Pith. sign in

REVIEW 4 major objections 4 minor 79 references

Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updates

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single poisoned client can reconstruct other clients' training data, and some defenses make the leak worse.

desk verdict A novel threat model with an intriguing defense-backfire result, but the reconstruction objective as written doesn't isolate the attacker's own update, and the theory doesn't model the poisoning; major revision needed before the headline claims hold. read the letter →

arxiv 2506.11413 v1 pith:5OEG3GF4 submitted 2025-06-13 cs.LG cs.CR

Kai Yue , Richeng Jin , Chau-Wai Wong , Huaiyu Dai This is my paper · ORCID
classification cs.LGcs.CR
keywords federatedlearningdatareconstructionattackgradientinversionmaliciouslycuriousclientByzantinerobustnessdifferentialprivacyrobustaggregationleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that federated learning has a blind spot where a single adversarial client can do both: poison its own updates like a Byzantine attacker and, in the same breath, use the observed global updates to reconstruct other clients' private training data. Its formal contribution is a threat model for this 'maliciously curious client' plus a bound showing that reconstruction error shrinks as the model becomes less trained. Its practical contribution is an algorithm that combines gradient inversion with sign-flipping, Gaussian, or backdoor poisoning, and experiments showing low RMSE on MNIST and Fashion-MNIST even under robust aggregation and local differential privacy. The paper further claims that standard defenses can backfire: local DP noise is not monotonic in privacy, and some server- or client-side defenses lower reconstruction error by 10-15% compared to no defense. If these claims hold, FL designers cannot treat robustness and privacy as separate problems and need new defenses.

What carries the argument

The load-bearing mechanism is the reconstruction objective of Eq. (22): the attacker randomly initializes latent codes, decodes them into dummy images with a pretrained autoencoder, computes dummy gradients for all $M$ clients, and minimizes $\|\Phi_q(\{\bar{g}_m\}) - g^{(k)}\|^2$ over a set of surrogate aggregation functions $\Phi_q$ (FedAvg, soft median, pseudo-Krum). This lets the attacker invert the observed aggregate gradient without knowing the server's defense exactly. The attack is driven by poisoning functions $p(\cdot)$—sign flipping, Gaussian noise, backdoor patterns—whose main effect, per Conjecture C-1 and Theorem 1, is to slow the model's convergence and shrink the objective gap $\Delta^{(k+1)}$, making gradients easier to invert. Theorem 1 supplies the formal link: reconstruction RMSE is bounded by terms proportional to the objective gap, the DP noise level, and a base error $e^{(0)}$.

What would settle it

A direct test is to rerun the attack with the attacker's own poisoned update removed from the aggregate gradient before inversion: if the low RMSE values collapse to the passive-listener baseline once $g^{(k)}$ contains only the other $M-1$ clients' contributions, then the claim that peers' data are being reconstructed is not established. A complementary test is to check whether reconstruction RMSE stays low under a fully converged model with a large number of clients, since Theorem 1 predicts error grows with convergence.

Watch

Extended reading notes

Core claim

The paper's central claim is that a single maliciously curious client—a participant who poisons its own gradient updates but has no access to any other client's data or gradients—can reconstruct the training images of its peers during federated learning. The attack works by combining gradient inversion with model poisoning: the attacker observes the global model updates, computes the aggregate gradient $g^{(k)} = (w^{(k)} - w^{(k+1)})/\eta$, and inverts it using an autoencoder while also sending poisoned updates that keep the model under-trained. The paper proves an upper bound on reconstruction error showing that the error grows with model convergence and noise, and it reports experiments on MNIST and Fashion-MNIST with 10 clients in which sign flipping, Gaussian, and backdoor poisoning lower the error below a passive-listener baseline. It concludes that both server-side robust aggregation (Krum, Median, DnC, FreqFed) and client-side differential privacy can fail against this attacker and that misconfigured defenses can improve reconstructed image quality by 10-15% over no defense.

Load-bearing premise

The paper's central premise is that the attacker's reconstruction objective, which fits dummy gradients for all M clients to the aggregate gradient that includes the attacker's own poisoned update, still recovers peers' data even though that self-contribution is never subtracted or masked.

Editorial extensions

If this is right

  • A curious client needs only its own poisoned update and the broadcast global model to attempt reconstruction of peers' training data.
  • Local differential privacy should not be treated as a monotonic privacy knob under this threat: in early training rounds, larger DP noise can produce lower reconstruction error.
  • Byzantine-robust aggregation rules can reduce privacy risk in some cases, but selecting the wrong rule—or combining it with DP incorrectly—can make reconstruction easier than with no defense.
  • Reconstruction quality is sensitive to model initialization and the inversion algorithm, so defense evaluations should report these choices rather than assume a universal baseline.
  • A mistakenly used defense can improve reconstructed image quality by 10-15% over the no-defense baseline, so test accuracy alone does not indicate privacy protection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: a direct follow-up is to rerun Eq. (22) with the attacker's own poisoned gradient removed from $g^{(k)}$; this would show whether the reported RMSE is purely about peers' data or partly about the attacker's own data.
  • Editorial extension: because the attacker optimizes over surrogate aggregation functions, hiding, randomizing, or certifiably obfuscating the server's aggregation rule is a testable defense direction the paper does not explore.
  • Editorial extension: the same 'keep the model under-trained, then invert the aggregate' recipe may transfer to text or tabular FL tasks, but the paper's evidence is limited to image classification with 10 clients.
  • Editorial extension: the results imply that privacy audits should include an adversarial client and track reconstruction error, not just test accuracy, when choosing FL defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces a client-side threat model for federated learning called the 'maliciously curious client': a single participant poisons its own updates while attempting to reconstruct other clients' training data from the broadcast global model. The authors define the threat model, present Theorem 1 as a theoretical bound on reconstruction error under FedSGD with local differential privacy, and propose a practical attack that combines gradient inversion with poisoning strategies such as sign flipping, Gaussian noise, and backdoor injection. Experiments on MNIST and Fashion-MNIST evaluate the attack under server-side robust aggregation (Krum, Median, DnC, FreqFed), client-side local DP, and combinations of both, claiming that defenses can fail or even amplify privacy leakage. The central theme—that robustness and privacy defenses are not independent—is interesting and worth investigating, but the theoretical result does not cover the poisoning component, the proof contains a gap, and the empirical reconstruction metric is not precisely tied to peer data because the optimization objective fits the attacker's own contribution as well.

Significance. The proposed threat model occupies a genuinely underexplored intersection between Byzantine robustness and gradient-inversion privacy attacks, and the experimental comparison across multiple defenses is broad and informative. If the central claims were fully supported, the paper would be a useful contribution to the growing literature on privacy leakage in federated learning. However, the theoretical guarantee in Theorem 1 is not a demonstration of the maliciously curious attack: it bounds passive reconstruction error under DP noise, and its proof assumes monotone loss decrease that DP noise does not guarantee. The reconstruction objective in Eq. (22) fits the aggregate gradient including the attacker's own poisoned update without subtracting it, so the reported peer-reconstruction RMSE is not well defined. The authors are careful to label the attack strategies C-1 through C-3 as conjectures, but the abstract claims stronger theoretical support than the paper actually provides. These are load-bearing issues that require substantial revision rather than minor polishing.

major comments (4)
  1. [§4.2 and Appendix A, Eq. (37f)] The proof of Theorem 1 is not valid as written. Step ③ of Eq. (37f) uses f(w(1)) ≤ f(w(0)) and f(w(k+1)) ≤ f(w(k)) as if the loss decreased monotonically, but local DP noise makes this false: the descent bound in Eq. (30) contains a positive noise term η²L_g d C²σ²/(2MB²), so the expected loss can increase between rounds. The subsequent bound on E‖g(0) − g(k)‖² depends on this monotonicity, and without it the theorem's inequality is unproved. Moreover, Theorem 1 applies to the aggregate gradient g(k) under DP but never includes the attacker's poisoning function p(·); it therefore does not establish that malicious updates improve reconstruction, which is the paper's central theoretical claim.
  2. [§4.3, Eqs. (22) and (14)] The reconstruction objective (22) minimizes over dummy codes for all M clients the discrepancy between Φ_q({˘g_m}) and g(k), where g(k) is the aggregate of all client updates including the attacker's own poisoned update. The paper never subtracts or fixes the attacker's known contribution, nor does it specify which of the M recovered batches are scored against which peer's data in Eq. (14). Under sign flipping (Example 3), the attacker's update can dominate the aggregate; the least-squares match can then be satisfied largely by reproducing the attacker's own gradient, and the optimized 'peer' images need not contain peer information. The RMSE curves in Figures 2–5 are therefore not well-defined measures of peer reconstruction unless a peer-only objective is specified.
  3. [§4.2, Eq. (17) and Remark 3] Theorem 1 does not demonstrate 'significant reconstruction success' because the bound is dominated by e(0), the reconstruction error of the same algorithm on the initial gradient g(0). If e(0) is large, the bound is vacuous; if e(0) is small, success is assumed rather than derived. The theorem also wraps the bound in O(·) while taking a min with the trivial bound 2υ√din, so the stated guarantee reduces to 'error grows at most like the initial error plus accumulated gradient movement.' Without a bound on e(0) in terms of problem parameters, the abstract's claim of a theoretical demonstration of attack feasibility is unsupported.
  4. [Abstract and §4.3, C-1 to C-3] The abstract and introduction state that the paper provides a theoretical analysis demonstrating the feasibility and effectiveness of the attack, but Section 4.3 explicitly labels C-1 through C-3 as conjectures, and they are validated only empirically. The only theorem concerns FedSGD with DP and passive reconstruction; it does not cover poisoning, FedAvg, or the specific reconstruction algorithm in Eq. (22). The wording should be softened to match the actual contribution, or the theory must be extended to include the poisoning component.
minor comments (4)
  1. [§4.1] The sentence 'In the context of this paper, In the context of this paper,' repeats the phrase 'In the context of this paper' twice and should be corrected.
  2. [§4.3, Eq. (22)] The text says 'Φq operates on the scaler inputs'; 'scaler' should be 'scalar'.
  3. [§5] The experimental section never states how many peer images N appear in Eq. (14) or how the M×B reconstructed dummy images are mapped to the peers being scored; this should be specified even after the peer-only objective is clarified.
  4. [§5.5, Figure 6] The qualitative comparison in Figure 6 reports only mean RMSE values without error bars or run counts; since all other results are averaged over five runs, a similar treatment would be consistent.

Circularity Check

1 steps flagged · score 6.0 of 10

The reconstruction objective in Eq. (22) fits the aggregate gradient that contains the attacker's own poisoned update, so the reported 'peer reconstruction' RMSE is not separated from self-fitting.

  1. self definitional [Section 4.3, Eq. (22) and Eq. (13)]
    "The client attacker first participates in two consecutive rounds of training and obtains the global models w(k) and w(k+1) broadcast by the server to calculate the aggregated gradient g(k) = ( w(k) − w(k+1))/η. ... Accordingly, the objective function of the maliciously curious client may be written as min_{q∈{0,1,...,Q}, {z^{(k)}_{m,i} | m∈[M], i∈[B]}} ∥Φq({g˘^{(k)}_m}^M_{m=1}) − g^{(k)}∥^2. (22)"

    Under FedAvg, w(k+1) is the average of all uploaded updates, so the g(k) in Eq. (13) includes the malicious client's own poisoned update (for example, p1(g) = -κg in Eq. (23)). Eq. (22) then optimizes dummy codes for all M clients, not just the M-1 peers, against this g(k), and no term subtracts or fixes the attacker's known self-contribution. Because the attacker knows its own update and data, and can make that update dominate the aggregate, the least-squares objective can be driven down by reproducing the attacker's own gradient with its own dummy batch, while the peer dummy batches need not contain peer information. The reported RMSE in Eq.

full rationale

The paper's central empirical claim is that a single maliciously curious client reconstructs peers' training data, and that defenses may amplify leakage by 10-15%. The derivation chain for this claim runs through Eq. (22), whose optimization target g(k) is the aggregate global-model difference observed between two rounds. That aggregate contains the attacker's own manipulated update by construction. The paper optimizes dummy gradients for all M clients against this aggregate without isolating the attacker's contribution, so a low value of the objective can be achieved by matching the known self-gradient alone. Consequently, the RMSE reported as 'peer reconstruction' is ambiguous and may reflect self-fitting rather than leakage of benign-client data. This is a genuine circularity in the central evaluation, not merely a missing baseline. The Theorem 1 upper bound, in contrast, is a true inequality and not circular; it is, however, weak because it carries the unquantified base error e(0) and unknown Lipschitz constants, so by itself it does not establish 'significant reconstruction success.' The only self-citation, the suggestion to explore stochastic sign-based SGD [71], is not load-bearing. Therefore the paper receives a score of 6: a central 'prediction' reduces by construction to an objective that includes the attacker's own input.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several idealizations: unquantified Lipschitz constants, an imposed norm equality for reconstructed data, a monotone-descent assumption that DP noise may violate, an unproven surrogacy assumption for server defenses, and an extrapolation from FedSGD to FedAvg. The most important gap is that Theorem 1 never includes the attacker's malicious update, which is the defining feature of the proposed threat.

free parameters (3)
  • Adam learning rate for reconstruction optimization = selected from {1e-4, 3e-3, 1e-3, 3e-3, 1e-2} via validation (Appendix C)
    Reconstruction RMSE, the main evidence for attack success, depends on this choice; the paper does not report the selected value or a sensitivity study.
  • Poisoning hyperparameters (sign-flipping scale kappa, Gaussian noise sigma_zeta) = not reported; 'default parameters in the respective papers'
    The conclusion that poisoning slows training and amplifies leakage depends on these values; without them the attack strength cannot be reproduced or compared.
  • Soft-median temperature T (Eq. 18a) = not reported
    The surrogate aggregation used by the attacker to simulate Median requires T; no value or selection rule is given.
assumptions (5)
  • domain assumption Gradients of all local objectives and reconstruction functions psi_i are Lipschitz continuous (Assumption 1, Eqs. 15-16).
    Used to bound reconstruction error by cumulative gradient movement in Theorem 1; the actual autoencoder-based reconstruction function is not shown to satisfy the assumed Lipschitz constant.
  • ad hoc to paper Input data and reconstructed data have the same norm upsilon (Assumption 2).
    Needed to cap the error at 2*upsilon; reconstructed images from the autoencoder need not have the same norm as the true inputs, and the attacker cannot enforce this.
  • ad hoc to paper The objective decreases monotonically under local DP noise: f(w(1)) <= f(w(0)) and f(w(k+1)) <= f(w(k)).
    Used in Appendix A, Eq. (37f) as 'the descent lemma'; DP noise can increase the loss, so this step is not guaranteed and the cumulative bound is not established as written.
  • domain assumption The attacker can choose a surrogate aggregation function Phi_q that is close to the server's unknown defense (Eq. 22).
    The attack optimizes over a finite set of surrogates; there is no guarantee the true robust aggregation is represented, which underpins all defense experiments.
  • domain assumption The FedSGD theorem extends to FedAvg with tau=5 and client heterogeneity.
    Theorem 1 is proven for FedSGD; Remark 5 says extension is left for future study, while experiments use FedAvg with tau=5, so the theoretical bound does not directly cover the evaluated setting.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updates." pith.science (2026). https://pith.science/paper/5OEG3GF4

@misc{pith2026250611413,
  author       = {Pith},
  title        = {Pith review of: Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updates},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5OEG3GF4}},
  note         = {Machine review of arXiv:2506.11413}
}
read the original abstract

Federated learning (FL) enables decentralized machine learning without sharing raw data, allowing multiple clients to collaboratively learn a global model. However, studies reveal that privacy leakage is possible under commonly adopted FL protocols. In particular, a server with access to client gradients can synthesize data resembling the clients' training data. In this paper, we introduce a novel threat model in FL, named the maliciously curious client, where a client manipulates its own gradients with the goal of inferring private data from peers. This attacker uniquely exploits the strength of a Byzantine adversary, traditionally aimed at undermining model robustness, and repurposes it to facilitate data reconstruction attack. We begin by formally defining this novel client-side threat model and providing a theoretical analysis that demonstrates its ability to achieve significant reconstruction success during FL training. To demonstrate its practical impact, we further develop a reconstruction algorithm that combines gradient inversion with malicious update strategies. Our analysis and experimental results reveal a critical blind spot in FL defenses: both server-side robust aggregation and client-side privacy mechanisms may fail against our proposed attack. Surprisingly, standard server- and client-side defenses designed to enhance robustness or privacy may unintentionally amplify data leakage. Compared to the baseline approach, a mistakenly used defense may instead improve the reconstructed image quality by 10-15%.

Figures

Figures reproduced from arXiv: 2506.11413 by the authors.

Figure 1
Figure 1. Illustration of FL systems under different threat and defense scenarios. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Reconstruction error versus the number of communication rounds [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Reconstruction error versus the number of communication rounds [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Reconstruction error versus the number of communication rounds [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 6
Figure 6. Figure 6: Comparison of the reconstructed images using the proposed attack [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 5
Figure 5. Figure 5: Reconstruction error versus the number of communication rounds [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 74 canonical work pages

  1. [1]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , “Advances and open problems in federated learning,” Foundations and Trends in Machine Learning , vol. 14, no. 1, 2021

    work page 2021

  2. [2]

    Federated learning review: Fundamen- tals, enabling technologies, and future applications,

    S. Banabilah, M. Aloqaily, E. Alsayed, N. Malik, and Y . Jararweh, “Federated learning review: Fundamen- tals, enabling technologies, and future applications,” Information Processing & Management, vol. 59, no. 6, p. 103061, 2022

    work page 2022

  3. [3]

    A survey of trustworthy federated learning: Issues, solutions, and challenges,

    Y . Zhang, D. Zeng, J. Luo, X. Fu, G. Chen, Z. Xu, and I. King, “A survey of trustworthy federated learning: Issues, solutions, and challenges,” ACM Transactions on Intelligent Systems and Technology , vol. 15, no. 6, pp. 1–47, 2024

    work page 2024

  4. [4]

    Trustworthy federated learn- ing: Privacy, security, and beyond,

    C. Chen, J. Liu, H. Tan, X. Li, K. I.-K. Wang, P. Li, K. Sakurai, and D. Dou, “Trustworthy federated learn- ing: Privacy, security, and beyond,” Knowledge and Information Systems , vol. 67, no. 3, pp. 2321–2356, 2025

    work page 2025

  5. [5]

    Deep leakage from gra- dients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gra- dients,” in Advances in Neural Information Processing Systems, 2019

    work page 2019

  6. [6]

    iDLG: Im- proved deep leakage from gradients

    B. Zhao, K. R. Mopuri, and H. Bilen, “iDLG: Im- proved deep leakage from gradients.” arXiv preprint arXiv:2001.02610, 2020

    arXiv 2001

  7. [7]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 16 337–16 346

    work page 2021

  8. [8]

    SoK: On gradient leakage in federated learning,

    J. Du, J. Hu, Z. Wang, P. Sun, N. Z. Gong, K. Ren, and C. Chen, “SoK: On gradient leakage in federated learning,” in USENIX Security Symposium , 2025

    work page 2025

Show all 79 references
  1. [9]

    More than enough is too much: Adaptive defenses against gradient leakage in production federated learning,

    F. Wang, E. Hugh, and B. Li, “More than enough is too much: Adaptive defenses against gradient leakage in production federated learning,” IEEE/ACM Transac- tions on Networking , 2024

    2024

  2. [10]

    Fishing for user data in large-batch federated learning via gradient magnification,

    Y . Wen, J. Geiping, L. Fowl, M. Goldblum, and T. Goldstein, “Fishing for user data in large-batch federated learning via gradient magnification,” in In- ternational Conference on Machine Learning , 2022, pp. 23 668–23 684

    2022

  3. [11]

    When the curious abandon honesty: Federated learning is not private,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “When the curious abandon honesty: Federated learning is not private,” in IEEE European Symposium on Security and Privacy (EuroS&P) , 2023, pp. 175–199

    2023

  4. [12]

    Hiding in plain sight: Disguising data stealing attacks in federated learning,

    K. Garov, D. I. Dimitrov, N. Jovanovi´c, and M. Vechev, “Hiding in plain sight: Disguising data stealing attacks in federated learning,” in International Conference on Learning Representations, 2024

    2024

  5. [13]

    Privacy and robustness in federated learning: Attacks and defenses,

    L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and S. Y . Philip, “Privacy and robustness in federated learning: Attacks and defenses,” IEEE transactions on neural networks and learning systems , 2022

    2022

  6. [14]

    Challenges and approaches for mitigating Byzantine attacks in federated learning,

    J. Shi, W. Wan, S. Hu, J. Lu, and L. Y . Zhang, “Challenges and approaches for mitigating Byzantine attacks in federated learning,” in International Confer- ence on Trust, Security and Privacy in Computing and Communications, 2022, pp. 139–146

    2022

  7. [15]

    Back to the drawing board: A critical eval- uation of poisoning attacks on production federated learning,

    V . Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ra- mage, “Back to the drawing board: A critical eval- uation of poisoning attacks on production federated learning,” in IEEE Symposium on Security and Pri- vacy, 2022, pp. 1354–1371

    2022

  8. [16]

    An experimen- tal study of Byzantine-robust aggregation schemes in federated learning,

    S. Li, E. C.-H. Ngai, and T. V oigt, “An experimen- tal study of Byzantine-robust aggregation schemes in federated learning,” IEEE Transactions on Big Data , 2023

    2023

  9. [17]

    Communication-efficient learn- ing of deep networks from decentralized data,

    H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learn- ing of deep networks from decentralized data,” in International Conference on Artificial Intelligence and Statistics, 2017

    2017

  10. [18]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, R. Guerraoui, J. Stainer et al., “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Process- ing Systems, 2017

    2017

  11. [19]

    Byzantine-robust distributed learning: Towards opti- mal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards opti- mal statistical rates,” in International Conference on Machine Learning, 2018

    2018

  12. [20]

    A systematic review of ho- momorphic encryption and its contributions in health- care industry,

    K. Munjal and R. Bhatia, “A systematic review of ho- momorphic encryption and its contributions in health- care industry,” Complex & Intelligent Systems , vol. 9, no. 4, pp. 3759–3786, 2023

    2023

  13. [21]

    ELSA: Secure aggregation for federated learning with ma- licious actors,

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa, “ELSA: Secure aggregation for federated learning with ma- licious actors,” in IEEE Symposium on Security and Privacy (SP), 2023, pp. 1961–1979

    2023

  14. [22]

    Gradient-leakage resilient federated learning,

    W. Wei, L. Liu, Y . Wut, G. Su, and A. Iyengar, “Gradient-leakage resilient federated learning,” in In- ternational Conference on Distributed Computing Sys- tems, 2021

    2021

  15. [23]

    Does differential privacy really protect fed- erated learning from gradient leakage attacks?

    J. Hu, J. Du, Z. Wang, X. Pang, Y . Zhou, P. Sun, and K. Ren, “Does differential privacy really protect fed- erated learning from gradient leakage attacks?” IEEE Transactions on Mobile Computing , 2024

    2024

  16. [24]

    Manipulating the Byzantine: Optimizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the Byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in Network and Dis- tributed System Security Symposium , 2021

    2021

  17. [25]

    FLTrust: Byzantine-robust federated learning via trust bootstrap- ping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrap- ping,” in Network and Distributed System Security Symposium, 2021

    2021

  18. [26]

    Byzantine-robust decentralized federated learning,

    M. Fang, Z. Zhang, Hairi, P. Khanduri, J. Liu, S. Lu, Y . Liu, and N. Gong, “Byzantine-robust decentralized federated learning,” in ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 2874–2888

    2024

  19. [27]

    On the privacy-robustness-utility trilemma in distributed learning,

    Y . Allouah, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “On the privacy-robustness-utility trilemma in distributed learning,” in International Conference on Machine Learning, 2023, pp. 569–626

    2023

  20. [28]

    Fed- erated learning: Challenges, methods, and future di- rections,

    T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Fed- erated learning: Challenges, methods, and future di- rections,” IEEE Signal Processing Magazine , vol. 37, no. 3, pp. 50–60, 2020

    2020

  21. [29]

    Inverting gradients – How easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients – How easy is it to break privacy in federated learning?” in Advances in Neural Information Processing Systems , 2020

    2020

  22. [30]

    Truth serum: Poisoning machine learning models to reveal their secrets,

    F. Tram `er, R. Shokri, A. San Joaquin, H. Le, M. Jagiel- ski, S. Hong, and N. Carlini, “Truth serum: Poisoning machine learning models to reveal their secrets,” in ACM SIGSAC Conference on Computer and Commu- nications Security, 2022, pp. 2779–2792

    2022

  23. [31]

    Membership inference attacks against machine learn- ing models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learn- ing models,” in IEEE Symposium on Security and Privacy (SP), 2017

    2017

  24. [32]

    Membership inference attacks and defenses in fed- erated learning: A survey,

    L. Bai, H. Hu, Q. Ye, H. Li, L. Wang, and J. Xu, “Membership inference attacks and defenses in fed- erated learning: A survey,” ACM Computing Surveys , vol. 57, no. 4, pp. 1–35, 2024

    2024

  25. [33]

    Compre- hensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Compre- hensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in IEEE Symposium on Secu- rity and Privacy (SP) , 2019, pp. 739–753

    2019

  26. [34]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in IEEE Symposium on Security and Privacy (SP), 2019, pp. 691–706

    2019

  27. [35]

    Deep models under the GAN: Information leakage from collabora- tive deep learning,

    B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the GAN: Information leakage from collabora- tive deep learning,” in ACM SIGSAC Conference on Computer and Communications Security , 2017, pp. 603–618

    2017

  28. [36]

    FedInverse: Evaluating privacy leak- age in federated learning,

    D. Wu, J. Bai, Y . Song, J. Chen, W. Zhou, Y . Xiang, and A. Sajjanhar, “FedInverse: Evaluating privacy leak- age in federated learning,” in International Conference on Learning Representations , 2024

    2024

  29. [37]

    Rethinking privacy preserving deep learning: How to evaluate and thwart privacy attacks,

    L. Fan, K. W. Ng, C. Ju, T. Zhang, C. Liu, C. S. Chan, and Q. Yang, “Rethinking privacy preserving deep learning: How to evaluate and thwart privacy attacks,” Federated Learning: Privacy and Incentive , pp. 32–50, 2020

    2020

  30. [38]

    The resource problem of using linear layer leakage attack in federated learn- ing,

    J. C. Zhao, A. R. Elkordy, A. Sharma, Y . H. Ezzeldin, S. Avestimehr, and S. Bagchi, “The resource problem of using linear layer leakage attack in federated learn- ing,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 3974–3983

    2023

  31. [39]

    FedSecurity: A benchmark for attacks and defenses in federated learning and federated LLMs,

    S. Han, B. Buyukates, Z. Hu, H. Jin, W. Jin, L. Sun, X. Wang, W. Wu, C. Xie, Y . Yao et al., “FedSecurity: A benchmark for attacks and defenses in federated learning and federated LLMs,” in ACM Conference on Knowledge Discovery and Data Mining , 2024, pp. 5070–5081

    2024

  32. [40]

    Fall of empires: Breaking byzantine-tolerant SGD by inner product ma- nipulation,

    C. Xie, O. Koyejo, and I. Gupta, “Fall of empires: Breaking byzantine-tolerant SGD by inner product ma- nipulation,” in Uncertainty in Artificial Intelligence , 2020, pp. 261–270

    2020

  33. [41]

    3dFed: Adaptive and extensible framework for covert backdoor attack in federated learning,

    H. Li, Q. Ye, H. Hu, J. Li, L. Wang, C. Fang, and J. Shi, “3dFed: Adaptive and extensible framework for covert backdoor attack in federated learning,” in IEEE Symposium on Security and Privacy (SP) , 2023

    2023

  34. [42]

    Data and model poisoning backdoor attacks on wireless federated learning, and the defense mecha- nisms: A comprehensive survey,

    Y . Wan, Y . Qu, W. Ni, Y . Xiang, L. Gao, and E. Hos- sain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mecha- nisms: A comprehensive survey,” IEEE Communica- tions Surveys & Tutorials , vol. 26, no. 3, pp. 1861– 1897, 2024

    2024

  35. [43]

    Byzantines can also learn from history: Fall of cen- tered clipping in federated learning,

    K. ¨Ozfatura, E. ¨Ozfatura, A. K ¨upc ¸¨u, and D. G ¨und¨uz, “Byzantines can also learn from history: Fall of cen- tered clipping in federated learning,” IEEE Transac- tions on Information Forensics and Security , 2023

    2023

  36. [44]

    AgrEvader: Poisoning membership inference against Byzantine-robust federated learning,

    Y . Zhang, G. Bai, M. A. P. Chamikara, M. Ma, L. Shen, J. Wang, S. Nepal, M. Xue, L. Wang, and J. Liu, “AgrEvader: Poisoning membership inference against Byzantine-robust federated learning,” in ACM Web Conference, 2023, pp. 2371–2382

    2023

  37. [45]

    Loden: Making every client in federated learning a defender against the poisoning membership inference attacks,

    M. Ma, Y . Zhang, P. C. M. Arachchige, L. Y . Zhang, M. B. Chhetri, and G. Bai, “Loden: Making every client in federated learning a defender against the poisoning membership inference attacks,” in ACM Asia Conference on Computer and Communications Secu- rity, 2023

    2023

  38. [46]

    Understanding clipping for federated learning: Con- vergence and client-level differential privacy,

    X. Zhang, X. Chen, M. Hong, Z. S. Wu, and J. Yi, “Understanding clipping for federated learning: Con- vergence and client-level differential privacy,” in Inter- national Conference on Machine Learning , 2022

    2022

  39. [47]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in ACM SIGSAC Conference on Computer and Communications Security , 2016

    2016

  40. [48]

    User-level privacy-preserving feder- ated learning: Analysis and performance optimization,

    K. Wei, J. Li, M. Ding, C. Ma, H. Su, B. Zhang, and H. V . Poor, “User-level privacy-preserving feder- ated learning: Analysis and performance optimization,” IEEE Transactions on Mobile Computing , 2021

    2021

  41. [49]

    Federated latent dirich- let allocation: A local differential privacy based frame- work,

    Y . Wang, Y . Tong, and D. Shi, “Federated latent dirich- let allocation: A local differential privacy based frame- work,” in AAAI Conference on Artificial Intelligence , vol. 34, no. 04, 2020, pp. 6283–6290

    2020

  42. [50]

    The distributed discrete gaussian mechanism for federated learning with secure aggregation,

    P. Kairouz, Z. Liu, and T. Steinke, “The distributed discrete gaussian mechanism for federated learning with secure aggregation,” in International Conference on Machine Learning , 2021, pp. 5201–5212

    2021

  43. [51]

    Differentially-private fed- erated linear bandits,

    A. Dubey and A. Pentland, “Differentially-private fed- erated linear bandits,” Advances in Neural Information Processing Systems, vol. 33, pp. 6003–6014, 2020

    2020

  44. [52]

    Practical secure aggregation for federated learning on user-held data,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for federated learning on user-held data,” NeurIPS Workshop on Private Multi-Party Machine Learning , 2016

    2016

  45. [53]

    A survey on federated learning: A perspective from multi-party computation,

    F. Liu, Z. Zheng, Y . Shi, Y . Tong, and Y . Zhang, “A survey on federated learning: A perspective from multi-party computation,” Frontiers of Computer Sci- ence, vol. 18, no. 1, p. 181336, 2024

    2024

  46. [54]

    Secure federated learning with fully ho- momorphic encryption for iot communications,

    N. M. Hijazi, M. Aloqaily, M. Guizani, B. Ouni, and F. Karray, “Secure federated learning with fully ho- momorphic encryption for iot communications,” IEEE Internet of Things Journal , vol. 11, no. 3, pp. 4289– 4300, 2023

    2023

  47. [55]

    Blockchain-based federated learning with secure aggregation in trusted execution environment for internet-of-things,

    A. P. Kalapaaking, I. Khalil, M. S. Rahman, M. Atiquz- zaman, X. Yi, and M. Almashor, “Blockchain-based federated learning with secure aggregation in trusted execution environment for internet-of-things,” IEEE Transactions on Industrial Informatics , vol. 19, no. 2, pp. 1703–1...

    2022

  48. [56]

    MESAS: Poisoning defense for federated learning resilient against adaptive attackers,

    T. Krauß and A. Dmitrienko, “MESAS: Poisoning defense for federated learning resilient against adaptive attackers,” in ACM SIGSAC Conference on Computer and Communications Security , 2023, pp. 1526–1540

    2023

  49. [57]

    FreqFed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning,

    H. Fereidooni, A. Pegoraro, P. Rieger, A. Dmitrienko, and A.-R. Sadeghi, “FreqFed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning,” in Network and Distributed System Security Symposium, 2024

    2024

  50. [58]

    Byzantine- robust federated learning through collaborative mali- cious gradient filtering,

    J. Xu, S.-L. Huang, L. Song, and T. Lan, “Byzantine- robust federated learning through collaborative mali- cious gradient filtering,” in International Conference on Distributed Computing Systems , 2022, pp. 1223– 1235

    2022

  51. [59]

    Differential privacy,

    C. Dwork, “Differential privacy,” in International Col- loquium on Automata, Languages, and Programming . Springer, 2006, pp. 1–12

    2006

  52. [60]

    Differential privacy meets federated learning under communication constraints,

    N. Mohammadi, J. Bai, Q. Fan, Y . Song, Y . Yi, and L. Liu, “Differential privacy meets federated learning under communication constraints,” IEEE Internet of Things Journal, pp. 1–1, 2021

    2021

  53. [61]

    Local SGD converges fast and communi- cates little,

    S. Stich, “Local SGD converges fast and communi- cates little,” in International Conference on Learning Representations, 2019

    2019

  54. [62]

    FL-NTK: A neural tangent kernel-based framework for federated learning analysis,

    B. Huang, X. Li, Z. Song, and X. Yang, “FL-NTK: A neural tangent kernel-based framework for federated learning analysis,” in International Conference on Ma- chine Learning, 2021, pp. 4423–4434

    2021

  55. [63]

    Recon- structing individual data points in federated learning hardened with differential privacy and secure aggrega- tion,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “Recon- structing individual data points in federated learning hardened with differential privacy and secure aggrega- tion,” in IEEE European Symposium on Security and Privacy (EuroS&P), 20...

    2023

  56. [64]

    Understanding gradient clipping in private SGD: A geometric per- spective,

    X. Chen, S. Z. Wu, and M. Hong, “Understanding gradient clipping in private SGD: A geometric per- spective,” Advances in Neural Information Processing Systems, vol. 33, pp. 13 773–13 782, 2020

    2020

  57. [65]

    Autoencoders, unsupervised learning, and deep architectures,

    P. Baldi, “Autoencoders, unsupervised learning, and deep architectures,” in ICML Workshop on Unsuper- vised and Transfer Learning , 2012, pp. 37–49

    2012

  58. [66]

    Robustness of graph neural networks at scale,

    S. Geisler, T. Schmidt, H. S ¸irin, D. Z ¨ugner, A. Bo- jchevski, and S. G ¨unnemann, “Robustness of graph neural networks at scale,” Advances in Neural Infor- mation Processing Systems , vol. 34, pp. 7637–7649, 2021

    2021

  59. [67]

    RSA: Byzantine-robust stochastic aggrega- tion methods for distributed learning from heteroge- neous datasets,

    L. Li, W. Xu, T. Chen, G. B. Giannakis, and Q. Ling, “RSA: Byzantine-robust stochastic aggrega- tion methods for distributed learning from heteroge- neous datasets,” in Conference on Artificial Intelli- gence, 2019

    2019

  60. [68]

    Neurotoxin: Durable backdoors in federated learning,

    Z. Zhang, A. Panda, L. Song, Y . Yang, M. Mahoney, P. Mittal, R. Kannan, and J. Gonzalez, “Neurotoxin: Durable backdoors in federated learning,” in Interna- tional Conference on Machine Learning , 2022, pp. 26 429–26 446

    2022

  61. [69]

    Measur- ing the effects of non-identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measur- ing the effects of non-identical data distribution for federated visual classification,” arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

  62. [70]

    Gaussian differen- tial privacy,

    J. Dong, A. Roth, and W. J. Su, “Gaussian differen- tial privacy,” Journal of the Royal Statistical Society: Series B, vol. 84, no. 1, pp. 3–37, 2022

    2022

  63. [71]

    Stochastic-sign SGD for federated learning with the- oretical guarantees,

    R. Jin, Y . Huang, X. He, H. Dai, and T. Wu, “Stochastic-sign SGD for federated learning with the- oretical guarantees,” arXiv preprint arXiv:2002.10940, 2020

    2002 arXiv

  64. [72]

    Communication-efficient and Byzantine-robust differentially private federated learning,

    M. Li, D. Xiao, J. Liang, and H. Huang, “Communication-efficient and Byzantine-robust differentially private federated learning,” IEEE Communications Letters , vol. 26, no. 8, pp. 1725– 1729, 2022

    2022

  65. [73]

    Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,

    K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” in IEEE International Confer- ence on Computer Vision , 2015, pp. 1026–1034

    2015

  66. [74]

    Efficient backprop,

    Y . LeCun, L. Bottou, G. B. Orr, and K.-R. M ¨uller, “Efficient backprop,” in Neural networks: Tricks of the trade. Springer, 2002, pp. 9–50

    2002

  67. [75]

    Ex- act solutions to the nonlinear dynamics of learn- ing in deep linear neural networks,

    A. M. Saxe, J. L. McClelland, and S. Ganguli, “Ex- act solutions to the nonlinear dynamics of learn- ing in deep linear neural networks,” arXiv preprint arXiv:1312.6120, 2013

    2013 arXiv

  68. [76]

    Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  69. [77]

    The MNIST database of handwritten digit images for machine learning research [best of the web],

    L. Deng, “The MNIST database of handwritten digit images for machine learning research [best of the web],” IEEE Signal Processing Magazine , vol. 29, no. 6, pp. 141–142, 2012

    2012

  70. [78]

    CNN for handwritten Arabic digits recognition based on LeNet- 5,

    A. El-Sawy, H. El-Bakry, and M. Loey, “CNN for handwritten Arabic digits recognition based on LeNet- 5,” in International Conference on Advanced Intelli- gent Systems and Informatics , 2016. Appendix A. Proofs We begin the proof of Theorem 1 by giving a few observations. E w(k...

    2016

  71. [79]

    (27) The term T1 may be bounded as E⟨∇f (w(k)), g(k)⟩ (28a) = E⟨ 1 M B MX m=1 X i∈I g(k,0) m,i , 1 M B MX m=1 X i∈I eg(k,0) m,i ⟩ (28b) ① = 1 M 2B2 MX m=1 X i∈I E h ∥g(k,0) m,i ∥∥eg(k,0) m,i ∥ cos θ i (28c) ② = 1 M 2B2 MX m=1 X i∈I E h ∥g(k,0) m,i ∥∥eg(k,0) m,i ∥ i (28d) ③ ⩾ 1...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.