Advances and Open Problems in Federated Learning

In the paper

“This suggests, as shown by Reyzin et al. [392] for practical settings, that assuming honest (or at least semi-honest) behaviour by the server in a key distribution phase (as done in [80, 58]) is required in scenarios where private channels among clients are needed.”

What the sources say

• Disputed

  In “B. Building Blocks” (p. 8), the paper says clients use the server as a relay but establish their secret key through client-to-client Diffie–Hellman exchange, with encryption to protect messages against the intermediary server and signatures to defend against active adversaries. It contrasts this setup with approaches that rely on a trusted third party for key generation and distribution, rather than stating that its setup requires an honest server during key distribution. (LLM, conf=0.78)

  Checked by a reasoning model — may be wrong.

  cites [392] Niu, 2019, Secure federated submodel learning sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [80] Ceballos, 2018, SplitNN-driven vertical partitioning
• Partly supported

  Section 2 (p. 3) says the model’s restriction on who can see messages can be enforced with secure communication channels, supporting the private-channels part of the claim. It does not describe a server-run key distribution phase or require an honest server; Section 3.3 (p. 5) instead says the approach does not rely on a central server. (LLM, conf=0.85)

  cites [58] Cyffers, 2020, Privacy amplification by decentralization sourceExperimental — accuracy not yet measured

In the paper

“Significant related work predates the introduction of the term federated learning.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [396] Cummings, 2019, Bringing differential privacy into the experimental economics lab: Theory and an application to a public-good game
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [492] Zafar
• Partly supported

  The Related Work section (p. 2) describes federated learning as an extension of server-based distributed training, supporting the existence of antecedent research. It does not say when the term “federated learning” was introduced or establish that significant related work predates that introduction. (LLM, conf=0.72)

  cites [11] Hard, 2018, Federated learning for mobile keyboard prediction sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [457] Ma

In the paper

“Further, [469] provides a convergence analysis for the non-IID data case, but for the specific scheme based on matching decomposition sampling described above.”

What the sources say

• ?Could not verify

  Section 4.4 (p. 9) and Appendix E.2 (p. 27) report empirical convergence comparisons under heterogeneous data. Searches for “matching decomposition sampling” and “convergence analysis non-IID data scheme sampling” found no passage describing that scheme or an analysis of its convergence, so our copy does not verify the attributed claim. (LLM, conf=0.76)

  cites [469] Li, 2019, Fair resource allocation in federated learning sourceExperimental — accuracy not yet measured

In the paper

“While large companies or organizations can play this role in some application scenarios, a reliable and powerful central server may not always be available or desirable in more collaborative learning scenarios [459].”

What the sources say

• ?Could not verify

  The Introduction and Conclusion discuss certified defenses against adversarial examples, not the availability or desirability of a central server. Searches for the quoted claim and for central servers in collaborative or distributed learning found no passage addressing that point. (LLM, conf=0.75)

  cites [459] Lécuyer sourceExperimental — accuracy not yet measured

In the paper

“Currently proposed algorithms include trees [118], linear and logistic regression [490, 224, 316], and neural networks [317].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [118] Xie, 2019, Local adaalter: Communication-efficient stochastic gradient descent with adaptive learning rates
• ?Could not verify

  The Introduction (p. 1) and Related Work (p. 12) discuss algorithmic fairness, not feature-partitioned cross-silo federated learning. Searches for that setting and for logistic regression found no passage describing the claimed algorithms; the paper’s mention of linear programming in Experiments (p. 11) is not linear regression. (LLM, conf=0.76)

  cites [490] Awasthi, 2020, Beyond individual and group fairness, CoRR sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [224] Bogdanov
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [316] Gennaro
• ?Not checked — no full text of the sourcecites [317] Goldwasser, 1989, The knowledge complexity of interactive proof systems, SIAM J. Comput. source

In the paper

“Furthermore, the server may even become a bottleneck when the number of clients is very large, as demonstrated by Lian et al. [305] (though this can be mitigated by careful system design, e.g. [81]).”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Lian et al. [305]
• Partly supported

  The bottleneck claim is attributed to Lian et al. [305]; this source is cited for the proposed mitigation. Its Analysis (p. 3) finds that split learning has lower data transfer with many clients, supporting a communication-efficiency benefit from system design. It does not establish that this design mitigates a server bottleneck, and the Conclusion (p. 4) leaves resource utilization for future work. (LLM, conf=0.78)

  cites [81] Singh, 2019, Detailed comparison of communication efficiency of split learning and federated learning sourceExperimental — accuracy not yet measured

In the paper

“However, on today's blockchain platforms such as Ethereum [478], data on the blockchains is publicly available by default”

What the sources say

• ?Could not verify

  The Introduction (p. 1) discusses differential privacy in machine learning, and Experiments (p. 3) mentions public training datasets, not blockchain records. Searches for Ethereum, blockchain, and publicly available ledger data found no passage addressing whether blockchain data is public by default. (LLM, conf=0.75)

  cites [478] Bagdasaryan, 2019, Differential privacy has disparate impact on model accuracy, CoRR sourceExperimental — accuracy not yet measured

In the paper

“The work of [459, 59] introduces fully decentralized algorithms to collaboratively learn a personalized model for each client by smoothing model parameters across clients that have similar tasks (i.e., similar data distributions).”

What the sources say

• ?Could not verify

  The Introduction describes PixelDP as a certified defense against adversarial examples, and the Differentially Private ML section describes its goal as making predictions robust to changes in input features. Neither section addresses fully decentralized learning, client-specific models, or smoothing parameters across clients with similar tasks. Searches for those terms and their paraphrases found no supporting passage in our copy. (LLM, conf=0.77)

  cites [459] Lécuyer sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [59] Wood, 2014, Ethereum: A secure decentralised generalised transaction ledger, Ethereum Project Yellow Paper

In the paper

“In order to prevent any client from trying to reconstruct the private data of another client by exploiting the global model, client-level differential privacy [338] has been proposed for FL.”

What the sources say

• Partly supported

  Section 8 (p. 12) discusses differential privacy as a defense against training-data leakage and reports privacy benefits from user-level DP models for language modeling. It does not say that client-level DP has been proposed for federated learning or that it prevents one client from reconstructing another’s data through a global model. (LLM, conf=0.82)

  cites [338] Carlini, 2020, Extracting training data from large language models sourceExperimental — accuracy not yet measured

In the paper

“Several challenging FL topics including personalization and privacy have begun to be studied in this multi-task/LTL framework [270, 250, 299].”

What the sources say

• ?Could not verify

  The Introduction and §2.3 discuss anonymous communication, verifiable shuffles, and private information retrieval, not federated learning. Searches for personalization, multi-task learning, and learning-to-learn found no passage addressing privacy in that framework. (LLM, conf=0.76)

  cites [270] Kwon, 2016, Riffle, Proceedings on Privacy Enhancing Technologies sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [250] Reyzin, 2018, Turning HATE into LOVE: Homomorphic ad hoc threshold encryption for scalable MPC, IACR Cryptology ePrint Archive
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [299] Dwork

In the paper

“For example, if data is vertically partitioned, each party maintaining private records of different feature sets about common entities, these problems may require addressing record linkage [124] within the federated learning task.”

What the sources say

• ?Could not verify

  The Introduction (p. 1) distinguishes cross-device from cross-silo federated learning, and the Problem setup (p. 3) addresses cross-device clients. Neither passage addresses vertically partitioned features or record linkage; further searches for those terms and entity matching found no supporting passage in our copy. (LLM, conf=0.76)

  cites [124] Karimireddy, 2020, Mime: Mimicking centralized stochastic algorithms in federated learning sourceExperimental — accuracy not yet measured

In the paper

“Methods combining Federated Averaging with sparsification and/or quantization of model updates to a small number of bits have demonstrated significant reductions in communication cost with minimal impact on training accuracy [282].”

What the sources say

• ?Could not verify

  Section 3.3 discusses communication costs for private batched sum retrieval, and Section 6.1 discusses the efficiency of private information retrieval methods. Neither addresses Federated Averaging, sparsification or quantization of model updates, or training accuracy. Searches for those terms and for federated-learning compression found no relevant passage in our copy. (LLM, conf=0.78)

  cites [282] Patel sourceExperimental — accuracy not yet measured

In the paper

“The recent progress in NAS [230, 387, 175, 388, 60, 375, 313, 488, 175, 323] provides a potential way to address these drawbacks.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [230] Bourse
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [387] Steinke
• ?Not checked — no full text of the sourcecites [175] He, 2020, FedNAS: Federated deep learning via neural architecture search
• ?Could not verify

  The Introduction (p. 1) identifies privacy, communication, and changing client participation as federated-learning challenges; the Discussion (p. 23) addresses private, communication-efficient optimization. Searches for NAS, neural architecture search, and architecture search found no passage connecting NAS to drawbacks of predefined architectures. (LLM, conf=0.76)

  cites [388] Girgis, 2020, Shuffled model of federated learning: Privacy, communication and accuracy trade-offs sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [60] Bonawitz
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [375] Cormode
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [313] Babai
• ?Could not verify

  The Introduction (p. 2) describes a superquantile-based approach to client-data heterogeneity, and Related Work (p. 10) discusses federated and robust optimization. Searches for NAS, neural architecture search, and model-architecture search found no passage addressing whether NAS could overcome drawbacks of predefined architectures. (LLM, conf=0.76)

  cites [488] Laguel, 2020, Device heterogeneity in federated learning: A superquantile approach sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [323] Costello

In the paper

“Similarly, recent works show that learning a compression scheme in a data-dependent fashion can lead to significantly better compression ratio for the case of data compression [482] as well as gradient compression.”

What the sources say

• ?Could not verify

  The Summary and Outlook (p. 17) describes learning anonymized representations and trade-offs between privacy and classification, not compression ratios. The rate-distortion discussion (p. 6) uses distortion to bound classification error; searches for data-dependent compression schemes, compression ratios, and gradient compression found no passage supporting the cited data-compression claim. (LLM, conf=0.76)

  cites [482] Feutry, 2018, Learning anonymized representations with adversarial neural networks, CoRR sourceExperimental — accuracy not yet measured

In the paper

“This is in sharp contrast with the traditional orthogonal frequency division multiplexing (OFDM) paradigm, whereby workers upload their models over orthogonal frequencies whose performance degrades with increasing number of workers [174].”

What the sources say

• ?Could not verify

  The Experimental Results (p. 6) concern weight-agnostic neural networks, not model uploads over OFDM. Searches for OFDM, orthogonal frequencies, workers uploading models, and performance as worker count increases found no passage addressing the claim. (LLM, conf=0.77)

  cites [174] Gaier, 2019, Weight agnostic neural networks sourceExperimental — accuracy not yet measured

In the paper

“These works are typically in the cross-silo setting, or the variant where computation is delegated to a small group of computing servers that do not collude with each other.”

What the sources say

• ?Could not verify

  Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  cites [359] Kairouz, 2021 sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Introduction (p. 1) and Related Work (p. 2) discuss communication-efficient distributed training, not custom secure computation protocols. The synchronous SGD appendix (p. 13) mentions parameter servers, but says nothing about cross-silo settings, delegated computation, or noncolluding servers. Searches for those terms and for secure regression and neural-network protocols found no passage addressing the claim. (LLM, conf=0.76)

  cites [194] Lin, 2017, Deep gradient compression: Reducing the communication bandwidth for distributed training sourceExperimental — accuracy not yet measured
• ?Could not verify

  Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  cites [351] Ramaswamy, 2020, Training production language models without memorizing user data sourceExperimental — accuracy not yet measured

In the paper

“For example, straightforward application of the Secure Aggregation protocol of Bonawitz et al. [80], Bell et al. [58] requires an additional O (log M ) bits of communication for each scalar, where M is the number of clients being summed over, and this may render ineffective the aggressive quantization of updates when M is large (though see [82] for a more efficient approach).”

What the sources say

• Not checked yetcites [80] Ceballos, 2018, SplitNN-driven vertical partitioning
• ?Could not verify

  The discussion on p. 5 describes decentralized computation without costly multi-party computation, but does not address Secure Aggregation’s per-scalar communication cost. Searches for quantization, additional O(log M) bits, and a more efficient Secure Aggregation approach found no passage in our copy that evaluates those claims. (LLM, conf=0.73)

  cites [58] Cyffers, 2020, Privacy amplification by decentralization sourceExperimental — accuracy not yet measured

In the paper

“Many algorithms used in federated learning such as Secure Aggregation [79] and mechanisms of adding noise to achieve differential privacy [3, 338] are not designed to work with compressed or quantized communications.”

What the sources say

• ?Could not verify

  The References (p. 6) list work on differential privacy, while the Conclusion (p. 4) proposes combining SplitNN with compression methods. Neither passage addresses whether noise-adding privacy mechanisms are designed to work with compressed or quantized communications. Searches for noise, differential privacy, compression, and quantization found no passage settling that claim. (LLM, conf=0.76)

  cites [79] Vepakomma, 2018, Split learning for health: Distributed deep learning without sharing raw patient data sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [3] Yao
• ?Could not verify

  Section 8 (p. 12) discusses differential privacy for training language models and its privacy–utility tradeoff. It does not address whether differential-privacy mechanisms work with compressed or quantized communications. Searches for those terms and for federated learning and secure aggregation found no passage addressing the claimed incompatibility. (LLM, conf=0.75)

  cites [338] Carlini, 2020, Extracting training data from large language models sourceExperimental — accuracy not yet measured

In the paper

“However, most HE schemes require that the secret keys be renewed often (due to e.g. susceptibility to chosen ciphertext attacks [117]).”

What the sources say

• ?Could not verify

  The cited paper discusses communication-efficient momentum SGD, including algorithm restarts in §6.3.1 (p. 13) and convergence analysis in §6.6 (p. 29). Searches for homomorphic encryption, secret-key renewal, and chosen-ciphertext attacks found no passage addressing the claim. (LLM, conf=0.78)

  cites [117] Yu, 2019, On the linear speedup analysis of communication efficient momentum SGD for distributed non-convex optimization sourceExperimental — accuracy not yet measured

In the paper

“Recent results on PIR have shown dramatic reductions in the computational cost through the use of lattice-based cryptosystems [12, 363, 13, 23, 198].”

What the sources say

• Not checked yetcites [12] Pichai, 2019, Google’s Sundar Pichai: Privacy should not be a luxury good
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [363] Mironov
• ?Could not verify

  Section 2, “Federated Learning” (p. 1), discusses on-device training and privacy-preserving techniques, not private information retrieval. Searches for PIR, lattice-based cryptosystems, and computational-cost reductions found no passage in our copy addressing the claim. (LLM, conf=0.78)

  cites [13] Ramaswamy, 2019, Federated learning for emoji prediction in a mobile keyboard sourceExperimental — accuracy not yet measured

In the paper

“Unfortunately, as we will discuss in Section 4.4.2, achieving LDP while maintaining utility can be difficult [266, 455].”

What the sources say

• ?Not checked — no full text of the sourcecites [266] Burkhart, 2010, SEPIA: Privacy-preserving aggregation of multi-domain network events and statistics, Network
• Partly supported

  Section 4 (p. 3) says that obtaining reasonable differential privacy traditionally requires relatively large amounts of noise, which supports the general difficulty implied by the claim. But it does not specifically discuss local differential privacy or demonstrate a privacy–utility trade-off for LDP; Section 5 (p. 5) tests only a small amount of noise for attack defense, not for a stated privacy guarantee. (LLM, conf=0.82)

  cites [455] Sun, 2019, Can you really backdoor federated learning? sourceExperimental — accuracy not yet measured

In the paper

“By designing the noise correctly, we may ensure that the noise in the aggregated result matches the noise that would have otherwise been added centrally by a trusted server (e.g. with a low ε / high privacy level) [8, 385, 205, 417, 213].”

What the sources say

• Not checked yetcites [8] Differential Privacy Team, 2017, Learning with privacy at scale, Apple Machine Learning Journal
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [385] Bassily
• ?Could not verify

  The Preliminaries (p. 6) discuss aggregating unbiased gradient estimates, and Privacy using Rappor (p. 21) describes adding noise to each quantized estimate. Neither passage says that the resulting aggregate noise can match noise added centrally by a trusted server; searches for that comparison found no such passage. (LLM, conf=0.72)

  cites [205] Gandikota, 2019, VqSGD: Vector quantized stochastic gradient descent sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [417] Yin
• ?Could not verify

  Section 6.1 (p. 4) discusses thermal, quantization, and channel-estimation noise in over-the-air aggregation, and averaging to reduce their effects. A search for trusted-server noise, differential privacy, and ε found no passage saying that the aggregate noise can be designed to match noise added centrally. (LLM, conf=0.74)

  cites [213] Abari, 2016, Over-the-air function computation in sensor networks, CoRR sourceExperimental — accuracy not yet measured

In the paper

“In order to recover some of the utility of central DP without having to rely on a trustworthy central server, one can instead use a distributed differential privacy model [166, 417, 73, 120].”

What the sources say

• ?Could not verify

  The cited paper discusses neural architecture search and network morphisms (Section 3.2, p. 4; Algorithm 1, p. 5), not differential privacy. Searches for distributed differential privacy, central-DP utility, and a trustworthy central server found no passage addressing the claim. (LLM, conf=0.77)

  cites [166] Elsken, 2018, Efficient multi-objective neural architecture search via Lamarckian evolution sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [417] Yin
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [73] Kang

In the paper

“Moreover, it is challenging for TEEs (especially those operating on shared microprocessors) to fully exclude all types of side channel attacks [458].”

What the sources say

• ?Could not verify

  The Abstract (p. 1) discusses attacks that reveal a client's contribution by analyzing a federated model, not side-channel attacks on trusted execution environments. Searches for TEEs, shared microprocessors, and side-channel attacks found no passage addressing the claim in our copy. (LLM, conf=0.75)

  cites [458] Geyer, 2017, Differentially private federated learning: A client level perspective, CoRR sourceExperimental — accuracy not yet measured

In the paper

“Similar protections can be achieved under the MPC model [351, 10].”

What the sources say

• ?Could not verify

  The Introduction (p. 1) assumes a trusted server and says protections under weaker server-trust assumptions require different techniques beyond this paper’s scope. The passages found when searching for MPC, TEEs, and concealment do not address whether MPC can provide protections similar to TEE-based concealment. (LLM, conf=0.73)

  cites [351] Ramaswamy, 2020, Training production language models without memorizing user data sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 2.2 (p. 2) says federated learning can be combined with secure aggregation to offer stronger privacy guarantees. Searches for MPC, multi-party computation, and trusted execution environments found no passage comparing MPC-based protections with TEE-based concealment, so our copy does not establish the attributed claim. (LLM, conf=0.72)

  cites [10] M. Chen , R.Mathews, T.Ouyang, and F.Beaufays, “Federated learning of out-of-vocabulary words,” arXiv preprint 1903.10635, 2019. [Online]. Available: http://arxiv.org/abs/1903.10635. sourceExperimental — accuracy not yet measured

In the paper

“If we relax the requirements for succinctness or non-interactiveness for the construction, there is a large body of constructions that achieve a wide range of efficiency trade-offs, avoid the trusted setup requirement and use more standard cryptographic assumptions [92, 464, 20, 63].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [92] Eichner
• Not checked yetcites [464] Barocas, 2019
• Not checked yetcites [20] WeBank , WeBank and Swiss re signed cooperation MoU, 2019. [Online]. Available: https://www.fedai.org/news/webank-and-swiss-re-signed-cooperation-mou/. Retrieved Aug. 2019.
• ?Could not verify

  The discussion of secure multiparty computation in §2.2 (p. 4) mentions efficiency trade-offs, but not constructions that relax succinctness or non-interactiveness. Searches for trusted setup and standard cryptographic assumptions found no passage addressing those requirements. (LLM, conf=0.76)

  cites [63] Yang, 2019, Federated machine learning: Concept and applications, CoRR sourceExperimental — accuracy not yet measured

In the paper

“As such, virtually all implementations of differential privacy satisfy only (variants of) computational differential privacy introduced by [347].”

What the sources say

• ?Could not verify

  The Introduction (p. 1) defines differential privacy, and Section 2 (p. 4) discusses privacy guarantees for mechanisms. Neither addresses whether virtually all implementations satisfy only computational differential privacy. Searches for “computational differential privacy” and “implementations of differential privacy computational” found no passage supporting that claim. (LLM, conf=0.75)

  cites [347] Kairouz, 2017, The composition theorem for differential privacy, IEEE Trans. Inform. Theor. sourceExperimental — accuracy not yet measured

In the paper

“However, since privacy guarantees degrade as additional information is published about the same data [167, 168], these updates must be less frequent to still preserve both privacy and accuracy of the overall analysis.”

What the sources say

• ?Could not verify

  Section 2.3 (p. 4) discusses gradients for architecture search, while Appendix B (p. 13) discusses search depth and computational cost. Searches for degrading privacy guarantees, repeated publication of the same data, and update frequency found no passage addressing the claim. (LLM, conf=0.76)

  cites [167] Liu, 2018, DARTS: Differentiable architecture search sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [168] Luo

In the paper

“user-level differential privacy can be used in FL's iterative training process [3, 338, 336, 68]”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [3] Yao
• Partly supported

  Section 8 (p. 12) says user-level differential privacy has shown privacy benefits for language models and describes differentially private training. It does not address federated learning (FL) or its iterative training process, so it supports only the differential-privacy training part of the claim. (LLM, conf=0.86)

  cites [338] Carlini, 2020, Extracting training data from large language models sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [336] Francillon
• Partly supported

  Section 4 (pp. 6–7) applies differential privacy to each training iteration and gives a guarantee across T epochs. But the Introduction (p. 2) describes protection against a change to a single feature in a party’s local dataset; it does not establish user-level differential privacy. (LLM, conf=0.88)

  cites [68] Hu, 2019, Learning privately over distributed features: An ADMM sharing approach sourceExperimental — accuracy not yet measured

In the paper

“Therefore, obtaining utility with LDP comparable to that in the central setting requires a relatively larger userbase or larger choice of ε parameter [445].”

What the sources say

• ?Could not verify

  The paper’s Hyperparameter Adjustment section (p. 5) defines ε as a step size for the Boundary Attack, not a differential-privacy parameter. Searches for LDP, central differential privacy, userbase size, and privacy-budget comparisons found no passage addressing the claim. (LLM, conf=0.78)

  cites [445] Brendel, 2017, Decision-based adversarial attacks: Reliable attacks against black-box machine learning models sourceExperimental — accuracy not yet measured

In the paper

“An alternative to this assumption would be incorporating an additional party or a public bulletin board (see, e.g., [398]) into the model that is known to the clients and trusted to not collude with the server.”

What the sources say

• ?Could not verify

  The Introduction and Possible Defenses sections discuss trojan attacks on neural networks, not key distribution. Searches for a public bulletin board, an additional trusted party, and an honest server found no passage addressing the cited example. (LLM, conf=0.78)

  cites [398] Liu sourceExperimental — accuracy not yet measured

In the paper

“the shuffle model's differential privacy guarantee degrades in proportion to the number of adversarial users participating in the computation [45].”

What the sources say

• ?Could not verify

  The Privacy Protection section (p. 6) discusses how decentralized, single-sided communication may make attacks harder, but does not discuss the shuffle model or a differential privacy guarantee. Searches for the shuffle model and adversarial-user privacy degradation found no passage addressing the claimed proportional relationship. (LLM, conf=0.75)

  cites [45] He, 2019, Central server free federated learning over single-sided trust social networks sourceExperimental — accuracy not yet measured

In the paper

“The Secure Aggregation protocols from [80, 58] have strong privacy guarantees when aggregating client reports.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [80] Ceballos, 2018, SplitNN-driven vertical partitioning
• Partly supported

  The discussion on p. 2 says cryptographic protocols securely aggregate user contributions and can provably improve the privacy–utility trade-off. But this paper presents decentralized aggregation algorithms without costly secure multi-party computation; it does not present the Secure Aggregation protocols that the citing sentence describes as coming from it. (LLM, conf=0.82)

  cites [58] Cyffers, 2020, Privacy amplification by decentralization sourceExperimental — accuracy not yet measured

In the paper

“It is crucial to note that even if the model parameters themselves are successfully hidden, research has shown that in many cases they can be reconstructed by an adversary who only has access to an inference/prediction API based on those parameters [450].”

What the sources say

• ?Could not verify

  Section 6.2 (pp. 7–8) evaluates defenses against black-box adversarial attacks, while Section 5 (p. 5) discusses attacks that use known model parameters. Neither those passages nor searches for parameter reconstruction, model extraction, and prediction-API access address whether an adversary can reconstruct hidden parameters from API queries. (LLM, conf=0.76)

  cites [450] Xie, 2019, Feature denoising for improving adversarial robustness sourceExperimental — accuracy not yet measured

In the paper

“Recent advances in differential privacy for dynamic databases and time series data [143, 142, 97] have all assumed the existence of a trusted curator who can see raw data as they arrive online, and publish dynamically updated statistics.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [143] Lake
• Partly supported

  Section 2.3 (p. 4) says global differential privacy assumes a trusted aggregator with direct access to the dataset before it privatizes the output. The paper does not establish that advances for dynamic databases or time-series data all use this model, or describe raw data arriving online and dynamically updated statistics. (LLM, conf=0.84)

  cites [142] Li, 2019, Differentially private meta-learning sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [97] Lan, 2012, An optimal method for stochastic composite optimization, Math. Program. source

In the paper

“current work on the hybrid model typically assumes that regardless of the user trust preference, their data comes from the same distribution [40, 39, 57].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [40] Colin
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [39] Bellet
• ?Could not verify

  The Introduction (p. 2) contrasts centralized and distributed optimization, and §4.2 (p. 11) discusses the distribution of added noise. Neither addresses a hybrid model, users’ trust preferences, or whether their data come from the same distribution. Searches for those terms and for “same distribution” found no supporting passage in our copy. (LLM, conf=0.76)

  cites [57] Huang sourceExperimental — accuracy not yet measured

In the paper

“One way around the issue of privacy composition is by producing synthetic data [165, 5], which can then be used indefinitely without incurring additional privacy loss. This follows from the postprocessing guarantees of differential privacy [167].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [165] Bello
• ?Not checked — no full text of the sourcecites [5] Vaidya, 2008, Privacy-preserving SVM classification, Knowl. Inf. Syst. source
• ?Could not verify

  The abstract (p. 1) and Section 2 (pp. 2–5) describe differentiable architecture search, not differential privacy. Searches for synthetic data, privacy loss, and postprocessing found no passage addressing the attributed claim. (LLM, conf=0.78)

  cites [167] Liu, 2018, DARTS: Differentiable architecture search sourceExperimental — accuracy not yet measured

In the paper

“a number of results have shown that achieving local differential privacy while preserving utility is challenging, especially in high-dimensional data settings [266, 455, 252, 54, 253, 495, 162, 128].”

What the sources say

• ?Not checked — no full text of the sourcecites [266] Burkhart, 2010, SEPIA: Privacy-preserving aggregation of multi-domain network events and statistics, Network
• Partly supported

  The Defenses section (p. 3) says that achieving reasonable differential privacy traditionally requires relatively large amounts of noise, while the Experiments section (p. 5) reports that a small amount of noise preserved performance. This lends limited support to a privacy–utility challenge, but the paper does not specifically address local differential privacy or say the challenge is especially severe for high-dimensional data. (LLM, conf=0.83)

  cites [455] Sun, 2019, Can you really backdoor federated learning? sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [252] Subramanyan
• Partly supported

  Future Work (p. 8) acknowledges a known privacy–accuracy trade-off for linear models and proposes differential privacy as future work. It does not discuss local differential privacy or say that preserving utility is especially challenging with high-dimensional data. (LLM, conf=0.78)

  cites [54] Zantedeschi, 2019 sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [253] Intel, 2012, Architecture instruction set extensions programming reference
• ?Could not verify

  Background and Related Work (p. 2) mentions differential privacy in deep learning, while Secure Aggregation Overheads (p. 10) discusses computational costs that rise with model vector size. Neither addresses the difficulty of preserving utility under local differential privacy, particularly with high-dimensional data. Searches for those terms and the privacy–utility tradeoff found no supporting passage. (LLM, conf=0.76)

  cites [495] Beutel, 2020, Flower: A friendly federated learning research framework sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Related work section (p. 3) mentions differential privacy only as a topic studied in federated learning. The Introduction (p. 2) discusses an optimization trade-off, not a privacy–utility trade-off. Searches for local differential privacy, utility, and high-dimensional data found no passage addressing the claim. (LLM, conf=0.77)

  cites [162] Charles, 2020, On the outsized importance of learning rates in local update methods sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [128] Smith

In the paper

“very little behavioral work has been done on eliciting preferences for differential privacy [144, 6].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [144] Ravi
• ?Could not verify

  Section 2.4.1 (p. 10) discusses differential privacy’s technical guarantees and its trade-off with model accuracy; Section 2.4.2 (p. 11) reviews its use in federated learning. Neither those passages nor searches for behavioral work and privacy preferences address whether little work has been done on eliciting preferences for differential privacy. (LLM, conf=0.74)

  cites [6] Li, 2020, Federated learning: Challenges, methods, and future directions, IEEE Signal Process. Mag. sourceExperimental — accuracy not yet measured

In the paper

“Past work has shown that various robust aggregators are provably effective for Byzantine-tolerant distributed learning [436, 76, 116] under appropriate assumptions, even in federated settings [379, 486, 427].”

What the sources say

• ?Could not verify

  The Related Work section (p. 5) discusses poisoning in collaborative deep learning, while the Threat Model (p. 4) concerns backdoored models supplied by a trainer. Neither addresses provable effectiveness of robust aggregators for Byzantine-tolerant distributed or federated learning. Searches for those terms found no supporting passage in our copy. (LLM, conf=0.76)

  cites [436] Gu, 2017, BadNets: Identifying vulnerabilities in the machine learning model supply chain sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 4.4 proves convergence of the paper’s federated tensor-factorization method, not Byzantine tolerance. The Introduction discusses robustness to sampling error from small or unevenly distributed hospitals; a search for Byzantine or malicious participants found no passage addressing whether robust aggregators are effective against them. (LLM, conf=0.78)

  cites [76] Kim sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Abstract (p. 1) and Related Work (p. 7) discuss FedAvg convergence, averaging schemes, and communication efficiency in federated learning. Searches for Byzantine tolerance, malicious clients, and robust aggregation found no passage in our copy addressing whether such aggregators are provably effective in federated settings. (LLM, conf=0.77)

  cites [116] Li, 2019, On the convergence of Fed Avg on non-IID data sourceExperimental — accuracy not yet measured

In the paper

“While often equipped with rigorous theoretical guarantees, such mechanisms generally assume the server has direct access to the data or is allowed to globally shuffle the data, and therefore are not directly applicable in federated settings.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [111] Wang
• Partly supported

  The Introduction (p. 1) says the trusted curator receives users’ true data, and Other Works in Hybrid Trust Models (p. 5) describes an anonymous channel that shuffles users’ contributions before they reach the curator. The paper does not discuss redundancy mechanisms or say these approaches are inapplicable in federated settings; it also attributes the shuffling to the channel, not the server. (LLM, conf=0.78)

  cites [381] Avent, 2020, The power of the hybrid model for mean estimation, Proceedings on Privacy Enhancing Technologies (PETS) sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [148] Mansour

In the paper

“Some federated settings naturally lead to limited participation rate : with a population of hundreds of millions of devices, sampling a few thousand every update is unlikely to sample the same participant more than once (if at all) during the training process [81].”

What the sources say

• Partly supported

  The Analysis (p. 3) describes a federated-learning scenario with millions of clients, including smart watches, so it supports the large-device-population premise. It does not discuss sampling a few thousand devices per update, limited participation rates, or the likelihood of selecting a participant more than once during training. (LLM, conf=0.79)

  cites [81] Singh, 2019, Detailed comparison of communication efficiency of split learning and federated learning sourceExperimental — accuracy not yet measured

In the paper

“since the theoretical guarantees of these defenses may only hold under assumptions on the learning problem that are often not met [52, 381].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [52] Koloskova
• ?Could not verify

  The Introduction (p. 1) frames the paper as a study of differentially private mean estimation, and Hybrid Mean Estimator Amplification (p. 15) gives privacy guarantees under specified noise and adversary assumptions. Searches for Byzantine-resilient defenses and learning-problem assumptions found no passage saying that such defenses’ guarantees rely on assumptions often unmet in practice. (LLM, conf=0.76)

  cites [381] Avent, 2020, The power of the hybrid model for mean estimation, Proceedings on Privacy Enhancing Technologies (PETS) sourceExperimental — accuracy not yet measured

In the paper

“More recent work has developed improved data sanitization methods using robust statistics [432, 416, 454, 152], which often have the benefit of being provably robust to small numbers of outliers [152].”

What the sources say

• ?Could not verify

  The Related work section (p. 12) discusses defenses that remove anomalous client contributions, while Appendix B (p. 15) reports experimental resilience to mixed poisoned data. Neither addresses data sanitization using robust statistics or a proof of robustness to small numbers of outliers; searches for those terms and for provable outlier guarantees found no supporting passage. (LLM, conf=0.76)

  cites [432] Fung, 2018, Mitigating sybils in federated learning poisoning sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 6 (page unavailable) discusses using median functions to keep processors’ agreed value within the range supplied by a nonfaulty input device. Searches for data sanitization, robust statistics, and outliers found no passage addressing methods provably robust to small numbers of outliers. (LLM, conf=0.76)

  cites [416] Lamport, 1982, The Byzantine generals problem, ACM Trans. Program. Lang. Syst. sourceExperimental — accuracy not yet measured
• Partly supported

  Section 5 (p. 4) describes a method for identifying poisoned training samples by clustering neural-network activations, so the paper supports the data-sanitization part of the attribution. Section 6.1 (p. 6) reports experimental detection results, but our copy does not establish a proof of robustness to small numbers of outliers or describe the method as using robust statistics. (LLM, conf=0.88)

  cites [454] Chen, 2018, Detecting backdoor attacks on deep neural networks by activation clustering sourceExperimental — accuracy not yet measured

In the paper

“For example Xie et al. [487], Xie [484] and Xie et al. [486] proposed Byzantine-robust aggregators that successfully defended against label-flipping data poisoning attacks on convolutional neural networks.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [487] Martin, 2019, Current clinical use of polygenic scores will risk exacerbating health disparities
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [484] Srivastava
• ?Could not verify

  The Methods describe training a convolutional neural network, and the Results report performance of cyclical weight transfer across institutions. Our copy does not address Byzantine-robust aggregators or defenses against label-flipping data poisoning attacks (searched those terms and related descriptions of malicious institutions). (LLM, conf=0.76)

  cites [486] Chang, 2018, Distributed deep learning networks among institutions for medical imaging, JAMIA sourceExperimental — accuracy not yet measured

In the paper

“Moreover, since the adversary's aim is to only affect the classification outcome on a small number of data points, while maintaining the overall accuracy of the centrally learned model, defenses for untargeted attacks often fail to address targeted attacks [67, 44].”

What the sources say

• ?Could not verify

  The Security Analysis (p. 4) says the framework does not address malicious parties, but it does not discuss targeted versus untargeted attacks. Searches for targeted attacks, defenses, and effects on a small number of classifications found no passage supporting the attributed explanation. (LLM, conf=0.76)

  cites [67] Liu, 2020, A secure federated transfer learning framework, IEEE Intelligent Systems sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [44] Tang

In the paper

“This ignores the reality that an adversary could corrupt the training process in order to create or enhance inference-time vulnerabilities of a model, as in [115].”

What the sources say

• ?Could not verify

  The Introduction (pp. 1–2) discusses federated-learning optimization, heterogeneous data, and convergence; the Experiments (p. 5) test that analysis. Neither those passages nor searches for adversarial training corruption, poisoning, and inference-time vulnerabilities address an adversary creating model vulnerabilities. (LLM, conf=0.76)

  cites [115] A. Khaled , K.Mishchenko, and P.Richtárik, First analysis of local GD on heterogeneous data, 2019. [Online]. Available: https://arxiv.org/abs/1909.04715. sourceExperimental — accuracy not yet measured

In the paper

“Bhagoji et al. [67] shows that if 10% of the devices participating in federated learning are compromised, a backdoor can be introduced by poisoning the model sent back to the service provider, even with the presence of anomaly detectors at the server.”

What the sources say

• ?Could not verify

  The Security Analysis (p. 4) says the framework does not address malicious parties. Our copy provides no finding about 10% compromised devices, model-poisoning backdoors, or server-side anomaly detectors; searches for those terms and for Bhagoji found no supporting passage. (LLM, conf=0.76)

  cites [67] Liu, 2020, A secure federated transfer learning framework, IEEE Intelligent Systems sourceExperimental — accuracy not yet measured

In the paper

“Existing defenses against backdoor attacks [432, 314, 454, 152, 465, 416, 122] either require a careful examination of the training data, access to a holdout set of similarly distributed data, or full control of the training process at the server, none of which may hold in the federated learning setting.”

What the sources say

• Partly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [432] Fung, 2018, Mitigating sybils in federated learning poisoning sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [314] Micali, 2000, Computationally sound proofs, SIAM J. Comput. source
• Partly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [454] Chen, 2018, Detecting backdoor attacks on deep neural networks by activation clustering sourceExperimental — accuracy not yet measured

In the paper

“Such methods are motivated by previous studies which showed empirically that poisoned data designed to introduce a backdoor often triggers so-called 'backdoor neurons' [214].”

What the sources say

• ?Could not verify

  The Introduction and IV. Privacy Analysis discuss model inversion, reconstruction attacks, and protecting local model updates, but not poisoned data or backdoor neurons. Searches for “backdoor neurons” and “data poisoning backdoor attacks” found no passage addressing the claimed empirical finding. Page numbers were not available in our copy. (LLM, conf=0.75)

  cites [214] Elgabli, Harnessing wireless channels for scalable and privacy-preserving federated learning sourceExperimental — accuracy not yet measured

In the paper

“Moreover, adversarial training typically only improves robustness to the specific type of adversarial examples incorporated during training, potentially leaving the trained model vulnerable to other forms of adversarial noise [176, 448, 414].”

What the sources say

• ?Could not verify

  The passages on distributional bias (Section 2, p. 3) and an image-preprocessing bug (p. 8) concern model errors, not adversarial training. Searches for adversarial examples, attack types, and robustness found no passage addressing whether training against one type of attack leaves a model vulnerable to others. (LLM, conf=0.76)

  cites [176] S. Augenstein , H. B.McMahan, D.Ramage, S.Ramaswamy, P.Kairouz, M.Chen, R.Mathews, and B. A.y Arcas, Generative models for effective ML on private, decentralized datasets, 2019. [Online]. Available: https://arxiv.org/abs/1911.06679. sourceExperimental — accuracy not yet measured
• Partly supported

  Section 5.1.1 (p. 5) says training exclusively on ℓ∞ adversarial examples provides only limited robustness against examples measured under other distortion metrics. This supports the concern about vulnerability to other forms of attack, but the paper gives this specific case rather than establishing that adversarial training typically improves robustness only to the type used in training. (LLM, conf=0.82)

  cites [448] Athalye, 2018, Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples sourceExperimental — accuracy not yet measured
• Partly supported

  Section 6 (p. 5) reports that training with fast-gradient-sign adversarial examples reduced the error rate on that type of example from 89.4% to 17.9%. The paper does not establish that adversarial training typically improves robustness only to the type used in training, or test whether that trained model remains vulnerable to other forms of adversarial noise. (LLM, conf=0.82)

  cites [414] Goodfellow, 2015, Explaining and harnessing adversarial examples sourceExperimental — accuracy not yet measured

In the paper

“One simple method would be to select more devices than required within each round. This helps ensure that stragglers and failed devices have minimal effect on the overall convergence [81].”

What the sources say

• ?Could not verify

  The Communication efficiency section (pp. 2–3) compares data transfer per client, and the Conclusion (p. 4) discusses communication efficiency and possible future analysis of convergence. Neither addresses selecting extra devices in each round or whether doing so limits the effects of stragglers and device failures; searches for those terms and a paraphrase found no supporting passage. (LLM, conf=0.76)

  cites [81] Singh, 2019, Detailed comparison of communication efficiency of split learning and federated learning sourceExperimental — accuracy not yet measured

In the paper

“Recent work has explored differential privacy as a defense against data poisoning [326], and in particular in the federated learning context [199].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [326] Xie
• ?Could not verify

  The cited paper’s Experiments section (p. 5) concerns pruning, quantization, and Huffman coding; its Related Work section (p. 11) likewise discusses neural-network compression. Searches for differential privacy, data poisoning, and federated learning found no passage addressing their use as a defense. The federated-learning clause is separately cited to [199]. (LLM, conf=0.78)

  cites [199] Han, 2015, Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding sourceExperimental — accuracy not yet measured

In the paper

“One driver of unfairness in machine-learned models is bias in the training data, including cognitive, sampling, reporting, and confirmation bias.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [258] Tramèr
• ?Could not verify

  The Related Work section (p. 3) says researchers have investigated bias in datasets, but it does not link that bias to unfairness in machine-learned models. Searches for fairness, discrimination, and the named types of bias found no passage addressing that link. (LLM, conf=0.74)

  cites [93] Wang, 2018, Dataset distillation sourceExperimental — accuracy not yet measured

In the paper

“Unfortunately, unresponsive clients become more challenging to contend with when using secure aggregation (SecAgg) [80, 58], especially if the clients drop out during the SecAgg protocol.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [80] Ceballos, 2018, SplitNN-driven vertical partitioning
• ?Could not verify

  The discussion on p. 2 says secure-aggregation approaches can require all users to interact at each step, but it does not discuss unresponsive clients or clients dropping out during a SecAgg protocol. Searches for dropout, unresponsive clients, and fault tolerance found no passage addressing that claim. (LLM, conf=0.72)

  cites [58] Cyffers, 2020, Privacy amplification by decentralization sourceExperimental — accuracy not yet measured

In the paper

“Even if the data on a client is not intentionally malicious, it may have noisy features [350] (eg. in vision applications, a client may have a low-resolution camera whose output is scaled to a higher resolution) or noisy labels [356] (eg. if the user indicates that a recommendation by an app is not relevant accidentally).”

What the sources say

• ?Could not verify

  The citation to this paper is attached to the noisy-features part of the sentence; noisy labels has a separate citation. The Introduction (p. 1) discusses Gaussian noise added to gradients for differential privacy, not unintentionally noisy client features. Searches for low-resolution cameras, noisy features, malicious clients, and noisy labels found no passage addressing the attributed point. (LLM, conf=0.76)

  cites [350] Wang, 2018, Subsampled Rényi differential privacy and analytical moments accountant sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [356] Liu

In the paper

“These result show that if the number of local steps K is smaller than T/M 3 then the (optimal) statistical term is dominating the rate.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [467] Kamishima
• ?Not checked — no full text of the sourcecites [435] Xie, 2019, Zeno++: Robust asynchronous SGD with arbitrary number of Byzantine workers

In the paper

“The approaches to personalization discussed in Section 3.3 still share the same model architecture among all clients.”

In the paper

“Schemes relying on a single local update step are typically proven to converge in the case of non-IID local datasets [278, 279].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [278] Gentry
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [279] Olumofin

In the paper

“When the network graph is complete but messages have a fixed probability to be dropped, Yu et al. [498] show that one can achieve convergence rates that are comparable to the case of a reliable network.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Yu et al. [498]

In the paper

“Cross-silo FL with data partitioned by features, employs a very different training architecture compared to the setting with data partitioned by example.”

In the paper

“Unfortunately, such local privacy approaches often come at a large cost in utility.”

In the paper

“However, when data is IID, sparser topologies do not necessarily hurt the convergence in practice: this was analyzed theoretically in [357].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [357] Feldman

In the paper

“It may or may not involve a central server as a neutral party, and based on specifics of the training algorithm, clients exchange specific intermediate results rather than model parameters, to assist other parties' gradient calculations; see for instance [490, Section 2.4.2].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [490, Section 2.4.2]

In the paper

“The downside of this approach is that the training algorithm is typically dependent on the type of machine learning objective being pursued.”

In the paper

“The values communicated can nevertheless, in general, reveal information about the underlying data.”

In the paper

“The optimal number of local updates strikes a balance between these two phenomena and achieves the fastest error versus wallclock time convergence.”

In the paper

“Violations of independence are introduced any time the distribution Q changes over the course of training”

In the paper

“Finally, we note that the temporal dependence of the distributions Q and P may introduce dataset shift in the classic sense”

In the paper

“For example, under feature-distribution skew, because P ( y | x ) is assumed to be common, the problem is at least in principle well specified, and training a single global model that learns P ( y | x ) may be appropriate.”

In the paper

“This rules out the direct application of a variety of approaches that are quite effective in the datacenter context, for example stateful optimization algorithms like ADMM, and stateful compression strategies that modify updates based on residual compression errors from previous rounds.”

In the paper

“Nevertheless, since local training is possible, it becomes feasible for each client to have a customized model.”

In the paper

“Further, different non-IID regimes may require the development of different mitigation strategies.”

In the paper

“Split learning also enables matching client-side model components with the best server-side model components for automating model selection as shown in the ExpertMatcher [413].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [413] Carlini

In the paper

“Further, because local time of day corresponds directly to longitude, this introduces a strong geographic bias in the source of the data.”

In the paper

“A larger challenge in the FL setting, however, is that as discussed at the beginning of Section 3.2, asynchronous approaches may be difficult to combine with complimentary techniques like differential privacy or secure aggregation.”

In the paper

“Local-update SGD methods where all M clients perform the same number of local updates may suffer from a common scalability issue-they can be bottlenecked if any one client unpredictably slows down or fails.”

In the paper

“In addition to addressing non-identical client distributions, using a plurality of models can also address violations of independence stemming from changes in client availability.”

In the paper

“Performing more local updates at the clients will increase the divergence between the resulting local models at the clients, before they are averaged. As a result, the error convergence in terms of training loss versus the total number of sequential SGD steps TK is slower.”

In the paper

“Since the clients independently collect their own training data which vary in both size and distribution, and these data are not shared with other clients or the central node, the IID assumption clearly almost never holds in practice.”

In the paper

“The main difference between federated optimization algorithms and standard distributed training methods is the need to address the characteristics of Table 1 - for optimization, non-IID and unbalanced data, limited communication bandwidth, and unreliable and limited device availability are particularly salient.”

In the paper

“When the same features map to different labels on different clients, some form of personalization (Section 3.3) may be essential to learning the true labeling functions.”

In the paper

“Furthermore, other criteria may make the set of clients eligible to train a federated model different from the set of clients where that model will be deployed.”

In the paper

“Split learning brings in another dimension of parallelism in the training, parallelization among parts of a model, e.g. client and server.”

In the paper

“Li et al. [303] directly analyzes the Federated Averaging algorithm, which applies K steps of local updates on randomly sampled M clients in each round, and presents a rate that suggests local updates ( K > 1) could slow down the convergence.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [303] Erlingsson

In the paper

“it is challenging to prove momentum accelerates the convergence rate in the federated learning setting.”

In the paper

“Wang et al. [471] proves that FedAvg and many other federated learning algorithms will converge to the stationary points of a mismatched objective function in the presence of heterogeneous local steps.”

What the sources say

• Not checked yetcites [471] Richardson, 2019, Dirty data, bad predictions: How civil rights violations impact police data, predictive policing systems, and justice

In the paper

“Notably, this allows convergence results not relying on bounding the amount of heterogeneity among clients.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [265] Shi

In the paper

“As first shown in Wang and Joshi [467], the convergence analysis of decentralized SGD can be applied to or combined with local SGD with a proper setting of the network topology matrix (mixing matrix).”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Wang and Joshi [467]

In the paper

“Assuming the client functions are strongly convex could help the convergence rate [303, 265].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [303] Erlingsson
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [265] Shi

In the paper

“Li et al. [303] studied the convergence of Federated Averaging in a more realistic setting where only a subset of clients are involved in each round.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [303] Erlingsson

In the paper

“However, in some applications similar benefits can be achieved by simply adding user and context features to the model.”

In the paper

“While both [501, 470] showed that the momentum variants of local SGD can converge to stationary points of non-convex objective functions at the same rate as synchronous mini-batch SGD, it”

What the sources say

• ?Not checked — no full text of the sourcecites [501] Rodríguez-Barroso, 2020, Federated learning and differential privacy: Software tools analysis, the sherpa.ai FL framework and methodological guidelines for preserving data privacy, Inform. Fusion source
• ?Not checked — no full text of the sourcecites [470] Eckhouse, 2019, Layers of bias: A unified approach for understanding problems with risk assessment, Criminal Justice and Behavior source

In the paper

“The objects communicated could otherwise contain information highly correlated with the input data if used without NoPeek SplitNN”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [462] Natarajan

In the paper

“This framework generalizes the server momentum framework proposed by Hsu et al. [237], Wang et al. [470], which allows momentum without increasing communication costs.”

What the sources say

• Not checked yetcites [237] Barak, 2019, Secure evaluation of quantized neural networks, IACR Cryptology ePrint Archive
• ?Not checked — no full text of the sourcecites [470] Eckhouse, 2019, Layers of bias: A unified approach for understanding problems with risk assessment, Criminal Justice and Behavior source

In the paper

“Suitably featurized, such inputs can allow a shared global model to produce highly personalized predictions.”

In the paper

“In order to reduce the communication overhead, Wang and Joshi [467] proposed periodic decentralized SGD (PD-SGD) which allows decentralized SGD to have multiple local updates as Federated Averaging.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [467] Kamishima

In the paper

“Several works have also studied cross-silo federated tensor factorization where multiple sites (each having a set of data with the same feature, i.e. horizontally partitioned) jointly perform tensor factorization by only sharing intermediate factors with the coordination server while keeping data private at each site.”

In the paper

“SCAFFOLD [265] models the difference in client updates using control variates to perform variance reduction.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [265] Shi

In the paper

“However, none of the existing works clearly formulates what would be comprehensive metrics for measuring personalized performance; for instance, is a small improvement for every client preferable to a larger improvement for a subset of clients?”

In the paper

“For small device populations, this might result in the over-use of limited communication and compute resources.”

In the paper

“Techniques for robustness and privacy can make local models relatively stronger, particularly for non-typical clients [502].”

What the sources say

• Not checked yetcites [502] PyVertical Authors , PyVertical, 2020. [Online]. Available: https://github.com/OpenMined/PyVertical.

In the paper

“The evaluation of MAML algorithms for supervised tasks is largely focused on synthetic image classification problems [290, 386] in which infinite artificial tasks can be constructed by subsampling from classes of images.”

What the sources say

• ?Not checked — no full text of the sourcecites [290] Dwork source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [386] McSherry

In the paper

“Federated learning adds potentially more hyperparameters - separate tuning of the aggregation / global model update rule and local client optimizer, number of clients selected per round, number of local steps per round, configuration of update compression algorithms, and more.”

In the paper

“On the other hand, given pathologically non-IID distributions (e.g. P i ( y | x ) directly disagree across clients), local models will do much better.”

In the paper

“The hardness of these questions depends on how the data is distributed among parties.”

In the paper

“However, it is difficult to deduce concrete insights from these theoretical works for communication bandwidth reduction in practice as they typically ignore the impact of the optimization algorithm.”

In the paper

“These works characterize the optimal minimax rates for distributed statistical estimation and learning under communication constraints.”

What the sources say

• Not checked yetcites [507] The Google-Landmark-v2 Authors , Google landmark dataset v2, 2019. [Online]. Available: https://github.com/cvdfoundation/google-landmark.
• ?Not checked — no full text of the sourcecites [89] Moreno-Torres, 2012, A unifying view on dataset shift in classification, Pattern Recogn. source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [221] Andrew
• Not checked yetcites [7] McMahan, 2017
• ?Not checked — no full text of the sourcecites [49] J. Wang , A.Sahu, G.Joshi, and S.Kar, “MATCHA: Speeding up decentralized SGD via matching decomposition sampling,” Preprint, May2019. [Online]. Available: https://arxiv.org/abs/1905.09435. source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [444] Chen
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [50] Lian

In the paper

“Neural architecture search (NAS) in the federated learning setting is motivated by the drawbacks of the current practice of applying predefined deep learning models: the predefined architecture of a deep learning model may not be the optimal design choice when the data generated by users are invisible to model developers.”

In the paper

“Among them, (a) has the potential for the most significant practical impact in terms of total runtime.”

In the paper

“It is now well-understood that communication can be a primary bottleneck for federated learning since wireless links and other end-user internet connections typically operate at lower rates than intra- or interdatacenter links and can be potentially expensive and unreliable.”

In the paper

“In cross-device FL, algorithms generally cannot assume any state is preserved on the clients (Table 1).”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Table 1

In the paper

“While these features can offer significant practical privacy improvements over centralizing all the training data, there is still no formal guarantee of privacy in this baseline federated learning model.”

In the paper

“For instance, it is possible to construct scenarios in which information about the raw data is leaked from a client to the server, such as a scenario where knowing the previous model and the gradient update from a user would allow one to infer a training example held by that user.”

In the paper

“While generic solutions exist, their performance characteristics often render them inapplicable in practical settings.”

In the paper

“Porting these protocols to the cross-device setting is not straightforward, as they require a significant amount of communication.”

In the paper

“Non-IID data due to non-identical client distributions, violation of independence, and dataset drift (Section 3.1) pose a key challenge.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Section 3.1

In the paper

“Achieving all the desired privacy properties for federated learning will typically require composing many of the tools and technologies described below into an end-to-end system”

In the paper

“In fact, preliminary work from Lalitha et al. [292] shows that incorporating Bayesian methods allows for model aggregation across non-IID data and heterogeneous platforms.”

What the sources say

• ?Not checked — no full text of the sourcecites [292] Dwork, 2014, The algorithmic foundations of differential privacy, Foundations and Trends in Theoretical Computer Science source

In the paper

“Moreover, the availability of a trusted non-colluding party is not standard in the FL setting.”

In the paper

“In particular, wireless interference, noisy channels and channel fluctuations can significantly hinder the information exchange between the server and clients (or directly between individual clients, as in the fully decentralized case, see Section 2.1).”

In the paper

“while the distributed DP framework can produce more accurate statistics for the same level of differential privacy as LDP”

In the paper

“It is important to remark that distributed differential privacy and local differential privacy yield different guarantees from several perspectives”

In the paper

“By allowing multiple models to coexist, hybrid model mechanisms can achieve more utility from a given userbase, compared to purely local or central DP mechanisms.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [40] Colin

In the paper

“Moreover, even when TEEs are present, they may not be sufficiently powerful to support training computations, which would have to happen inside the TEE in order to protect the model iterate, and may be computationally expensive and/or require significant amounts of RAM”

In the paper

“The output distribution of a randomized algorithm A with access to a PRNG is indistinguishable from the output distribution of A with access to a true source of entropy as long as the distinguisher is computationally bounded .”

In the paper

“Even though central DP provides protections against both threat models, a careful theoretical analysis can reveal that for a specific implementation of the above Gaussian mechanism (or any other differentially private mechanism), we may get different privacy parameters for these two threat models.”

In the paper

“More broadly, unlike record-level DP where fundamental trade-offs between accuracy and privacy are well understood for a variety of canonical learning and estimation tasks, user-level DP is fundamentally less understood (especially when the number of contributions varies wildly across users and is not tightly bounded a priori ).”

In the paper

“Indeed, TEEs enable to attest and verify the code (binary) running in its environment.”

In the paper

“For moderate privacy budgets and in the absence of a sufficiently large dataset [384], the noise introduced by this process can lead to a large decrease in model accuracy.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [384] Balle

In the paper

“Some works [156, 315, 247] begin to explore this area in the context of differential privacy”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [156] Kohavi
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [315] Goldwasser
• Not checked yetcites [247] 2020

In the paper

“Unfortunately, TEEs may not be generally available across clients, especially when those clients are end-user devices such as smartphones.”

In the paper

“The first is the requirement of a trusted intermediary”

In the paper

“Note that these concerns can also apply in the context of TEEs.”

In the paper

“In particular, clients do not have a clear way of establishing secure channels among themselves independent of the server.”

In the paper

“For example, na¨ ıvely attempting to use homomorphic encryption would require the decryption keys to be on device where the inferences are to be used, thereby undermining the value of the encryption in the first place.”

In the paper

“Part of this difficulty is attributed to the fact that the magnitude of the random noise introduced must be comparable to the magnitude of the signal in the data, which may require combining reports between clients.”

In the paper

“it assumes a semi-honest server (only in the private key infrastructure phase)”

In the paper

“The shuffle model enables users' locally-added noise to be amplified through a shuffling intermediary”

In the paper

“It is harder to adapt MPC strategies to this use case without forgoing the advantages offered by on-device inference: if the user data, model parameters, and inference results are all intended to be on-device, then it is unclear what additional party is participating in the multi-party computation.”

In the paper

“it is not efficient for sparse vector aggregation”

In the paper

“it lacks the ability to enforce well-formedness of client inputs”

In the paper

“Beyond trusting the server to facilitate private communication channels, the participants in cross-device FL must also trust the server to form cohorts of clients in a fair and honest manner.”

In the paper

“Either way, the adversary could control far more participants in a round of FL than would be expected simply from a base rate of adversarial devices in the population.”

In the paper

“Even if the security of protocol itself remains intact (for example, if its security is rooted in a different source of trust, such as a secure enclave), there is a risk that if a large number of adversarial clients' model updates are known to or controlled by the adversary, then the privacy of the remaining clients' updates may be undermined.”

In the paper

“the recent work of [207] shows that multi-message shuffling is not needed to achieve central DP accuracy with low communication cost.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [207] Abadi

In the paper

“Since this number isn't known to the users or the curator, it introduces uncertainty into the true level of privacy that users are receiving.”

In the paper

“the number of dropped out clients becomes a bottleneck when increasing the number of clients that participate in a secure aggregation round.”

In the paper

“Many scenarios arise in which each client may have local data that is only relevant to a relatively small portion of the full model being trained.”

In the paper

“Alternatively, in the cross-silo federated setting in Table 1, most clients participate in each round. Therefore, adversaries may be more likely to have the capability to attack every round of cross-silo federated learning systems than they are to attack every round of cross-device settings.”

In the paper

“in the distributed setting of DP, due to finite precision issues associated with practical implementations of secure shuffling and secure aggregation, the Gaussian mechanism cannot be used.”

In the paper

“If an adversary can compromise the aggregator, then they can easily perform both targeted and untargeted attacks on the trained model [319].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [319] Schnorr

In the paper

“Thus, an adversary limited to a single client may only be able to inject a poisoned update a limited number of times.”

In the paper

“noise is often added to all elements of the vector, even those that are zero; as a result, adding this noise on each client would transform an otherwise sparse model update (i.e. non-zero only on the submodel) into a dense privatized model update (non-zero almost everywhere with high probability).”

In the paper

“Bagdasaryan et al. [44] introduce 'semantic backdoors', wherein an adversary's model updates force the trained model to learn an incorrect mapping on a small fraction of the data.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [44] Tang

In the paper

“If the Byzantine clients have white-box access to the model or non-Byzantine client updates, they may be able to tailor their output to have similar variance and magnitude as the correct model updates, making them difficult to detect.”

In the paper

“Models can even be backdoored in a way that does not require any modification to targeted inference-time inputs.”

In the paper

“In contrast, a malicious user with the ability to continuously participate in the federated setting could launch a poisoning attack throughout model training, where the user adaptively modifies training data or model updates as the training progresses.”

In the paper

“clients dropping out could lead too little noise being added to meet the differential privacy epsilon target.”

In the paper

“The federated setting shares a training-time poisoning attack vector with datacenter multi-machine learning: the model update sent from remote workers back to the shared model.”

In the paper

“Targeted model update poisoning attacks may require fewer adversaries than untargeted attacks by focusing on a narrower desired outcome for the adversary.”

In the paper

“Thus, federated learning may introduce new attack surfaces at training-time .”

In the paper

“the existing works in this space have resorted to noise distributions that are of a discrete nature (e.g. adding Bernoulli or binomial noise).”

In the paper

“When more clients report, however, this leads to excess noise”

In the paper

“Despite this, Fang et al. [183] recently showed that multiple Byzantine-resilient defenses did little to defend against model poisoning attacks in federated learning.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [183] Han

In the paper

“the different characteristics of the federated learning setting affect an adversary's capabilities.”

In the paper

“adversaries can construct malicious updates that achieve the exact desired effect, ignoring the prescribed client loss function or training scheme.”