Pith. sign in

REVIEW 3 major objections 4 minor 42 references

SVAFD: A Secure and Verifiable Co-Aggregation Protocol for Federated Distillation

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SVAFD claims to be the first secure aggregation protocol built specifically for federated distillation, giving clients a cryptographic proof that the aggregated teacher knowledge has not been tampered with by a malicious server.

desk verdict A genuinely motivated FD-specific secure aggregation design, undermined by a scalar-sum verification that lets a colluding server/leader tamper with any entries of the teacher-knowledge matrix. read the letter →

arxiv 2505.13319 v2 pith:OFONDEOD submitted 2025-05-19 cs.CR cs.DC

Tian Wen , Sheng Sun , Yuwei Wang , Peiyan Chen , Zhiyuan Wu , Min Liu , Bo Gao This is my paper · ORCID
classification cs.CRcs.DC
keywords federateddistillationsecureaggregationverifiablemaliciousserverLagrangecodedcomputationbilinearpairingspoisoningattacksknowledgefiltration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that secure aggregation for federated distillation can be made verifiable even when the server is malicious. Federated distillation trains heterogeneous models by exchanging soft predictions (logits) rather than model parameters, but most existing secure-aggregation protocols assume a server that is at worst honest-but-curious and are designed for homogeneous model updates. The paper proposes SVAFD as the first secure-aggregation protocol built for this setting, arguing that client-side local aggregation, server-side decoding and proof generation, and a quality-aware logits filter together protect privacy, preserve knowledge integrity, and let each client verify that the aggregated teacher knowledge was not altered. If the protocol works as argued, heterogeneous federated learning could operate without a trusted central aggregator while resisting both poisoning and inference attacks.

What carries the argument

MM-LCC (Multi-to-Multi Lagrange Coding Computation), an extension of Lagrange Coded Computation in which each client acts as both a data provider and a computation provider, encodes its split and blinded logits as evaluations of a polynomial, and exchanges shares so that weighted sums can be computed before any single party sees the plaintext knowledge. The redundancy built into the Lagrange encoding is what gives $D$-resilience against stragglers and $T$-privacy against colluding clients, while the homomorphic-share property lets clients aggregate shares locally and the server decode the global teacher knowledge. The verification machinery is a bilinear-pairing signature scheme: followers sign scalar sums of their logits slices, the leader signs the aggregation weights, and the server combines these into a single proof that the decoded knowledge matches the signed inputs.

What would settle it

Run SVAFD with two different logits matrices for the same group that have identical per-slice totals $V^{(k)}_z$ but different entries, using the same weights and keys, and see whether Eq. (20) accepts both; if the proof passes, the verification cannot detect tampering that preserves slice sums. A complementary check is to have a group leader use the follower keys it receives to compute $\pi^c$ itself and to strip the blinding from $\tilde{Y}_c$, and observe whether clients accept the leader's transcript.

Watch

Extended reading notes

Core claim

The central claim is that SVAFD gives each group leader a way to verify the teacher knowledge it receives: the server decodes the aggregated logits and computes a proof $\pi^c$ from signatures over each follower's per-slice logits sums and the leader's aggregation weights, and the leader accepts only if the bilinear-pairing equality $\pi^c \overset{?}{=} e(g,g)^{\sum_{g=1}^{M}\sum_{l=1}^{D} y_{g,l} + K\sum_{i\in G_c} w_i \Upsilon_i}$ holds. The paper argues that this equality, together with the Lagrange-coded encoding and the class-average-logits filter, ensures that no malicious server or colluding follower can forge an aggregation result or inject poisoned knowledge without detection. On the paper's own terms, this establishes privacy protection, knowledge integrity, and verifiability for both class-grained and sample-grained federated distillation.

Load-bearing premise

The protocol's proof checks only the per-slice sums of each client's logits, so the integrity claim rests on the assumption that guarding these sums guards the full teacher-knowledge matrix, and it also assumes a group leader can be trusted with followers' private signing keys even though the server is malicious.

Editorial extensions

If this is right

  • Federated distillation systems can run with a malicious server: clients no longer need to trust the server to aggregate honestly, because each group leader can check the proof in Eq. (20) before using the teacher knowledge.
  • Quality-aware filtration based on class-average logits and locality-sensitive hashing keeps poisoned clients from steering the aggregate, improving model accuracy under eight poisoning attacks with 40% to 60% malicious clients.
  • The co-aggregation design applies to both class-grained and sample-grained logit formats, and the prototype runs on four federated distillation architectures.
  • The protocol keeps client-side latency in the millisecond range while the server performs the heavy decoding, so the scheme is intended for resource-constrained edge networks with up to 1,300 clients.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The verification in Section IV-C authenticates only the per-slice totals $V^{(k)}_z$ (Eq. (14) and Eq. (17)), not the individual logit entries; a party that redistributes values within a slice while preserving each slice's total would still satisfy Eq. (20), so the integrity guarantee is weaker than full-matrix integrity.
  • Because each follower sends its private signing key $\Upsilon_z$ to its group leader during the aggregation stage, a malicious leader can compute the proof $\pi^c$ itself and can strip the blinding from the decoded knowledge; the protocol's security against a malicious server therefore depends on leaders being semi-honest toward their own followers.
  • The proof-of-sum construction is not specific to logits: it could be tested on other linear aggregates such as model updates or gradient sums, since it only requires a bilinear pairing group and signed per-slice sums.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes SVAFD, a secure aggregation protocol specifically for Federated Distillation. The design splits responsibilities: clients encode local logits with Lagrange Coding Computation, exchange and locally aggregate shares, while the server decodes the aggregated results and generates a pairing-based verification proof. A quality-aware filtration scheme (CAL) is used to exclude biased logits from poisoning attacks. The authors claim privacy protection, knowledge integrity, and verifiability against a malicious server, and present experiments over four FD architectures under multiple poisoning attacks and an inference attack.

Significance. If the security claims were sound, this would be a meaningful step: SVAFD targets a realistic setting (heterogeneous FD, malicious server, colluding clients), avoids a trusted third party, and reports broad experiments and overhead measurements. The LCC-based co-aggregation idea is interesting and the system-level evaluation is extensive. However, the central verifiability claim is not supported by the protocol as written: the verification equation authenticates only a scalar sum of the decoded teacher knowledge, not the individual entries, and the protocol requires followers to hand their private signature keys to the group leader. These issues are load-bearing for the paper's main advertised properties, so the contribution cannot be accepted in its current form.

major comments (3)
  1. [Section IV-D, Eq. (20) and Eq. (23)] The verification predicate does not bind the entries of the teacher-knowledge matrix; it only checks the total sum of all entries. Since π^{(k)'}_z = g^{V_z^{(k)}+Υ_z} and π^c_z = g^{w_z}, the product in Eq. (17) collapses in Eq. (23) to e(g,g)^{Σ_{g,l} y_{g,l} + K Σ_i w_i Υ_i}. Thus any matrix Y' with the same total sum as the genuine teacher knowledge satisfies Eq. (20) with the same proof. A server that can produce such a Y' therefore passes verification while changing every entry of the matrix. This directly contradicts the claimed 'knowledge integrity' and 'verifiability' properties. The security of the protocol now depends entirely on the secrecy of the deblinding matrix R_c and on the server being unable to learn or reproduce the scalar sum, which is a much weaker guarantee than the advertised matrix-level integrity.
  2. [Section IV-A and Section V.A.2] The protocol requires every follower to send its private signature key Υ_z to the group leader. Since the threat model in Section II-C explicitly allows the server to collude with any clients, a colluding leader/server pair knows R_c, all follower keys Υ_z, all weights w_z, and all signatures. This pair can select any tampered matrix Y' with the same total sum as the true result, re-sign the modified slice digests using the known keys, and produce a proof satisfying Eq. (20). The statement in Section V.A.2 that colluding parties 'cannot deceive the leader' is therefore unsupported. Handing private signature keys to another party also undermines the unforgeability assumption on which the whole verification argument rests.
  3. [Section IV.C.1, Eq. (10)] The claimed information-theoretic privacy guarantee is asserted rather than proven. The text states that truncated circularly-symmetric complex Gaussian noise 'ensure[s] information-theoretic privacy', but no theorem or analysis connects the noise distribution, the parameters K and T, and the number of clients N to a privacy bound. The LCC privacy theorem (Theorem 1) is stated for the algebraic LCC setting; the protocol here uses real-valued/truncated Gaussian blinding and real-valued aggregated shares, so the T-privacy guarantee cannot simply be inherited. This is a load-bearing gap for the privacy requirement, which is one of the three central advertised properties.
minor comments (4)
  1. [Throughout] There are numerous typos and inconsistencies, including 'inple ment' (Note 4), 'attatins' (Section IV.C.4), 'simplied' (Section V.A.1), 'eights attacks' (Fig. 6 caption), 'poision' (Section VI.B), 'Dilliclet' (Section III.C), and inconsistent use of 'MAUA' vs 'MUAU'.
  2. [Appendix C] The precision conversion function has a typo: '⌊V^{(k)}_z * 10^q.⌋' contains an extra period inside the floor notation.
  3. [Section V.A.1, Eq. (21)] The correctness proof writes exact equality for the decode/deblind operation, but the protocol uses analog LCC with truncation and real-part extraction, and Table III reports nonzero relative error. The proof should state that the equality holds only up to the approximation error, and the verification step should specify how that error is tolerated.
  4. [Section III.C] The CAL filtration rule is motivated by measurements on the same datasets used in the evaluation (Fig. 4b), and the parameters of the LSH projection P and the group size R are chosen without a formal analysis. The robustness results should be interpreted as empirical evidence for a heuristic, not as a security guarantee.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the co-aggregation and verification derivations use external LCC and verifiable-computation results, and the CAL heuristic is not fitted to the claimed security outcome.

full rationale

The derivation chain is self-contained against external building blocks. Co-aggregation correctness (Eq. 21) is an application of the LCC homomorphism theorem from [30], and the signature-aggregation proof (Eq. 23) is an instantiation of the verifiable linear-inference scheme from [38]; neither theorem is authored by the present paper, and neither assumes the target result. The CAL filtration rule (Eqs. 7-9) is a heuristic motivated by the authors' own measurements (Fig. 4b) and evaluated on external FD architectures and attack benchmarks, with no constants fitted to the claimed security outcome. The paper's self-citations (e.g., logits-poisoning attacks [15,16] and the FedCache benchmark [24]) are contextual or evaluative and are not load-bearing for the central verifiability claim. One caveat is a soundness gap rather than circularity: the verification predicate in Eq. (20) depends on the decoded teacher knowledge only through the single scalar sum of all entries (see Eq. 23), so the assertion in Section V.A.2 that colluding parties 'cannot deceive the leader' is not established by the given equations; a malicious leader/server that holds R_c and follower keys could alter entries while preserving the sum. This is a correctness risk, not a circular derivation.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central construction is mostly composed of established primitives; the novel load-bearing assumptions are the empirical validity of CAL-based filtration and the sufficiency of sum-based signatures for integrity.

free parameters (8)
  • P
    Size of LSH-hashed value in Eq. (8), chosen by hand without sensitivity analysis.
  • R
    Number of followers per group in Eq. (9); controls the filtration aggressiveness.
  • K = 10-80 in experiments
    Number of logits slices in LCC encoding; protocol parameter.
  • T = 10-50 in experiments
    Privacy parameter, maximum colluding attackers; protocol parameter.
  • theta = 6
    Truncation coefficient for the Gaussian noise matrices in Eq. (10).
  • sigma_z = 10^3
    Variance of the noise matrices in Table III; chosen by hand.
  • lambda
    Distillation weight in Eq. (1); not central but part of each FD architecture.
  • q
    Quantization scale in Appendix C for converting logits to integers for signatures.
assumptions (5)
  • standard math LCC achievability condition D + deg(f)(K+T-1) + 1 <= N (Theorem 1 of Ref. [30]).
    Used directly in Definition 1 to claim D-resilience and T-privacy; noted in Section III-B.
  • domain assumption The bilinear pairing group (p,G,G_T,e) is secure and discrete log is hard in G.
    Needed for the signature aggregation proof in Section IV-D2/D3; standard cryptographic assumption.
  • domain assumption Logits from benign clients are correlated with their local data distributions, so cosine similarity of LSH-hashed class-average logits separates benign from poisoned clients.
    This is the basis for CAL filtration, motivated by Fig. 4(b), but no adversarial distribution is modeled in the proof.
  • domain assumption The additive/sample split of logits preserves the weighted aggregation operation ℏ(·), i.e., ℏ is linear over the field.
    Correctness of Eq. (21) requires the aggregation to be a linear weighted sum, which limits the semantics of 'knowledge integrity'.
  • ad hoc to paper Truncated circularly-symmetric complex Gaussian noise in Eq. (10) provides information-theoretic privacy.
    The paper states 'to ensure information-theoretic privacy,' but continuous Gaussian noise does not yield a uniform conditional distribution; the claim is unproven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SVAFD: A Secure and Verifiable Co-Aggregation Protocol for Federated Distillation." pith.science (2026). https://pith.science/paper/OFONDEOD

@misc{pith2026250513319,
  author       = {Pith},
  title        = {Pith review of: SVAFD: A Secure and Verifiable Co-Aggregation Protocol for Federated Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OFONDEOD}},
  note         = {Machine review of arXiv:2505.13319}
}
read the original abstract

Secure Aggregation (SA) is an indispensable component of Federated Learning (FL) that concentrates on privacy preservation while allowing for robust aggregation. However, most SA designs rely heavily on the unrealistic assumption of homogeneous model architectures. Federated Distillation (FD), which aggregates locally computed logits instead of model parameters, introduces a promising alternative for cooperative training in heterogeneous model settings. Nevertheless, we recognize two major challenges in implementing SA for FD. (i) Prior SA designs encourage a dominant server, who is solely responsible for collecting, aggregating and distributing. Such central authority facilitates server to forge aggregation proofs or collude to bypass the claimed security guarantees; (ii) Existing SA, tailored for FL models, overlook the intrinsic properties of logits, making them unsuitable for FD. To address these challenges, we propose SVAFD, the first SA protocol that is specifically designed for FD. At a high level, SVAFD incorporates two innovations: (i) a multilateral co-aggregation method tha redefines the responsibilities of clients and server. Clients autonomously evaluate and aggregate logits shares locally with a lightweight coding scheme, while the server handles ciphertext decoding and performs the task of generating verification proofs; (ii) a quality-aware knowledge filtration method that facilitates biased logits exclusion against poisoning attacks. Moreover, SVAFD is resilient to stragglers and colluding clients, making it well-suited for dynamic networks in real-world applications. We have implemented the SVAFD prototype over four emerging FD architectures and evaluated it against poisoning and inference attacks. Results demonstrate that SVAFD improves model accuracy, making it a significant step forward in secure and verifiable aggregation for heterogeneous FL systems.

Figures

Figures reproduced from arXiv: 2505.13319 by the authors.

Figure 1
Figure 1. Federated Distillation Architecture and Security [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of SVAFD. In contrast to sharing model parameters or updates, FD employs the knowledge guided mechanism that is communication-efficient and heterogeneity-friendly to enable collaborative training. The server aggregates local knowledge from multiple clients to construct global knowledge, which is subsequently disseminated back to the clients to enhance local training. Throughout this paper, local knowledge i… view at source ↗
Figure 3
Figure 3. Workflow of LCC and MM-LCC. global decoding and signature aggregation to guarantee the verifiability of the aggregation process. Experimental results show that SVAFD does not introduce excessive computational overhead on the client side but instead offloads most com￾putational tasks to servers with stronger resource capabilities. More details are deferred to §III-B. Challenge ②: Current malicious client detection me… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Observation of CAL Definition 2: Homomorphic Share Aggregation. MM￾LCC is utilized to enable co-aggregation for its property of Homomorphic Share Aggregation. Specifically, any operation performed by the client on the knowledge shares, after decod￾ing, must correspond …
Figure 5
Figure 5. Figure 5: Workflow of SVAFD. Wfc to its group member z ∈ Gc. Followers first split their local logits to obtain ϑ and joint noise matrices. Then, they encode ϑ by LCC, deliver the corresponding logits share with each other, and aggregate all the received shares respectively. Mea…
Figure 6
Figure 6. Figure 6: The MAUA of the client model obtained by different aggregation architectures under eights attacks with 40% malicious [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: The MAUA of the client model obtained by different aggregation architectures under eights attacks with 60% malicious [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: The ASR obtained on SVHN. over three datasets. Specifically, we consider that SVAFD cooperative with the four benchmarks under (i) the model heterogeneity among clients, and those with residuals of index mod 3 of 0, 1 and 2 are assigned with model architectures AC 1 ,A…
Figure 10
Figure 10. Figure 10: The similarity of knowledge distribution and label distribution in different cases. [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 13
Figure 13. Figure 13: Run time of encode and de￾code in class-grained [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Run time of encode and de￾code in sample-grained [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 37 canonical work pages

  1. [1]

    Edge Artificial Intelligence for 6G: Vision, Enabling Technologies, and Applications,

    K. B. Letaief, Y . Shi, J. Lu, and J. Lu, “Edge Artificial Intelligence for 6G: Vision, Enabling Technologies, and Applications,” IEEE Journal on Selected Areas in Communications, vol. 40, no. 1, pp. 5–36, Jan. 2022

    work page 2022

  2. [2]

    Agglomerative federated learning: Empowering larger model training via end-edge-cloud collaboration,

    Z. Wu, S. Sun, Y . Wang, M. Liu, B. Gao, Q. Pan, T. He, and X. Jiang, “Agglomerative federated learning: Empowering larger model training via end-edge-cloud collaboration,” in IEEE INFOCOM 2024-IEEE Conference on Computer Communications. IEEE, 2024, pp. 131–140

    work page 2024

  3. [3]

    Federated learning in mobile edge networks: A comprehensive survey,

    W. Y . B. Lim, N. C. Luong, D. T. Hoang, Y . Jiao, Y .-C. Liang, Q. Yang, D. Niyato, and C. Miao, “Federated learning in mobile edge networks: A comprehensive survey,” IEEE communications surveys & tutorials, vol. 22, no. 3, pp. 2031–2063, 2020

    work page 2020

  4. [4]

    Exploring the Distributed Knowledge Congruence in Proxy-data-free Federated Distillation,

    Z. Wu, S. Sun, Y . Wang, M. Liu, Q. Pan, J. Zhang, Z. Li, and Q. Liu, “Exploring the Distributed Knowledge Congruence in Proxy-data-free Federated Distillation,” ACM Transactions on Intelligent Systems and Technology, p. 3639369, Dec. 2023

    work page 2023

  5. [5]

    Survey of knowledge distillation in federated edge learning,

    Z. Wu, S. Sun, Y . Wang, M. Liu, X. Jiang, and R. Li, “Survey of knowledge distillation in federated edge learning,” arXiv preprint arXiv:2301.05849, 2023

    arXiv 2023

  6. [6]

    Personal- ized edge intelligence via federated self-knowledge distillation,

    H. Jin, D. Bai, D. Yao, Y . Dai, L. Gu, C. Yu, and L. Sun, “Personal- ized edge intelligence via federated self-knowledge distillation,” IEEE Transactions on Parallel and Distributed Systems, vol. 34, no. 2, pp. 567–580, 2023

    work page 2023

  7. [7]

    Selective Knowledge Sharing for Privacy- Preserving Federated Distillation without A Good Teacher,

    J. Shao, F. Wu, and J. Zhang, “Selective Knowledge Sharing for Privacy- Preserving Federated Distillation without A Good Teacher,” Dec. 2023

    work page 2023

  8. [8]

    Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack,

    H. Takahashi, J. Liu, and Y . Liu, “Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack,” in 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Vancouver, BC, Canada: IEEE, Jun. 2023, pp. 12 198–12 207

    work page 2023

Show all 42 references
  1. [9]

    ELSA: Secure Aggregation for Federated Learning with Malicious Actors,

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa, “ELSA: Secure Aggregation for Federated Learning with Malicious Actors,” in 2023 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE, May 2023, pp. 1961–1979

    2023

  2. [10]

    RoFL: Robustness of Secure Federated Learning,

    H. Lycklama, L. Burkhalter, A. Viand, N. K ¨uchler, and A. Hith- nawi, “RoFL: Robustness of Secure Federated Learning,” in 2023 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE, May 2023, pp. 453–476

    2023

  3. [11]

    Practical Secure Aggregation for Privacy-Preserving Machine Learning|Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security,

    “Practical Secure Aggregation for Privacy-Preserving Machine Learning|Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security,” https://dl.acm.org/doi/abs/10.1145/3133956.3133982

    2017

  4. [12]

    EV-FL: Efficient Verifiable Federated Learning With Weighted Aggregation for Industrial IoT Networks,

    H. Yu, R. Xu, H. Zhang, Z. Yang, and H. Liu, “EV-FL: Efficient Verifiable Federated Learning With Weighted Aggregation for Industrial IoT Networks,” IEEE/ACM Transactions on Networking, vol. 32, no. 2, pp. 1723–1737, Apr. 2024

    2024

  5. [13]

    martFL: Enabling Utility-Driven Data Marketplace with a Robust and Verifiable Federated Learning Architecture,

    Q. Li, Z. Liu, Q. Li, and K. Xu, “martFL: Enabling Utility-Driven Data Marketplace with a Robust and Verifiable Federated Learning Architecture,” May 2024

    2024

  6. [14]

    Vcd-fl: Verifiable, collusion-resistant, and dynamic federated learning,

    S. Gao, J. Luo, J. Zhu, X. Dong, and W. Shi, “Vcd-fl: Verifiable, collusion-resistant, and dynamic federated learning,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 3760–3773, 2023

    2023

  7. [15]

    Logits poisoning attack in federated distillation,

    Y . Tang, Z. Wu, B. Gao, T. Wen, Y . Wang, and S. Sun, “Logits poisoning attack in federated distillation,” in International Conference on Knowledge Science, Engineering and Management. Springer, 2024, pp. 286–298

    2024

  8. [16]

    Peak-controlled logits poisoning attack in federated distillation,

    Y . Tang, A. Zhang, Z. Wu, B. Gao, T. Wen, Y . Wang, and S. Sun, “Peak-controlled logits poisoning attack in federated distillation,” ArXiv, vol. abs/2407.18039, 2024. [Online]. Available: https://api. semanticscholar.org/CorpusID:271431993

    2024 arXiv

  9. [17]

    Privacy leakage from logits attack and its defense in federated distillation,

    D. Xiao, D. Yang, J. Li, X. Chen, and W. Wu, “Privacy leakage from logits attack and its defense in federated distillation,” in 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2024, pp. 169–182

    2024

  10. [18]

    Federated Learning with Non-IID Data,

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra, “Federated Learning with Non-IID Data,” Jul. 2022

    2022

  11. [19]

    Privacy- preserving deep learning via additively homomorphic encryption,

    L. T. Phong, Y . Aono, T. Hayashi, L. Wang, and S. Moriai, “Privacy- preserving deep learning via additively homomorphic encryption,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 5, pp. 1333–1345, 2018. 15

    2018

  12. [20]

    Secure Neural Network in Federated Learning with Model Aggregation under Multiple Keys,

    Z. L. Jiang, H. Guo, Y . Pan, Y . Liu, X. Wang, and J. Zhang, “Secure Neural Network in Federated Learning with Model Aggregation under Multiple Keys,” in 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2021 7th IEEE International Confere...

    2021

  13. [21]

    Verifiable Privacy-Preserving Federated Learning Under Multiple En- crypted Keys,

    X. Shen, X. Luo, F. Yuan, B. Wang, Y . Chen, D. Tang, and L. Gao, “Verifiable Privacy-Preserving Federated Learning Under Multiple En- crypted Keys,” IEEE Internet of Things Journal, pp. 1–1, 2023

    2023

  14. [22]

    Secure Single-Server Aggregation with (Poly)Logarithmic Overhead,

    J. H. Bell, K. A. Bonawitz, A. Gasc ´on, T. Lepoint, and M. Raykova, “Secure Single-Server Aggregation with (Poly)Logarithmic Overhead,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. Virtual Event USA: ACM, Oct. 2020, pp. 1253–1269

    2020

  15. [23]

    FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attacks,

    E. Kabir, Z. Song, M. R. Ur Rashid, and S. Mehnaz, “FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attacks,” in 2024 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE, May 2024, pp. 2572–2590

    2024

  16. [24]

    Fedcache: A knowledge cache-driven federated learning architecture for personalized edge intelligence,

    Z. Wu, S. Sun, Y . Wang, M. Liu, K. Xu, W. Wang, X. Jiang, B. Gao, and J. Lu, “Fedcache: A knowledge cache-driven federated learning architecture for personalized edge intelligence,” IEEE Transactions on Mobile Computing, 2024

    2024

  17. [25]

    FedICT: Federated Multi-task Distillation for Multi-access Edge Computing,

    Z. Wu, S. Sun, Y . Wang, M. Liu, Q. Pan, X. Jiang, and B. Gao, “FedICT: Federated Multi-task Distillation for Multi-access Edge Computing,” IEEE Transactions on Parallel and Distributed Systems, pp. 1–16, 2023

    2023

  18. [26]

    Multi-task federated learning for person- alised deep neural networks in edge computing,

    J. Mills, J. Hu, and G. Min, “Multi-task federated learning for person- alised deep neural networks in edge computing,” IEEE Transactions on Parallel and Distributed Systems, vol. 33, no. 3, pp. 630–641, 2021

    2021

  19. [27]

    Communication-Efficient On-Device Machine Learning: Federated Dis- tillation and Augmentation under Non-IID Private Data,

    E. Jeong, S. Oh, H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Communication-Efficient On-Device Machine Learning: Federated Dis- tillation and Augmentation under Non-IID Private Data,” Nov. 2018

    2018

  20. [28]

    FedMD: Heterogenous Federated Learning via Model Distillation,

    D. Li and J. Wang, “FedMD: Heterogenous Federated Learning via Model Distillation,” Oct. 2019

    2019

  21. [29]

    Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training With Non-IID Private Data,

    S. Itahara, T. Nishio, Y . Koda, M. Morikura, and K. Ya- mamoto, “Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training With Non-IID Private Data,” IEEE Transactions on Mobile Computing, vol. 22, no. 1, pp. 191–205, Jan. 2023

    2023

  22. [30]

    Lagrange Coded Computing: Optimal Design for Resiliency, Security and Privacy,

    Q. Yu, S. Li, N. Raviv, S. M. M. Kalan, M. Soltanolkotabi, and S. Aves- timehr, “Lagrange Coded Computing: Optimal Design for Resiliency, Security and Privacy,” Apr. 2019

    2019

  23. [31]

    Auction-and-Learning Based Lagrange Coded Computing Model for Privacy-Preserving, Secure, and Resilient Mobile Edge Computing,

    A. Asheralieva, D. Niyato, and Z. Xiong, “Auction-and-Learning Based Lagrange Coded Computing Model for Privacy-Preserving, Secure, and Resilient Mobile Edge Computing,” IEEE Transactions on Mobile Computing, vol. 22, no. 2, pp. 744–764, Feb. 2023

    2023

  24. [32]

    Analog Lagrange Coded Computing,

    M. Soleymani, H. Mahdavifar, and A. S. Avestimehr, “Analog Lagrange Coded Computing,” Jan. 2021

    2021

  25. [33]

    DReS-FL: Dropout-resilient secure federated learning for non-IID clients via secret data sharing,

    J. Shao, Y . Sun, S. Li, and J. Zhang, “DReS-FL: Dropout-resilient secure federated learning for non-IID clients via secret data sharing,” in Advances in Neural Information Processing Systems, S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, Eds., vol. 35. Cu...

    2022

  26. [34]

    Decentralized federated learning through proxy model sharing,

    S. Kalra, J. Wen, J. C. Cresswell, M. V olkovs, and H. R. Tizhoosh, “Decentralized federated learning through proxy model sharing,” Nature Communications, vol. 14, no. 1, p. 2899, May 2023

    2023

  27. [35]

    DFLStar: A Decentralized Federated Learning Framework with Self- Knowledge Distillation and Participant Selection,

    B. Soltani, V . Haghighi, Y . Zhou, Q. Z. Sheng, and L. Yao, “DFLStar: A Decentralized Federated Learning Framework with Self- Knowledge Distillation and Participant Selection,” in Proceedings of the 33rd ACM International Conference on Information and Knowledge Management. Bo...

    2024

  28. [36]

    Distilling the Knowledge in a Neural Network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the Knowledge in a Neural Network,” Mar. 2015

    2015

  29. [37]

    Similarity search in high dimen- sions via hashing,

    A. Gionis, P. Indyk, and R. Motwani, “Similarity search in high dimen- sions via hashing,” in Proceedings of the 25th International Conference on Very Large Data Bases, ser. VLDB ’99. San Francisco, CA, USA: Morgan Kaufmann Publishers Inc., 1999, p. 518–529

    1999

  30. [38]

    Privacy- Preserving and Verifiable Outsourcing Linear Inference Computing Framework,

    J. Liu, X. Li, X. Liu, J. Tang, Y . Wang, Q. Tong, and J. Ma, “Privacy- Preserving and Verifiable Outsourcing Linear Inference Computing Framework,” IEEE Transactions on Services Computing, vol. 16, no. 6, pp. 4591–4604, Nov. 2023

    2023

  31. [39]

    Fedml: A research library and benchmark for federated machine learning,

    C. He, S. Li, J. So, X. Zeng, M. Zhang, H. Wang, X. Wang, P. Vepakomma, A. Singh, H. Qiu, X. Zhu, J. Wang, L. Shen, P. Zhao, Y . Kang, Y . Liu, R. Raskar, Q. Yang, M. Annavaram, and S. Avestimehr, “Fedml: A research library and benchmark for federated machine learning,” 2020. ...

    2020 arXiv

  32. [40]

    Random projection in dimensionality reduction: applications to image and text data,

    E. Bingham and H. Mannila, “Random projection in dimensionality reduction: applications to image and text data,” in Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining, 2001, pp. 245–250

    2001

  33. [41]

    Charm: a framework for rapidly prototyp- ing cryptosystems,

    J. A. Akinyele, C. Garman, I. Miers, M. W. Pagano, M. Rushanan, M. Green, and A. D. Rubin, “Charm: a framework for rapidly prototyp- ing cryptosystems,” Journal of Cryptographic Engineering, vol. 3, pp. 111–128, 2013

    2013

  34. [42]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, A. Y . Ng et al., “Reading digits in natural images with unsupervised feature learning,” in NIPS workshop on deep learning and unsupervised feature learning, vol. 2011, no. 2. Granada, 2011, p. 4

    2011

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.