Advances and Open Problems in Federated Learning

In the paper

“A similar scheme is used by Xie et al. [485] to design a variant of local SGD in which clients locally perform Adagrad [335, 161].”

What the sources say

• Disputed

  The Cluster Primal Dual Splitting section (page unavailable) says the authors propose cPDS for decentralized sparse-SVM learning, and Algorithm 1 specifies primal and dual updates. That is a different method from the attributed local-SGD variant with client-side Adagrad; searches for those terms found no supporting passage. (LLM, conf=0.87)

  Checked by a reasoning model — may be wrong.

  cites [485] Brisimi, 2018, Federated learning of predictive models from federated electronic health records, Int. J. Med. Informat. sourceExperimental — accuracy not yet measured

In the paper

“Notably, Smith et al. [424] introduced the MOCHA algorithm for multi-task federated learning, directly tackling challenges of communication efficiency, stragglers, and fault tolerance.”

What the sources say

• Disputed

  The Abstract (p. 1) identifies the framework introduced in this paper as DETOX, not MOCHA. The Conclusion (p. 11) says federated-learning variants of DETOX are a future goal, contrary to attributing an introduced federated-learning algorithm to this source. Searches for MOCHA, Smith, stragglers, and communication efficiency yielded no supporting passage. (LLM, conf=0.89)

  Checked by a reasoning model — may be wrong.

  cites [424] Rajput, 2019, DETOX: A redundancy-based framework for faster and more robust gradient aggregation sourceExperimental — accuracy not yet measured

In the paper

“The impact of (b) on convergence in general has not been studied until very recently; an analysis is presented in [123].”

What the sources say

• Disputed

  The Related Work section (p. 4) says the benefits of compression for methods that average model parameters remain unclear and identifies combining SlowMo with compression as future work. Although the paper analyzes SlowMo’s convergence, it does not present the attributed analysis of model broadcast compression. (LLM, conf=0.88)

  Checked by a reasoning model — may be wrong.

  cites [123] Wang, 2019, SlowMo: Improving communication-efficient distributed SGD with slow momentum sourceExperimental — accuracy not yet measured

In the paper

“In image and audio domains, adversarial examples are generally constructed by adding norm-bounded perturbations to test examples, though more recent works explore other distortions [176, 477, 259].”

What the sources say

• ?Could not verify

  Section 6 (p. 7) discusses generative adversarial networks for producing images, not adversarial examples made by perturbing test inputs. Searches for norm-bounded perturbations, audio adversarial examples, and other distortions found no passage addressing the claim in our copy. (LLM, conf=0.76)

  cites [176] S. Augenstein , H. B.McMahan, D.Ramage, S.Ramaswamy, P.Kairouz, M.Chen, R.Mathews, and B. A.y Arcas, Generative models for effective ML on private, decentralized datasets, 2019. [Online]. Available: https://arxiv.org/abs/1911.06679. sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 2.3 discusses noise added to computed quantities for differential privacy, and Section 3 describes perturbing statistics used in fair classification. Neither addresses adversarial examples or norm-bounded changes to image or audio test examples; searches for those terms and for other distortions found no relevant passage. Page numbers were unavailable in our copy. (LLM, conf=0.78)

  cites [477] Jagielski, 2018, Differentially private fair learning, CoRR sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [259] Van Bulck

In the paper

“Agrawal and Srikant [11] and Vaidya et al. [457] are early examples of work that sought to learn from local data using a centralized server while preserving privacy.”

What the sources say

• ?Could not verify

  Section 4 (p. 3) describes learning from data kept on client devices while a server aggregates updates, but it does not discuss Agrawal and Srikant or Vaidya et al. Searches for those names and for early privacy-preserving work found no passage identifying their studies as early examples. The printed sentence cites [11] and [457], not an identifiable reference to the Hard et al. paper supplied here. (LLM, conf=0.77)

  cites [11] Hard, 2018, Federated learning for mobile keyboard prediction sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [457] Ma

In the paper

“The growing demand for federated learning technology has resulted in a number of tools and frameworks becoming available. These include TensorFlow Federated [38], Federated AI Technology Enabler [33], PySyft [399], Leaf [35], PaddleFL [36] and Clara Training Framework [125]; more details in Appendix A.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [38] Assran
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [33] Dean
• Partly supported

  Section 3 (p. 3) identifies OpenMined and decentralizedML as providers of open-source software for federated learning, supporting the availability of tools. It does not say that growing demand caused those tools to become available, or identify PySyft by name. (LLM, conf=0.78)

  cites [399] Bagdasaryan, 2018, How to backdoor federated learning sourceExperimental — accuracy not yet measured

In the paper

“Cross-device federated learning and federated data analysis are now being applied in consumer digital products.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [376] Duchi
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [222] Araki
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [491] Hardt
• ?Could not verify

  The Concluding Remarks (p. 19) mention federated learning only as a framework for future work. Searches for “federated data analysis,” “cross-device,” and consumer-product applications found no passage in our copy saying these methods are being applied in consumer digital products. (LLM, conf=0.76)

  cites [112] Dutta sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [383] Chen
• Partly supported

  The Introduction and Conclusion describe federated learning used to train and deploy a model for Gboard, a consumer product, with training performed on devices. The paper does not establish that federated data analysis, as distinct from model training and evaluation, is being applied in consumer products. (LLM, conf=0.86)

  cites [14] Yang, 2018, Applied federated learning: Improving Google keyboard query suggestions sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Abstract (p. 1) and Introduction (p. 1) discuss training-set attacks on machine learners, not federated learning or federated data analysis. Searches for cross-device federated learning and consumer-product deployment found no passage in our copy addressing the claim. (LLM, conf=0.76)

  cites [439] Mei sourceExperimental — accuracy not yet measured

In the paper

“Google makes extensive use of federated learning in the Gboard mobile keyboard [376, 222, 491, 112, 383], as well as in features on Pixel phones [14] and in Android Messages [439].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [376] Duchi
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [222] Araki
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [491] Hardt
• ?Could not verify

  The citation is attached to the Gboard portion of the sentence, not the separate Pixel or Android Messages claims. The Introduction (p. 2) mentions Google’s DistBelief system, and the References (p. 24) list federated-learning papers, but neither passage addresses Google’s use of federated learning in Gboard. Searches for Gboard, mobile keyboard, and Google federated learning found no supporting passage in our copy. (LLM, conf=0.76)

  cites [112] Dutta sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [383] Chen
• Supported

  The citation is attached to the Gboard portion of the sentence, not the Pixel phones or Android Messages portions. The Introduction describes a commercial, global-scale federated-learning deployment for Gboard query suggestions and also notes its use for next-word prediction; the Conclusion confirms the query-suggestion model was deployed in production. (LLM, conf=0.90)

  cites [14] Yang, 2018, Applied federated learning: Improving Google keyboard query suggestions source
• ?Could not verify

  The Abstract (p. 1) describes training-set attacks, and “Training-Set Attacks and Machine Teaching” (p. 3) discusses designing training data to influence a learner. Searches for Gboard, Google’s mobile keyboard, and federated learning found no passage addressing their use together. This citation is attached to the Gboard portion of the sentence, not the Pixel or Android Messages portions. (LLM, conf=0.78)

  cites [439] Mei sourceExperimental — accuracy not yet measured

In the paper

“Cross-silo applications have also been proposed or described in myriad domains including finance risk prediction for reinsurance [476], pharmaceuticals discovery [179], electronic health records mining [184], medical data segmentation [15, 139], and smart manufacturing [354].”

What the sources say

• ?Not checked — no full text of the sourcecites [476] Cummings source
• ?Could not verify

  The citation’s placement attaches this source to medical data segmentation, not to every domain in the list. The Introduction (p. 1) concerns learning distributions under communication constraints, and Applications to Common Statistical Models (p. 4) discusses Gaussian estimation; neither describes medical data segmentation. Searches for medical segmentation and the other listed applications found no relevant passage in our copy. (LLM, conf=0.77)

  cites [179] Barnes, 2020, Lower bounds for learning distributions under communication constraints via Fisher information, J. Mach. Learn. Res. sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [184] Alistarh

In the paper

“fully decentralized variants of SGD and other optimization algorithms have recently been considered in machine learning both for improved scalability in datacenters [29] as well as for decentralized networks of devices [127, 459, 443, 59, 278, 291, 173].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [29] The Leaf Authors , Leaf, 2019. [Online]. Available: https://leaf.cmu.edu/.
• Partly supported

  “Handling Big Data” (p. 15) says training data can reside on different devices and describes distributed multi-task learning algorithms, supporting the device-network part of the citation. “MTL with Other Learning Paradigms” (p. 13) also mentions a decentralized solver. Neither passage establishes that fully decentralized variants of SGD are used for those device networks; the datacenter clause is attached to a different citation. (LLM, conf=0.83)

  cites [127] Zhang, 2017, A survey on multi-task learning, CoRR sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Architecture section says PixelDP training can use an optimizer such as stochastic gradient descent, but does not discuss fully decentralized SGD. Searches for decentralized device networks, distributed optimization, and datacenter scalability found no passage addressing the attributed claim; page numbers were unavailable in our copy. (LLM, conf=0.76)

  cites [459] Lécuyer sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Experiments section (p. 4) describes synchronous distributed training on 50 machines, not a fully decentralized optimization method. Searches for decentralized SGD, datacenter scalability, and networks of devices found no passage addressing the attributed claim. (LLM, conf=0.76)

  cites [443] Kurakin, 2016, Adversarial machine learning at scale sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [59] Wood, 2014, Ethereum: A secure decentralised generalised transaction ledger, Ethereum Project Yellow Paper
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [278] Gentry
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [291] Dwork
• ?Could not verify

  The Introduction (p. 1) and Related Works (p. 9) discuss gradient-based neural architecture search, not decentralized optimization. Searches for decentralized SGD, device networks, distributed training, and datacenter scalability found no passage in our copy addressing the attributed claim. (LLM, conf=0.77)

  cites [173] Xie, 2018, SNAS: Stochastic neural architecture search sourceExperimental — accuracy not yet measured

In the paper

“Bonawitz et al. [81] provides even more detail for a particular production system, including a discussion of specific architectural choices and considerations.”

What the sources say

• ?Could not verify

  The Abstract (p. 1) describes a comparison of split and federated learning communication efficiency, and the Analysis (p. 3) discusses illustrative use cases. Searches for Bonawitz and for a production system’s architecture found no passage addressing the attributed claim. (LLM, conf=0.76)

  cites [81] Singh, 2019, Detailed comparison of communication efficiency of split learning and federated learning sourceExperimental — accuracy not yet measured

In the paper

“[238, 318] study the security and privacy related challenges inherent in such systems.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [238] Gentry
• ?Could not verify

  Section 2.1 (p. 2) discusses private inputs to verifiable computation, and Related Work (p. 12) discusses cryptographic proof systems. Neither addresses security or privacy challenges inherent in feature-partitioned systems. Searches for feature partitioning, vertical partitioning, and privacy across parties found no passage on that point. (LLM, conf=0.76)

  cites [318] Parno, 2016, Pinocchio: Nearly practical verifiable computation, Commun. ACM sourceExperimental — accuracy not yet measured

In the paper

“Federated transfer learning [490] is another concept that considers challenging scenarios in which data parties share only a partial overlap in the user space or the feature space, and leverage existing transfer learning techniques [365] to build models collaboratively.”

What the sources say

• ?Could not verify

  The Introduction (p. 1) discusses individual and group fairness, while Related Work (p. 14) discusses fairness metrics and limited access to sensitive attributes. Searches for federated transfer learning, partial overlap in user or feature space, and collaborative model building found no passage addressing the claim. The References (p. 15) list a work on fair transfer learning, but that does not establish the claimed description. (LLM, conf=0.76)

  cites [490] Awasthi, 2020, Beyond individual and group fairness, CoRR sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [365] Jagielski

In the paper

“Other platforms include [125] focused on a range of medical applications and [321] for enterprise use cases.”

What the sources say

• ?Could not verify

  The paper’s opening section (p. 1) describes DJAM as an algorithm for learning personalized models, and its applications discussion (p. 1) lists recommender systems, classification, opinion propagation, and field estimation. Searches for medical applications and enterprise platforms found no passage addressing either kind of platform. (LLM, conf=0.76)

  cites [125] Almeida, 2018, DJAM: Distributed Jacobi asynchronous method for learning personal models, IEEE Signal Process. Lett. sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [321] Bitansky source

In the paper

“For instance, different banks can collaboratively train classification or anomaly detection models for fraud detection [476], hospitals can build better diagnostic models [139], and so on.”

What the sources say

• ?Not checked — no full text of the sourcecites [476] Cummings source
• ?Could not verify

  Citation [476] is attached to the claim about banks collaborating on fraud-detection models; the hospital claim has a different citation. The Introduction (p. 1) describes federated training across devices, but our copy does not address banks, fraud detection, or anomaly detection (searched those terms and related financial terms). (LLM, conf=0.75)

  cites [139] Jiang, 2019, Improving federated learning personalization via model agnostic meta learning sourceExperimental — accuracy not yet measured

In the paper

“A variation of split learning called NoPeek SplitNN [462] reduces the potential leakage via communicated activations, by reducing their distance correlation [461, 442] with the raw data, while maintaining good model performance via categorical cross-entropy.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [462] Natarajan
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [461] Mnih
• ?Could not verify

  The Preliminaries (p. 3) define Wasserstein distance for transporting mass between images, and Background and Related Work (p. 2) discusses its use in adversarial attacks. Searches for NoPeek SplitNN and distance correlation found no passage about communicated activations, leakage reduction, or the claimed performance trade-off. (LLM, conf=0.77)

  cites [442] Wong, 2019, Wasserstein adversarial examples via projected sinkhorn iterations sourceExperimental — accuracy not yet measured

In the paper

“This completes a round of forward propagation without sharing the raw data.”

What the sources say

• Partly supported

  The Problem formulation (p. 4) says users share local models with neighbors without sharing private data. The Algorithm description (p. 5) describes an iteration involving model exchange, gradient computation, and an update, but does not identify it as a round of forward propagation. (LLM, conf=0.85)

  cites [215] Zhao, 2019, Decentralized online learning: Take benefits from others’ data without sharing your own to track global trend sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [460] Srinathan

In the paper

“This process is continued until convergence, without having clients directly access each others raw data.”

What the sources say

• Partly supported

  The Problem formulation (p. 4) says users cooperate without sharing private data, and the Algorithm description (p. 5) says they exchange local models. But Algorithm 1 (p. 4) runs for a specified number of iterations, T; it does not say the process continues until convergence. (LLM, conf=0.89)

  cites [215] Zhao, 2019, Decentralized online learning: Take benefits from others’ data without sharing your own to track global trend sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [460] Srinathan

In the paper

“Comparing these two results, we see that minibatch SGD attains the optimal 'statistical' term ( σ / √ TKM ), whilst SGD on a single device (ignoring the updates of the other devices) achieves the optimal 'optimization' term ( H / ( TK ) 2 ).”

What the sources say

• ?Could not verify

  The paper’s discussion of statistical-query and local private learning (sections 1.1 and 5.1, pp. 3, 20–22) does not address the claimed comparison between minibatch SGD and single-device SGD. Searches for the two methods and their stated statistical and optimization terms found no passage supporting the claim. (LLM, conf=0.75)

  cites [294] Kasiviswanathan, 2011, What can we learn privately?, SIAM J. Comput. sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 3 (p. 4) mentions distributed optimization, but gives no comparison of minibatch SGD with single-device SGD. Section 5.1 (pp. 5–7) analyzes meta-learning updates, not the claimed statistical and optimization terms. Searches for those terms and the stated rates found no supporting passage in our copy. (LLM, conf=0.75)

  cites [137] Nichol, 2018, On first-order meta-learning algorithms sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [151] Schnell source

In the paper

“This can be done for both training and inference.”

What the sources say

• ?Could not verify

  The Problem formulation (p. 4) describes decentralized online learners making predictions and receiving losses, while the Conclusion (p. 9) discusses sharing models rather than data. Neither passage addresses split learning or whether it can be used for both training and inference; searches for those terms found no relevant passage. (LLM, conf=0.76)

  cites [215] Zhao, 2019, Decentralized online learning: Take benefits from others’ data without sharing your own to track global trend sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [460] Srinathan

In the paper

“Bounded gradient variance, which is a widely used assumption to analyze stochastic gradient methods, is often used when clients use stochastic local updates [305, 303, 304, 469, 265].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [305] Chen
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [303] Erlingsson
• ?Could not verify

  Section 5.3 (pp. 22–23) discusses the variance of privacy-amplification random variables, not gradient variance. Searches for bounded gradient variance, stochastic gradient methods, and stochastic local updates found no passage addressing the attributed assumption. (LLM, conf=0.76)

  cites [304] Balle sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section 3.1 (p. 3) describes clients performing local SGD, and Section 3.3 (p. 5) describes local stochastic updates. Neither states that bounded gradient variance is assumed or commonly used for their analysis. Searches for “bounded gradient variance,” “variance,” and related assumptions found discussion of variance in device accuracies, not stochastic gradients. (LLM, conf=0.75)

  cites [469] Li, 2019, Fair resource allocation in federated learning sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [265] Shi

In the paper

“One other engineering driven approach to minimize the amount of information communicated in split learning has been via a specifically learnt pruning of channels present in the client side activations [422].”

What the sources say

• ?Could not verify

  The Introduction (pp. 1–2) describes federated learning in which clients send local models to a master device, and §3.1 (p. 5) concerns poisoning those models. Searches for split learning, client-side activations, channel pruning, and communication reduction found no passage addressing the claimed approach. (LLM, conf=0.75)

  cites [422] Fang, 2019, Local model poisoning attacks to Byzantine-robust federated learning sourceExperimental — accuracy not yet measured

In the paper

“MATCHA [469] further improves the performance of PD-SGD by randomly sampling clients for computation and communication, and provides a convergence analysis showing that local updates can accelerate convergence.”

What the sources say

• Partly supported

  Section 4.4 (p. 9) reports that local updates made q-FedAvg converge faster than q-FedSGD in communication rounds in most cases, and Algorithm 1 (p. 6) randomly selects devices for q-FedSGD. The paper does not identify MATCHA or PD-SGD, show that MATCHA improves PD-SGD, or provide the claimed convergence analysis for MATCHA. (LLM, conf=0.84)

  cites [469] Li, 2019, Fair resource allocation in federated learning sourceExperimental — accuracy not yet measured

In the paper

“Reddi et al. [389] instead proposes using adaptive learning rates at the server-level, developing federated versions of adaptive optimization methods with the same communication cost as FedAvg.”

What the sources say

• ?Could not verify

  The References list names Reddi et al.’s “Adaptive federated optimization,” but does not describe its methods or communication cost. Section 5.2.3 Setup discusses this paper’s own FedAvg experiments and server learning-rate settings; it does not state that Reddi et al. developed server-level adaptive methods with the same communication cost as FedAvg. Searches for those terms found no supporting passage in our copy. (LLM, conf=0.76)

  cites [389] Kairouz, 2021, The distributed discrete gaussian mechanism for federated learning with secure aggregation sourceExperimental — accuracy not yet measured

In the paper

“This algorithm is extended by Li et al. [304] to the non-IID case.”

What the sources say

• ?Could not verify

  Section 4.2.1 (p. 13) discusses an i.i.d. assumption for a lower bound on summation protocols, not an extension of PD-SGD. Searches for PD-SGD, Li et al., and a non-IID stochastic-gradient extension found no passage addressing the attributed claim. (LLM, conf=0.76)

  cites [304] Balle sourceExperimental — accuracy not yet measured

In the paper

“Chai Sim et al. [102] applied local fine tuning to personalize speech recognition models in federated learning.”

What the sources say

• ?Could not verify

  The Related Work section (p. 3) discusses local SGD in federated learning, while Experiments (p. 7) describes logistic-regression tests on LIBSVM datasets. Searches for Chai Sim, speech recognition, and local fine-tuning found no passage about personalizing speech-recognition models. Our copy therefore does not substantiate the attributed claim. (LLM, conf=0.76)

  cites [102] A. Khaled , K.Mishchenko, and P.Richtárik, Better communication complexity for local SGD, 2019. [Online]. Available: https://arxiv.org/abs/1909.04746. sourceExperimental — accuracy not yet measured

In the paper

“When local datasets are small and the data is IID, FL clearly has an edge, and indeed, real-world applications of federated learning [491, 222, 112] benefit from training a single model across devices.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [491] Hardt
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [222] Araki
• ?Could not verify

  The Introduction (p. 1) discusses distributed SGD across worker nodes, but does not assess federated learning when local datasets are small. The Concluding Remarks (p. 19) mention federated learning only as future work. Searches for small IID local datasets and real-world federated-learning applications found no passage supporting the attributed benefits. (LLM, conf=0.74)

  cites [112] Dutta sourceExperimental — accuracy not yet measured

In the paper

“Such hyperparameters can be crucial to obtaining a good trade-off between accuracy and convergence, and may actually impact the quality of the learned model [106].”

What the sources say

• Supported

  The Preliminaries (p. 4) describe how the number of local steps affects the trade-off between communication and optimization error. Section 4 (p. 7) shows that choices of K and R change convergence rates and worst-case error, while Future Work (p. 9) describes tuning the stepsize to minimize training loss. Together, these support the claim that such hyperparameters can affect convergence and the quality of the resulting model. (LLM, conf=0.86)

  cites [106] Woodworth, 2020, Is local SGD better than minibatch SGD? source

In the paper

“Recently, a class of algorithms referred to as model-agnostic meta-learning (MAML) have been developed that meta-learn a global model, which can be used as a starting point for learning a good model adapted to a given task, using only a few local gradient steps [187].”

What the sources say

• ?Could not verify

  Section 1.1 discusses aggregating stochastic gradients in distributed learning, not meta-learning a model for task adaptation. Searches for MAML, a learned starting point, and adaptation in a few gradient steps found no passage addressing the claim; page numbers were not available in our copy. (LLM, conf=0.77)

  cites [187] Konečný, 2018, Randomized distributed mean estimation: Accuracy vs. communication, Frontiers in Applied Mathematics and Statistics sourceExperimental — accuracy not yet measured

In the paper

“In nonfederated learning, researchers often use fine-tuning, transfer learning, domain adaptation [329, 132, 61, 332, 133], or interpolation with a personal local model.”

What the sources say

• ?Could not verify

  The paper’s Related work section (p. 2) discusses cryptographic polynomial commitments, not domain adaptation. Searches for fine-tuning, transfer learning, domain adaptation, and personal local models found no passage addressing the cited claim. (LLM, conf=0.78)

  cites [329] Wahby sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [132] Cortes, 2020, Multiple-source adaptation with domain classifiers
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [61] Cheng
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [332] Tramèr
• Supported

  The citation is attached to “domain adaptation” in a list of nonfederated learning approaches. The Introduction (p. 1) identifies domain adaptation as the paper’s main topic, and Learning Set-Up (p. 2) describes learning from a source distribution for use on a target distribution. The paper therefore supports the citation as an example of domain-adaptation research; it need not address the other approaches in the list. (LLM, conf=0.92)

  cites [133] Mansour, 2009, Domain adaptation: Learning bounds and algorithms source

In the paper

“Khodak et al. [270] and Jiang et al. [250] explore the connection between FL and MAML, and show how the MAML setting is a relevant framework to model the personalization objectives for FL.”

What the sources say

• ?Could not verify

  Our copy of Riffle discusses anonymity systems in Background and Related Work and its own system in Models and Assumptions, not federated learning or MAML. Searches for MAML, federated learning, and personalization found no passage addressing the attributed claim. The citing sentence names Khodak et al. and Jiang et al., but our copy does not identify either work as the source of that point. (LLM, conf=0.78)

  cites [270] Kwon, 2016, Riffle, Proceedings on Privacy Enhancing Technologies sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [250] Reyzin, 2018, Turning HATE into LOVE: Homomorphic ad hoc threshold encryption for scalable MPC, IACR Cryptology ePrint Archive

In the paper

“Hyperparameter optimization (HPO) has a long history under the framework of AutoML [395, 273, 277], but it mainly concerns how to improve the model accuracy [64, 426, 374, 180] rather than communication and computing efficacy for mobile devices.”

What the sources say

• ?Not checked — no full text of the sourcecites [395] Abowd, 2019, An economic analysis of privacy protection and statistical accuracy as social choices, Am. Econ. Rev. source
• ?Could not verify

  The Introduction and §2.4 (pages not supplied) discuss private information retrieval, including its communication and computational complexity. Searches for hyperparameter optimization, AutoML, model accuracy, and mobile devices found no passage addressing what HPO mainly concerns. The paper’s focus on communication complexity does not, by itself, contradict a claim about HPO. (LLM, conf=0.76)

  cites [273] Chor, 1998, Private information retrieval, J. ACM sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [277] Angel
• ?Could not verify

  The Introduction (pp. 1–2) and Preliminaries and Related Work (p. 2) discuss federated learning and mobile terminals, not the history or objectives of hyperparameter optimization under AutoML. Searches for HPO, model accuracy, and communication or computing efficiency for mobile devices found no passage addressing that comparison. (LLM, conf=0.72)

  cites [64] Cheng, 2019, Se-cureBoost: A lossless federated learning framework, CoRR sourceExperimental — accuracy not yet measured
• ?Could not verify

  The cited paper discusses accuracy in the context of backdoor attacks and defenses (Section 4, p. 6; Appendix A.1, p. 10). Searches for hyperparameter optimization and AutoML found no passage addressing whether HPO primarily targets model accuracy rather than communication or computing efficiency on mobile devices. (LLM, conf=0.76)

  cites [426] Chen, 2020, Backdoor attacks on federated meta-learning sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [374] Bassily, 2020, Practical locally private heavy hitters, J. Mach. Learn. Res.
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [180] Braverman

In the paper

“Independently of the eventual technical levy of carrying out record linkage privately [407], the task itself happens to be substantially noise prone in the real world [406] and only sparse results have addressed its impact on training models [224].”

What the sources say

• ?Could not verify

  The citation [224] is attached to the claim that few results address how record-linkage errors affect model training. The paper’s Abstract (page not provided) concerns Byzantine faults in distributed learning, not record linkage. Searches for record linkage and erroneous matches found no passage addressing that claim. (LLM, conf=0.76)

  cites [406] Chen, 2017, Distributed statistical machine learning in adversarial settings: Byzantine gradient descent, POMACS sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [224] Bogdanov

In the paper

“Several of these problems relate to previous work on multiple-source adaptation and agnostic federated learning [329, 330, 234, 352].”

What the sources say

• ?Could not verify

  The Related work section (p. 2) discusses cryptographic commitment schemes, while §6.2 (p. 9) discusses sharing witness elements in data-parallel proofs. Searches for “multiple-source adaptation,” “agnostic federated learning,” and related terms found no passage connecting this paper to the cited claim. (LLM, conf=0.76)

  cites [329] Wahby sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [330] Ben-Sasson
• ?Not checked — no full text of the sourcecites [234] Goldreich source
• ?Could not verify

  The Introduction (p. 1) and Conclusions (p. 8) discuss differentially private training and activation functions, not multiple-source adaptation or agnostic federated learning. Searches for both terms found no passage in our copy addressing the claimed relationship. (LLM, conf=0.76)

  cites [352] Papernot, 2020, Tempered sigmoid activations for deep learning with differential privacy sourceExperimental — accuracy not yet measured

In the paper

“Consequently, a wider set of ideas related to error-correction such as [311, 405, 463, 444, 263, 435] are relevant in this setting, many of which could address both (a) and (b).”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [311] Avent
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [405] Blanchard
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [463] Dwork
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [444] Chen
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [263] Chan
• Supported

  The citation is one of several examples offered for a wider set of error-handling ideas, rather than an attribution that Zeno++ itself compresses both gradients and model broadcasts. Section 4.1 (p. 3) describes its method for filtering harmful candidate gradients, supporting its identification as an example of such an idea. (LLM, conf=0.84)

  cites [435] Xie, 2019, Zeno++: Robust asynchronous SGD with arbitrary number of Byzantine workers source

In the paper

“Caldas et al. [95] proposed a practical method by constraining the desired model update such that only particular submatrices of model variables are necessary to be available on clients;”

What the sources say

• ?Could not verify

  The Introduction (p. 1) describes mini-batch gradient updates, and the Preliminaries (p. 3) describe stochastic and accelerated gradient methods. Neither addresses Caldas et al. or a method that limits client access to particular submatrices; searches for those terms and for constrained model updates found no supporting passage in our copy. (LLM, conf=0.76)

  cites [95] Cotter, 2011 sourceExperimental — accuracy not yet measured

In the paper

“Hamer et al. [219] proposed a communication-efficient federated algorithm for learning mixture weights on an ensemble of pre-trained models, based on communicating only a subset of the models to any one device;”

What the sources say

• ?Could not verify

  The passages in §3.2 (Encoder) concern fragmenting user data for privacy, while §5.5 (Flix: Collaborative Filtering) concerns collecting movie-rating statistics. Searches for Hamer’s proposed algorithm and for sending only a subset of models to each device found no passage about learning mixture weights over pre-trained models. (LLM, conf=0.78)

  cites [219] Bittau sourceExperimental — accuracy not yet measured

In the paper

“Much of the existing literature applies to the objective (a) [282, 440, 281, 17, 235, 55].”

What the sources say

• ?Could not verify

  The cited paper’s Discussion (section 6.1; page unavailable) concerns communication costs in private information retrieval, not gradient compression. Searches for “gradient compression” and related optimization terms found no passage addressing the attributed claim. (LLM, conf=0.76)

  cites [282] Patel sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Related Work section (p. 3) discusses adversarial rotations and translations, while Section 3 (p. 4) discusses gradients used to optimize those transformations. Neither passage addresses gradient compression or whether much of the existing literature applies to it (searched: “gradient compression” and related terms). (LLM, conf=0.76)

  cites [440] Engstrom, 2017, A rotation and a translation suffice: Fooling CNNs with simple transformations sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [281] Kadhe source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [17] Apple , Designing for privacy (video and slide deck), Apple WWDC, https://developer.apple.com/videos/play/wwdc2019/708, 2019.
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [235] Nikolaenko
• Supported

  The Introduction (p. 2) describes communication-efficient distributed optimization as an established research area and identifies several existing gradient-compression methods. That supports the citing sentence’s broad point that substantial existing literature addresses gradient compression. (LLM, conf=0.85)

  cites [55] Reisizadeh, 2019, Robust and communication-efficient collaborative learning source

In the paper

“Thanks to both theoretical and engineering breakthroughs, the field has moved from being of a purely theoretical interest to a deployed technology in industry [78, 77, 295, 27, 191, 242, 243].”

What the sources say

• ?Could not verify

  The Related Work section discusses secure computation and notes that some methods are impractical at scale. The Datasets and Implementation section describes the authors’ own protocol, but no passage found says that secure multi-party computation has progressed from theoretical interest to deployment in industry (searched for that transition and industrial applications). Page numbers are unavailable in our copy. (LLM, conf=0.73)

  cites [78] Gupta, 2018, Distributed learning of deep neural network over multiple agents sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Conclusion and §5.3 Implementation Details describe a differentially private tensor-factorization method tested on datasets using AWS instances. Searches for secure multi-party computation and industrial deployment found no passage in our copy addressing the claimed shift from theory to deployed industry technology. (LLM, conf=0.76)

  cites [77] Ma sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [295] Ding

In the paper

“This topic has received a lot of attention in the broader ML community [220, 138, 509, 309, 362, 74], but these methods either do not have a straightforward mapping to federated learning, or make the training process more complex which makes it difficult to adopt.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [220] NSA , Defense in depth: A practical strategy for achieving Information Assurance in today’s highly networked environments, 2012. [Online]. Available: https://apps.nsa.gov/iaarchive/library/ia-guidance/archive/defense-in-depth.cfm.
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [138] Khodak
• ?Not checked — no full text of the sourcecites [509] Annas, 2003, HIPAA regulations - a new era of medical-record privacy?, NEJM source
• Partly supported

  The Related Work section (p. 11) describes substantial research on shuffled differential privacy, supporting the claim that the topic has received attention. The Conclusion (p. 58) says extending the paper’s protocols to sparse SGD updates remains future work, which supports a limited claim about their applicability to ML training. The paper does not establish that the cited methods generally lack a straightforward mapping to federated learning or make training more complex and difficult to adopt. (LLM, conf=0.78)

  cites [309] Ghazi, 2019, On the power of multiple anonymous messages sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [362] Haeberlen
• ?Not checked — no full text of the sourcecites [74] Yu, 2020, A sustainable incentive scheme for federated learning, IEEE Intelligent Systems source

In the paper

“TEEs can provide several crucial facilities for establishing trust that a unit of code has been executed faithfully and privately [437]:”

What the sources say

• ?Could not verify

  The Defenses section discusses trusted training data, not trusted execution environments. Searches for TEE, enclaves, confidentiality, integrity, and attestation found no passage in our copy addressing the claimed facilities; page numbers were not available. (LLM, conf=0.76)

  cites [437] Koh, 2018, Stronger data poisoning attacks break data sanitization defenses sourceExperimental — accuracy not yet measured

In the paper

“We note that several recent works allow biased estimators and would work nicely with Laplacian noise [435], however those would not give differential privacy, as they break independence between rounds.”

What the sources say

• Partly supported

  The Model (p. 3) permits Byzantine workers to submit gradient estimators with arbitrary values, supporting the point that the method can handle biased estimators. Our copy does not discuss Laplacian noise or establish that the method would work well with it. The differential-privacy conclusion follows the citation and is not treated here as a claim attributed to this source. (LLM, conf=0.76)

  cites [435] Xie, 2019, Zeno++: Robust asynchronous SGD with arbitrary number of Byzantine workers sourceExperimental — accuracy not yet measured

In the paper

“However usually in information theory, the compression guarantees are instance specific and depend on the entropy of the underlying distribution [140].”

What the sources say

• ?Could not verify

  Section 3.2.2 discusses a Fisher-information-based regularizer for personalizing speech-recognition models, not information-theoretic compression guarantees. A search for entropy, compression, and distribution-dependent guarantees found no passage in our copy addressing the claim; page numbers were unavailable. (LLM, conf=0.76)

  cites [140] Sim, 2019, Personalization of end-to-end speech recognition on mobile devices for named entities sourceExperimental — accuracy not yet measured

In the paper

“Potential solutions to address this challenge include federated distillation (FD), in which workers exchange their model output parameters (logits) as opposed to the model parameters (gradients and/weights), and optimizing workers' scheduling policy with appropriate communication and computing resources [248, 368, 402].”

What the sources say

• ?Could not verify

  The Applications section (p. 8) discusses computation on confidential distributed datasets, and the Conclusion (p. 9) discusses sharing ciphertexts for collaborative computation. Neither addresses federated distillation, exchanging logits instead of model parameters, or optimizing workers’ scheduling. Searches for those terms in our copy found no supporting passage. (LLM, conf=0.75)

  cites [248] Sathya, 2018, A review of homomorphic encryption libraries for secure computation sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [368] Cummings
• ?Could not verify

  The passages in §4.2 (pp. 5–8) concern adversarial examples and their generalization across neural networks, not federated learning. Searches for federated distillation, workers exchanging logits, and scheduling with communication or computing resources found no passage addressing the attributed solutions. (LLM, conf=0.78)

  cites [402] Szegedy, 2013, Intriguing properties of neural networks sourceExperimental — accuracy not yet measured

In the paper

“There is some work on adding discrete noise [9], but there is no notion whether such methods are optimal.”

What the sources say

• Supported

  The citation supports the first clause: RAPPOR describes adding randomness to binary reports through permanent and instantaneous randomized response (sections 2 and 3; page unavailable). The statement about whether such methods are optimal is the citing authors’ uncited qualification, not a finding attributed to RAPPOR. (LLM, conf=0.88)

  cites [9] Erlingsson source

In the paper

“Succinct non-interactive zero-knowledge proofs (SNARKs) [71] are a type of ZKP that provides constant proof size and verification that depends only on the input size, linearly.”

What the sources say

• ?Could not verify

  Section 4.3 (pp. 11–12) discusses secure multi-party computation and differential privacy, but not SNARKs. Searches for SNARK proof size and zero-knowledge verification found no passage addressing constant proof size or verification time linear in input size. (LLM, conf=0.76)

  cites [71] Ludwig, 2020, IBM federated learning: An enterprise framework white paper V0.1 sourceExperimental — accuracy not yet measured

In the paper

“Most existing SNARK constructions leverage quadratic arithmetic programs [196, 369, 136] and are now available in open-source libraries, such as libsnark [307], and deployed in cryptocurrencies, such as Zcash [62].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [196] Vogels
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [369] Cummings
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [136] Finn
• ?Could not verify

  The Introduction (p. 1) and related-work discussion (pp. 2–3) address differentially private aggregation in the shuffled model, not SNARK constructions. Searches for quadratic arithmetic programs, libsnark, and Zcash found no passage in our copy addressing the attributed claim. (LLM, conf=0.76)

  cites [307] Ghazi, 2019, Scalable and differentially private distributed aggregation in the shuffled model sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [62] McMahan

In the paper

“MPC approaches to PIR break down into two main categories: computational PIR (cPIR), in which a single party can execute the entire server side of the protocol [286], and information theoretic PIR (itPIR), in which multiple non-colluding parties are required to execute the server side of the protocol [121].”

What the sources say

• Partly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [286] Bitar sourceExperimental — accuracy not yet measured
• ?Could not verify

  Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  cites [121] Reddi, 2020, Adaptive federated optimization sourceExperimental — accuracy not yet measured

In the paper

“TEEs have been instantiated in many forms, including Intel's SGX-enabled CPUs [241, 134], Arm's TrustZone [28, 22], and Sanctum on RISC-V [135], each varying in its ability to systematically offer the above facilities.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [241] Brakerski
• ?Could not verify

  Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  cites [134] Mansour, 2020, A theory of multiple-source adaptation with limited target labeled data sourceExperimental — accuracy not yet measured
• ?Could not verify

  Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

  cites [28] Ryffel, 2018, A generic framework for privacy preserving deep learning sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [22] Feature Cloud , Feature Cloud: Our vision, 2019. [Online]. Available: https://featurecloud.eu/about/our-vision/. Retrieved Aug. 2019.
• ?Not checked — no full text of the sourcecites [135] Baxter, 2000, A model of inductive bias learning, J. Artif. Intell. Res. source

In the paper

“LDP has been deployed effectively to gather statistics on popular items across large userbases by Google, Apple and Microsoft [177, 154, 155].”

What the sources say

• ?Could not verify

  The Introduction (p. 1) discusses federated learning on user devices, and Experiments (p. 4) describes simulations using Reddit data. Searches for local differential privacy, popular-item statistics, and deployment by Google, Apple, or Microsoft found no passage in our copy addressing the attributed claim. (LLM, conf=0.76)

  cites [177] Konečný, 2016, Federated learning: Strategies for improving communication efficiency sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [154] Patrini
• ?Not checked — no full text of the sourcecites [155] King, 1995, StatLog: Comparison of classification algorithms on large real-world problems, Appl. Artif. Intell. source

In the paper

“The state-of-the-art model for quantifying and limiting information disclosure about individuals is differential privacy (DP) [167, 164, 165]”

What the sources say

• ?Could not verify

  The abstract (p. 1) and Section 2 (p. 2) describe differentiable neural architecture search, not differential privacy. Searches for “differential privacy,” “information disclosure,” and “privacy” found no passage in our copy addressing the attributed claim. (LLM, conf=0.77)

  cites [167] Liu, 2018, DARTS: Differentiable architecture search sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [164] Thakkar, 2019, Differentially private learning with adaptive clipping
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [165] Bello

In the paper

“shuffling models of differential privacy can use broader classes of local randomizers, and can even select these local randomizers adaptively [178]”

What the sources say

• ?Could not verify

  The Introduction (pp. 3–5) describes locally differentially private channels and randomized channel selection by players, but does not discuss a shuffling model. Searches for shuffling and adaptive selection found no passage addressing whether shuffling permits broader classes of local randomizers or their adaptive selection. (LLM, conf=0.76)

  cites [178] Acharya, 2020, Inference under information constraints I: Lower bounds from chi-square contraction, IEEE Trans. Inform. Theor. sourceExperimental — accuracy not yet measured

In the paper

“This can enable differentially private protocols with far smaller error than what is possible in the local model, while relying on weaker trust assumptions than in the central model, e.g., [120, 178, 45, 201, 204, 200, 202, 203, 110].”

What the sources say

• ?Could not verify

  The Introduction (p. 1) discusses adaptive regret bounds, and Related work (p. 16) discusses online convex optimization. Searches for shuffling, differential privacy, local and central models, and trust assumptions found no passage addressing the claimed error or trust comparison. (LLM, conf=0.76)

  cites [120] McMahan, 2010, Adaptive bound optimization for online convex optimization sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Introduction (p. 3) defines locally differentially private channels, and the Summary of our techniques (p. 11) discusses bounds under LDP constraints. Neither passage addresses shuffling, its error relative to the local model, or its trust assumptions relative to the central model; searches for those terms found no supporting passage in our copy. (LLM, conf=0.74)

  cites [178] Acharya, 2020, Inference under information constraints I: Lower bounds from chi-square contraction, IEEE Trans. Inform. Theor. sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Introduction (p. 1) describes decentralized exchange of local models under single-sided trust, and Privacy Protection (p. 6) discusses potential reductions in privacy leakage. Neither passage addresses model shuffling, differentially private protocols, or an error comparison with the local model; searches for those terms found no supporting passage in our copy. (LLM, conf=0.75)

  cites [45] He, 2019, Central server free federated learning over single-sided trust social networks sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [201] Oktay, 2019, Model compression by entropy penalized reparameterization
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [204] Wu
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [200] Lin
• ?Could not verify

  The Discussion (p. 9) concerns neural-network pruning, compression, and accuracy, not privacy protocols. Searches for shuffling, differential privacy, and the local and central models found no passage addressing the claimed error or trust-assumption comparison. (LLM, conf=0.78)

  cites [202] Zhu, 2017, To prune, or not to prune: Exploring the efficacy of pruning for model compression sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [203] Cover, 2012
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [110] Wang

In the paper

“Privacy and security protocols are notoriously difficult to implement correctly (e.g., [345, 217] for differential privacy).”

What the sources say

• Supported

  The citation offers differential privacy as an example of a protocol that is difficult to implement correctly. The Introduction (p. 2) says privacy calculations must be isolated and well tested to prevent bugs from producing errors in the privacy guarantee; Section 8 (p. 6) describes the high burden of implementation and leaves a provable floating-point implementation of DP-SGD as an open task. (LLM, conf=0.88)

  cites [345] McMahan, 2018, A general approach to adding differential privacy to iterative training procedures source
• ?Could not verify

  The Introduction (p. 1) says privacy concerns restrict sharing raw data in decentralized learning, but it does not discuss whether privacy or security protocols are difficult to implement correctly. Searches for implementation difficulty and differential privacy found no passage addressing that claim. (LLM, conf=0.76)

  cites [217] Lalitha, 2019, Decentralized Bayesian learning over graphs sourceExperimental — accuracy not yet measured

In the paper

“While recent works [47, 257] suggest that these constraints can be simultaneously achieved”

What the sources say

• Partly supported

  The Abstract (p. 1) and Problem Setup (p. 4) support robustness to dropped network messages during distributed learning, not to users becoming unavailable or dropping out. They do not support self-accounting, local participation decisions, or a privacy–utility trade-off, let alone achieving all these constraints simultaneously. (LLM, conf=0.85)

  cites [47] Yu, 2018, Distributed learning over unreliable networks sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [257] Costan

In the paper

“Prior work has explored a number of avenues to mitigate this trade-off between privacy and accuracy, including collecting more private data [338], designing privacy-friendly model architectures [367], or leveraging priors on the private data domain [449].”

What the sources say

• ?Could not verify

  The citation [338] is attached to “collecting more private data,” not to the other strategies in the sentence. Section 8 (p. 12) discusses the privacy–utility trade-off and recommends filtering sensitive content from training data, but does not describe collecting more private data to mitigate that trade-off. Searches for that strategy and for using larger datasets found no supporting passage. (LLM, conf=0.73)

  cites [338] Carlini, 2020, Extracting training data from large language models sourceExperimental — accuracy not yet measured
• ?Could not verify

  The citation [367] is attached to “designing privacy-friendly model architectures.” The introduction (p. 1) discusses encrypted neural-network inference, while the abstract and conclusion (pp. 1, 13) describe HEAX as hardware for accelerating homomorphic encryption. Our copy does not describe designing a machine-learning model architecture to mitigate a privacy–accuracy trade-off; searches for that trade-off and for model accuracy found no supporting passage. (LLM, conf=0.75)

  cites [367] Riazi, 2019, HEAX: High-performance architecture for computation on homomorphically encrypted data in the cloud sourceExperimental — accuracy not yet measured
• ?Could not verify

  The Contributions section (p. 2) describes faster adversarial training and robustness against attacks, not a privacy–accuracy trade-off. Searches for private-data collection, privacy-friendly architectures, and data-domain priors found no passage addressing the attributed claim; the paper's mention of differential privacy is only in a reference (p. 11). (LLM, conf=0.77)

  cites [449] Shafahi, 2019, Adversarial training for free sourceExperimental — accuracy not yet measured

In the paper

“Progress here could be made both by algorithmic advances as well as through the development of more efficient hardware accelerators for MPC [393].”

What the sources say

• ?Could not verify

  The Algorithmic Framework (pp. 6–8) describes privacy-preserving search of social networks, and the Experimental Evaluation (pp. 9–10) compares its private and non-private algorithms. Searches for MPC, multiparty computation, hardware accelerators, and algorithmic advances found no passage about improving MPC performance by either route. (LLM, conf=0.76)

  cites [393] Kearns, 2015, Privacy for the protected (only), CoRR sourceExperimental — accuracy not yet measured

In the paper

“While LDP protocols are effective at enforcing privacy and have theoretical justifications [177, 154, 155]”

What the sources say

• ?Could not verify

  The Introduction (pp. 1–2) discusses keeping training data on devices and mentions cryptographic protocols that prevent inspection of individual updates. Searches for LDP, local differential privacy, privacy guarantees, and theoretical justification found no passage addressing whether LDP protocols are effective or theoretically justified. (LLM, conf=0.76)

  cites [177] Konečný, 2016, Federated learning: Strategies for improving communication efficiency sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [154] Patrini
• ?Not checked — no full text of the sourcecites [155] King, 1995, StatLog: Comparison of classification algorithms on large real-world problems, Appl. Artif. Intell. source

In the paper

“An actively malicious adversary controlling the server could simulate a large number of fake client devices (a 'Sybil attack' [160]) or could preferentially select previously compromised devices from the pool of available devices.”

What the sources say

• ?Could not verify

  The citation is attached to the Sybil-attack example. The Introduction (p. 2) discusses hyperparameter optimization, and searches for “Sybil attack,” “fake client devices,” and “malicious server” found no passage about simulated clients. Our copy therefore does not address the cited point; the later claim about selecting compromised devices is not directly attached to this citation. (LLM, conf=0.76)

  cites [160] Pedregosa, 2016, Hyperparameter optimization with approximate gradient sourceExperimental — accuracy not yet measured

In the paper

“they are robust to clients dropping out during the execution (a common feature of cross-device FL) and scale to a large number of parties (up to billions for Bell et al. [58]) and vector lengths.”

What the sources say

• ?Could not verify

  The introduction (p. 2) mentions secure aggregation protocols but does not describe their dropout tolerance or scalability. Section 4.3 (p. 7) says users need not remain available throughout the paper’s random-walk approach; it does not establish that secure aggregation protocols tolerate clients dropping out during execution. Searches for dropout tolerance, numbers of parties, and vector lengths found no passage supporting the attributed claim. (LLM, conf=0.76)

  cites [58] Cyffers, 2020, Privacy amplification by decentralization sourceExperimental — accuracy not yet measured

In the paper

“Instead of sending locally updated models to the server, these Byzantine clients can send arbitrary values. This can result in convergence to sub-optimal models, or even lead to divergence [76].”

What the sources say

• Partly supported

  Section 4.3.2 describes hospitals sending locally updated factor matrices to the server. But the paper’s privacy analysis (§4.5) assumes an honest-but-curious adversary; our copy does not address Byzantine clients sending arbitrary values or whether that causes sub-optimal convergence or divergence. Page numbers are unavailable in our copy. (LLM, conf=0.82)

  cites [76] Kim sourceExperimental — accuracy not yet measured

In the paper

“Examples of adversarial attacks include data poisoning [69, 319], model update poisoning [44, 67], and model evasion attacks [441, 69, 211].”

What the sources say

• Supported

  The citation is offered as an example of model update poisoning. In the Threat Model (p. 2), the paper says the attacker can modify local updates, including weights and gradients, and describes its attack as poisoning gradients and model updates. (LLM, conf=0.92)

  cites [69] Liu, 2020, Backdoor attacks and defenses in feature-partitioned collaborative learning source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [319] Schnorr
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [44] Tang
• ?Could not verify

  The security definition (p. 2) assumes honest-but-curious parties, and the Security Analysis (p. 4) says the protocol does not address malicious parties. Searches for poisoning and evasion found no passage in our copy identifying data poisoning, model-update poisoning, or model evasion as examples of adversarial attacks. (LLM, conf=0.74)

  cites [67] Liu, 2020, A secure federated transfer learning framework, IEEE Intelligent Systems sourceExperimental — accuracy not yet measured
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [441] Kang, 2019, Testing robustness against unforeseen adversaries
• Partly supported

  The EVT Applications passage (p. 15) discusses adversarial inputs to a classifier, consistent with evasion attacks. The Blockchained Training passage (p. 18) describes malicious devices disrupting training and cross-validation of exchanged model information. Our copy does not identify data poisoning or explicitly present the three attack types as a taxonomy. (LLM, conf=0.76)

  cites [211] Park, 2018, Wireless network intelligence at the edge, CoRR sourceExperimental — accuracy not yet measured

In the paper

“attacks on the training phase can be used as a stepping stone towards inferencetime attacks [319, 67], and (b) many defenses against inference-time attacks are implemented during training.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [319] Schnorr
• ?Could not verify

  The citation is attached to the claim that training-phase attacks can lead to inference-time attacks. The Security Analysis (pp. 3–4) discusses protections during training and a possible malicious input at inference, but does not connect a training-phase attack to a later inference-time attack. A search for that connection and for inference-time defenses implemented during training found no supporting passage. (LLM, conf=0.76)

  cites [67] Liu, 2020, A secure federated transfer learning framework, IEEE Intelligent Systems sourceExperimental — accuracy not yet measured

In the paper

“Recent work on data privacy, notably differential privacy (DP) [167], defines privacy in terms of robustness.”

What the sources say

• ?Could not verify

  The Abstract (p. 1) and Section 2 (p. 2) describe differentiable architecture search, not differential privacy. Searches for differential privacy, robustness, and privacy guarantees found no passage in our copy addressing the claimed definition. (LLM, conf=0.78)

  cites [167] Liu, 2018, DARTS: Differentiable architecture search sourceExperimental — accuracy not yet measured

In the paper

“In the black-box setting, models have also been shown to be vulnerable to attacks based on query-access to the model [113, 90] or based on substitute models trained on similar data [441, 366, 452].”

What the sources say

• ?Could not verify

  The paper’s Introduction (p. 1) mentions privacy as a challenge in federated learning, while Experimental Details (p. 7) describes tests of FedProx under data heterogeneity. Searches for black-box attacks, query access, and substitute models found no passage addressing the claimed vulnerabilities. (LLM, conf=0.74)

  cites [113] T. Li , A. K.Sahu, M.Zaheer, M.Sanjabi, A.Talwalkar, and V.Smith, Federated optimization in heterogeneous networks, 2018. [Online]. Available: https://arxiv.org/abs/1812.06127. sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [90] Quionero-Candela, 2009 source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [441] Kang, 2019, Testing robustness against unforeseen adversaries

In the paper

“An adversary could use targeted attacks to create vulnerabilities to specific types of adversarial examples [115, 214] or use untargeted attacks to degrade the effectiveness of adversarial training.”

What the sources say

• ?Could not verify

  The cited work’s Introduction (pp. 1–2) discusses local gradient descent and federated learning, not targeted attacks or vulnerabilities to adversarial examples. Searches for targeted attacks and for untargeted attacks affecting adversarial training found no passage addressing either point. (LLM, conf=0.77)

  cites [115] A. Khaled , K.Mishchenko, and P.Richtárik, First analysis of local GD on heterogeneous data, 2019. [Online]. Available: https://arxiv.org/abs/1909.04715. sourceExperimental — accuracy not yet measured
• ?Could not verify

  Section IV (Privacy Analysis; page unavailable) discusses model-inversion and membership attacks on local model updates, not targeted attacks that create vulnerabilities to particular adversarial examples. Searches for targeted adversarial examples and for untargeted attacks on adversarial training found no passage addressing either point. The citation is attached to the targeted-attacks clause. (LLM, conf=0.74)

  cites [214] Elgabli, Harnessing wireless channels for scalable and privacy-preserving federated learning sourceExperimental — accuracy not yet measured

In the paper

“Recent work by Bhagoji et al. [67] suggests that data poisoning may be weaker, especially in settings with limited participation rate (see Table 11).”

What the sources say

• ?Could not verify

  The security definition (p. 2) assumes honest-but-curious parties, and the Security Analysis (p. 4) says the protocol does not address malicious parties. Searches for data poisoning, model-update poisoning, limited participation, and Bhagoji found no passage comparing the attacks or discussing participation rates. (LLM, conf=0.76)

  cites [67] Liu, 2020, A secure federated transfer learning framework, IEEE Intelligent Systems sourceExperimental — accuracy not yet measured

In the paper

“Such methods can be applied to both targeted and untargeted attacks, with some degree of empirical success [416].”

What the sources say

• ?Could not verify

  The passages in “Malicious Intelligence” and “Reliable Systems” discuss faulty processors, signatures, and agreement on input values, not data sanitization. Searches for sanitization, targeted and untargeted attacks, and empirical success found no passage addressing the claim; page numbers were unavailable in our copy. (LLM, conf=0.76)

  cites [416] Lamport, 1982, The Byzantine generals problem, ACM Trans. Program. Lang. Syst. sourceExperimental — accuracy not yet measured

In the paper

“Recent work has shown that federated learning is vulnerable to both targeted and untargeted sybil attacks [190].”

What the sources say

• ?Could not verify

  The Introduction (pp. 1–2) and Related Work (p. 2) discuss communication costs and client resource constraints, not security attacks. Searches for sybil attacks and for malicious clients, adversarial attacks, and poisoning found no passage addressing targeted or untargeted sybil attacks. (LLM, conf=0.75)

  cites [190] Caldas, 2018, Expanding the reach of federated learning by reducing client resource requirements sourceExperimental — accuracy not yet measured

In the paper

“More sophisticated approaches [296] add noise and then release the prediction with the highest probability.”

What the sources say

• Partly supported

  The DDML Client-Side Update section (p. 3) says the method adds Laplace noise to client-side model updates. But its algorithm specifies averaging model instances for prediction, not adding noise to predictions and releasing the one with the highest probability. (LLM, conf=0.86)

  cites [296] Pihur, 2018, Differentially-private ‘draw and discard’ machine learning, CoRR sourceExperimental — accuracy not yet measured

In the paper

“- PySyft [399] is a Python library for secure, private Deep Learning. PySyft decouples private data from model training, using federated learning, differential privacy, and multi-party computation (MPC) within PyTorch.”

What the sources say

• ?Could not verify

  Section 3 (p. 3) says OpenMined provides software for training on private data, but it does not identify or describe PySyft. Searches for PySyft and for its claimed combination of federated learning, differential privacy, MPC, and PyTorch found no passage establishing those features of PySyft; the paper discusses the techniques separately. (LLM, conf=0.76)

  cites [399] Bagdasaryan, 2018, How to backdoor federated learning sourceExperimental — accuracy not yet measured

In the paper

“While SecAgg is designed to be robust to significant numbers of dropouts [81], there is still the potential for failure.”

What the sources say

• ?Could not verify

  The Abstract (p. 1) and Analysis (p. 3) compare the communication efficiency of split learning and federated learning. Searches for SecAgg, secure aggregation, and dropout-related failure found no passage addressing SecAgg’s dropout tolerance or potential failure. (LLM, conf=0.76)

  cites [81] Singh, 2019, Detailed comparison of communication efficiency of split learning and federated learning sourceExperimental — accuracy not yet measured

In the paper

“- PySyft [399] is a Python library for secure, private Deep Learning. PySyft decouples private data from model training, using federated learning, differential privacy, and multi-party computation (MPC) within PyTorch.”

What the sources say

• ?Could not verify

  The Federated Learning section (p. 3) mentions OpenMined software for training on private data, and Experimental setup (p. 6) says the authors used PyTorch. Neither passage identifies PySyft or describes its capabilities; searches for “PySyft” and the claimed library features found no supporting passage in our copy. (LLM, conf=0.76)

  cites [399] Bagdasaryan, 2018, How to backdoor federated learning sourceExperimental — accuracy not yet measured

In the paper

“One common antipattern is that minority or marginalized social groups are under-represented in the training data, and thus the learner weights these groups less during training [258], leading to inferior quality predictions for members of these groups (e.g. [93]).”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [258] Tramèr
• ?Could not verify

  The citation [258] is attached to the claim that under-represented minority or marginalized groups receive less weight during training; the later prediction-quality claim has a separate citation. Section 2 (p. 3) mentions dataset bias generally, and Section 3.1 (p. 4) describes minibatch training, but neither addresses social-group under-representation or its effect on training weight. Searches for minority groups, under-representation, and class imbalance found no passage establishing that link. (LLM, conf=0.76)

  cites [93] Wang, 2018, Dataset distillation sourceExperimental — accuracy not yet measured

In the paper

“- EMNIST dataset [126] consists of 671,585 images of digits and upper and lower case English characters (62 classes). The federated version splits the dataset into 3,400 unbalanced clients indexed by the original writer of the digits/characters. The non-IID distribution comes from the unique writing style of each person.”

What the sources say

• ?Could not verify

  The Abstract (p. 1) and §§3.2–3.3 (p. 3) describe personalization of a smartphone next-word prediction model, not EMNIST. Searches for EMNIST, 3,400 clients, and writer-indexed handwriting found no passage addressing the claimed dataset split. (LLM, conf=0.75)

  cites [126] Wang, 2019, Federated evaluation of on-device personalization sourceExperimental — accuracy not yet measured

In the paper

“Similar to the iNaturalist dataset, one can split the dataset by authors, but due to the difference in scale with iNaturalist dataset, Google Landmark Dataset provides much more diversity and creates even greater challenges to large-scale federated learning.”

What the sources say

• ?Could not verify

  The Experiments section describes partitioning other datasets, and the Introduction discusses federated-learning challenges generally. Searches for Google Landmark, iNaturalist, author-based partitioning, and a comparison of their diversity or scale found no passage addressing the claim in our copy. (LLM, conf=0.76)

  cites [456] Wang, 2020, Attack of the tails: Yes, you really can backdoor federated learning sourceExperimental — accuracy not yet measured

In the paper

“One can partition it by the geolocation or the author of an observation.”

What the sources say

• ?Could not verify

  Section 2 (p. 1) describes data held on users’ devices, and Section 5 (p. 3) describes Gboard training data in client caches. Neither addresses iNaturalist observations or partitioning them by geolocation or author; searches for those terms and a paraphrase found no relevant passage. (LLM, conf=0.77)

  cites [13] Ramaswamy, 2019, Federated learning for emoji prediction in a mobile keyboard sourceExperimental — accuracy not yet measured

In the paper

“If we partition it by the group an organism belongs to, like kingdom, phylum, etc., then the clients have totally different labels and biological closeness between two clients is already known.”

What the sources say

• ?Could not verify

  Sections 4 and 5 (p. 3) describe Gboard text and emoji data stored on client devices, not iNaturalist data. Searches for iNaturalist, taxonomic partitioning, distinct client labels, and biological closeness found no passage addressing the claim. (LLM, conf=0.76)

  cites [13] Ramaswamy, 2019, Federated learning for emoji prediction in a mobile keyboard sourceExperimental — accuracy not yet measured

In the paper

“These datasets can easily be converted to numpy arrays for use in other frameworks. 11”

What the sources say

• ?Could not verify

  The Introduction (p. 2) discusses datasets for training a prediction model, and Model Architecture (p. 2) says the model was trained using TensorFlow. Neither passage addresses converting datasets to NumPy arrays for use in other frameworks; searches for NumPy conversion and dataset formats found no such passage. (LLM, conf=0.75)

  cites [11] Hard, 2018, Federated learning for mobile keyboard prediction sourceExperimental — accuracy not yet measured

In the paper

“- PaddleFL [36] is an open source federated learning framework based on PaddlePaddle [37]. In PaddleFL, several federated learning strategies and training strategies are provided with application demonstrations.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [36] Lian
• ?Could not verify

  The paper’s Introduction (p. 1) and Conclusion (p. 21) describe randomized gossip algorithms for distributed averaging, not a federated-learning framework. Searches for PaddleFL, PaddlePaddle, and federated-learning strategies found no passage addressing the claim in our copy. (LLM, conf=0.78)

  cites [37] Boyd, 2006, Randomized gossip algorithms, IEEE Trans. Inform. Theor. sourceExperimental — accuracy not yet measured

In the paper

“- Clara Training Framework [125] includes the support of cross-silo federated learning based on a server-client approach with data privacy protection.”

What the sources say

• ?Could not verify

  The DJAM overview (p. 1) describes an asynchronous method in which neighboring agents exchange models, not the Clara Training Framework. Searches for Clara, cross-silo federated learning, server-client training, and privacy protection found no passage addressing Clara or its capabilities. (LLM, conf=0.76)

  cites [125] Almeida, 2018, DJAM: Distributed Jacobi asynchronous method for learning personal models, IEEE Signal Process. Lett. sourceExperimental — accuracy not yet measured

In the paper

“- EMNIST dataset [126] consists of 671,585 images of digits and upper and lower case English characters (62 classes). The federated version splits the dataset into 3,400 unbalanced clients indexed by the original writer of the digits/characters. The non-IID distribution comes from the unique writing style of each person.”

What the sources say

• ?Could not verify

  Our copy discusses next-word prediction using on-device language data (3.2 Global Model Training, p. 3; 4 Experiments, p. 4). Searches for EMNIST, 671,585 images, 62 classes, and writer-indexed clients found no passage addressing the attributed dataset description. (LLM, conf=0.76)

  cites [126] Wang, 2019, Federated evaluation of on-device personalization sourceExperimental — accuracy not yet measured

In the paper

“Another example is the Google-Landmark-v2 [456] that includes over 5 million images of more than 200 thousand different types of landmark.”

What the sources say

• ?Could not verify

  The Experiments section lists CIFAR-10, EMNIST, ImageNet, Sentiment140, and Reddit as the study’s datasets; the edge-dataset details describe other image sources. Searches for “Google-Landmark-v2” and the claimed image and landmark counts found no passage addressing that dataset or its size in our copy. (LLM, conf=0.76)

  cites [456] Wang, 2020, Attack of the tails: Yes, you really can backdoor federated learning sourceExperimental — accuracy not yet measured

In the paper

“- EMNIST dataset [126] consists of 671,585 images of digits and upper and lower case English characters (62 classes). The federated version splits the dataset into 3,400 unbalanced clients indexed by the original writer of the digits/characters. The non-IID distribution comes from the unique writing style of each person.”

What the sources say

• ?Could not verify

  The Introduction (p. 1) describes a keyboard next-word prediction study, and the Experiments section (p. 3) attributes differences in users’ baseline accuracy to language style and register. Searches for EMNIST, handwriting, and writer-indexed clients found no passage addressing whether individual writing styles cause EMNIST’s non-IID distribution. (LLM, conf=0.76)

  cites [126] Wang, 2019, Federated evaluation of on-device personalization sourceExperimental — accuracy not yet measured

In the paper

“One example is the iNaturalist dataset 13 which consists of large numbers of observations of various organisms all over the world.”

What the sources say

• ?Could not verify

  The cited paper’s Server-based Training section (p. 3) describes Gboard text snippets, while Federated Training (p. 3) describes data cached on users’ devices. Searches for iNaturalist and organism observations found no passage in our copy addressing the claimed dataset. (LLM, conf=0.78)

  cites [13] Ramaswamy, 2019, Federated learning for emoji prediction in a mobile keyboard sourceExperimental — accuracy not yet measured

In the paper

“Whilst most schemes are able to reach the asymptotically dominant statistical term, none are able to match the convergence rate of accelerated mini-batch SGD.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Table 5

In the paper

“The error bound is measured by optimal objective (1) for convex functions and norm of gradient for nonconvex functions.”

In the paper

“All the methods in Table 6 assume smoothness or Lipschitz gradients for the local functions on clients.”

In the paper

“We also note that techniques (described in the following sections) which are designed to address worst-case adversarial robustness are also able to effectively address non-malicious failures.”

In the paper

“Thus, the term federated learning provides a convenient shorthand for a set of characteristics, constraints, and challenges that often co-occur in applied ML problems on decentralized data where privacy is paramount.”

In the paper

“The term federated learning was introduced in 2016 by McMahan et al. [337]”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [337] Carlini, 2018, The secret sharer: Measuring unintended neural network memorization and extracting secrets

In the paper

“Apple is using cross-device FL in iOS 13 [25], for applications like the QuickType keyboard and the vocal classifier for 'Hey Siri' [26]”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [25] Musketeer , Musketeer: About, 2019. [Online]. Available: http://musketeer.eu/project/. Retrieved Aug. 2019.
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [26] The TFF Authors , Tensor Flow Federated, 2019. [Online]. Available: https://www.tensorflow.org/federated.

In the paper

“An unbalanced and non-IID (identically and independently distributed) data partitioning across a massive number of unreliable devices with limited communication bandwidth was introduced as the defining set of challenges.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [337] Carlini, 2018, The secret sharer: Measuring unintended neural network memorization and extracting secrets

In the paper

“Since the term federated learning was initially introduced with an emphasis on mobile and edge device applications [337, 334], interest in applying FL to other applications has greatly increased, including some which might involve only a small number of relatively reliable clients, for example multiple organizations collaborating to train a model.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [337] Carlini, 2018, The secret sharer: Measuring unintended neural network memorization and extracting secrets
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [334] Eldefrawy

In the paper

“Cryptographic methods for computing on encrypted data were developed starting in the early 1980s [396, 492]”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [396] Cummings, 2019, Bringing differential privacy into the experimental economics lab: Theory and an application to a public-good game
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [492] Zafar

In the paper

“Many of the hardest problems are at the intersections of these areas”

In the paper

“Akey property of many of the problems discussed is that they are inherently interdisciplinary - solving them likely requires not just machine learning, but techniques from distributed optimization, cryptography, security, differential privacy, fairness, compressed sensing, systems, information theory, statistics, and more.”

In the paper

“They consider undirected network graphs, although the case of directed networks (encoding unidirectional channels which may arise in real-world scenarios such as social networks or data markets) has also been studied in [29, 226].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [29] The Leaf Authors , Leaf, 2019. [Online]. Available: https://leaf.cmu.edu/.
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [226] Furukawa

In the paper

“The cross-silo setting can be relevant where a number of companies or organizations share incentive to train a model based on all of their data, but cannot share their data directly.”

In the paper

“Wang et al. [469] propose MATCHA, a decentralized SGD method based on matching decomposition sampling, that reduces the communication delay per iteration for any given node topology while maintaining the same error convergence speed.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Wang et al. [469]

In the paper

“Well-connected or denser networks encourage faster consensus and give better theoretical convergence rates, which depend on the spectral gap of the network graph.”

In the paper

“For the case with several local update steps, [467, 280] recently provided convergence analysis.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [467] Kamishima
• ?Not checked — no full text of the sourcecites [280] Ali, 2019, Communication-computation trade-offs in PIR, IACR Cryptol. ePrint Arch.

In the paper

“this could discourage users from participating in the decentralized federated learning protocol, as the protection of the data is typically the primary motivating factor for FL.”

In the paper

“A practical secure aggregation protocol already used in cross-device FL was proposed by Bonawitz et al. [80], effectively handling dropping out participants at the cost of complexity of the protocol.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Bonawitz et al. [80]

In the paper

“These characteristics establish many of the constraints that practical federated learning systems must typically satisfy, and hence serve to both motivate and inform the open challenges in federated learning.”

In the paper

“Zantedeschi et al. [504] further learn the similarity graph together with the personalized models.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Zantedeschi et al. [504]

In the paper

“The server is thus a central player which also potentially represents a single point of failure.”

In the paper

“A certain degree of trust of the participating clients in a central authority would still be needed to answer these questions.”

In the paper

“Local updates similar to Federated Averaging (see Section 3.2) has been proposed to address the communication challenges of feature-partitioned systems [316]”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [316] Gennaro

In the paper

“In this setting, application of techniques such as secure multi-party computation or homomorphic encryption have been proposed in order to limit the amount of information other participants can infer from observing the training process.”

In the paper

“It is worth noting that even in the decentralized setting outlined above, a central authority may still be in charge of setting up the learning task.”

In the paper

“Cross-device and cross-silo federated learning are two examples of FL domains, but are not intended to be exhaustive.”

In the paper

“Denser networks typically incur communication delays which increase with the node degrees.”

In the paper

“In contrast with the characteristics of cross-device federated learning, see Table 1, cross-silo federated learning admits more flexibility in certain aspects of the overall design, but at the same time presents a setting where achieving other properties can be harder.”

In the paper

“This difference has been also referred to as horizontal and vertical federated learning by Yang et al. [490].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Yang et al. [490]

In the paper

“In the cross-silo setting, in addition to partitioning by examples, partitioning by features is of practical relevance.”

In the paper

“In contrast to well-shuffled mini-batches consisting of independent and identically distributed (IID) examples in centralized learning, federated learning uses local data from end user devices, leading to many varieties of non-IID data (Section 3.1).”

In the paper

“However, performing more local updates saves significant communication cost and reduces the time spent per iteration.”

In the paper

“Unlike the IID setting, we cannot necessarily assume M = N , as the client distributions are not all equal.”

In the paper

“For IID data, where each client is assumed to have a infinitely large dataset, this reduces to taking a simple average of the local models.”

In the paper

“However, this family of algorithms also poses several new algorithmic challenges from an optimization theory point of view.”

In the paper

“Quantity skew or unbalancedness: Different clients can hold vastly different amounts of data.”

In the paper

“The original goal of federated learning, training a single global model on the union of client datasets, becomes harder with non-IID data.”

In the paper

“Performing local updates and communicating less frequently with the central server addresses the core challenges of respecting data locality constraints and of the limited communication capabilities of mobile device clients.”

In the paper

“Updating and averaging a larger number of client models per training round yields better convergence, but it makes the training vulnerable to slowdown due to unpredictable tail delays in computation/communication at/with the clients.”

In the paper

“We note that while such an assumption may be compatible with the cross-silo federated setting in Table 1, it is generally infeasible in the cross-device setting.”

In the paper

“An open-source platform supporting the above outlined applications is currently available as Federated AI Technology Enabler (FATE) [33].”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [33] Dean

In the paper

“For completeness, we note that even considering the dataset on a single device, if the data is in an insufficiently-random order, e.g. ordered by time, then independence is violated locally as well.”

In the paper

“Sources of intra-client correlation can generally be resolved by local shuffling.”

In the paper

“Partitioning by examples is usually relevant in cross-silo FL when a single company cannot centralize their data due to legal constraints, or when organizations with similar objectives want to collaboratively improve their models.”

In the paper

“One of the fundamental challenges in addressing these goals is the presence of non-IID data”

In the paper

“However, it is also important to note that the distribution Q and P i may change over time, introducing another dimension of 'non-IIDness'.”

In the paper

“However, for typical cross-device applications we might have T = 10 6 and M = 100 (Table 2), implying K = 1 .”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites Table 2

In the paper

“FL settings where the total number of devices is huge (e.g. across mobile devices) necessitate algorithms that only require a handful of clients to participate per round (client sampling).”

In the paper

“The existing formulation is limited to the case of 2 clients.”