How Does the Smoothness Approximation Method Facilitate Generalization for Federated Adversarial Learning?

Fan Wu; Lixing Chen; Shichao Kan; Wenjun Ding; Ying An; Zhe Qu

REVIEW 4 major objections 5 minor 66 references

How Does the Smoothness Approximation Method Facilitate Generalization for Federated Adversarial Learning?

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proves stability-based generalization bounds for federated adversarial learning and argues that randomized smoothness approximation plus slack-reweighted aggregation minimizes the generalization gap.

desk verdict The VFAL generalization bounds are a plausible new contribution, but the SFAL improvement claim rests on a concrete algebra error and an unhandled data-dependent weighting. read the letter →

arxiv 2412.08282 v2 pith:ONE7D7IH submitted 2024-12-11 cs.LG cs.AI

Wenjun Ding , Ying An , Lixing Chen , Shichao Kan , Fan Wu , Zhe Qu This is my paper · ORCID

classification cs.LGcs.AI

keywords federatedadversariallearninggeneralizationboundsalgorithmicstabilitysmoothnessapproximationrandomizedsmoothingdataheterogeneitytrainingslackreweighting

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated adversarial learning trains models against adversarial examples across distributed clients, but its loss functions are non-smooth, which blocks standard generalization analysis. This paper claims that three common smoothness approximation methods — surrogate, randomized, and over-parameterized — each yield explicit stability-based generalization bounds for two federated adversarial algorithms, VFAL and SFAL. The bounds say that randomized smoothness approximation (RSA) gives the smallest generalization error, and that the slack-reweighted aggregation used by SFAL improves all three bounds by a factor larger than one whenever the slack parameter $\alpha$ is positive. If these bounds hold, practitioners facing heterogeneous client data can choose RSA with SFAL-style reweighting to reduce the gap between training and test performance, and can justify that choice by a provable statement rather than by empirics alone. The paper also draws design insights from the bounds: use adversarial-loss-based metrics for aggregation, and control attack strength, noise level, and network width.

What carries the argument

The load-bearing machinery is the on-average stability framework for federated adversarial learning: neighboring datasets replace one sample in one client, and the generalization gap is bounded by the expected change in the loss at that perturbed point. To handle non-smooth adversarial losses, the paper plugs in three smooth surrogates: the surrogate loss $h(\theta; z) = \max_{\|z-z'\|_p \le \rho} \ell(\theta; z')$, which is only approximately gradient-Lipschitz; randomized smoothing $\ell_\gamma(\theta,z) = \mathbb{E}_u[\ell_\rho(\theta+\gamma u,z)]$ with $Q$ Monte-Carlo gradient samples; and an over-parameterized shallow network whose Hessian is bounded, making the adversarial loss $\zeta_\theta$-smooth. The final piece is the $\alpha$-slack decomposed mechanism: local adversarial losses are sorted, the low-loss clients are upweighted by $1+\alpha$ and the high-loss clients downweighted by $1-\alpha$, with weights normalized by $\tilde m$, and the theorems claim this inserts the factor $r_\alpha$ into the denominator of each generalization bound.

What would settle it

Recompute the SFAL stability recursion without the fixed-weight assumption: run SFAL on $S$ and on a one-sample-replaced neighbor, record the actual weights $\phi_t(\alpha,i)$ on both runs, and check whether $\mathbb{E}\|\theta_{t+1}-\theta'_{t+1}\|$ still contracts at the claimed $r_\alpha$ rate. In the algebra, the step labeled 'Using (24) x2 - (23)' yields a coefficient $1-3\alpha$ on the last term rather than $1-\alpha$, so for $\alpha > 1/3$ the claimed contraction requires an additional argument.

Watch

Extended reading notes

Core claim

The paper's central claim is that the generalization error of federated adversarial learning can be explicitly bounded through algorithmic stability once the non-smooth adversarial loss is replaced with a smooth approximation, and that the choice of approximation method and the aggregation scheme determine how small the bound is. For Vanilla FAL, the bounds depend on the attack radius $\rho$, data heterogeneity $D_{\max}$, the number of clients, and local data sizes; randomized smoothing makes the leading error grow like $T^{1/4}$ rather than like $T$, while over-parameterization removes the approximation error but introduces a width-dependent heterogeneity term. For Slack FAL, the same three bounds hold with the convergence- and heterogeneity-related denominators multiplied by $r_\alpha = 1 + \frac{\alpha}{1-\alpha}\frac{2\hat m}{m}$, which exceeds one for $\alpha > 0$, so the paper concludes that SFAL strictly reduces the stated generalization bounds without changing which smoothness approximation is best. This is Remark 7's claim: SFAL enhances the generalization of these methods without altering their strengths and weaknesses. The paper further identifies RSA as the most effective of the three approximations and recommends SFAL when data heterogeneity is high.

Load-bearing premise

The proof of SFAL's advantage assumes the aggregation weights are the same for a dataset and its one-sample-replaced neighbor, even though those weights are computed from the local adversarial losses that change when the sample is replaced; the proof never bounds the drift in the weights.

Editorial extensions

If this is right

If the bounds are correct, RSA should be the default smoothness approximation for federated adversarial learning: its generalization error grows as $T^{1/4}\log T/\sqrt{Q}$, which is slower than SSA's $\rho T \log T$ term and avoids OPSA's width-dependent term.
Under high data heterogeneity, SFAL's reweighting yields a strictly smaller bound than VFAL for all three approximations because $r_\alpha > 1$ for $\alpha > 0$; the paper recommends SFAL in precisely that regime.
The bounds identify controllable levers: reducing the attack radius $\rho$ cuts the SSA error, increasing the number of smoothing samples $Q$ cuts the RSA estimation error up to a computational limit, and controlling the over-parameterized width $s$ controls the OPSA heterogeneity term.
The analysis supports designing new aggregation metrics based on local adversarial loss, contrastive loss, or adversarial penalty to target the heterogeneity term $D_{\max}$ directly.
In the limit $\rho \to 0$ the SSA and RSA bounds recover standard federated-learning heterogeneity terms, so the adversarial analysis contains the non-adversarial picture as a special case.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the claimed SFAL improvement rests on treating the $\alpha$-slack weights as unchanged when one sample is replaced, and the proof does not bound the weight-drift term; a stability proof that accounts for changing weights would either recover $r_\alpha$ with an extra cost or show the improvement is smaller than stated.
Beyond the paper: the bound suggests an adaptive schedule in which $\alpha$ grows with the estimated heterogeneity $D_i$ (or with the ratio of sorted local adversarial losses) would shrink the generalization gap further; this is testable by comparing fixed-$\alpha$ SFAL with a per-round adaptive $\alpha$ on the same federated adversarial benchmark.
Beyond the paper: the RSA result implies a smoothing-noise trade-off: increasing the smoothing radius $\gamma$ flattens the loss landscape and improves the bound, but with finite $Q$ the Monte-Carlo variance term $T^{1/4}/\sqrt{Q}$ sets a floor, so a practical rule of small $Q$ balances the bound with client computation, consistent with the reported experiments.
Beyond the paper: applying the same stability analysis to the paper's proposed total-variation-weighted aggregation rule would require bounding how the distance $d_{TV}(\tilde P_i, P_i)$ drifts when a sample is replaced; if that drift can be bounded, the TV-weighted rule may outperform SFAL because it uses distributional geometry rather than loss ranks.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper's real contribution is the first stability-based generalization analysis for federated adversarial learning (FAL) comparing three smoothing approximations under the VFAL algorithm. That part is decent and worth reading: the VFAL bounds (Theorems 2–4) follow known stability templates but add a heterogeneity term based on total variation between original and adversarial distributions, which is genuinely new for this setting. The decomposition of the generalization gap into approximation, convergence, and heterogeneity terms is clear, and the experiments qualitatively match the main qualitative predictions (larger ρ and heterogeneity increase the gap; RSA has smaller gap in the tested regimes).

The soft spot is the SFAL analysis. Theorem 6 and Remark 7, which claim that the α-slack reweighting provably improves generalization over VFAL, are not established. The proof of Theorem 6 contains an algebraic error at the step labeled 'Using (24) x2 - (23)'. With A = e^{βKη_t}E||θ_t−θ'_t|| + e^{βKη_t}Kη_tξ and B = 2Kη_t e^{βKη_t}/(m̃n_i)E||g_i||, inequality (23) is A + (1+α)B and (24) is A + (1−α)B. Then 2·(24)−(23) gives A + (1−3α)B, not A + (1−α)B. The claimed denominator r_α depends entirely on that wrong coefficient. Worse, the proof factors the aggregation weight φ^{(α,j)} out of the sum as though the weight vector were identical for the dataset and its neighbor. But SFAL computes φ from the sorted local losses (Algorithm 4, Eqs. (8)–(9)); changing one sample changes local losses, can change the up/down-weighted partition, and changes α. No term bounds the induced difference in the aggregation operator. Without that term, the stability argument for SFAL is missing a load-bearing piece.

Smaller issues: the 'RSA is most effective' claim is an order-only comparison, not a uniform bound, so it is a heuristic conclusion. The OPSA bound hides a width condition (s ≥ ...) that is only stated as 'without loss of generality'. The experiments are thin: only generalization gap plots, no error bars, no ablations over α or m̂ beyond one default.

Who is this for? Researchers working on robustness and generalization in federated learning, especially those who want to see how stability bounds behave with smoothing approximations. The VFAL half could be salvageable and deserves referee time. But the current manuscript overclaims SFAL improvement, and Theorem 6 cannot be accepted as written. My recommendation: send to peer review with an eye toward major revision, but flag the SFAL proof for correction before publication.

Referee Report

4 major / 5 minor

Summary. This paper studies the generalization performance of two federated adversarial learning algorithms, VFAL and SFAL, under three smoothness approximation methods: SSA, RSA, and OPSA. It derives on-average stability bounds for VFAL in Theorems 2–4 and for SFAL in Theorem 6, with the stated conclusions that RSA is the most effective smoothing method and that SFAL improves the generalization bounds relative to VFAL by a factor r_alpha = 1 + (alpha/(1-alpha))(2*hat_m/m). The paper also reports experiments on SVHN and CIFAR10 measuring generalization gaps for varying attack strength, heterogeneity, and number of clients.

Significance. If the theoretical results were correct, the paper would provide a useful framework for choosing smoothing methods in federated adversarial learning and for designing aggregation rules that mitigate heterogeneity. The VFAL bounds follow standard stability templates, and the decomposition of heterogeneity via total-variation metrics is a potentially valuable addition to the literature. However, the main novel claim—that SFAL provably reduces the generalization error—rests on a flawed proof, so the significance of the SFAL contribution is not established as written.

major comments (4)

[Theorem 6 and the appendix section 'Generalization Analyses of SFAL'] The step labeled 'Using (24) x2 - (23)' is algebraically incorrect. With A = e^{beta K eta_t}(E||theta_t - theta'_t|| + K eta_t xi) and B = 2 K eta_t e^{beta K eta_t}/(m_tilde n_i) E||g_i(theta_{i,k})||, inequality (23) reads E||theta_{t+1}-theta'_{t+1}|| <= A + (1+alpha)B and (24) reads the same quantity <= A + (1-alpha)B; combining them as 2*(24) - (23) yields A + (1 - 3alpha)B, not the displayed A + (1-alpha)B. Moreover, (23) and (24) bound two different cases (up-weighted client i vs. down-weighted client i), so a linear combination of these two separate upper bounds cannot serve as a bound for the recursion. The denominator r_alpha in Theorem 6 and the conclusion of Remark 7 are obtained solely from this invalid step.
[Proof of Theorem 6, Eqs. (23)-(24), and Algorithm 4] The proof assumes the aggregation coefficients phi_t^{(alpha,j)} are identical for the dataset S and its neighboring dataset S^{(i)}. In Algorithm 4, the weights are computed from the sorted local losses via Eqs. (8)-(9) of the main text; replacing a training sample changes these losses, can change the up/down-weighting partition, and can change alpha itself. The recursion therefore contains an additional term sum_j (phi_t(S,j)/m_tilde(S) - phi_t(S',j)/m_tilde(S')) theta'_{j,K}, which is never bounded. Without a bound on this weight-perturbation term, the SFAL stability recursion is incomplete and Theorem 6 does not follow from the argument as written.
[Theorem 4 and Remark 5] The OPSA bound is stated conditionally on the width s >= 16 eta_t^2 T^2 K^2 (b' H_K)^2 (1 + 2 eta_t zeta_theta)^2, but the displayed bound then contains a term O(T (rho^2 sqrt(s) + 1) D_max/(m n_min)). Since the condition forces s to grow with T^2, the dependence of the approximation term on the width is hidden by the big-O notation as written. The comparison in Remark 5 that OPSA has the largest generalization error due to sqrt(s) is only meaningful if this width constraint is made explicit in the stated bound.
[Experiments section] The experiments do not directly compare VFAL and SFAL across values of alpha, and they do not report variance or multiple seeds. The claim in the Experiments section that 'under suitable alpha, SFAL effectively reduces the generalization error compared to VFAL' is not supported by a presented figure or table, which is especially important because the theoretical guarantee for SFAL is the central contribution of the paper.

minor comments (5)

[Conclusion] In the Conclusion, the sentence 'we also find that SFAL always performs better than SFAL due to its re-weighted aggregation strategy' should read 'better than VFAL'.
[Definition 3] Definition 3 in the main text defines xi = 2 rho z; the subscript L_z is missing, and later xi is used as 2 rho L_z.
[Appendix, Lemma 2] Lemma 2 in the appendix contains a broken cross-reference, 'defined in ??', for the adversarial surrogate loss.
[Theorem 6 statement] In the statement of Theorem 6, item 2 repeats 'Under Assumption 1' twice; the second occurrence is redundant.
[Supplementary experiments] In the supplementary experiments, 'Fot simulating the Non-IID scenario' is a typo for 'For simulating the Non-IID scenario'.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the main bounds are derived from standard stability reductions and externally cited smoothing lemmas; self-citations are not load-bearing.

full rationale

The paper's derivation chain is self-contained with respect to its central claims. Theorems 2-4 follow the standard algorithmic-stability route (Hardt-Recht-Singer style recursion plus on-average stability) and import the smoothing lemmas (Xiao et al. 2022a; Lin, Zheng, and Jordan 2022; Lei, Jin, and Ying 2022) as external ingredients; the bounds are not fitted to data and the target quantities are not defined in terms of the conclusions. The introduction cites prior work by overlapping authors (e.g., Qu et al. 2022, 2023; Li et al. 2023), but none of these citations supplies a uniqueness theorem or an unverified premise that carries the main results. The comparison of VFAL and SFAL is a theorem about the algorithm's reweighted aggregation rather than a restatement of its inputs. For completeness, I note a rigor concern that is outside the circularity definition: in the proof of Theorem 6, the step 'Using (24) ×2−(23)' is algebraically suspect (2*(24)−(23) gives a (1−3α) coefficient, not (1−α)), and the recursion treats the data-dependent weights phi_t^(α,i) as identical for S and S^(i), leaving the change in weights unbound. These issues bear on correctness, not on circularity; the paper's derivation is not equivalent to its conclusions by construction.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

No new physical or mathematical entities are introduced. The proposed contrastive loss and adversarial penalty are suggestions and are not defined or used in the theorems. The main assumptions are standard Lipschitz and boundedness conditions, plus imported lemmas from prior work.

free parameters (5)

alpha (SFAL reweighting) = data-dependent via Eq. (9)
Controls the up/down weighting in aggregation; Theorem 6 claims larger alpha reduces the generalization bound.
m_hat (number of upweighted clients) = m/5 in experiments
Chosen by hand in experiments; part of the SFAL algorithm and not specified theoretically.
Q (RSA noise samples) = 1-5 in experiments
Inverse-square-root term in the RSA bound; no theoretically optimal value is derived.
gamma (RSA smoothing radius) = not specified
Controls the smoothness of the randomized loss and appears in the step-size condition, but the experimental value is not reported.
s (OPSA width) = not specified in experiments
The theory requires s at least O(T^2) for the co-coercivity argument, but experiments do not report the width of the OPSA network.

assumptions (6)

domain assumption Assumption 1: loss and gradient Lipschitz continuity in theta and z
Used throughout all theorems; adversarial loss functions may not satisfy this for neural networks.
domain assumption Assumption 4: bounded stochastic gradient variance sigma^2
Introduced in the appendix and used in all stability proofs, but not stated in the main body.
domain assumption Assumptions 2 and 3: bounded activation, inputs, labels, and parameters for OPSA
Used to bound the Hessian and apply the co-coercivity lemma for over-parameterized networks.
standard math Lemma 2/3 from Xiao et al.: the surrogate loss is approximately beta-gradient Lipschitz with xi = 2*rho*Lz
Imported from prior work and central to the SSA bound.
standard math Lemma 9 from Lin, Zheng, and Jordan: randomized smoothing yields a cL*sqrt(d)/gamma-smooth objective
Imported and underpins the RSA bound.
standard math Lemma 19 from Lei, Jin, and Ying: almost co-coercivity of the gradient operator for over-parameterized networks
Imported and underpins the OPSA proof.

how reviews work

0 comments

Cite this review

Pith. "Pith review of How Does the Smoothness Approximation Method Facilitate Generalization for Federated Adversarial Learning?." pith.science (2026). https://pith.science/paper/ONE7D7IH

@misc{pith2026241208282,
  author       = {Pith},
  title        = {Pith review of: How Does the Smoothness Approximation Method Facilitate Generalization for Federated Adversarial Learning?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ONE7D7IH}},
  note         = {Machine review of arXiv:2412.08282}
}

read the original abstract

Federated Adversarial Learning (FAL) is a robust framework for resisting adversarial attacks on federated learning. Although some FAL studies have developed efficient algorithms, they primarily focus on convergence performance and overlook generalization. Generalization is crucial for evaluating algorithm performance on unseen data. However, generalization analysis is more challenging due to non-smooth adversarial loss functions. A common approach to addressing this issue is to leverage smoothness approximation. In this paper, we develop algorithm stability measures to evaluate the generalization performance of two popular FAL algorithms: \textit{Vanilla FAL (VFAL)} and {\it Slack FAL (SFAL)}, using three different smooth approximation methods: 1) \textit{Surrogate Smoothness Approximation (SSA)}, (2) \textit{Randomized Smoothness Approximation (RSA)}, and (3) \textit{Over-Parameterized Smoothness Approximation (OPSA)}. Based on our in-depth analysis, we answer the question of how to properly set the smoothness approximation method to mitigate generalization error in FAL. Moreover, we identify RSA as the most effective method for reducing generalization error. In highly data-heterogeneous scenarios, we also recommend employing SFAL to mitigate the deterioration of generalization performance caused by heterogeneity. Based on our theoretical results, we provide insights to help develop more efficient FAL algorithms, such as designing new metrics and dynamic aggregation rules to mitigate heterogeneity.

Figures

Figures reproduced from arXiv: 2412.08282 by the authors.

**Figure 2.** Generalization Gap of the skew parameter [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Generalization Gap of the number of client [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Generalization Gap of the number of noise [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]

**Figure 5.** Figure 5: Generalization Gap of the attack strength [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Generalization Gap of the skew parameter [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: Generalization Gap of the number of client [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 48 canonical work pages

[1]

Alashqar, B.; Gasnikov, A.; Dvinskikh, D.; and Lobanov, A. 2023. Gradient-free federated learning methods with l 1 and l 2-randomization for non-smooth convex stochastic optimization problems. Computational Mathematics and Mathematical Physics, 63(9): 1600--1653

work page 2023
[2]

Arora, S.; Cohen, N.; and Hazan, E. 2018. On the optimization of deep networks: Implicit acceleration by overparameterization. In International conference on machine learning, 244--253. PMLR

work page 2018
[3]

Athalye, A.; Carlini, N.; and Wagner, D. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, 274--283. PMLR

work page 2018
[4]

Bagdasaryan, E.; Veit, A.; Hua, Y.; Estrin, D.; and Shmatikov, V. 2020. How to backdoor federated learning. In International conference on artificial intelligence and statistics, 2938--2948. PMLR

2020
[5]

Bousquet, O.; and Elisseeff, A. 2002. Stability and generalization. The Journal of Machine Learning Research, 2: 499--526

work page 2002
[6]

Bubeck, S.; et al. 2015. Convex optimization: Algorithms and complexity. Foundations and Trends in Machine Learning , 8(3-4): 231--357

work page 2015
[7]

Carlini, N.; and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), 39--57. Ieee

2017
[8]

Chen, C.; Liu, Y.; Ma, X.; and Lyu, L. 2022. Calfat: Calibrated federated adversarial training with label skewness. NeurIPS, 35: 3569--3581

work page 2022

Show all 66 references

[9]

Cheng, X.; Fu, K.; and Farnia, F. 2024. Stability and Generalization in Free Adversarial Training. arXiv preprint arXiv:2404.08980

2024 arXiv
[10]

Croce, F.; and Hein, M. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, 2206--2216. PMLR

2020
[11]

Cui, S.; Pan, W.; Liang, J.; Zhang, C.; and Wang, F. 2021. Addressing algorithmic disparity and performance inconsistency in federated learning. NeurIPS, 34: 26091--26102

2021
[12]

C.; Bartlett, P

Duchi, J. C.; Bartlett, P. L.; and Wainwright, M. J. 2012. Randomized smoothing for stochastic optimization. SIAM Journal on Optimization, 22(2): 674--701

2012
[13]

J.; Shlens, J.; and Szegedy, C

Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572

2014 arXiv
[14]

Hardt, M.; Recht, B.; and Singer, Y. 2016. Train faster, generalize better: Stability of stochastic gradient descent. In International conference on machine learning, 1225--1234. PMLR

2016
[15]

Hassani, H.; and Javanmard, A. 2024. The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression. The Annals of Statistics, 52(2): 441--465

2024
[16]

Hong, J.; Wang, H.; Wang, Z.; and Zhou, J. 2021. Federated robustness propagation: Sharing adversarial robustness in federated learning. arXiv preprint arXiv:2106.10196, 1

2021 arXiv
[17]

Hu, X.; Li, S.; and Liu, Y. 2022. Generalization bounds for federated learning: Fast rates, unparticipating clients and unbounded losses. In The Eleventh International Conference on Learning Representations

2022
[18]

Huang, W.; Shi, Y.; Cai, Z.; and Suzuki, T. 2023. Understanding convergence and generalization in federated learning through feature learning theory. In The Twelfth International Conference on Learning Representations

2023
[19]

Kanai, S.; Yamada, M.; Takahashi, H.; Yamanaka, Y.; and Ida, Y. 2023. Relationship between nonsmoothness in adversarial training, constraints of attacks, and flatness in the input space. IEEE Trans. Neural Netw. Learn. Syst

2023
[20]

P.; Kale, S.; Mohri, M.; Reddi, S.; Stich, S.; and Suresh, A

Karimireddy, S. P.; Kale, S.; Mohri, M.; Reddi, S.; Stich, S.; and Suresh, A. T. 2020. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning, 5132--5143. PMLR

2020
[21]

Kearns, M.; and Ron, D. 1997. Algorithmic stability and sanity-check bounds for leave-one-out cross-validation. In Proceedings of the tenth annual conference on Computational learning theory, 152--162

1997
[22]

Krizhevsky, A.; Hinton, G.; et al. 2009. Learning multiple layers of features from tiny images. Technical report, University of Toronto

2009
[23]

Kuzborskij, I.; and Lampert, C. 2018. Data-dependent stability of stochastic gradient descent. In International Conference on Machine Learning, 2815--2824. PMLR

2018
[24]

Lei, Y.; Jin, R.; and Ying, Y. 2022. Stability and generalization analysis of gradient methods for shallow neural networks. NeurIPS, 35: 38557--38570

2022
[25]

Lei, Y.; Sun, T.; and Liu, M. 2023. Stability and Generalization for Minibatch SGD and Local SGD. arXiv preprint arXiv:2310.01139

2023
[26]

Li, X.; Qu, Z.; Tang, B.; and Lu, Z. 2023. Fedlga: Toward system-heterogeneity of federated learning via local gradient approximation. IEEE Trans. Cybern., 54(1): 401--414

2023
[27]

Li, X.; Qu, Z.; Zhao, S.; Tang, B.; Lu, Z.; and Liu, Y. 2021. Lomar: A local defense against poisoning attack on federated learning. IEEE Trans. Dependable Secure Comput, 20(1): 437--450

2021
[28]

Li, X.; Song, Z.; Tao, R.; and Zhang, G. 2022. A convergence theory for federated average: Beyond smoothness. In International Conference on Big Data, 1292--1297. IEEE

2022
[29]

Li, X.; Song, Z.; and Yang, J. 2023. Federated adversarial learning: A framework with convergence analysis. In International Conference on Machine Learning, 19932--19959. PMLR

2023
[30]

Lin, T.; Zheng, Z.; and Jordan, M. 2022. Gradient-free methods for deterministic and stochastic nonsmooth nonconvex optimization. NeurIPS, 35: 26160--26175

2022
[31]

Liu, C.; Salzmann, M.; Lin, T.; Tomioka, R.; and S \"u sstrunk, S. 2020. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. NeurIPS, 33: 21476--21487

2020
[32]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In International Conference on Learning Representations

2018
[33]

McMahan, B.; Moore, E.; Ramage, D.; Hampson, S.; and y Arcas, B. A. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, 1273--1282. PMLR

2017
[34]

Mohri, M.; Sivek, G.; and Suresh, A. T. 2019. Agnostic federated learning. In International Conference on Machine Learning, 4615--4625. PMLR

2019
[35]

Y.; et al

Netzer, Y.; Wang, T.; Coates, A.; Bissacco, A.; Wu, B.; Ng, A. Y.; et al. 2011. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, 4. Granada

2011
[36]

Neyshabur, B.; Bhojanapalli, S.; McAllester, D.; and Srebro, N. 2017. Exploring generalization in deep learning. NeurIPS, 30

2017
[37]

Qu, Z.; Li, X.; Duan, R.; Liu, Y.; Tang, B.; and Lu, Z. 2022. Generalized federated learning via sharpness aware minimization. In International conference on machine learning, 18250--18280. PMLR

2022
[38]

Qu, Z.; Li, X.; Han, X.; Duan, R.; Shen, C.; and Chen, L. 2023. How to Prevent the Poor Performance Clients for Personalized Federated Learning? In Proceedings of the IEEE/CVF CVPR, 12167--12176

2023
[39]

Reddi, S.; Charles, Z.; Zaheer, M.; Garrett, Z.; Rush, K.; Kone c n \`y , J.; Kumar, S.; and McMahan, H. B. 2020. Adaptive federated optimization. arXiv preprint arXiv:2003.00295

2020 arXiv
[40]

Rice, L.; Wong, E.; and Kolter, Z. 2020. Overfitting in adversarially robust deep learning. In International conference on machine learning, 8093--8104. PMLR

2020
[41]

Richards, D.; and Kuzborskij, I. 2021. Stability & generalisation of gradient descent for shallow neural networks without the neural tangent kernel. NeurIPS, 34: 8609--8621

2021
[42]

Sadeghi, A.; Wang, G.; Ma, M.; and Giannakis, G. B. 2020. Learning while respecting privacy and robustness to distributional uncertainties and adversarial data. arXiv preprint arXiv:2007.03724

2020 arXiv
[43]

Samangouei, P.; Kabkab, M.; and Chellappa, R. 2018. Defense- GAN : Protecting Classifiers Against Adversarial Attacks Using Generative Models. In International Conference on Learning Representations

2018
[44]

Shah, D.; Dube, P.; Chakraborty, S.; and Verma, A. 2021. Adversarial training in communication constrained federated learning. arXiv preprint arXiv:2103.01319

2021 arXiv
[45]

Shalev-Shwartz, S.; Shamir, O.; Srebro, N.; and Sridharan, K. 2010. Learnability, stability and uniform convergence. The Journal of Machine Learning Research, 11: 2635--2670

2010
[46]

Sitawarin, C.; Chakraborty, S.; and Wagner, D. 2020. SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing. arXiv preprint arXiv:2003.09347

2020 arXiv
[47]

Sun, Z.; Niu, X.; and Wei, E. 2023. Understanding generalization of federated learning via stability: Heterogeneity matters. arXiv preprint arXiv:2306.03824

2023 arXiv
[48]

Sun, Z.; and Wei, E. 2022. A communication-efficient algorithm with linear convergence for federated minimax learning. NeurIPS, 35: 6060--6073

2022
[49]

Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

2013 arXiv
[50]

A.; ter Braak, C

Vrugt, J. A.; ter Braak, C. J.; Diks, C. G.; Robinson, B. A.; Hyman, J. M.; and Higdon, D. 2009. Accelerating Markov chain Monte Carlo simulation by differential evolution with self-adaptive randomized subspace sampling. International journal of nonlinear sciences and numerica...

2009
[51]

Wang, H.; Sreenivasan, K.; Rajput, S.; Vishwakarma, H.; Agarwal, S.; Sohn, J.-y.; Lee, K.; and Papailiopoulos, D. 2020. Attack of the tails: Yes, you really can backdoor federated learning. NeurIPS, 33: 16070--16084

2020
[52]

Wang, P.; Lei, Y.; Wang, D.; Ying, Y.; and Zhou, D.-X. 2023. Generalization Guarantees of Gradient Descent for Multi-Layer Neural Networks. arXiv preprint arXiv:2305.16891

2023 arXiv
[53]

Wu, B.; Chen, J.; Cai, D.; He, X.; and Gu, Q. 2021. Do wider neural networks really help adversarial robustness? NeurIPS, 34: 7054--7067

2021
[54]

Xiao, J.; Fan, Y.; Sun, R.; Wang, J.; and Luo, Z.-Q. 2022 a . Stability analysis and generalization bounds of adversarial training. NeurIPS, 35: 15446--15459

2022
[55]

Xiao, J.; Zhang, J.; Luo, Z.-Q.; and Ozdaglar, A. E. 2022 b . Smoothed-sgdmax: A stability-inspired algorithm to improve adversarial generalization

2022
[56]

Xie, C.; Tan, M.; Gong, B.; Yuille, A.; and Le, Q. V. 2020. Smooth adversarial training. arXiv preprint arXiv:2006.14536

2020 arXiv
[57]

Xing, Y.; Song, Q.; and Cheng, G. 2021 a . On the algorithmic stability of adversarial training. NeurIPS, 34: 26523--26535

2021
[58]

Xing, Y.; Song, Q.; and Cheng, G. 2021 b . On the generalization properties of adversarial training. In International Conference on Artificial Intelligence and Statistics, 505--513. PMLR

2021
[59]

Zhang, G.; Lu, S.; Zhang, Y.; Chen, X.; Chen, P.-Y.; Fan, Q.; Martie, L.; Horesh, L.; Hong, M.; and Liu, S. 2022. Distributed adversarial training to robustify deep neural networks at scale. In Uncertainty in Artificial Intelligence, 2353--2363. PMLR

2022
[60]

Zhang, H.; Yu, Y.; Jiao, J.; Xing, E.; El Ghaoui, L.; and Jordan, M. 2019. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, 7472--7482. PMLR

2019
[61]

Zhang, J.; Li, B.; Chen, C.; Lyu, L.; Wu, S.; Ding, S.; and Wu, C. 2023. Delving into the adversarial robustness of federated learning. In Proceedings of the AAAI conference on artificial intelligence, volume 37, 11245--11253

2023
[62]

Zhou, Y.; Wu, J.; and He, J. 2021. Adversarially robust federated learning for neural networks

2021
[63]

Zhu, J.; Yao, J.; Liu, T.; Yao, Q.; Xu, J.; and Han, B. 2023. Combating exacerbated heterogeneity for robust models in federated learning. arXiv preprint arXiv:2303.00250

2023 arXiv
[64]

Zizzo, G.; Rawat, A.; Sinn, M.; and Buesser, B. 2020. Fat: Federated adversarial training. arXiv preprint arXiv:2012.01791

2020 arXiv
[65]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...
[66]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Alashqar, B.; Gasnikov, A.; Dvinskikh, D.; and Lobanov, A. 2023. Gradient-free federated learning methods with l 1 and l 2-randomization for non-smooth convex stochastic optimization problems. Computational Mathematics and Mathematical Physics, 63(9): 1600--1653

work page 2023

[2] [2]

Arora, S.; Cohen, N.; and Hazan, E. 2018. On the optimization of deep networks: Implicit acceleration by overparameterization. In International conference on machine learning, 244--253. PMLR

work page 2018

[3] [3]

Athalye, A.; Carlini, N.; and Wagner, D. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, 274--283. PMLR

work page 2018

[4] [4]

Bagdasaryan, E.; Veit, A.; Hua, Y.; Estrin, D.; and Shmatikov, V. 2020. How to backdoor federated learning. In International conference on artificial intelligence and statistics, 2938--2948. PMLR

2020

[5] [5]

Bousquet, O.; and Elisseeff, A. 2002. Stability and generalization. The Journal of Machine Learning Research, 2: 499--526

work page 2002

[6] [6]

Bubeck, S.; et al. 2015. Convex optimization: Algorithms and complexity. Foundations and Trends in Machine Learning , 8(3-4): 231--357

work page 2015

[7] [7]

Carlini, N.; and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), 39--57. Ieee

2017

[8] [8]

Chen, C.; Liu, Y.; Ma, X.; and Lyu, L. 2022. Calfat: Calibrated federated adversarial training with label skewness. NeurIPS, 35: 3569--3581

work page 2022