Pith. sign in

REVIEW 5 major objections 6 minor 55 references

Local Differential Privacy is Not Enough: A Sample Reconstruction Attack against Federated Learning with Local Differential Privacy

T0 review · 5 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One clipped, noised gradient can reveal a victim's training image.

desk verdict Novel reverse-index separation attack that works at weak privacy (epsilon=10), but collision risk and evaluation gaps keep it from being the 'only attack' it claims to be. read the letter →

arxiv 2502.08151 v1 pith:WCYJEC6W submitted 2025-02-12 cs.CR cs.LG

Zhichao You , Xuewen Dong , Shujun Li , Ximeng Liu , Siqi Ma , Yulong Shen This is my paper · ORCID
classification cs.CRcs.LG
keywords federatedlearninglocaldifferentialprivacysamplereconstructionattackgradientinversionclippingGaussiannoiseseparationlayerreverseunit
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that local differential privacy (LDP), the standard defense of clipping and perturbing gradients in federated learning, does not by itself stop sample reconstruction. It proposes an attack in which a malicious server, which only designs the global model, reconstructs the main subject of a victim's training image from a single round of clipped and noised gradients when the privacy parameter is around epsilon=10. The attack embeds a separation layer into the model so that each sample's gradient lands in its own unit, compresses redundant background gradients, and estimates the LDP noise from deliberately inserted zero gradients to denoise the reconstruction. If correct, LDP-based federated learning needs stronger defenses than gradient clipping and perturbation alone.

What carries the argument

The load-bearing object is the separation layer: a fully connected layer with all weight vectors equal and biases set from the quantile function of a Laplace distribution, followed by taking the minimal positive activation. This creates, for each sample, a unique reverse unit whose output is the minimal positive value; backpropagation makes the sample's gradients vanish in every other unit, so weight and bias gradients of that unit satisfy x = grad_w / grad_b. The separation layer confines nonzero gradients to at most batch-size units, so enlarging it does not expand the gradient norm, and this is the key to surviving LDP clipping. Two supporting structures carry the noise handling: a bias layer that repeats the bias gradient many times so averaging cancels perturbation noise, and a convolution layer that injects known zero gradients so the adversary can estimate the Gaussian noise scale and build a confidence interval for filtering. A metric layer imprints sample statistics and reverse-unit indices into gradients to guide optimization of the reconstructed samples.

What would settle it

Run the attack on a batch of 16 images with a 2048-unit separation layer, deliberately choosing two images whose projections fall in the same reverse interval; if the reconstructed output is a linear mixture rather than either original, the distinctness requirement is confirmed as load-bearing. On ordinary batches, count how often the reverse-unit indices reconstructed from the metric layer are non-distinct and check whether those batches' reconstructions show visibly lower CW-SSIM.

Watch

Extended reading notes

Core claim

The central claim is the existence of a practical sample reconstruction attack against LDP-protected federated learning that works with any target model and with batch sizes larger than one. The authors prove that a fully connected layer whose weights are all equal and whose biases are Laplace quantiles acts as a separation layer: for each input sample there is a reverse unit, and the sample's weight and bias gradients exist only in that unit, so weight gradients divided entry-wise by bias gradients recover the sample, provided two samples do not share a reverse unit. Because at most batch-size units carry nonzero gradients, adding more units improves separation without inflating the gradient norm, which keeps the gradient from being destroyed by clipping. The attack then removes background pixels using an image segmentation model, averages repeated bias gradients to cancel noise, estimates the noise scale from zero gradients it inserted, filters background noise with a confidence interval, and refines the reconstruction against imprinted sample-wise mean, variance, and total variation. The paper reports that this is the only evaluated attack that reconstructs meaningful training samples from LDP-protected gradients at epsilon=10, with negligible effect on model accuracy.

Load-bearing premise

The attack recovers a clean image only if every image in the victim's batch lands in a different reverse unit of the separation layer; that separation is probabilistic, and when two images share a unit the reconstruction is a blend that may show neither image.

Editorial extensions

If this is right

  • In federated learning with LDP at epsilon around 10, a malicious server that controls model design can recover the main subject of a victim's training image from a single clipped, noised gradient, so LDP alone is not a sufficient defense.
  • Clipping alone cannot stop the attack: since the same clipping factor scales both weight and bias gradients, the ratio that reconstructs the sample is unchanged.
  • Increasing batch size makes reconstruction harder because each sample's share of the clipped gradient shrinks, but the paper shows the attack still operates at batch size 16 and larger.
  • The attack's model modifications can be made nearly invisible: non-target users receive a structure with a tiny output coefficient, and dropping the victim's gradient from aggregation has negligible effect when the federation has many users.
  • Noise-based defenses can be reverse-engineered: by injecting zero gradients, the adversary estimates the privacy noise scale and filters much of it out.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper establishes the attack at epsilon=10, but an implication the authors do not pursue is that at smaller epsilon the noise estimate becomes less reliable and attack quality should degrade sharply; testing epsilons below roughly 3 would map the actual privacy frontier.
  • The reverse-unit uniqueness assumption implies a collision budget: with 16 samples and 2048 units, a meaningful fraction of batches should contain a collision that yields a blurred mixture, and a practical attacker could detect and discard such batches using the metric layer's reconstructed reverse-unit indices.
  • The same separation-layer idea could be probed against LDP mechanisms with non-Gaussian noise or against secure aggregation that hides individual gradients; the paper only addresses the unprotected-gradient setting.
  • Because the attack needs a custom global model, a testable defense is client-side verification of model components, such as checking that the first layers produce sample-dependent activations; the paper lists this idea as future work rather than demonstrating it.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes an active sample reconstruction attack against federated learning with local differential privacy (LDP), where users clip and perturb gradients before upload. The malicious server embeds a 'separation layer' (an FCL with shared weights and Laplace-quantile biases) before an arbitrary target model so that each training sample's gradient is confined to a single 'reverse unit' determined by the smallest positive activation. The sample is then recovered as the ratio of weight-gradient to bias-gradient for that unit. The paper adds SAM-based background removal, a zero-gradient structure to estimate the LDP noise scale, and a metric-imprinting layer to support optimization-based quality improvement. Theorems 1-4 analyze the primary attack, gradient separation, and the improved separation layer. Evaluations on ImageNet, CIFAR-100, Caltech-256, and Flowers102 compare the attack with five prior attacks and report high reconstruction quality at epsilon=10, with minimal impact on the target model's accuracy. The paper claims to be the first and only attack that reconstructs victims' training samples in LDP-based FL.

Significance. If the central claims hold, the paper would demonstrate that LDP-protected FL with a malicious server is vulnerable to sample reconstruction at moderate privacy levels (epsilon=10), thereby questioning the common assumption that clipping plus perturbation suffices to prevent gradient inversion. The separation-layer construction is a genuine technical novelty: it concentrates each sample's gradient in one unit without increasing the gradient norm as the number of units grows. The zero-gradient noise estimation and the metric-imprinting mechanism are also clever and are supported by ablation experiments. The evaluation is relatively extensive, comparing five prior attacks across four datasets and including ablations for the optimization and denoising components. However, the core separation guarantee is only probabilistic in the finite-unit regime, and the headline quality metrics are computed against the SAM-masked training samples rather than the original samples, so the abstract's claim of reconstructing 'victims' training samples' is overstated as written.

major comments (5)
  1. [Section V-A, Theorem 3; Section VII] The finite-K collision probability for the separation layer is not quantified, and the evaluation does not report it. Because all units in the separation layer share the same weight vector, the reverse index is a function of the one-dimensional statistic w^T x; two samples in the same batch that map to the same reverse unit produce a weighted mixture in the reconstructed image, which is exactly the failure mode the paper itself identifies in Theorem 1 and Fig. 1(d). Theorem 3 only proves that doubling K splits reverse intervals and thus reduces the probability of collision; it provides no bound for the finite values K=1024 or K=2048 used in the evaluation. Under a uniform-bin approximation, the probability of at least one collision is roughly 3% for batch size 16 with K=2048 and roughly 63% for batch size 64 with K=2048, and the probability can be much higher if the distribution of w^T x is concentrated relative to the quantile bin widths. Table IV averages quality metrics over batches without separating collision-free from collision-containing cases, and Fig. 10 reports 'separation ratio' without linking it to reconstruction fidelity. The central claim that individual victim samples are recovered therefore rests on an unverified probabilistic assumption. Please provide empirical collision rates for the evaluated settings, a bound for the collision probability, and either restrict the headline claims to collision-free batches or demonstrate that collisions do not materially degrade the reconstructions.
  2. [Section VII-A and Table IV] The quality metrics (MSE, PSNR, CW-SSIM) are computed between the reconstructed samples and the SAM-masked training samples, not the original training images. The attack deliberately sets background pixels to zero, so a near-perfect reconstruction of the masked subject does not imply that the victim's original training image has been recovered. The abstract and the introduction state that the attack 'reconstructs victims' training samples' and is 'the only attack that reconstructs victims' training samples in LDP-based FL'. These claims should be qualified to state that the reconstruction target is the subject-masked version of the sample, and the paper should discuss what information about the original sample (e.g., subject identity, background context) is or is not revealed. This is not a fatal flaw given the paper's stated focus on subject information, but the claims need to match the evaluation.
  3. [Section IV-B, Eqs. (4)-(6), Theorem 1] The derivation of Theorem 1 assumes that the derivative of the loss with respect to the FCL output is identical for every sample in the batch. This is not true in general; the correct statement is that the primary attack returns a weighted average of samples with weights proportional to the per-sample loss derivatives (∂L_i/∂y_i), not the unweighted average shown in Eq. (6). The conclusion that the primary attack produces a mixture of samples is directionally correct, but the proof as written is incorrect and should be corrected, since Theorem 1 is used to motivate the need for the separation layer.
  4. [Section V-D, Eq. (24)] The metric-based optimization uses as targets the sample statistics (μ, σ², TV) reconstructed from the metric-layer gradients, which are noisy estimates obtained from the same clipped and perturbed gradient signal. The paper does not quantify the noise in these targets or demonstrate that optimizing against them cannot bias the reconstructed sample away from the true sample. Since the metric layer is a key component for improving reconstruction quality, please provide an analysis of the noise in the reconstructed metrics or an ablation that compares the current approach against using ground-truth (clean) sample statistics.
  5. [Section VII-A and Table VIII] The attack relies on several hand-tuned hyperparameters, including the separation-layer weight and the Laplace scale s, which are set to different values for CIFAR-100 and the other datasets. These parameters determine whether the unknown distribution of w^T x aligns with the reverse intervals; if they are poorly chosen, the collision probability increases significantly. The paper does not analyze the sensitivity of the attack to these parameters, nor does it provide guidance for an adversary who does not know the victim's data distribution in advance. Please add a sensitivity analysis or a robustness argument to support the claim that the attack is flexible and applicable to 'any target models' and various learning scenarios.
minor comments (6)
  1. [Section IV-A] The sentence 'We considers gradient protection with LDP' contains a typo and should be 'We consider gradient protection with LDP'.
  2. [Section I, Contributions] The claim that the proposed attack is the first reconstruction attack in LDP-based FL should be reconciled with reference [15] (Boenisch et al., 'Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation'), which is cited in the reference list but not discussed in the related-work section; if that work already demonstrates reconstruction under DP-hardened FL, the novelty statement needs to be positioned more carefully.
  3. [Section VII-C, Fig. 10] The 'separation ratio' is described only as the proportion of separated reconstructed images; please provide a precise definition, the number of seeds, and error bars, since this metric is central to the collision discussion.
  4. [Section VII-D] The results for the privacy parameter ε and the clipping bound are shown only in figures without numeric values in the text; please add tables or report the exact PSNR/CW-SSIM values for the tested settings.
  5. [Section V-C, Eqs. (17)-(18)] The symbol ω is used both for the clipping scale in Eqs. (17)-(18) and for model parameters in Section III; please use a distinct symbol for the clipping scale to avoid confusion.
  6. [Abstract and Conclusion] The evaluation focuses on ε=10 with δ=0.01, which is a relatively weak privacy regime; the paper should state more explicitly that the attack is demonstrated only for such settings and may not apply when ε is much smaller.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reconstruction is a chain-rule inversion of the separation layer's own min-output construction, and the noise estimate comes from an independent zero-gradient channel.

full rationale

The paper's central derivation is self-contained rather than circular. Lemma 1 (Eqs. 2-3) states the standard fact, attributed to Geiping et al. [35], that the input of a fully connected layer with batch size one is the entry-wise ratio of weight gradient to bias gradient. Theorem 1 then shows that with batch size B the same ratio is a batch average; this is a genuine derivation, not a restatement of the input. The separation layer (Section V-A) is built so that the output is the minimal positive pre-activation; a sample's reverse unit is defined as the argmin unit, and Theorem 2 is exactly backpropagation through that min operation. When a unit receives exactly one sample's gradient, Eq. 23 reconstructs that sample by the chain rule; this is a constructional identity between the layer's forward computation and its inversion, not a fitted parameter renamed as a prediction. The collision limitation is real but is a probabilistic robustness condition, not a circular one: Theorem 3 only proves that doubling units splits reverse intervals, and the paper does not bound the finite-K collision probability; if two samples share a reverse unit the reconstruction becomes a weighted mixture (the paper's own Fig. 1(d)). That is a correctness risk, not a derivation that assumes its conclusion. Noise estimation (Section V-C) uses extra all-zero input channels whose gradients contain only perturbation noise; inferring sigma from the half-normal statistics of that independent channel is external evidence, and averaging repeated bias gradients is justified by the law of large numbers. The metric-based optimization (Section V-D) is the most self-referential component: sample statistics are imprinted in a metric layer, recovered from the victim's own gradients, and then used as targets in Eq. 24. This does not manufacture the reconstruction by definition, because the metrics are side information separate from the weight-gradient ratio that defines the reconstructed sample, but it can propagate noise from the same gradient into the optimization objective. That is an evaluation-quality caveat, not a circular step. Citations to the authors' prior work [2], [3] appear only as contextual FL references and are not load-bearing; the paper's attack premise relies on external prior art [10], [11], [35], not on a self-citation chain. Overall, the derivation chain is not circular.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The attack's central claim rests on several hand-tuned hyperparameters, including the separation layer weight, the Laplace scale, the metric weights, and the output coefficient, and on domain assumptions about the LDP mechanism, the min-operation gradient, per-user model customization, and the data distribution. No new physical or mathematical entities are introduced.

free parameters (5)
  • Separation layer weight w (shared across units) = 1e-5 (ImageNet, Caltech-256, Flowers102); 2e-4 (CIFAR-100)
    Sets the scale of w^T x, which determines the reverse index binning and the gradient magnitude. Hand-tuned per dataset.
  • Laplace scale s for bias quantiles = 3e-3 (most datasets); 1.3e-3 (CIFAR-100)
    Controls the spacing of bias values in the separation layer, which determines how samples are binned into reverse units. Hand-tuned.
  • Metric optimization weights w_mu, w_sigma, w_TV = 1e6, 2e4, 1e-6
    Weights in Eq. (24) for the optimization objective, tuned to balance the mean, variance, and total variation terms.
  • Metric output scale factors (mean, variance, TV) = 1, 10, 1e-3
    Scale factors applied to the metric layer output before adding it to the target model input; chosen by hand.
  • Inference structure output coefficient for non-target users = Not specified (described as 'small')
    Reduces the impact of the inference structure on non-target users' training; the exact value is not given in the paper.
assumptions (4)
  • domain assumption Users apply the Gaussian-mechanism LDP in Algorithm 1: clip the gradient norm to C, then add Gaussian noise with scale sigma.
    The noise estimation step assumes the observable zero-gradient channels contain pure Gaussian noise added after clipping; the attack is designed for this specific LDP mechanism.
  • standard math The 'minimum positive value' operation over the separation layer units has gradient equal to the gradient of the selected (reverse) unit's pre-activation and zero elsewhere.
    This is a property of the min operation, used in Theorem 2 to confine each sample's gradient to a single unit.
  • domain assumption The malicious server can distribute different model variants to different users, such as a large inference-structure output to the victim and a small one to others.
    The threat model states the server only designs a global model, but the attack requires the server to customize the model per user; this stronger ability is not explicitly listed in the threat model.
  • domain assumption The reverse indices of the samples in a batch are distinct with high probability, which depends on the distribution of w^T x over the data.
    Theorem 3 only shows that increasing the number of units reduces collision probability for independent samples; it does not guarantee separation for all data distributions, and the evaluation assumes it holds.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Local Differential Privacy is Not Enough: A Sample Reconstruction Attack against Federated Learning with Local Differential Privacy." pith.science (2026). https://pith.science/paper/WCYJEC6W

@misc{pith2026250208151,
  author       = {Pith},
  title        = {Pith review of: Local Differential Privacy is Not Enough: A Sample Reconstruction Attack against Federated Learning with Local Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WCYJEC6W}},
  note         = {Machine review of arXiv:2502.08151}
}
read the original abstract

Reconstruction attacks against federated learning (FL) aim to reconstruct users' samples through users' uploaded gradients. Local differential privacy (LDP) is regarded as an effective defense against various attacks, including sample reconstruction in FL, where gradients are clipped and perturbed. Existing attacks are ineffective in FL with LDP since clipped and perturbed gradients obliterate most sample information for reconstruction. Besides, existing attacks embed additional sample information into gradients to improve the attack effect and cause gradient expansion, leading to a more severe gradient clipping in FL with LDP. In this paper, we propose a sample reconstruction attack against LDP-based FL with any target models to reconstruct victims' sensitive samples to illustrate that FL with LDP is not flawless. Considering gradient expansion in reconstruction attacks and noise in LDP, the core of the proposed attack is gradient compression and reconstructed sample denoising. For gradient compression, an inference structure based on sample characteristics is presented to reduce redundant gradients against LDP. For reconstructed sample denoising, we artificially introduce zero gradients to observe noise distribution and scale confidence interval to filter the noise. Theoretical proof guarantees the effectiveness of the proposed attack. Evaluations show that the proposed attack is the only attack that reconstructs victims' training samples in LDP-based FL and has little impact on the target model's accuracy. We conclude that LDP-based FL needs further improvements to defend against sample reconstruction attacks effectively.

Figures

Figures reproduced from arXiv: 2502.08151 by the authors.

Figure 1
Figure 1. Samples reconstructed by different attacks when the batch size is 16: [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison of sample reconstruction attacks using original and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The process of the proposed attacks in FL with LDP. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Reconstructed training samples generated by the primary attack when [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The framework of the global model with any target models in the [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The process of reconstructing training samples according to the [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Reconstructed samples generated by the proposed attack under [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: The ℓ2 norms and absolute values of gradients under different conditions. We also find that protecting gradients by clipping or pertur￾bation alone has little effect on the proposed attack. Gradients are clipped by ∇ωL = ∇ωL/ max  1, ∥∇ωL∥ C  , and samples are recons…
Figure 13
Figure 13. Figure 13: The quality of reconstructed samples under various clipping bounds. [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 11
Figure 11. Figure 11: The ℓ2 norms and absolute values of gradients without clipping under different numbers of the weight layer units in the inference structure. The number of batch sizes has the most significant impact on the absolute value of gradients. Given a clipping bound, a larger …
Figure 12
Figure 12. Figure 12: The quality of reconstructed samples under various [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 42 canonical work pages

  1. [1]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. A. Bonawitz, Z. Charles, G. Cormode, R. Cummings, R. G. L. D’Oliveira, S. E. Rouayheb, D. Evans, J. Gardner, Z. Garrett, A. Gasc ´on, B. Ghazi, P. B. Gibbons, M. Gruteser, Z. Harchaoui, C. He, L. He, Z. Huo, B. Hutchinson, J. Hsu, M. Jaggi, T. Javidi, G. Joshi, M. Khodak, J. Kone...

    arXiv 1912

  2. [2]

    Feddmc: Efficient and robust federated learning via detecting malicious clients,

    X. Mu, K. Cheng, Y . Shen, X. Li, Z. Chang, T. Zhang, and X. Ma, “Feddmc: Efficient and robust federated learning via detecting malicious clients,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  3. [3]

    Fedproc: Prototypical contrastive federated learning on non-iid data,

    X. Mu, Y . Shen, K. Cheng, X. Geng, J. Fu, T. Zhang, and Z. Zhang, “Fedproc: Prototypical contrastive federated learning on non-iid data,” Future Generation Computer Systems , vol. 143, pp. 93–104, 2023

    2023

  4. [4]

    Federated learning: Collaborative ma- chine learning without centralized training data,

    B. McMahan and D. Ramage, “Federated learning: Collaborative ma- chine learning without centralized training data,” 2017

    work page 2017

  5. [5]

    Federated evaluation and tuning for on-device personalization: System design & and applications,

    M. Paulik, M. Seigel, H. Mason, D. Telaar, J. Kluivers, R. van Dalen, C. W. Lau, L. Carlson, F. Granqvist, C. Vandevelde, S. Agarwal, J. Freudiger, A. Byde, A. Bhowmick, G. Kapoor, S. Beaumont, A. Cahill, D. Hughes, O. Javidbakht, F. Dong, R. Rishi, and S. Hung, “Federated evaluation and tuning for on-device personalization: System design & and applicatio...

    work page 2021

  6. [6]

    Fate: An industrial grade platform for collaborative learning with data protection,

    Y . Liu, T. Fan, T. Chen, Q. Xu, and Q. Yang, “Fate: An industrial grade platform for collaborative learning with data protection,” Journal of Machine Learning Research , vol. 22, no. 226, pp. 1–6, 2021

    2021

  7. [7]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Advances in Neural Information Processing Systems (H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alch ´e-Buc, E. Fox, and R. Garnett, eds.), vol. 32, Curran Associates, Inc., 2019

    work page 2019

  8. [8]

    Using highly compressed gradients in federated learning for data reconstruction attacks,

    H. Yang, M. Ge, K. Xiang, and J. Li, “Using highly compressed gradients in federated learning for data reconstruction attacks,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 818– 830, 2023

    work page 2023

Show all 55 references
  1. [9]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16337–16346, 2021

    2021

  2. [10]

    Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,

    L. H. Fowl, J. Geiping, W. Czaja, M. Goldblum, and T. Goldstein, “Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,” in International Conference on Learning Representations, 2022

    2022

  3. [11]

    When the curious abandon honesty: Federated learn- ing is not private,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “When the curious abandon honesty: Federated learn- ing is not private,” 2021

    2021

  4. [12]

    A framework for evaluating gradient leakage attacks in federated learning,

    W. Wei, L. Liu, M. Loper, K.-H. Chow, M. E. Gursoy, S. Truex, and Y . Wu, “A framework for evaluating gradient leakage attacks in federated learning,” 2020

    2020

  5. [13]

    Eluding secure aggregation in federated learning via model inconsistency,

    D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in federated learning via model inconsistency,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS ’22, (New York, NY , USA), p. 2429–2443, Association for Computi...

    2022

  6. [14]

    Dreaming to distill: Data-free knowledge transfer via deepinversion,

    H. Yin, P. Molchanov, J. M. Alvarez, Z. Li, A. Mallya, D. Hoiem, N. K. Jha, and J. Kautz, “Dreaming to distill: Data-free knowledge transfer via deepinversion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 8715–8724, 2020

    2020

  7. [15]

    Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation,” in 2023 IEEE 8th European Symposium on Security and Privacy , (Los A...

    2023

  8. [16]

    Gradient inversion with generative image prior,

    J. Jeon, K. Lee, S. Oh, J. Ok, et al., “Gradient inversion with generative image prior,” Advances in Neural Information Processing Systems , vol. 34, pp. 29898–29908, 2021

    2021

  9. [17]

    Gradvit: Gradient inversion of vision transformers,

    A. Hatamizadeh, H. Yin, H. R. Roth, W. Li, J. Kautz, D. Xu, and P. Molchanov, “Gradvit: Gradient inversion of vision transformers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10021–10030, June 2022

    2022

  10. [18]

    Analyzing user-level privacy attack against federated learning,

    M. Song, Z. Wang, Z. Zhang, Y . Song, Q. Wang, J. Ren, and H. Qi, “Analyzing user-level privacy attack against federated learning,” IEEE Journal on Selected Areas in Communications, vol. 38, no. 10, pp. 2430– 2444, 2020

    2020

  11. [19]

    Cafe: Catas- trophic data leakage in vertical federated learning,

    X. Jin, P.-Y . Chen, C.-Y . Hsu, C.-M. Yu, and T. Chen, “Cafe: Catas- trophic data leakage in vertical federated learning,” Advances in Neural Information Processing Systems , vol. 34, pp. 994–1006, 2021

    2021

  12. [20]

    R-gap: Recursive gradient attack on privacy,

    J. Zhu and M. Blaschko, “R-gap: Recursive gradient attack on privacy,” 2021

    2021

  13. [21]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. S. Quek, and H. Vincent Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 3454–3469, 2020

    2020

  14. [22]

    A differentially private federated learning model against poisoning attacks in edge computing,

    J. Zhou, N. Wu, Y . Wang, S. Gu, Z. Cao, X. Dong, and K.-K. R. Choo, “A differentially private federated learning model against poisoning attacks in edge computing,” IEEE Transactions on Dependable and Secure Computing, pp. 1–1, 2022

    2022

  15. [23]

    Personalized federated learning with differential privacy,

    R. Hu, Y . Guo, H. Li, Q. Pei, and Y . Gong, “Personalized federated learning with differential privacy,” IEEE Internet of Things Journal , vol. 7, no. 10, pp. 9530–9539, 2020

    2020

  16. [24]

    Efficient differentially private secure aggregation for federated learning via hardness of learning with errors,

    T. Stevens, C. Skalka, C. Vincent, J. Ring, S. Clark, and J. Near, “Efficient differentially private secure aggregation for federated learning via hardness of learning with errors,” in 31st USENIX Security Sympo- sium (USENIX Security 22) , (Boston, MA), pp. 1379–1395, USENIX ...

    2022

  17. [25]

    Exploring the security boundary of data reconstruction via neuron exclusivity analysis,

    X. Pan, M. Zhang, Y . Yan, J. Zhu, and Z. Yang, “Exploring the security boundary of data reconstruction via neuron exclusivity analysis,” in 31st USENIX Security Symposium (USENIX Security 22) , (Boston, MA), pp. 3989–4006, USENIX Association, Aug. 2022

    2022

  18. [26]

    Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from a face recognition system,

    M. Khosravy, K. Nakamura, Y . Hirose, N. Nitta, and N. Babaguchi, “Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from a face recognition system,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 357– 372, 2022

    2022

  19. [27]

    On the inadequacy of similarity- based privacy metrics: Reconstruction attacks against

    G. Ganev and E. D. Cristofaro, “On the inadequacy of similarity- based privacy metrics: Reconstruction attacks against ”truly anonymous synthetic data”,” 2023

    2023

  20. [28]

    Beyond class-level privacy leakage: Breaking record-level privacy in federated learning,

    X. Yuan, X. Ma, L. Zhang, Y . Fang, and D. Wu, “Beyond class-level privacy leakage: Breaking record-level privacy in federated learning,” IEEE Internet of Things Journal , vol. 9, no. 4, pp. 2555–2565, 2021

    2021

  21. [29]

    Generative adversarial networks,

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial networks,” 2014

    2014

  22. [30]

    Communication-Efficient Learning of Deep Networks from Decentral- ized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentral- ized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (A. Singh and J. Zhu, eds.), vol. 54 of...

    2017

  23. [31]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Roth, et al., “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science , vol. 9, no. 3–4, pp. 211–407, 2014

    2014

  24. [32]

    Learning differ- entially private recurrent language models,

    H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, “Learning differ- entially private recurrent language models,” in International Conference on Learning Representations , 2018. 16

    2018

  25. [33]

    Local and central differential privacy for robustness and privacy in federated learning,

    M. Naseri, J. Hayes, and E. De Cristofaro, “Local and central differential privacy for robustness and privacy in federated learning,” 2022

    2022

  26. [34]

    Eluding secure aggregation in federated learning via model inconsistency,

    D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in federated learning via model inconsistency,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 2429–2443, 2022

    2022

  27. [35]

    Inverting gradi- ents - how easy is it to break privacy in federated learning?,

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradi- ents - how easy is it to break privacy in federated learning?,” inAdvances in Neural Information Processing Systems (H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, eds.), vol. 33, pp. 169...

    2020

  28. [36]

    ImageNet Large Scale Visual Recognition Challenge,

    O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei, “ImageNet Large Scale Visual Recognition Challenge,” International Journal of Computer Vision (IJCV) , vol. 115, no. 3, pp. 211–252, 2015

    2015

  29. [37]

    Segment anything,

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Lo,et al., “Segment anything,” arXiv preprint arXiv:2304.02643 , 2023

    2023 arXiv

  30. [38]

    A comprehensive survey on segment anything model for vision and beyond,

    C. Zhang, L. Liu, Y . Cui, G. Huang, W. Lin, Y . Yang, and Y . Hu, “A comprehensive survey on segment anything model for vision and beyond,” arXiv preprint arXiv:2305.08196 , 2023

    2023 arXiv

  31. [39]

    Segment anything in medical images,

    J. Ma, Y . He, F. Li, L. Han, C. You, and B. Wang, “Segment anything in medical images,” 2023

    2023

  32. [40]

    Segment anything in non-euclidean domains: Challenges and opportunities,

    Y . Jing, X. Wang, and D. Tao, “Segment anything in non-euclidean domains: Challenges and opportunities,” 2023

    2023

  33. [41]

    A generalization of the half-normal distribution with applications to lifetime data,

    K. Cooray and M. M. Ananda, “A generalization of the half-normal distribution with applications to lifetime data,” Communications in Statistics—Theory and Methods , vol. 37, no. 9, pp. 1323–1337, 2008

    2008

  34. [42]

    F. M. Dekking, C. Kraaikamp, H. P. Lopuha ¨a, and L. E. Meester, A Modern Introduction to Probability and Statistics: Understanding why and how, vol. 488. Springer, 2005

    2005

  35. [43]

    Foreseeing recon- struction quality of gradient inversion: An optimization perspective,

    H. G. Hong, Y . Cho, H. Cho, J. Ahn, and J. Kim, “Foreseeing recon- struction quality of gradient inversion: An optimization perspective,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, pp. 12473–12481, 2024

    2024

  36. [44]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  37. [45]

    Caltech-256 object category dataset,

    G. Griffin, A. Holub, and P. Perona, “Caltech-256 object category dataset,” 2007

    2007

  38. [46]

    Automated flower classification over a large number of classes,

    M.-E. Nilsback and A. Zisserman, “Automated flower classification over a large number of classes,” in2008 Sixth Indian Conference on Computer Vision, Graphics & Image Processing , pp. 722–729, IEEE, 2008

    2008

  39. [47]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 770–778, 2016

    2016

  40. [48]

    Complex wavelet structural similarity: A new image similarity index,

    M. P. Sampat, Z. Wang, S. Gupta, A. C. Bovik, and M. K. Markey, “Complex wavelet structural similarity: A new image similarity index,” IEEE Transactions on Image Processing, vol. 18, no. 11, pp. 2385–2401, 2009

    2009

  41. [49]

    Preserving privacy and security in federated learning,

    T. Nguyen and M. T. Thai, “Preserving privacy and security in federated learning,” IEEE/ACM Transactions on Networking , vol. 32, no. 1, pp. 833–843, 2024

    2024

  42. [50]

    L-secnet: Towards secure and lightweight deep neural network inference,

    A. Song, J. Fu, X. Mu, X. Zhu, and K. Cheng, “L-secnet: Towards secure and lightweight deep neural network inference,” Journal of Networking and Network Applications , no. 4, pp. 171–181, 2023

    2023

  43. [51]

    A convnet for the 2020s,

    Z. Liu, H. Mao, C.-Y . Wu, C. Feichtenhofer, T. Darrell, and S. Xie, “A convnet for the 2020s,” 2022

    2022

  44. [52]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. van der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” 2018

    2018

  45. [53]

    Efficientnet: Rethinking model scaling for convolutional neural networks,

    M. Tan and Q. V . Le, “Efficientnet: Rethinking model scaling for convolutional neural networks,” 2020

    2020

  46. [54]

    Going deeper with convolutions,

    C. Szegedy, W. Liu, Y . Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V . Vanhoucke, and A. Rabinovich, “Going deeper with convolutions,” 2014. Zhichao You received his B.E. degree in Informa- tion and Computing Science from South China Agri- cultural University, Guangzhou...

    2014

  47. [2018]

    She is currently a Senior Lecturer with the University of New South Wales, Canberra Campus, Australia

    She was a Research Fellow with the Dis- tinguished System Security Group, CSIRO. She is currently a Senior Lecturer with the University of New South Wales, Canberra Campus, Australia. Her current research interests include data security, the IoT security, and software security...

    2002

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.