Pith. sign in

REVIEW 5 major objections 4 minor 22 references

TriShield claims to make sample-level reconstruction from federated gradients information-theoretically impossible while preserving model accuracy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-03 01:36 UTC pith:G3Q3B6OK

load-bearing objection A creative three-layer defense idea, but the central privacy and utility proofs don't hold and the full-scale results are projected, not measured. the 5 major comments →

arxiv 2607.27940 v2 pith:G3Q3B6OK submitted 2026-07-30 cs.LG cs.CL

TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement

Cheng Wei (Honor Device Co. , Ltd. , Shenzhen , China) This is my paper
classification cs.LG cs.CL
keywords federated learningprivacy backdoorPEFTgradient inversionorthogonal projectionAdam momentumclient-side defenseNeuroImprint
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper addresses a recent attack, NeuroImprint, in which a malicious parameter server plants 'memory neurons' in a PEFT adapter so that each client training sample writes into a dedicated slot, letting the server reconstruct 59–79% of client text from the uploaded gradient. TriShield is a client-side, three-layer defense: it scans the received adapter for planted memory-neuron signatures and resets them, runs several virtual optimizer steps on public data so Adam's momentum entangles gradients and breaks the attack's closed-form inversion, and projects the final gradient onto the main-task subspace computed by SVD so that any memory-neuron component is physically removed. The paper proves that after the second and third layers the mutual information between the uploaded gradient and any individual training sample is zero, and reports 0% reconstruction on GPT-2 and Llama-Guard-3-1B with under 0.3% accuracy loss and less than 5% GPU overhead. If correct, this would give federated fine-tuning a practical way to resist a strong server-side adversary without paying the utility cost of differential privacy.

Core claim

On the paper's own terms, the central claim is that NeuroImprint-style reconstruction becomes mathematically impossible once the client applies TriShield's last two layers. The Stateful Virtual Iteration turns the memorization neuron's update from a clean multiple of the sample embedding into a nonlinear mixture of that embedding with public-data momentum, so the server faces an under-determined system. The Zero-Utility Orthogonal Projection then projects the gradient onto the SVD-derived main-task subspace; because NeuroImprint's memory gradients are orthogonal to that subspace by design, their projected weight and bias updates both become zero, and the attacker's reconstruction formula eva

What carries the argument

The load-bearing machinery is a trio of client-side operations, each aimed at a specific vulnerability. The Parameter Artifact Detector (PAD) reinitializes adapter rows whose within-row variance or cross-row correlation matches the planted memory-neuron signature. The Stateful Virtual Iteration (SVI) pre-runs K=3 Adam steps on a small public auxiliary dataset without updating weights, so that when real training gradients arrive they are mixed with an unobserved momentum state. The Zero-Utility Orthogonal Projection (ZUOP) computes an SVD of gradients on the same auxiliary data to form the main-task subspace U_main and replaces the uploaded gradient with its projection onto that subspace. The

Load-bearing premise

The privacy guarantee rests on the server being unable to know or reliably estimate the client's virtual-iteration momentum state (the public auxiliary data and virtual-step details are treated as unobserved), and the zero-utility-loss guarantee rests on the private-task gradient lying entirely in the public-data subspace; if either assumption fails, the corresponding half of the claim collapses.

What would settle it

Take a TriShield-protected client and a server that knows the defense: the server replays the K virtual Adam steps on the same public auxiliary dataset (or a close proxy) to estimate m_K and v_K, then runs NeuroImprint's reconstruction on the received update. If the server recovers any private token above the clean noise floor, the paper's mutual-information-zero claim is false. Alternatively, measure the Pearson correlation between the uploaded projected gradient and each private sample's embedding over many rounds; nonzero correlation contradicts I=0.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Clients could upload gradients that provably carry zero sample-level information, so a malicious server gets no raw text even with full access to the update.
  • The defense costs no extra communication rounds and keeps accuracy within 0.3% of vanilla FedAvg, making it usable in production FL pipelines.
  • Because ZUOP removes off-subspace components, any attack vector whose encoding is orthogonal to the main-task subspace is eliminated regardless of how it evades detection.
  • SVI's pre-poisoned momentum blocks closed-form single-step inversion even when the gradient direction itself is intact, adding a complementary barrier.
  • The paper's adaptive-variant evaluation suggests the defense also neutralizes memory-neuron designs that try to hide from PAD, as long as their signal is task-orthogonal.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: The zero-mutual-information proof assumes the server cannot reconstruct the client's Adam momentum state after SVI, yet the auxiliary dataset is public and the server distributes the adapter; a TriShield-aware server could rerun the same K virtual steps on that public data to approximate m_K and v_K, potentially reducing the 'under-determined system' to a solvable one. This is
  • Editorial inference: The 'zero utility loss' result is only as good as the subspace estimate; if the public auxiliary data is not representative of the private task distribution, real task gradients will have off-subspace components and the projection will discard useful signal, so the <0.3% loss bound should be re-validated on domain-mismatched auxiliary sets.
  • Editorial inference: The defense narrative suggests a general design principle — make the attacker's inversion formula singular by ensuring the received signal has support only where the attacker's planted encodings have none. This could be adapted to other gradient-inversion attacks beyond NeuroImprint, e.g., by projecting onto a public-data task subspace before upload.
  • Editorial inference: A straightforward empirical test would measure the correlation between projected gradients and private-sample embeddings; if any private token recovers above the noise floor at large n or across many rounds, the claimed I=0 guarantee is falsified.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes TriShield, a three-layer client-side defense against the NeuroImprint privacy backdoor in federated fine-tuning of LLMs with PEFT adapters. Layer 1 (PAD) scans the received adapter for near-zero-variance memory rows and reinitializes them. Layer 2 (SVI) pre-warms the Adam optimizer state with K virtual steps on public auxiliary data, aiming to break NeuroImprint's closed-form inversion. Layer 3 (ZUOP) projects the local gradient update onto the top-k SVD subspace of gradients on public auxiliary data, aiming to remove memory-neuron components while preserving task-relevant updates. The paper claims a theoretical guarantee that after Layers 2 and 3 the mutual information between the uploaded gradient and any individual training sample is zero, together with zero utility loss and less than 5% overhead. Experiments are reported on GPT-2 and Llama-Guard-3-1B, with 0% reconstruction across attack variants and projected accuracy losses below 0.3%.

Significance. If the claims were established, TriShield would be a substantial contribution to federated learning privacy, because it targets a concrete and recent backdoor attack and proposes a layered, client-side defense that does not require server trust or data-level perturbation. The paper also provides a reproducible-looking local notebook and a thoughtful discussion of adaptive attack variants. However, the central privacy and utility guarantees are not currently supported. The zero-utility-loss theorem is circular, the zero-MI theorem rests on an unproven orthogonality premise, the SVI argument depends on an unjustified secrecy assumption, and the headline experimental numbers are partly projected rather than measured. For these reasons the significance of the work as a validated defense is not yet established.

major comments (5)
  1. [§IV-C, Theorem 2] Theorem 2 is circular. It defines U_main as the column space of G and then proves zero utility loss by assuming ∇_φ L_task lies in U_main. The proof states this is true 'by construction', but G is computed on public auxiliary data D_aux, while the actual task gradient comes from the private data D_i. No argument is given that private-data gradients lie in the span of gradients on a small public set. Without that, the zero-utility-loss claim collapses, and the projection may remove legitimate task signal.
  2. [§IV-C, Theorem 3 and Corollary 1] Theorem 3 assumes g_mem ⊥ U_main 'by design' and then proves the projection kills it. The premise is never established: NeuroImprint memory-neuron gradients are of the form α·Embed(x_j), and LayerNorm invariance does not imply orthogonality to gradients on D_aux. Corollary 1 then claims that because the reconstructed sample is 0/0, the mutual information is zero. This is an invalid inference: an undefined ratio does not imply zero information, and even an exactly zero numerator and denominator would not show that the projected gradient vector as a whole carries no information about x_j. Thus the central zero-MI claim is not proved.
  3. [§IV-B, Theorem 1] The SVI guarantee depends on the server not knowing m_K and v_K. The paper states these are 'never transmitted', but the server distributed the adapter and D_aux is explicitly public (§III-C). An attacker aware of TriShield can rerun the same K virtual iterations on D_aux if it knows the client's batch sampling and optimizer seeding. The paper provides no argument that these are secret. If the server can compute m_K and v_K, the 'under-determined system' of Theorem 1 becomes an element-wise invertible system, and SVI provides no closed-form-inversion protection.
  4. [§VII-C and §VIII-B] The full-scale reconstruction and utility numbers are projected, not measured. Table III and Table IV explicitly mark values as '[proj.]' based on NeuroImprint [1] attack rates and published benchmarks, and §VIII-B.6 admits that full-scale LLaMA experiments are left for future work. The abstract nevertheless states that 'Experiments on GPT-2 ... and Llama-Guard-3-1B verify' 0% reconstruction and maintained accuracy. The only measured local verification is on 15 samples, where one-sample swings equal 6.7% accuracy, and a separate n=256 token-reconstruction experiment. This is insufficient support for the headline zero-utility-loss and zero-reconstruction claims at scale.
  5. [§VII-E] The ablation table is internally inconsistent: rank fraction 0.70 gives k=9, 0.80 gives k=3, and 0.90 gives k=8. Since k is defined as a fraction of the rank of G, it should be monotone in the fraction. This inconsistency undermines the explanation of why 0.80 is the 'safe default'. More importantly, the same table shows that rank fraction 0.95 yields a 50% SR1E reconstruction rate, which contradicts the paper's repeated claim of 0% reconstruction across all tested attack variants and undermines the universality of the defense.
minor comments (4)
  1. [§VII-B, Table II] Table II lists 'Recon Rate' as 100% for PAD-only and PAD+SVI, with a note that this is expected because gradient-norm is not the right metric for those layers. This is confusing: a reader naturally reads 100% as a defense failure. The table should separate 'reconstruction rate under the correct metric' from the gradient-norm proxy, or relabel the columns.
  2. [Throughout] There are several formatting and typographical issues: the abstract contains a stray brace ('Stateful Virtual Iteration}'), the running header shows 'arXiv:2607.27940v2 [cs.LG] 31 Jul 2026' inside the text, Table 0 appears before Table I, and the reference to 'Table V-L' does not correspond to a labeled table. Section references are also inconsistent (e.g., 'Section 7.3b' vs. '§VII-D').
  3. [§VII-D] The text says 'Figure 1' presents the n-robust validation results, but what follows is a table, not a figure. The actual pipeline figure in §IV is not numbered. Please fix the cross-referencing.
  4. [§VII-E] The reported k values should be reconciled with the definition k = min(0.8·rank(G), n−1). With n=32 aux samples and rank fraction 0.80, k≈3, but the table lists k=9 at 0.70 and k=8 at 0.90. Either the formula, the data, or the notation is inconsistent, and this should be clarified.

Circularity Check

3 steps flagged

TriShield's central guarantees reduce to definitions: Theorem 2 assumes the task gradient lies in U_main and Theorem 3 assumes memory gradients lie in U_main^⊥, so 'zero utility loss' and 'zero mutual information' are restatements of the premises rather than derived results.

specific steps
  1. self definitional [Section IV-C, Theorem 2 (Zero Utility Loss)]
    "Theorem 2 (Zero Utility Loss): Let U_main be the column space of G. If the main-task gradient ∇_ϕL_task lies in U_main, then the projected gradient Δϕ* = P_Umain Δϕ preserves ∇_ϕL_task exactly: P_Umain ∇_ϕL_task = ∇_ϕL_task. Proof: By definition, ∇_ϕL_task ∈ U_main, so P_Umain is an identity on this vector."

    The zero-utility conclusion is exactly the assumption that the private-data task gradient lies in U_main, where U_main is defined as the column space of gradients on the public auxiliary set. No argument establishes that the actual task gradient on D_i is contained in this estimated subspace; the proof merely restates the premise. The abstract's unconditional 'zero model utility loss' therefore reduces to a definitional assumption, not a derived result.

  2. self definitional [Section IV-C, Theorem 3 (Privacy Guarantee)]
    "Theorem 3 (Privacy Guarantee): Let g_mem ⊥ U_main be the gradient of a NeuroImprint memory neuron (lying in the orthogonal complement of the task subspace by design). Then P_Umain g_mem = 0. Proof: g_mem ∈ U⊥_main by assumption. The projection onto U_main of any vector in U⊥_main is exactly zero: P_Umain g_mem = U_k U_k^T g_mem = 0 since U_k^T g_mem = 0 for g_mem ⊥ col(U_k)."

    The privacy guarantee is the orthogonality assumption itself: the theorem assumes away the property that must be established. The 'by design' appeal to LayerNorm invariance is asserted, not proved or measured, and if memory-neuron gradients are not exactly orthogonal to U_main the projection does not zero them. The conclusion P_Umain g_mem = 0 is identical to the input premise g_mem ∈ U_main^⊥, so the claimed information-theoretic elimination is built into the assumption.

  3. other [Section IV-C, Corollary 1 (Reconstruction Impossibility)]
    "Corollary 1 (Reconstruction Impossibility): After ZUOP, the attacker receives Δϕ* = P_Umain Δϕ. For any memory neuron j, the attacker's reconstructed sample x̂_j = Δϕ*_rj / Δϕ*_bj = 0/0, which is undefined. The mutual information I(x̂_j; x_j) = 0."

    The headline zero-MI result is not derived; it is equated with an undefined 0/0 quotient. Even if the numerator and denominator vanish, an undefined ratio does not imply that the projected gradient vector carries zero information about x_j, and no information-theoretic argument connects the quotient to I=0. This step converts the assumed orthogonality into the abstract's 'mutual information ... is zero' by renaming an undefined expression as a proof rather than by derivation.

full rationale

The paper's two headline theoretical claims—zero utility loss and zero mutual information—are conditional tautologies. Theorem 2 proves that if the task gradient lies in U_main, projection preserves it, but U_main is defined as the column space of D_aux gradients and membership of the private-data task gradient is never established. Theorem 3 proves that if memory gradients lie in U_main^⊥, projection annihilates them, but that orthogonality is asserted 'by design' and never verified against actual NeuroImprint gradients or the estimated subspace. Corollary 1 then declares I=0 from an undefined 0/0 ratio, which is not an information-theoretic consequence. Thus the 'provable' privacy and 'zero utility loss' claims reduce to the paper's own geometric assumptions rather than to independent derivation. The PAD and SVI layers are not circular mechanism descriptions, and the local token-reconstruction experiments provide some independent empirical evidence for the defense's practical effect, but the theoretical derivation chain itself is forced by definitions and unproven premises. No self-citation chain is involved; the circularity is internal to the theorems. Score 8 reflects that the central claims are forced by the stated assumptions and definitions.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The central guarantees depend on geometric and secrecy assumptions about the attack (orthogonality to U_main) and the client (secret momentum), plus hand-set thresholds (τ_var, τ_corr, rank fraction) that are tuned on the demo data. These are the real preconditions for the claimed results.

free parameters (5)
  • PAD variance threshold τ_var = 1e-4
    Hand-set threshold separating planted memory rows (var≈1e-12) from Kaiming rows (var≈2.6e-3); authors note it needs recalibration for novel PEFT init (Sec. VIII-B.3).
  • PAD correlation threshold τ_corr = 0.95
    Hand-set threshold for 'near-duplicate' rows; tunable per Sec. VII.G.
  • SVI virtual steps K = 3 (default; range 2–5)
    Chosen default; sensitivity low but affects compute; K=1 fails per Table VII-F.
  • ZUOP rank fraction = 0.80 (k≈3 from 32 aux samples; 0.60 in n-robust backstop)
    Critical: 0.80 labeled empirically safe; 0.95 leaks 50% SR1E; ablation k values non-monotone (0.70→9, 0.80→3), so the stated mapping k=min(0.8·rank(G), n−1) is not consistently applied.
  • Angular tolerance δ in Theorem 4 = 5° (assumed)
    Privacy bound I≤...·sin²δ depends on assumed near-orthogonality; no measurement of δ for real attacks.
axioms (5)
  • domain assumption Memory-neuron gradients are orthogonal (or within angle δ) to the task-gradient subspace U_main
    Used in Theorems 3–4 to conclude projection deletes all private signal; claimed 'by design' of NeuroImprint but not proven for adaptive variants; SR1E is assumed still orthogonal even though it evades PAD (Sec. IV-C, V-A).
  • domain assumption The main-task gradient ∇L_task lies in U_main, the column space of gradients on public aux data
    Theorem 2's zero-utility-loss proof requires this; not guaranteed when D_aux is not perfectly representative; paper lists this as a limitation (Sec. VIII-B.2).
  • ad hoc to paper A server aware of TriShield cannot determine the client's Adam momentum state (m_K, v_K)
    SVI Theorem 1 relies on the server not knowing m_K, v_K, but D_aux is public and the server controls the adapter initialization, so the server could replay virtual steps; the paper does not address this (Sec. IV-B).
  • domain assumption D_aux is drawn from the same distribution as private data D_i
    Required for subspace estimation and for Theorem 5's convergence; paper recommends domain-adjacent public data (Sec. VI-C).
  • standard math Standard FL convergence conditions (bounded gradients, Lipschitz smoothness)
    Invoked in Theorem 5 proof sketch; standard background.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement." pith.science (2026). https://pith.science/paper/G3Q3B6OK

@misc{pith2026260727940,
  author       = {Pith},
  title        = {Pith review of: TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G3Q3B6OK}},
  note         = {Machine review of arXiv:2607.27940}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated fine-tuning of large language models (LLMs) enables collaborative training without exposing raw data. However, a recent attack, NeuroImprint, demonstrates that a malicious parameter server can corrupt a PEFT adapter into a privacy backdoor: by assigning a dedicated memorization neuron to each training sample and ensuring each neuron updates at most once, the server can analytically reconstruct 59%--79% of client training data with high semantic fidelity. Existing defenses---including local differential privacy (LDP) and gradient clipping---either fail against this attack or impose unacceptable utility degradation. We present \textbf{TriShield}, a three-layer deterministic defense that completely prevents NeuroImprint-style reconstruction with zero model utility loss and no additional communication rounds. TriShield consists of: (1) a Parameter Artifact Detector that identifies memory-neuron signatures in distributed model parameters before local training begins; (2) a Stateful Virtual Iteration} mechanism that forces Adam/AdamW's momentum state to irreversibly entangle gradients across virtual steps, invalidating NeuroImprint's closed-form inversion; and (3) a Zero-Utility Orthogonal Projection operator that projects all local gradient updates onto the main-task semantic subspace computed via SVD, physically eliminating any gradient components that carry private memorization. We prove theoretically that after Layers 2 and 3, the mutual information between the uploaded gradient and any individual training sample is zero. Experiments on GPT-2 (117M) and Llama-Guard-3-1B verify that TriShield reduces NeuroImprint reconstruction rate to 0% across all tested attack variants, while maintaining or improving training accuracy, with less than 5% additional GPU computation overhead.

Figures

Figures reproduced from arXiv: 2607.27940 by Cheng Wei (Honor Device Co., China), Ltd., Shenzhen.

Figure 1
Figure 1. Figure 1: TriShield defense results across attack variants and ablations [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

22 extracted references · 14 linked inside Pith

  1. [1]

    T., & Lou, W

    Shi, S., Zhang, C., Jin, H., Xiao, Y ., V orobeychik, Y ., Yeoh, W., Zhang, N., Hou, Y . T., & Lou, W. (2026).From Efficiency to Leakage – Privacy Backdoor in Federated Language Model Fine-Tuning.arXiv:2606.20553 [cs.CR]. https://doi.org/10.48550/arXiv.2606.20553(Authors: Shanghao Shi, Chaoyu Zhang, Heng Jin, Yang Xiao, Yevgeniy Vorobeychik, William Yeoh,...

    Pith/arXiv arXiv doi:10.48550/arxiv.2606.20553 2026

  2. [2]

    B., Moore, E., Ramage, D., Hampson, S., & Ag ¨uera y Arcas, B

    McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Ag ¨uera y Arcas, B. (2017).Communication-Efficient Learning of Deep Networks from Decentralized Data.Proceedings of the 20th International Confer- ence on Artificial Intelligence and Statistics (AISTATS 2017), PMLR 54:1273–1282. https://proceedings.mlr.press/v54/mcmahan17a.html

    2017

  3. [3]

    J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., & Chen, W

    Hu, E. J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., & Chen, W. (2022).LoRA: Low-Rank Adaptation of Large Language Models.International Conference on Learning Representations (ICLR 2022). arXiv:2106.09685. https://doi.org/10.48550/arXiv.2106.09685

    Pith/arXiv arXiv doi:10.48550/arxiv.2106.09685 2022

  4. [4]

    (2021).Gradient Projection Memory for Continual Learning.International Conference on Learning Represen- tations (ICLR 2021)

    Saha, G., Garg, I., & Roy, K. (2021).Gradient Projection Memory for Continual Learning.International Conference on Learning Represen- tations (ICLR 2021). arXiv:2103.09762. https://doi.org/10.48550/arXiv. 2103.09762

    Pith/arXiv arXiv doi:10.48550/arxiv.2103.09762 2021

  5. [5]

    D., Rieger, P., Chen, H., Yalame, H., M ¨ollering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Zeitouni, S., Koushanfar, F., Sadeghi, A

    Nguyen, T. D., Rieger, P., Chen, H., Yalame, H., M ¨ollering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Zeitouni, S., Koushanfar, F., Sadeghi, A. R., & Schneider, T. (2022).FLAME: Taming Backdoors in Federated Learning.31st USENIX Security Sym- posium (USENIX Security 2022), pp. 1415–1432. arXiv:2101.02281. https://doi.org/10.48550/a...

    Pith/arXiv arXiv doi:10.48550/arxiv.2101.02281 2022

  6. [6]

    (2020).In- verting Gradients — How easy is it to break privacy in federated learning?Advances in Neural Information Processing Systems 33 (NeurIPS 2020)

    Geiping, J., Bauermeister, H., Dr ¨oge, H., & Moeller, M. (2020).In- verting Gradients — How easy is it to break privacy in federated learning?Advances in Neural Information Processing Systems 33 (NeurIPS 2020). arXiv:2003.14053. https://doi.org/10.48550/arXiv.2003. 14053(First three authors contributed equally)

    Pith/arXiv arXiv doi:10.48550/arxiv.2003.14053 2020

  7. [7]

    R., & Bilen, H

    Zhao, B., Mopuri, K. R., & Bilen, H. (2020).iDLG: Improved Deep Leakage from Gradients.arXiv:2001.02610. https://doi.org/10.48550/ arXiv.2001.02610

    Pith/arXiv arXiv doi:10.48550/arxiv.2001.02610 2020

  8. [8]

    (2006).Calibrating Noise to Sensitivity in Private Data Analysis.In: Halevi, S., Rabin, T

    Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006).Calibrating Noise to Sensitivity in Private Data Analysis.In: Halevi, S., Rabin, T. (eds) Theory of Cryptography (TCC 2006). Lecture Notes in Computer Science, vol. 3876, pp. 265–284. Springer, Berlin, Heidelberg. https: //doi.org/10.1007/11681878 14

    doi:10.1007/11681878 2006

  9. [9]

    (2023).Parameter-efficient fine-tuning of large-scale pre-trained language models.Nature Machine Intelligence, 5, 220–235

    Ding, N., Qin, Y ., Yang, G., Wei, F., Yang, Z., Su, Y ., Hu, S., Chen, Y ., Chan, C.-M., Chen, W., Yi, J., Zhao, W., Wang, X., Liu, Z., Zheng, H.-T., Chen, J., Liu, Y ., Tang, J., Li, J., & Sun, M. (2023).Parameter-efficient fine-tuning of large-scale pre-trained language models.Nature Machine Intelligence, 5, 220–235. https://doi.org/10.1038/s42256-023-00626-4

    doi:10.1038/s42256-023-00626-4 2023

  10. [10]

    L., & Liang, P

    Li, X. L., & Liang, P. (2021).Prefix-Tuning: Optimizing Continuous Prompts for Generation.Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (ACL-IJCNLP 2021), pp. 4582–4597. https://doi.org/10.18653/v1/2021.acl-long.353

    doi:10.18653/v1/2021.acl-long.353 2021

  11. [11]

    M., Guerraoui, R., & Stainer, J

    Blanchard, P., El Mhamdi, E. M., Guerraoui, R., & Stainer, J. (2017).Machine Learning with Adversaries: Byzantine Tolerant Gra- dient Descent.Advances in Neural Information Processing Sys- tems 30 (NeurIPS 2017). https://proceedings.neurips.cc/paper/2017/ hash/f4b9ec30ad9f68f89b29639786cb62ef-Abstract.html

    2017

  12. [12]

    (2020).How To Backdoor Federated Learning.Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS 2020), PMLR 108:2938–2948

    Bagdasaryan, E., Veit, A., Hua, Y ., Estrin, D., & Shmatikov, V . (2020).How To Backdoor Federated Learning.Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS 2020), PMLR 108:2938–2948. arXiv:1807.00459. https://doi. org/10.48550/arXiv.1807.00459

    Pith/arXiv arXiv doi:10.48550/arxiv.1807.00459 2020

  13. [13]

    Sun, J., Li, A., DiValentin, L., Hassanzadeh, A., Chen, Y ., & Li, H. (2021).FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Per- spective.Advances in Neural Information Processing Systems 34 (NeurIPS 2021). https://proceedings.neurips.cc/paper/2021/hash/ 692baebec3bb4b53d7ebc3b9fabac31b-Abstract.html

    2021

  14. [14]

    (2020).InstaHide: Instance-hiding Schemes for Private Distributed Learning.Proceedings of the 37th International Conference on Machine Learning (ICML 2020), PMLR 119:4507–4518

    Huang, Y ., Song, Z., Li, K., & Arora, S. (2020).InstaHide: Instance-hiding Schemes for Private Distributed Learning.Proceedings of the 37th International Conference on Machine Learning (ICML 2020), PMLR 119:4507–4518. arXiv:2010.02772. https://doi.org/10. 48550/arXiv.2010.02772

    Pith/arXiv arXiv doi:10.48550/arxiv.2010.02772 2020

  15. [15]

    U., & Jaggi, M

    Lin, T., Kong, L., Stich, S. U., & Jaggi, M. (2020).Ensemble Distillation for Robust Model Fusion in Federated Learning.Advances in Neural Information Processing Systems 33 (NeurIPS 2020). arXiv:2006.07242. https://doi.org/10.48550/arXiv.2006.07242

    Pith/arXiv arXiv doi:10.48550/arxiv.2006.07242 2020

  16. [16]

    Acar, D. A. E., Zhao, Y ., Matas Navarro, R., Mattina, M., Whatmough, P. N., & Saligrama, V . (2021).Federated Learning Based on Dynamic Regularization.International Conference on Learning Representations (ICLR 2021). arXiv:2111.04263. https://doi.org/10.48550/arXiv.2111. 04263

    Pith/arXiv arXiv doi:10.48550/arxiv.2111.04263 2021

  17. [17]

    S., Shu- mailov, I., & Papernot, N

    Boenisch, F., Dziedzic, A., Schuster, R., Shamsabadi, A. S., Shu- mailov, I., & Papernot, N. (2023).When the Curious Abandon Honesty: Federated Learning Is Not Private.IEEE European Symposium on Security and Privacy (EuroS&P 2023). arXiv:2112.02918. https://doi. org/10.48550/arXiv.2112.02918

    Pith/arXiv arXiv doi:10.48550/arxiv.2112.02918 2023

  18. [18]

    (2022).PRECODE — A Generic Model Extension to Prevent Deep Gradient Leakage.Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV 2022), pp

    Scheliga, D., M ¨ader, P., & Seeland, M. (2022).PRECODE — A Generic Model Extension to Prevent Deep Gradient Leakage.Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV 2022), pp. 1849–1858. arXiv:2108.04725. https://doi.org/10. 48550/arXiv.2108.04725

    Pith/arXiv arXiv doi:10.48550/arxiv.2108.04725 2022

  19. [19]

    Huang, Y ., Gupta, S., Song, Z., Li, K., & Arora, S. (2021). Evaluating Gradient Inversion Attacks and Defenses in Feder- ated Learning.Advances in Neural Information Processing Sys- tems 34 (NeurIPS 2021). https://proceedings.neurips.cc/paper/2021/ hash/3b3fff6463464959dcd1b68d0320f781-Abstract.html

    2021

  20. [20]

    (2024).Gradient Projection for Continual Parameter-Efficient Tuning

    Qiao, J., Zhang, Z., Tan, X., Qu, Y ., Zhang, W., Han, Z., & Xie, Y . (2024).Gradient Projection for Continual Parameter-Efficient Tuning. arXiv:2405.13383. https://doi.org/10.48550/arXiv.2405.13383

    Pith/arXiv arXiv doi:10.48550/arxiv.2405.13383 2024

  21. [21]

    (2019).Deep Leakage from Gradients.Advances in Neural Information Processing Systems 32 (NeurIPS 2019)

    Zhu, L., Liu, Z., & Han, S. (2019).Deep Leakage from Gradients.Advances in Neural Information Processing Systems 32 (NeurIPS 2019). https://proceedings.neurips.cc/paper/2019/hash/ 60a6c4002cc7b29142def8871531281a-Abstract.html

    2019

  22. [22]

    Zhu, J., & Blaschko, M. B. (2021).R-GAP: Recursive Gradient At- tack on Privacy.International Conference on Learning Representations (ICLR 2021). arXiv:2010.07733. https://doi.org/10.48550/arXiv.2010. 07733

    Pith/arXiv arXiv doi:10.48550/arxiv.2010.07733 2021

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.