Pith. sign in

REVIEW 5 major objections 6 minor 33 references

PoisonCatcher: Revealing and Identifying LDP Poisoning Attacks in IIoT

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PoisonCatcher finds poisoned data in LDP-protected IIoT streams.

desk verdict Aggregator-side LDP poisoning defense with strong F2 on weather data, but the IIoT claim is not yet supported and the theory has load-bearing gaps. read the letter →

arxiv 2412.15704 v2 pith:KVQJZ3AM submitted 2024-12-20 cs.CR

Lisha Shuai , Shaofeng Tan , Nan Zhang , Jiamin Zhang , Min Zhang , Xiaolong Yang This is my paper · ORCID
classification cs.CR
keywords localdifferentialprivacypoisoningattackIndustrialInternetofThingsstatisticalqueryresultstime-seriesanomalydetectionattributecorrelationattack-patterninstability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that local-differential-privacy poisoning attacks in the Industrial Internet of Things can be defeated from the aggregator side, without trusting the resource-poor edge devices. It names three attack modes—deliberate input poisoning, deliberate rule poisoning, and randomized output poisoning—and argues that all three disturb temporal similarity, inter-attribute correlation, and pattern stability of statistical query results. PoisonCatcher combines detectors for those three disturbances with a latent-bias feature miner that amplifies subtle statistical bias and flags individual poisoned devices. On a cleaned, normalized weather benchmark the paper measures $F_2$ scores above 90.7% for identifying poisoned data across attack ratios from 0% to 50% and across all three attack modes.

What carries the argument

The load-bearing mechanism is the attack-pattern instability paradox: an adversary who wants both impact and stealth must keep the poisoning perturbation small and slowly varying, yet any real attack must create excess temporal variation or magnitude spikes. Around that paradox PoisonCatcher builds three time-series detectors—temporal similarity against LDP fault-tolerance thresholds, attribute-correlation deviation from historical baselines, and pattern stability metrics on the detector outputs—plus a feature miner that repeatedly samples the flagged attribute time series, aggregates the samples, and feeds the resulting bias features to a random-forest classifier that labels each device poisoned or clean.

What would settle it

Take a labeled IIoT process dataset with known injection times and devices, implement the three attack modes, and run PoisonCatcher's detectors and feature miner as specified; if per-attribute $F_2$ falls below 90.7% at a 5% attack ratio, the central claim is refuted. A second check is to let an adversary vary the poisoning pattern on a very slow timescale and see whether the stability detector leaves the attack unflagged for an extended window.

Watch

Extended reading notes

Core claim

The paper's discovery is that poisoned data in an LDP-utilized IIoT collection are identifiable at the aggregator because poisoning leaves fingerprints in the aggregated statistics even when individual perturbed records are indistinguishable. Temporal similarity of statistical query results breaks, correlations between attributes shift, and, paradoxically, the attack pattern cannot remain stable over time because stealth forces it to track the natural drift of the process while also pushing the statistics away from truth. PoisonCatcher exploits these fingerprints with three detectors and a supervised latent-bias feature miner; the claimed outcome is that poisoned data can be located device-by-device, not merely that a global poisoning ratio can be estimated.

Load-bearing premise

The load-bearing premise is that clean IIoT data display stable temporal patterns and inter-attribute correlations that can be captured in a historical baseline; if real industrial streams are nonstationary or weakly correlated, deviations look like poisoning and poisoning looks like normal drift.

Editorial extensions

If this is right

  • Aggregators can run the defense without adding computation or communication burden to edge sensors, addressing the 3C constraints that make edge-side defenses impractical.
  • Poisoned data can be identified at device level, so an operator can quarantine specific compromised nodes rather than discard or reweight whole data sets.
  • The three detectors complement each other: temporal similarity struggles at low attack ratios, attribute correlation fails on discrete attributes, and the stability detector picks up the slack, so the ensemble is the claimed source of reliable detection.
  • The feature-mining step can be paired with any supervised classifier, and the paper reports that the feature-enhanced model keeps $F_2$ above 90.7% where a baseline random forest degrades by up to 43.2%.
  • The attack-ratio estimates produced by PoisonCatcher are closer to the true values than the DETECT, LDPGuard, theoretical, and expert estimates reported in the comparison table.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the reliance on historical clean baselines means PoisonCatcher will need periodic recalibration in nonstationary industrial processes; a regime shift would produce exactly the same temporal and correlation deviations as poisoning.
  • My inference: an adversary who could keep the poisoning pattern truly constant for very long windows would evade the stability detector, so the practical guarantee degrades against slow, patient attacks; the paper's own adaptation-rate argument says such perfect stability is hard, not impossible.
  • My inference: the method should transfer to other privacy-preserving data collection settings beyond LDP, as the paper suggests, but the detector thresholds are tied to LDP fault-tolerance formulas and would need re-derivation for mechanisms with different noise properties.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper addresses local differential privacy (LDP) poisoning attacks in the Industrial Internet of Things (IIoT). It identifies three attack modes (DIPA, DRPA, ROPA), proposes a generalized attack model, and derives quantitative claims about how poisoning distorts statistical query results, disrupts attribute correlations, and exhibits unstable attack patterns. The paper then proposes PoisonCatcher, an aggregator-side defense combining three time-series detectors (temporal similarity, attribute correlation, and pattern stability) with a latent-bias feature miner and a random-forest classifier to identify poisoned data. The evaluation uses the World Weather Repository and reports F2 scores above 90.7% for poisoned-data identification across attack ratios from 0% to 50% and across the three attack modes. The paper claims this is the first solution that identifies specific poisoned data rather than only estimating a global poisoning ratio.

Significance. If the central result were robust and transferable to IIoT, PoisonCatcher would be a valuable aggregator-side defense for LDP-utilized systems. The paper's contributions include an IIoT-oriented attack taxonomy, the observation that stealthy poisoning patterns are difficult to keep stable over time, and a four-stage statistical detection architecture. The claimed code release is also a positive step for reproducibility, although the provided link is malformed. However, the central empirical claim currently rests on weather data rather than IIoT data, the theoretical bounds contain an invalid step at Eq. (11), and the evaluation protocol is under-specified. The significance is therefore conditional: the ideas are worthwhile, but the advertised IIoT capability is not yet established by the evidence presented.

major comments (5)
  1. [Section IV-C1, Eq. (11)] The inequality ||Delta(d_i, psi) - Phi(d_i, psi)||_1 <= e^epsilon - 1 does not follow from the epsilon-LDP definition in Eq. (1). epsilon-LDP bounds the ratio of output probabilities, not the L1 distance between reported values or between query results; the 'translation to an additive difference cap in the probability domain' does not impose a data-domain bound. Because Eq. (12), the 'Distortion proportional to L * m/n * (e^epsilon - 1)' statement, and Eq. (16) all rely on Eq. (11), the quantitative impact analysis is unsupported. This step should be replaced with a bound justified by the actual attack construction, such as domain constraints or an explicit Lipschitz model of the poisoning operation, or re-characterized as an assumption.
  2. [Sections VI-A1 and VII] The only real-world evaluation is on the World Weather Repository, after removing non-uniform samples, Min-Max scaling to [-1,1], and dropping skewed variables. Section VII explicitly lists evaluation on 'diverse, publicly available IIoT datasets' as future work. The Abstract's claim of F2 scores above 90.7% and the paper's IIoT framing are therefore not supported for industrial process data; the empirical result is so far only about weather-like SQR streams. Either include an IIoT dataset or a documented argument that weather SQRs have the same temporal and inter-attribute correlation structure as industrial streams, or explicitly rescope the title and abstract claims to weather-like streams.
  3. [Section VI-B3 and Figs. 5-7] The central identification result is reported without a train/test split, cross-validation scheme, number of repetitions, or error bars, and Table II contains only point estimates with unexplained '--' entries. The manuscript also does not state how the supervised labels for poisoned devices were generated, how the RF hyperparameters and detector thresholds theta_i were chosen, or whether the same attack instances used for feature engineering were used for evaluation. Without this information, the F2 >= 90.7% claim cannot be distinguished from overfitting or evaluation leakage. The authors should provide a complete experimental protocol, including temporal or nested cross-validation and variance estimates.
  4. [Section V-D and VI-B3] The FE-enhanced feature miner samples and aggregates the very bias statistics that the attacks are designed to create, and the random-forest model is then trained on those features, which raises a circularity concern. The paper should clarify whether the features are computed independently of the detector outputs and of the training labels, and should demonstrate on held-out attack configurations (for example, unseen epsilon values, attack ratios, or attribute subsets) that the high F2 reflects generalizable identification rather than the feature construction encoding the attack signature.
  5. [Section IV-B2, Eqs. (6)-(8)] The step from Eq. (6) to Eq. (7) is invalid: Eq. (6) gives a total-variation bound of e^{epsilon+epsilon'} - 1, which is not less than or equal to epsilon + epsilon' for positive values of the exponent. Additionally, Eq. (8) at epsilon' = 0 would require epsilon = 0 to yield 'perfect stealth', which is not a meaningful LDP regime. The stealth-probability conclusions should be restated with correct inequalities or explicitly presented as small-parameter asymptotics.
minor comments (6)
  1. [Reference [31]] The code URL 'https://github.com/shuailishasls/PoisonCatcher Code' contains a space and is malformed; the authors should provide a valid repository link.
  2. [Figs. 6 and 7] The middle attack mode is labeled 'DPPA' in both figure captions; this should be 'DRPA'.
  3. [Eq. (24)] The text says the Laplace mechanism is characterized by Lap(0, |X|/epsilon), but Eq. (24) uses Lap(2/epsilon); the domain-range notation and the sensitivity should be made consistent.
  4. [Table II] The '--' entries for DETECT and for LDPGuard under the Laplace rows are undefined; state whether they denote failure, non-applicability, or values below reporting precision.
  5. [Abstract] The phrase 'due to its lightweight, decentralized, and scalable' lacks a noun; it should read, for example, 'due to its lightweight, decentralized, and scalable nature'.
  6. [Figs. 2-4] The ten per-attribute curves are plotted in the same color without a legend; distinct line styles or a legend would make the figures readable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PoisonCatcher's detection components are evaluated against independently injected attacks, and the theoretical attack-impact bounds are not used as their own confirmation.

full rationale

The paper's derivation chain is not circular. The attack modes in Section IV are defined as constrained perturbations (DIPA, DRPA, ROPA) and the subsequent impact analysis derives bounds on SQR distortion, correlation disruption, and pattern instability from those definitions plus Lipschitz and LDP arguments. These bounds motivate the three detectors in Section V, but the detectors are empirical measurement devices: they compare test-window SQRs, correlations, and stability metrics against baselines built from historical clean data. The latent-bias feature miner trains a supervised random forest on bias features computed by repeated random sampling and aggregation; the labels are the actual injected poisoned-device statuses, and the F2 scores in Section VI-B are measured on the resulting classification task. Even though the features are engineered to be sensitive to the same distributional shifts the attacks induce, this is standard feature engineering for a supervised detector, not a fitted parameter being renamed as a prediction. The 'indistinguishability' discussion in Section IV-B2 restates the ε-LDP definition for the poisoned mechanism, but it is used as a threat-model premise rather than as an empirical claim confirmed by the experiments. The most notable limitation is external validity: the only benchmark is the World Weather Repository, and Section VII explicitly defers evaluation on genuine IIoT datasets to future work. That is a generalizability concern, not a circularity of the derivation chain. No load-bearing self-citation, imported uniqueness theorem, or ansatz-by-citation appears in the paper.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on five load-bearing assumptions: the Lipschitz property of the statistical queries, bounded variation of clean SQRs, recoverability of inter-attribute correlations from SQRs despite LDP noise, a cited approximation for GRR error variance, and the validity of the weather dataset as an IIoT proxy. No new physical or algorithmic entities are introduced.

free parameters (4)
  • Stability detector thresholds theta_i (i=1..3) = Not reported
    Set empirically from historical benign data (Section V-C) and used in Eq (49) to flag poisoned attributes; values directly control detection sensitivity.
  • Random forest hyperparameters = Not reported
    The RF classifier in Section V-D2 is described as an illustrative example, but the paper never states the number of trees, maximum depth, or other tuning parameters used to obtain the F2 scores.
  • FE-enhanced sampling count s and window length l = s not stated; l swept in Fig 7
    These control the feature matrix F^{t:t+l} (Section V-D1); Fig 7 shows performance depends on l, and s is not specified.
  • Privacy budget epsilon and confidence delta = epsilon=1, delta=0.95
    Chosen in Section VI-A; they set the LDP fault tolerance thresholds in Eqs (27) and (32), which drive the temporal similarity detector.
assumptions (5)
  • domain assumption Statistical queries used for SQR are Lipschitz continuous with constant L (Eq 10).
    The distortion bound (10) assumes Q is Lipschitz; not justified for mean or frequency estimators under LDP.
  • domain assumption Clean industrial SQR time series satisfy bounded variation over consecutive windows (Eq 17).
    The stability detector assumes natural drift is bounded by epsilon; used to define stealth constraints.
  • domain assumption Inter-attribute correlations are preserved in SQR time series despite LDP per-record noise (Section V-B1).
    The correlation detector relies on recovering correlations from aggregated SQRs, citing Kifer and Machanavajjhala [29] and Rastogi and Nath [30].
  • standard math GRR frequency estimation error variance follows the approximation in Eq (30) from Kairouz et al. [27].
    Used to set alpha_GRR; no derivation in the paper, accepted as a cited result.
  • domain assumption The World Weather Repository after preprocessing represents IIoT sensor characteristics.
    The entire experimental evaluation uses weather data as a proxy for IIoT; no IIoT data is tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PoisonCatcher: Revealing and Identifying LDP Poisoning Attacks in IIoT." pith.science (2026). https://pith.science/paper/KVQJZ3AM

@misc{pith2026241215704,
  author       = {Pith},
  title        = {Pith review of: PoisonCatcher: Revealing and Identifying LDP Poisoning Attacks in IIoT},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KVQJZ3AM}},
  note         = {Machine review of arXiv:2412.15704}
}
read the original abstract

Local Differential Privacy (LDP), a robust privacy-protection model, is widely adopted in the Industrial Internet of Things (IIoT) due to its lightweight, decentralized, and scalable. However, its perturbation-based privacy-protection mechanism hinders distinguishing between any two data, thereby facilitating LDP poisoning attacks. The exposed physical-layer vulnerabilities and resource-constrained prevalent at the IIoT edge not only facilitate such attacks but also render existing LDP poisoning defenses, all of which are deployed at the edge and rely on ample resources, impractical. This work proposes a LDP poisoning defense for IIoT in the resource-rich aggregator. We first reveal key poisoning attack modes occurring within the LDP-utilized IIoT data-collection process, detailing how IIoT vulnerabilities enable attacks, and then formulate a general attack model and derive the poisoned data's indistinguishability. This work subsequently analyzes the poisoning impacts on aggregated data based on industrial process correlation, revealing the distortion of statistical query results' temporal similarity and the resulting disruption of inter-attribute correlation, and uncovering the intriguing paradox that adversaries' attempts to stabilize their poisoning actions for stealth are difficult to maintain. Given these findings, we propose PoisonCatcher, a solution for identifying poisoned data, which includes time-series detectors based on temporal similarity, attribute correlation, and pattern stability metrics to detect poisoned attributes, and a latent-bias feature miner for identifying poisons. Experiments on the real-world dataset indicate that PoisonCatcher successfully identifies poisoned data, demonstrating robust identification capabilities with F2 scores above 90.7\% under various attack settings.

Figures

Figures reproduced from arXiv: 2412.15704 by the authors.

Figure 1
Figure 1. Three Distinct Attack Modes of the LDP Poisoning Attack in IIoT [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Efficacy of Temporal Similarity Detector in Detecting Poisoned Attributes [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Efficacy of Attribute Correlation Detector in Detecting Poisoned Attributes [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Efficacy of Stability Tracking Detector in Detecting Poisoned Attributes [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Efficacy of Attack Ratio on Per-Attribute Poisoned Data Identification Performance [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Robustness of Privacy Budget on Per-Attribute Poisoned Data Identification Performance [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Robustness of Length of Time Window on Per-Attribute Poisoned Data Identification Performance [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 32 canonical work pages

  1. [1]

    Industrial internet of things: Recent advances, enabling technologies and open challenges

    Wazir Zada Khan et al. “Industrial internet of things: Recent advances, enabling technologies and open challenges”. In: Computers & Elec- trical Engineering 81 (2020), p. 106522

    work page 2020

  2. [2]

    What can we learn privately?

    Shiva Prasad Kasiviswanathan et al. “What can we learn privately?” In: SIAM Journal on Computing 40.3 (2011), pp. 793–826

    work page 2011

  3. [3]

    Local differential private data aggregation for discrete distribution estimation

    Shaowei Wang et al. “Local differential private data aggregation for discrete distribution estimation”. In: IEEE Transactions on Parallel and Distributed Systems 30.9 (2019), pp. 2046–2059

    work page 2019

  4. [4]

    Local privacy and statistical minimax rates

    John C Duchi, Michael I Jordan, and Martin J Wainwright. “Local privacy and statistical minimax rates”. In: 2013 IEEE 54th An- nual Symposium on Foundations of Computer Science . IEEE. 2013, pp. 429–438

    work page 2013

  5. [5]

    Collecting telemetry data privately

    Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. “Collecting telemetry data privately”. In: Advances in Neural Information Pro- cessing Systems 30 (2017)

    work page 2017

  6. [6]

    Rappor: Randomized aggregatable privacy-preserving ordinal response

    ´Ulfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. “Rappor: Randomized aggregatable privacy-preserving ordinal response”. In: Proceedings of the 2014 ACM SIGSAC conference on computer and communications security. 2014, pp. 1054–1067

    work page 2014

  7. [7]

    Learning with Privacy at Scale Differential

    Apple Differential Privacy Team. “Learning with Privacy at Scale Differential”. In: 2017

    work page 2017

  8. [8]

    Local Differential Privacy for Smart Meter Data Sharing

    Yashothara Shanmugarasa et al. “Local Differential Privacy for Smart Meter Data Sharing”. In: arXiv preprint arXiv:2311.04544 (2023)

    work page Pith review arXiv 2023

Show all 33 references
  1. [9]

    Local differential privacy for deep learning

    Pathum Chamikara Mahawaga Arachchige et al. “Local differential privacy for deep learning”. In: IEEE Internet of Things Journal 7.7 (2019), pp. 5827–5842

    2019

  2. [10]

    Differential privacy for industrial internet of things: Opportunities, applications, and challenges

    Bin Jiang et al. “Differential privacy for industrial internet of things: Opportunities, applications, and challenges”. In: IEEE Internet of Things Journal 8.13 (2021), pp. 10430–10451

    2021

  3. [11]

    Manipulation attacks in local differential privacy

    Albert Cheu, Adam Smith, and Jonathan Ullman. “Manipulation attacks in local differential privacy”. In: 2021 IEEE Symposium on Security and Privacy (SP) . IEEE. 2021, pp. 883–900

    2021

  4. [12]

    Data Poisoning Attacks to Local Differential Privacy Protocols

    Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. “Data Poisoning Attacks to Local Differential Privacy Protocols”. In: 30th USENIX Security Symposium (USENIX Security 21) . USENIX Association, Aug. 2021, pp. 947–964. ISBN : 978-1-939133-24-3

    2021

  5. [13]

    Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data

    Yongji Wu et al. “Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data”. In: 31st USENIX Security Symposium (USENIX Security 22) . USENIX Association, Aug. 2022, pp. 519–

    2022

  6. [14]

    Fine-grained poisoning attack to local dif- ferential privacy protocols for mean and variance estimation

    Xiaoguang Li et al. “Fine-grained poisoning attack to local dif- ferential privacy protocols for mean and variance estimation”. In: 32nd USENIX Security Symposium (USENIX Security 23) . 2023, pp. 1739–1756

    2023

  7. [15]

    Differentially private histograms in the shuffle model from fake users

    Albert Cheu and Maxim Zhilyaev. “Differentially private histograms in the shuffle model from fake users”. In: 2022 IEEE Symposium on Security and Privacy (SP) . IEEE. 2022, pp. 440–457

    2022

  8. [16]

    Robustness of Locally Differentially Private Graph Analysis Against Poisoning

    Jacob Imola, Amrita Roy Chowdhury, and Kamalika Chaudhuri. “Robustness of Locally Differentially Private Graph Analysis Against Poisoning”. In: arXiv preprint arXiv:2210.14376 (2022)

    2022 arXiv

  9. [17]

    Preventing Manipulation Attack in Local Differential Privacy Using Verifiable Randomization Mechanism

    Fumiyuki Kato, Yang Cao, and Masatoshi Yoshikawa. “Preventing Manipulation Attack in Local Differential Privacy Using Verifiable Randomization Mechanism”. In: Data and Applications Security and Privacy XXXV. Ed. by Ken Barker and Kambiz Ghazinour. Springer International Publis...

    2021

  10. [18]

    Efficient Defenses Against Output Poisoning Attacks on Local Differential Privacy

    Shaorui Song, Lei Xu, and Liehuang Zhu. “Efficient Defenses Against Output Poisoning Attacks on Local Differential Privacy”. In: IEEE Transactions on Information Forensics and Security 18 (2023), pp. 5506–5521

    2023

  11. [19]

    Local Differ- ential Privacy Protocol for Making Key–Value Data Robust Against Poisoning Attacks

    Hikaru Horigome, Hiroaki Kikuchi, and Chia-Mu Yu. “Local Differ- ential Privacy Protocol for Making Key–Value Data Robust Against Poisoning Attacks”. In: Modeling Decisions for Artificial Intelligence. Ed. by Vicenc ¸ Torra and Yasuo Narukawa. Springer Nature Switzer- land, 20...

    2023

  12. [20]

    LDPGuard: Defenses Against Data Poisoning At- tacks to Local Differential Privacy Protocols

    Kai Huang et al. “LDPGuard: Defenses Against Data Poisoning At- tacks to Local Differential Privacy Protocols”. In: IEEE Transactions on Knowledge and Data Engineering 36.7 (2024), pp. 3195–3209

    2024

  13. [21]

    Robust Estimation Method against Poisoning Attacks for Key-Value Data with Local Differential Privacy

    Hikaru Horigome et al. “Robust Estimation Method against Poisoning Attacks for Key-Value Data with Local Differential Privacy”. In: Applied Sciences 14.14 (2024). ISSN : 2076-3417

    2024

  14. [22]

    Data Poisoning Attacks and Defenses to LDP- Based Privacy-Preserving Crowdsensing

    Zhirun Zheng et al. “Data Poisoning Attacks and Defenses to LDP- Based Privacy-Preserving Crowdsensing”. In: IEEE Transactions on Dependable and Secure Computing 21.5 (2024), pp. 4861–4878

    2024

  15. [23]

    A Poisoning-Resilient LDP Schema Leveraging Oblivious Transfer with the Hadamard Trans- form

    Masahiro Shimizu and Hiroaki Kikuchi. “A Poisoning-Resilient LDP Schema Leveraging Oblivious Transfer with the Hadamard Trans- form”. In: Modeling Decisions for Artificial Intelligence . Ed. by Vicenc ¸ Torra, Yasuo Narukawa, and Hiroaki Kikuchi. Springer Nature Switzerland, 2...

    2024

  16. [24]

    Lectures on Lipschitz analysis

    Juha Heinonen. Lectures on Lipschitz analysis . 100. University of Jyv¨askyl¨a, 2005

    2005

  17. [25]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork et al. “Calibrating noise to sensitivity in private data analysis”. In: Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3. Springer. 2006, pp. 265–284

    2006

  18. [26]

    A generalized randomized response tech- nique

    Tasos C Christofides. “A generalized randomized response tech- nique”. In: Metrika 57 (2003), pp. 195–200

    2003

  19. [27]

    Discrete distri- bution estimation under local privacy

    Peter Kairouz, Keith Bonawitz, and Daniel Ramage. “Discrete distri- bution estimation under local privacy”. In: International Conference on Machine Learning . PMLR. 2016, pp. 2436–2444

    2016

  20. [28]

    Cybersecurity Challenges in Industrial Control Sys- tems

    Hadi Mansour. “Cybersecurity Challenges in Industrial Control Sys- tems”. In: Electronic Research Journal of Engineering, Computer and Applied Sciences 2.01 (2020), pp. 14–17

    2020

  21. [29]

    Pufferfish: A framework for mathematical privacy definitions

    Daniel Kifer and Ashwin Machanavajjhala. “Pufferfish: A framework for mathematical privacy definitions”. In: ACM Transactions on Database Systems (TODS) 39.1 (2014), pp. 1–36

    2014

  22. [30]

    Differentially private aggregation of distributed time-series with transformation and encryption

    Vibhor Rastogi and Suman Nath. “Differentially private aggregation of distributed time-series with transformation and encryption”. In: Proceedings of the 2010 ACM SIGMOD International Conference on Management of data . 2010, pp. 735–746

    2010

  23. [31]

    PoisonCatcher Code

    Shuai Lisha. PoisonCatcher Code. https://github.com/shuailishasls/ PoisonCatcher Code. 2025

    2025

  24. [32]

    World Weather Repository ( Daily Updating )

    Nidula Elgiriyewithana. World Weather Repository ( Daily Updating ). Accessed March 17, 2025. 2023. URL: https://www.kaggle.com/ datasets/nelgiriyewithana/global-weather-repository

    2025

  25. [536]

    ISBN : 978-1-939133-31-1

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.