., 2019). A homogeneous data distribution is considered among honest workers. User-level DP is used and privacy budgets for MNIST are ε = 26.4 and 27.8 for f = 10 and f = 5, respectively. For Fashion-MNIST, the privacy budget is ε = 39.6. T… view at source ↗
Figure 2
Figure 2. Performance of CAFCOR versus standard robust algorithms.There are f = 5 malicious workers among n = 15 on MNIST and α = 1, and f = 3 malicious workers among n = 13 on Fashion-MNIST and α = 0.1. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε, δ) = (13.7, 10−4 ) throughout. ing CDP and substantially outperforming LDP on both datasets. For f = 5, CAFCOR-SecLDP exhibits identi￾c… view at source ↗
Figure 3
Figure 3. Comparison of CAFCOR and DSGD under four privacy threat models on MNIST. There are n = 100 workers, including f = 5 malicious workers executing four attacks. A homogeneous data distribution is considered among honest workers. User-level DP is used and the aggregate privacy budget is (ϵ, δ) = (27.8, 10−4 ). 38 [PITH_FULL_IMAGE:figures/full_fig_p038_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Comparison of CAFCOR and DSGD under four privacy threat models on MNIST. There are n = 100 workers, including f = 10 malicious workers executing four attacks. A homogeneous data distribution is considered among honest workers. User-level DP is used and the aggregate pr…
Figure 5
Figure 5. Figure 5: Comparison of CAFCOR and DSGD under four privacy threat models on Fashion-MNIST. There are n = 100 workers, including f = 5 malicious workers executing four attacks. A homogeneous data distribution is considered among honest workers. User-level DP is used and the aggre…
Figure 6
Figure 6. Figure 6: Comparison of CAFCOR and DSGD under four privacy threat models on Fashion-MNIST. There are n = 100 workers, including f = 10 malicious workers executing four attacks. A homogeneous data distribution is considered among honest workers. User-level DP is used and the aggr…
Figure 7
Figure 7. Figure 7: Performance of CAFCOR versus standard robust algorithms on MNIST. There is f = 1 malicious worker among n = 11 workers, and we consider extreme heterogeneity among honest workers. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε,…
Figure 8
Figure 8. Figure 8: Performance of CAFCOR versus standard robust algorithms on MNIST. There are f = 3 malicious workers among n = 13 and α = 0.1. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε, δ) = (13.7, 10−4 ) throughout. 41 [PITH_FULL_IMAGE:f…
Figure 9
Figure 9. Figure 9: Performance of CAFCOR versus standard robust algorithms on MNIST. There are f = 5 malicious workers among n = 15 and α = 1. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε, δ) = (13.7, 10−4 ) throughout. Comparison with SMEA (Al…
Figure 10
Figure 10. Figure 10: Performance of CAFCOR versus standard robust algorithms on Fashion-MNIST. There are f = 1 malicious worker among n = 11, and we consider extreme heterogeneity among honest workers. The CDP privacy model is considered under example-level DP, and the privacy budget is (…
Figure 11
Figure 11. Figure 11: Performance of CAFCOR versus standard robust algorithms on Fashion-MNIST. There are f = 3 malicious workers among n = 13 and α = 0.1. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε, δ) = (13.7, 10−4 ) throughout. 43 [PITH_FUL…
Figure 12
Figure 12. Figure 12: Performance of CAFCOR versus standard robust algorithms on Fashion-MNIST. There are f = 5 malicious workers among n = 15 and α = 1. The CDP privacy model is considered under example-level DP, and the privacy budget is (ε, δ) = (13.7, 10−4 ) throughout. 44 [PITH_FULL_…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ByzFL: Research Framework for Robust Federated Learning

    cs.LG 2025-05 conditional novelty 6.0 of 10

    The paper introduces ByzFL, a modular open-source library for simulating, attacking, and benchmarking Byzantine-robust federated learning with a single JSON config.

Reference graph

Works this paper leans on

74 extracted references · 49 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Robust testing and estimation under manipulation attacks

    Acharya, J., Sun, Z., and Zhang, H. Robust testing and estimation under manipulation attacks. In International Conference on Machine Learning, pp.\ 43--53. PMLR, 2021

    work page 2021

  3. [3]

    T., Yu, F

    Agarwal, N., Suresh, A. T., Yu, F. X. X., Kumar, S., and McMahan, B. cpsgd: Communication-efficient and differentially-private distributed sgd. Advances in Neural Information Processing Systems, 31, 2018

    work page 2018

  4. [4]

    K., Tankala, P., Venkat, P., and Zhang, F

    Alabi, D., Kothari, P. K., Tankala, P., Venkat, P., and Zhang, F. Privately estimating a gaussian: Efficient, robust, and optimal. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing, pp.\ 483--496, 2023

    work page 2023

  5. [5]

    B yzantine-resilient non-convex stochastic gradient descent

    Allen-Zhu, Z., Ebrahimianghazani, F., Li, J., and Alistarh, D. B yzantine-resilient non-convex stochastic gradient descent. In International Conference on Learning Representations, 2020

    work page 2020

  6. [6]

    Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity

    Allouah, Y., Farhadkhani, S., Guerraoui, R., Gupta, N., Pinot, R., and Stephan, J. Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity. In International Conference on Artificial Intelligence and Statistics, pp.\ 1232--1300. PMLR, 2023 a

    work page 2023

  7. [7]

    Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity

    Allouah, Y., Guerraoui, R., Gupta, N., Pinot, R., and Rizk, G. Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity. In Thirty-seventh Conference on Neural Information Processing Systems, 2023 b

    work page 2023

  8. [8]

    On the privacy-robustness-utility trilemma in distributed learning

    Allouah, Y., Guerraoui, R., Gupta, N., Pinot, R., and Stephan, J. On the privacy-robustness-utility trilemma in distributed learning. In International Conference on Machine Learning, pp.\ 569--626. PMLR, 2023 c

    work page 2023

Show all 74 references
  1. [9]

    The privacy power of correlated noise in decentralized learning

    Allouah, Y., Koloskova, A., El Firdoussi, A., Jaggi, M., and Guerraoui, R. The privacy power of correlated noise in decentralized learning. In Proceedings of the 41st International Conference on Machine Learning, ICML, 2024

    2024

  2. [10]

    A little is enough: Circumventing defenses for distributed learning

    Baruch, G., Baruch, M., and Goldberg, Y. A little is enough: Circumventing defenses for distributed learning. In Wallach, H., Larochelle, H., Beygelzimer, A., d Alch\' e -Buc, F., Fox, E., and Garnett, R. (eds.), Advances in Neural Information Processing Systems, volume 32. Cu...

    2019

  3. [11]

    Private empirical risk minimization: Efficient algorithms and tight error bounds

    Bassily, R., Smith, A., and Thakurta, A. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th annual symposium on foundations of computer science, pp.\ 464--473. IEEE, 2014

    2014

  4. [12]

    and Tsitsiklis, J

    Bertsekas, D. and Tsitsiklis, J. Parallel and distributed computation: numerical methods. Athena Scientific, 2015

    2015

  5. [13]

    M., Guerraoui, R., and Stainer, J

    Blanchard, P., El Mhamdi, E. M., Guerraoui, R., and Stainer, J. Machine learning with adversaries: B yzantine tolerant gradient descent. In Guyon, I., Luxburg, U. V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (eds.), Advances in Neural Information ...

    2017

  6. [14]

    B., Patel, S., Ramage, D., Segal, A., and Seth, K

    Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., and Seth, K. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ...

    2017

  7. [15]

    Distributed statistical machine learning in adversarial settings: B yzantine gradient descent

    Chen, Y., Su, L., and Xu, J. Distributed statistical machine learning in adversarial settings: B yzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1 0 (2): 0 1--25, 2017

    2017

  8. [16]

    Distributed differential privacy via shuffling

    Cheu, A., Smith, A., Ullman, J., Zeber, D., and Zhilyaev, M. Distributed differential privacy via shuffling. In Advances in Cryptology--EUROCRYPT 2019: 38th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Darmstadt, Germany, May 19--...

    2019

  9. [17]

    Manipulation attacks in local differential privacy

    Cheu, A., Smith, A., and Ullman, J. Manipulation attacks in local differential privacy. In 2021 IEEE Symposium on Security and Privacy (SP), pp.\ 883--900. IEEE, 2021

    2021

  10. [18]

    Towards practical homomorphic aggregation in byzantine-resilient distributed learning

    Choffrut, A., Guerraoui, R., Pinot, R., Sirdey, R., Stephan, J., and Zuber, M. Towards practical homomorphic aggregation in byzantine-resilient distributed learning. In Proceedings of the 25th International Middleware Conference, Middleware '24, pp.\ 431–444, New York, NY, USA...

    2024

  11. [19]

    Differential privacy-enabled federated learning for sensitive health data

    Choudhury, O., Gkoulalas-Divanis, A., Salonidis, T., Sylla, I., Park, Y., Hsu, G., and Das, A. Differential privacy-enabled federated learning for sensitive health data. arXiv preprint arXiv:1910.02578, 2019

    1910 arXiv

  12. [20]

    and Boneh, D

    Corrigan-Gibbs, H. and Boneh, D. Prio: private, robust, and scalable computation of aggregate statistics. In Proceedings of the 14th USENIX Conference on Networked Systems Design and Implementation, NSDI'17, pp.\ 259–282, USA, 2017. USENIX Association. ISBN 9781931971379

    2017

  13. [21]

    a., Senior, A., Tucker, P., Yang, K., Le, Q., and Ng, A

    Dean, J., Corrado, G., Monga, R., Chen, K., Devin, M., Mao, M., Ranzato, M. a., Senior, A., Tucker, P., Yang, K., Le, Q., and Ng, A. Large scale distributed deep networks. In Pereira, F., Burges, C. J. C., Bottou, L., and Weinberger, K. Q. (eds.), Advances in Neural Informatio...

    2012

  14. [22]

    M., Li, J., Moitra, A., and Stewart, A

    Diakonikolas, I., Kamath, G., Kane, D. M., Li, J., Moitra, A., and Stewart, A. Being robust (in high dimensions) can be practical. In International Conference on Machine Learning, pp.\ 999--1008. PMLR, 2017

    2017

  15. [23]

    C., Jordan, M

    Duchi, J. C., Jordan, M. I., and Wainwright, M. J. Local privacy and statistical minimax rates. In 2013 IEEE 54th Annual Symposium on Foundations of Computer Science, pp.\ 429--438. IEEE, 2013

    2013

  16. [24]

    C., Jordan, M

    Duchi, J. C., Jordan, M. I., and Wainwright, M. J. Minimax optimal procedures for locally private estimation. Journal of the American Statistical Association, 113 0 (521): 0 182--201, 2018

    2018

  17. [25]

    Amplification by shuffling: From local to central differential privacy via anonymity

    Erlingsson, \'U ., Feldman, V., Mironov, I., Raghunathan, A., Talwar, K., and Thakurta, A. Amplification by shuffling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pp.\ 2468--2479. S...

    2019

  18. [26]

    B yzantine machine learning made easy by resilient averaging of momentums

    Farhadkhani, S., Guerraoui, R., Gupta, N., Pinot, R., and Stephan, J. B yzantine machine learning made easy by resilient averaging of momentums. In Chaudhuri, K., Jegelka, S., Song, L., Szepesvari, C., Niu, G., and Sabato, S. (eds.), Proceedings of the 39th International Confe...

    2022

  19. [27]

    Distributed robust learning, 2015

    Feng, J., Xu, H., and Mannor, S. Distributed robust learning, 2015

    2015

  20. [28]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Fredrikson, M., Jha, S., and Ristenpart, T. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS '15, pp.\ 1322–1333, New York, NY, USA, 2015. Associ...

    2015

  21. [29]

    R \'e nyi divergence measures for commonly used univariate continuous distributions

    Gil, M., Alajaji, F., and Linder, T. R \'e nyi divergence measures for commonly used univariate continuous distributions. Information Sciences, 249: 0 124--131, 2013

    2013

  22. [30]

    Dp-brem: differentially-private and byzantine-robust federated learning with client momentum

    Gu, X., Li, M., and Xiong, L. Dp-brem: differentially-private and byzantine-robust federated learning with client momentum. arXiv preprint arXiv:2306.12608, 2023

    2023 arXiv

  23. [31]

    Guerraoui, R., Gupta, N., Pinot, R., Rouault, S., and Stephan, J. Differential privacy and B yzantine resilience in sgd: Do they add up? In Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing, PODC'21, pp.\ 391–401, New York, NY, USA, 2021. Association...

    2021

  24. [32]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 770--778, 2016

    2016

  25. [33]

    Deep models under the gan: Information leakage from collaborative deep learning

    Hitaj, B., Ateniese, G., and Perez-Cruz, F. Deep models under the gan: Information leakage from collaborative deep learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS '17, pp.\ 603–618, New York, NY, USA, 2017. Association fo...

    2017

  26. [34]

    B., Kamath, G., and Majid, M

    Hopkins, S. B., Kamath, G., and Majid, M. Efficient mean estimation with pure differential privacy via a sum-of-squares exponential mechanism. In Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing, pp.\ 1406--1417, 2022

    2022

  27. [35]

    H., Qi, H., and Brown, M

    Hsu, T.-M. H., Qi, H., and Brown, M. Measuring the effects of non-identical data distribution for federated visual classification, 2019. URL https://arxiv.org/abs/1909.06335

    2019 arXiv

  28. [36]

    Personalized federated learning with differential privacy

    Hu, R., Guo, Y., Li, H., Pei, Q., and Gong, Y. Personalized federated learning with differential privacy. IEEE Internet of Things Journal, 7 0 (10): 0 9530--9539, 2020

    2020

  29. [37]

    M., Sarwate, A

    Imtiaz, H., Mohammadi, J., Silva, R., Baker, B., Plis, S. M., Sarwate, A. D., and Calhoun, V. D. A correlated noise-assisted decentralized differentially private estimation protocol, and its application to fmri source separation. volume 69, pp.\ 6355--6370, 2021. doi:10.1109/T...

    2021

  30. [38]

    Distributed learning without distress: Privacy-preserving empirical risk minimization

    Jayaraman, B., Wang, L., Evans, D., and Gu, Q. Distributed learning without distress: Privacy-preserving empirical risk minimization. Advances in Neural Information Processing Systems, 31, 2018

    2018

  31. [39]

    B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A

    Kairouz, P., McMahan, H. B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A. N., Bonawitz, K., Charles, Z., Cormode, G., Cummings, R., et al. Advances and open problems in federated learning. Foundations and Trends in Machine Learning , 14 0 (1--2): 0 1--210, 2021

    2021

  32. [40]

    A., Makowski, M

    Kaissis, G. A., Makowski, M. R., R \"u ckert, D., and Braren, R. F. Secure, privacy-preserving and federated machine learning in medical imaging. Nature Machine Intelligence, 2 0 (6): 0 305--311, 2020

    2020

  33. [41]

    Linear convergence of gradient and proximal-gradient methods under the polyak- ojasiewicz condition

    Karimi, H., Nutini, J., and Schmidt, M. Linear convergence of gradient and proximal-gradient methods under the polyak- ojasiewicz condition. In Joint European conference on machine learning and knowledge discovery in databases, pp.\ 795--811. Springer, 2016

    2016

  34. [42]

    P., Kale, S., Mohri, M., Reddi, S., Stich, S., and Suresh, A

    Karimireddy, S. P., Kale, S., Mohri, M., Reddi, S., Stich, S., and Suresh, A. T. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning, pp.\ 5132--5143. PMLR, 2020

    2020

  35. [43]

    P., He, L., and Jaggi, M

    Karimireddy, S. P., He, L., and Jaggi, M. Learning from history for B yzantine robust optimization. International Conference On Machine Learning, Vol 139, 139, 2021

    2021

  36. [44]

    P., He, L., and Jaggi, M

    Karimireddy, S. P., He, L., and Jaggi, M. B yzantine-robust learning on heterogeneous datasets via bucketing. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=jXKKDEi5vJt

    2022

  37. [45]

    P., Lee, H

    Kasiviswanathan, S. P., Lee, H. K., Nissim, K., Raskhodnikova, S., and Smith, A. What can we learn privately? SIAM Journal on Computing, 40 0 (3): 0 793--826, 2011

    2011

  38. [46]

    The B yzantine generals problem

    Lamport, L., Shostak, R., and Pease, M. The B yzantine generals problem. ACM Trans. Program. Lang. Syst., 4 0 (3): 0 382–401, jul 1982. ISSN 0164-0925. doi:10.1145/357172.357176. URL https://doi.org/10.1145/357172.357176

    1982

  39. [47]

    and Cortes, C

    LeCun, Y. and Cortes, C. MNIST handwritten digit database. 2010

    2010

  40. [48]

    Robust and differentially private mean estimation

    Liu, X., Kong, W., Kakade, S., and Oh, S. Robust and differentially private mean estimation. Advances in Neural Information Processing Systems, 34: 0 3887--3901, 2021

    2021

  41. [49]

    Differentially private B yzantine-robust federated learning

    Ma, X., Sun, X., Wu, Y., Liu, Z., Chen, X., and Dong, C. Differentially private B yzantine-robust federated learning. IEEE Transactions on Parallel and Distributed Systems, 2022

    2022

  42. [50]

    D., and Shmatikov, V

    Melis, L., Song, C., Cristofaro, E. D., and Shmatikov, V. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019 , pp.\ 691--706. IEEE , 2019. doi:10.1109/SP.2019.00029. ...

    2019

  43. [51]

    R \'e nyi differential privacy

    Mironov, I. R \'e nyi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pp.\ 263--275. IEEE, 2017

    2017

  44. [52]

    Nesterov, Y. et al. Lectures on convex optimization, volume 137. Springer, 2018

    2018

  45. [53]

    Differentially private federated learning on heterogeneous data

    Noble, M., Bellet, A., and Dieuleveut, A. Differentially private federated learning on heterogeneous data. In International Conference on Artificial Intelligence and Statistics, pp.\ 10110--10145. PMLR, 2022

    2022

  46. [54]

    Lecture notes: Statistics, optimization and algorithms in high dimension, 2020

    Pauwels, E. Lecture notes: Statistics, optimization and algorithms in high dimension, 2020

    2020

  47. [55]

    T., Aono, Y., Hayashi, T., Wang, L., and Moriai, S

    Phong, L. T., Aono, Y., Hayashi, T., Wang, L., and Moriai, S. Privacy-preserving deep learning: Revisited and enhanced. In Batten, L., Kim, D. S., Zhang, X., and Li, G. (eds.), Applications and Techniques in Information Security, pp.\ 100--110, Singapore, 2017. Springer Singap...

    2017

  48. [56]

    Rice, J. A. Mathematical statistics and data analysis. Cengage Learning, 2006

    2006

  49. [57]

    and H \"u tter, J.-C

    Rigollet, P. and H \"u tter, J.-C. High dimensional statistics. Lecture notes for course 18S997, 813 0 (814): 0 46, 2015

    2015

  50. [58]

    An accurate, scalable and verifiable protocol for federated differentially private averaging

    Sabater, C., Bellet, A., and Ramon, J. An accurate, scalable and verifiable protocol for federated differentially private averaging. Machine Learning, 111 0 (11): 0 4249--4293, 2022

    2022

  51. [59]

    How to share a secret

    Shamir, A. How to share a secret. Communications of the ACM, 22 0 (11): 0 612--613, 1979

    1979

  52. [60]

    Membership inference attacks against machine learning models

    Shokri, R., Stronati, M., and Shmatikov, V. Membership inference attacks against machine learning models. CoRR, abs/1610.05820, 2016

    2016 arXiv

  53. [61]

    Resilience: A criterion for learning in the presence of arbitrary outliers

    Steinhardt, J., Charikar, M., and Valiant, G. Resilience: A criterion for learning in the presence of arbitrary outliers. In 9th Innovations in Theoretical Computer Science Conference (ITCS 2018). Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2018

    2018

  54. [62]

    Introduction to the non-asymptotic analysis of random matrices

    Vershynin, R. Introduction to the non-asymptotic analysis of random matrices. arXiv preprint arXiv:1011.3027, 2010

    2010 arXiv

  55. [63]

    Beyond inferring class representatives: User-level privacy leakage from federated learning

    Wang, Z., Mengkai, S., Zhang, Z., Song, Y., Wang, Q., and Qi, H. Beyond inferring class representatives: User-level privacy leakage from federated learning. pp.\ 2512--2520, 04 2019. doi:10.1109/INFOCOM.2019.8737416

    2019

  56. [64]

    and Su, L

    Xiang, M. and Su, L. -stochastic sign sgd: A B yzantine resilient and differentially private gradient compressor for federated learning. arXiv preprint arXiv:2210.00665, 2022

    2022 arXiv

  57. [65]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms

    Xiao, H., Rasul, K., and Vollgraf, R. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  58. [66]

    Generalized B yzantine-tolerant sgd

    Xie, C., Koyejo, O., and Gupta, I. Generalized B yzantine-tolerant sgd. 2018

    2018

  59. [67]

    Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation

    Xie, C., Koyejo, O., and Gupta, I. Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation. In Adams, R. P. and Gogate, V. (eds.), Proceedings of The 35th Uncertainty in Artificial Intelligence Conference, volume 115 of Proceedings of Machine Learning Re...

    2020

  60. [68]

    Unraveling the connections between privacy and certified robustness in federated learning against poisoning attacks

    Xie, C., Long, Y., Chen, P.-Y., Li, Q., Koyejo, S., and Li, B. Unraveling the connections between privacy and certified robustness in federated learning against poisoning attacks. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 15...

    2023

  61. [69]

    B yzantine-robust distributed learning: Towards optimal statistical rates

    Yin, D., Chen, Y., Kannan, R., and Bartlett, P. B yzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pp.\ 5650--5659. PMLR, 2018

    2018

  62. [70]

    Opacus: User-friendly differential privacy library in pytorch, 2021

    Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggine, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., and Mironov, I. Opacus: User-friendly differential privacy library in pytorch, 2021. URL https://arxiv.org/abs/2109.12298

    2021 arXiv

  63. [71]

    BatchCrypt : Efficient homomorphic encryption for Cross-Silo federated learning

    Zhang, C., Li, S., Xia, J., Wang, W., Yan, F., and Liu, Y. BatchCrypt : Efficient homomorphic encryption for Cross-Silo federated learning. In 2020 USENIX Annual Technical Conference (USENIX ATC 20), pp.\ 493--506. USENIX Association, July 2020. ISBN 978-1-939133-14-4. URL htt...

    2020

  64. [72]

    Robust estimation via generalized quasi-gradients

    Zhu, B., Jiao, J., and Steinhardt, J. Robust estimation via generalized quasi-gradients. Information and Inference: A Journal of the IMA, 11 0 (2): 0 581--636, 2022

    2022

  65. [73]

    and Ling, Q

    Zhu, H. and Ling, Q. Bridging differential privacy and B yzantine-robustness via model aggregation. In Raedt, L. D. (ed.), Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22 , pp.\ 2427--2433. International Joint Conferences on ...

    2022 doi

  66. [74]

    Deep leakage from gradients

    Zhu, L., Liu, Z., and Han, S. Deep leakage from gradients. In Wallach, H., Larochelle, H., Beygelzimer, A., d Alch\' e -Buc, F., Fox, E., and Garnett, R. (eds.), Advances in Neural Information Processing Systems 32, pp.\ 14774--14784. Curran Associates, Inc., 2019

    2019

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.