{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T07:00:11Z","timestamp":1787900411671,"version":"build-2784847793"},"reference-count":324,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFF0712100"],"award-info":[{"award-number":["2022YFF0712100"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002170"],"award-info":[{"award-number":["62002170"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61902184"],"award-info":[{"award-number":["61902184"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["30921013104"],"award-info":[{"award-number":["30921013104"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Science and Technology on Information Systems Engineering Laboratory","award":["WDZC20205250411"],"award-info":[{"award-number":["WDZC20205250411"]}]},{"name":"Future Network Grant of Provincial Education Board in Jiangsu"},{"name":"Youth Foundation Project of Zhejiang Laboratory","award":["K2023PD0AA01"],"award-info":[{"award-number":["K2023PD0AA01"]}]},{"name":"Research Initiation Project of Zhejiang Laboratory"},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["CNS-2107216"],"award-info":[{"award-number":["CNS-2107216"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["CNS-2128368"],"award-info":[{"award-number":["CNS-2128368"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["CNS-2128448"],"award-info":[{"award-number":["CNS-2128448"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["CMMI-2222810"],"award-info":[{"award-number":["CMMI-2222810"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["ECCS-2302469"],"award-info":[{"award-number":["ECCS-2302469"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation, U.S. Department of Transportation, Toyota and Amazon","doi-asserted-by":"publisher","award":["ECCS-2335876"],"award-info":[{"award-number":["ECCS-2335876"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. IEEE"],"published-print":{"date-parts":[[2023,9]]},"DOI":"10.1109\/jproc.2023.3306773","type":"journal-article","created":{"date-parts":[[2023,9,14]],"date-time":"2023-09-14T17:54:09Z","timestamp":1694714049000},"page":"1097-1132","source":"Crossref","is-referenced-by-count":83,"title":["Trusted AI in Multiagent Systems: An Overview of Privacy and Security for Distributed Learning"],"prefix":"10.1109","volume":"111","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6198-9498","authenticated-orcid":false,"given":"Chuan","family":"Ma","sequence":"first","affiliation":[{"name":"Zhejiang Laboratory, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6239-2922","authenticated-orcid":false,"given":"Jun","family":"Li","sequence":"additional","affiliation":[{"name":"School of Electronic and Optical Engineering, Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8794-2153","authenticated-orcid":false,"given":"Kang","family":"Wei","sequence":"additional","affiliation":[{"name":"Zhejiang Laboratory, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3603-6617","authenticated-orcid":false,"given":"Bo","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science, University of Technology Sydney, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3690-0321","authenticated-orcid":false,"given":"Ming","family":"Ding","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8111-0401","authenticated-orcid":false,"given":"Long","family":"Yuan","sequence":"additional","affiliation":[{"name":"School of Computer Science, Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6606-5822","authenticated-orcid":false,"given":"Zhu","family":"Han","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Houston, Houston, TX, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2062-131X","authenticated-orcid":false,"given":"H.","family":"Vincent Poor","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, Princeton University, Princeton, NJ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014","journal-title":"arXiv 1412 6572"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/CCGrid51090.2021.00101"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3079472"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86130-8_16"},{"key":"ref59","first-page":"1299","article-title":"When does machine learning FAIL? Generalized transferability for evasion and poisoning attacks","author":"suciu","year":"2018","journal-title":"Proc Usenix Secur Symp"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2022.3208736"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1109\/CCGrid49817.2020.00-52"},{"key":"ref53","article-title":"F2A2: Flexible fully-decentralized approximate actor-critic for cooperative multi-agent reinforcement learning","author":"li","year":"2020","journal-title":"arXiv 2004 11145"},{"key":"ref203","first-page":"557","article-title":"Snooping attacks on deep reinforcement learning","author":"inkawhich","year":"2020","journal-title":"Proc Int Conf Auto Agents Multiagent Syst (AAMAS)"},{"key":"ref324","first-page":"22863","article-title":"A variational perspective on diffusion-based generative models and score matching","author":"huang","year":"2021","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ALLERTON.2015.7447103"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.14778\/3503585.3503592"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref201","first-page":"1","article-title":"Adversarial policies: Attacking deep reinforcement learning","author":"gleave","year":"2020","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref322","doi-asserted-by":"publisher","DOI":"10.1109\/ISCTURKEY53027.2021.9654360"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref323","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2022.3217565"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2988132"},{"key":"ref210","first-page":"11372","article-title":"CRFL: Certifiably robust federated learning against backdoor attacks","volume":"139","author":"xie","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179336"},{"key":"ref51","article-title":"Revisiting distributed synchronous SGD","author":"chen","year":"2016","journal-title":"arXiv 1604 00981"},{"key":"ref50","article-title":"Accurate, large minibatch SGD: Training ImageNet in 1 hour","author":"goyal","year":"2017","journal-title":"arXiv 1706 02677"},{"key":"ref46","first-page":"14068","article-title":"Group knowledge transfer: Federated learning of large CNNs at the edge","author":"he","year":"2020","journal-title":"Proc Int Conf Neural Inf Process Syst (NIPS)"},{"key":"ref218","first-page":"1","article-title":"Label leakage and protection in two-party split learning","author":"li","year":"2022","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref45","first-page":"2938","article-title":"How to backdoor federated learning","volume":"108","author":"bagdasaryan","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist (AISTATS)"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384740"},{"key":"ref48","article-title":"Reducing leakage in distributed deep learning for sensitive health data","author":"vepakomma","year":"0"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1145\/1529282.1529574"},{"key":"ref47","article-title":"Split learning for health: Distributed deep learning without sharing raw patient data","author":"vepakomma","year":"2018","journal-title":"arXiv 1812 00564"},{"key":"ref217","year":"2022","journal-title":"AI Solution for Self-Learning EMR"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1145\/3511808.3557439"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2986024"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45023-8_44"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3212174"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539231"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.05.003"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.001.1900506"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2020.2975749"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref4","first-page":"12","article-title":"AstroPortal: A science gateway for large-scale astronomy data analysis","author":"raicu","year":"2016","journal-title":"Proc TeraGrid Conf"},{"key":"ref3","author":"bernstein","year":"2009","journal-title":"Principles of Transaction Processing"},{"key":"ref6","article-title":"Federated learning: Strategies for improving communication efficiency","author":"konecn\u00fd","year":"2016","journal-title":"arXiv 1610 05492"},{"key":"ref5","article-title":"From server-based to client-based machine learning: A comprehensive survey","author":"gu","year":"2019","journal-title":"arXiv 1909 08329"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2022.3153135"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2021.3070013"},{"key":"ref101","article-title":"Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer","author":"chang","year":"2019","journal-title":"arXiv 1912 11279"},{"key":"ref222","first-page":"1","article-title":"PyVertical: A vertical federated learning framework for multi-headed splitNN","author":"romanini","year":"2021","journal-title":"Proc ICLR Workshop Distrib Private Mach Learn (DPML)"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/358549.358563"},{"key":"ref220","article-title":"Practical privacy attacks on vertical federated learning","author":"weng","year":"2020","journal-title":"arXiv 2011 09290"},{"key":"ref35","first-page":"629","article-title":"Gaia: Geo-distributed machine learning approaching LAN speeds","author":"hsieh","year":"2017","journal-title":"Proc USENIX Symp Networked Syst Design Implement (NSDI)"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2881452"},{"key":"ref34","first-page":"571","article-title":"Project Adam: Building an efficient and scalable deep learning training system","author":"chilimbi","year":"2014","journal-title":"Proceedings of the 5th USENIX Symposium on Operating Systems Design and Implementation (OSDI)"},{"key":"ref307","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2020.3033483"},{"key":"ref37","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","author":"mcmahan","year":"2017","journal-title":"Proc Int Conf Artif Intell Statist (AISTATS)"},{"key":"ref304","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2946476"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2835776.2835781"},{"key":"ref305","article-title":"CaRENets: Compact and resource-efficient CNN for homomorphic inference on encrypted medical images","author":"chao","year":"2019","journal-title":"arXiv 1901 10074"},{"key":"ref31","first-page":"693","article-title":"Hogwild: A lock-free approach to parallelizing stochastic gradient descent","author":"recht","year":"2011","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref302","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900107"},{"key":"ref30","first-page":"2737","article-title":"Asynchronous parallel stochastic gradient for nonconvex optimization","author":"lian","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref303","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2020.2976475"},{"key":"ref33","first-page":"265","article-title":"TensorFlow: A system for large-scale machine learning","author":"abadi","year":"2016","journal-title":"Proceedings of the 5th USENIX Symposium on Operating Systems Design and Implementation (OSDI)"},{"key":"ref300","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_14"},{"key":"ref32","first-page":"19","article-title":"Communication efficient distributed machine learning with the parameter server","author":"li","year":"2014","journal-title":"Proc Adv Neural Inf Process Syst (NeurIPS)"},{"key":"ref301","doi-asserted-by":"publisher","DOI":"10.1109\/WiMOB.2017.8115788"},{"key":"ref39","article-title":"Towards federated learning at scale: System design","author":"bonawitz","year":"2019","journal-title":"arXiv 1902 01046"},{"key":"ref38","article-title":"Federated optimization: Distributed optimization beyond the datacenter","author":"konecn\u00fd","year":"2015","journal-title":"arXiv 1511 03575"},{"key":"ref308","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00502"},{"key":"ref309","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.20"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.1109\/SYSCON.2017.7934755"},{"key":"ref24","article-title":"Privacy-preserving machine learning: Methods, challenges and directions","author":"xu","year":"2021","journal-title":"arXiv 2108 04417"},{"key":"ref317","doi-asserted-by":"publisher","DOI":"10.1038\/ncomms4074"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900091"},{"key":"ref318","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2022.3188249"},{"key":"ref26","year":"2021","journal-title":"Training Validation and Test Sets—Wikipedia the Free Encyclopedia"},{"key":"ref315","doi-asserted-by":"publisher","DOI":"10.1145\/3385956.3418967"},{"key":"ref25","author":"schalkoff","year":"2007","journal-title":"Pattern Recognition"},{"key":"ref316","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2018.3761710"},{"key":"ref20","article-title":"A review of privacy-preserving federated learning for the Internet-of-Things","author":"briggs","year":"2020","journal-title":"arXiv 2004 11794"},{"key":"ref313","first-page":"427","article-title":"Ethics emerging: The story of privacy and security perceptions in virtual reality","author":"adams","year":"2018","journal-title":"Proceedings of Symposium on Usable Privacy and Security (SOUPS)"},{"key":"ref314","doi-asserted-by":"publisher","DOI":"10.1109\/CCNC.2019.8651847"},{"key":"ref22","article-title":"Threats to federated learning: A survey","author":"lyu","year":"2020","journal-title":"arXiv 2003 02133"},{"key":"ref311","doi-asserted-by":"publisher","DOI":"10.1109\/RO-MAN50785.2021.9515399"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-70604-3_8"},{"key":"ref312","doi-asserted-by":"publisher","DOI":"10.1007\/s10676-010-9234-6"},{"key":"ref28","first-page":"1","article-title":"Parallelized stochastic gradient descent","volume":"23","author":"zinkevich","year":"2010","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/J.ENG.2016.02.008"},{"key":"ref319","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2022.3204839"},{"key":"ref29","first-page":"1223","article-title":"More effective distributed ML via a stale synchronous parallel parameter server","author":"ho","year":"2013","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref320","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3010798"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.3390\/jsan7030028"},{"key":"ref321","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2019.2927312"},{"key":"ref128","article-title":"Concentrated differential privacy","author":"dwork","year":"2016","journal-title":"arXiv 1603 01887"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.10"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00069"},{"key":"ref97","first-page":"119","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","author":"blanchard","year":"2017","journal-title":"Proc Annu Conf Neural Inf Process Syst (NIPS)"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref247","article-title":"Individualized PATE: Differentially private machine learning with individual privacy guarantees","author":"boenisch","year":"2022","journal-title":"arXiv 2202 10517"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/357172.357176"},{"key":"ref127","first-page":"263","article-title":"Rényi differential privacy","author":"mironov","year":"2017","journal-title":"Proc IEEE Comput Secur Found Symp (CSF)"},{"key":"ref248","article-title":"G-PATE: Scalable differentially private data generator via private aggregation of teacher discriminators","author":"long","year":"2019","journal-title":"arXiv 1906 09338"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/2588555.2610509"},{"key":"ref124","article-title":"Learning in a large function space: Privacy-preserving mechanisms for SVM learning","author":"rubinstein","year":"2009","journal-title":"arXiv 0911 5708"},{"key":"ref245","article-title":"Multi-armed bandits with local differential privacy","author":"ren","year":"2020","journal-title":"arXiv 2007 03121"},{"key":"ref98","first-page":"3521","article-title":"The hidden vulnerability of distributed learning in byzantium","volume":"80","author":"el mhamdi","year":"2018","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.14778\/2350229.2350253"},{"key":"ref246","first-page":"404","article-title":"Distributed deep learning under differential privacy with the teacher–student paradigm","author":"zhao","year":"2018","journal-title":"Proc 32nd AAAI Conf Artif Intell (AAAI)"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2015.2470255"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1145\/3387107"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3214303"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2633620"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/MCI.2022.3180932"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23119"},{"key":"ref131","first-page":"729","article-title":"Locally differentially private protocols for frequency estimation","author":"wang","year":"2017","journal-title":"Proc Usenix Secur Symp"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.3014246"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2013.18"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-01834-3"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1145\/1749603.1749605"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467096"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/Allerton.2013.6736718"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2019.00133"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-56614-6_8"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813705"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978331"},{"key":"ref139","first-page":"8270","article-title":"Adversarial distributional training for robust deep learning","author":"dong","year":"2020","journal-title":"Proc Annu Conf Neural Inf Process Syst (NIPS)"},{"key":"ref86","article-title":"Blind justice: Fairness with encrypted sensitive attributes","author":"kilbertus","year":"2018","journal-title":"arXiv 1806 03281"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC45663.2020.9120770"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref85","first-page":"1","article-title":"ML confidential: Machine learning on encrypted data","author":"graepel","year":"2012","journal-title":"Proc Int Conf Inf Secur Cryptol (ICISC)"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.33"},{"key":"ref259","first-page":"1","article-title":"DBA: Distributed backdoor attacks against federated learning","author":"xie","year":"2021","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref88","first-page":"35","article-title":"ABY3: A mixed protocol framework for machine learning","author":"mohassel","year":"2018","journal-title":"Proc ACM SIGSAC Conf Comput Commun Secur (CCS)"},{"key":"ref135","first-page":"1","article-title":"Adversarial attacks on neural network policies","author":"huang","year":"2017","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref256","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"ref87","article-title":"PrivPy: Enabling scalable and general privacy-preserving machine learning","author":"li","year":"2018","journal-title":"arXiv 1801 10117"},{"key":"ref136","first-page":"1010","article-title":"Characterizing attacks on deep reinforcement learning","author":"pan","year":"2022","journal-title":"Proc Int Conf Auto Agents Multiagent Syst (AAMAS)"},{"key":"ref257","first-page":"1","article-title":"Bayesian framework for gradient leakage","author":"balunovic","year":"2022","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972740.21"},{"key":"ref144","author":"samarati","year":"2018","journal-title":"Protecting Privacy when Disclosing Information k-anonymity and its Enforcement Through Generalization and Suppression"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179422"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.30"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/69.971193"},{"key":"ref266","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796724"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1016\/j.jbi.2014.04.003"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1145\/3302505.3310068"},{"key":"ref263","article-title":"On the security & privacy in federated learning","author":"abad","year":"2021","journal-title":"arXiv 2112 05423"},{"key":"ref83","first-page":"1","article-title":"Machine learning classification over encrypted data","author":"bost","year":"2014","journal-title":"Proc Network and Distributed System Security Symp (NDSS)"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00549"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.14778\/3551793.3551798"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1142\/S0218488502001648"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3501279"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2964658"},{"key":"ref262","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484749"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref260","article-title":"Covert model poisoning against federated learning: Algorithm design and optimization","author":"wei","year":"2021","journal-title":"arXiv 2101 11799"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref108","article-title":"Network in network","author":"lin","year":"2013","journal-title":"arXiv 1312 4400"},{"key":"ref229","first-page":"994","article-title":"CAFE: Catastrophic data leakage in vertical federated learning","volume":"34","author":"jin","year":"2021","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref109","article-title":"Communication-efficient on-device machine learning: Federated distillation and augmentation under non-IID private data","author":"jeong","year":"2018","journal-title":"arXiv 1811 11479"},{"key":"ref106","first-page":"5977","article-title":"The convergence of sparsified gradient methods","author":"alistarh","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref227","article-title":"Feature reconstruction attacks and countermeasures of DNN training in vertical federated learning","author":"ye","year":"2022","journal-title":"arXiv 2210 06771"},{"key":"ref107","first-page":"4452","article-title":"Sparsified SGD with memory","author":"stich","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NeurIPS)"},{"key":"ref228","article-title":"Your labels are selling you out: Relation leaks in vertical federated learning","author":"qiu","year":"2022","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref104","first-page":"560","article-title":"signSGD: Compressed optimisation for non-convex problems","volume":"80","author":"bernstein","year":"2018","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref225","first-page":"1397","article-title":"Label inference attacks against vertical federated learning","author":"fu","year":"2022","journal-title":"Proc 31st USENIX Secur Symp"},{"key":"ref74","first-page":"601","article-title":"Stealing machine learning models via prediction APIS","author":"tram\u00e8r","year":"2016","journal-title":"Proc Usenix Secur Symp"},{"key":"ref105","first-page":"1509","article-title":"TernGrad: Ternary gradients to reduce communication in distributed deep learning","author":"wen","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref226","article-title":"Clustering label inference attack against practical split learning","author":"liu","year":"2022","journal-title":"arXiv 2203 05222"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref102","first-page":"999","article-title":"Being robust (in high dimensions) can be practical","volume":"70","author":"diakonikolas","year":"2017","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/216"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"ref103","first-page":"1","article-title":"QSGD: Communication-efficient SGD via gradient quantization and encoding","volume":"30","author":"alistarh","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1145\/3559613.3563201"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pgen.1000167"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3166101"},{"key":"ref232","article-title":"Additively homomorphical encryption based deep neural network for asymmetrically collaborative machine learning","author":"zhang","year":"2020","journal-title":"arXiv 2007 06849"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978355"},{"key":"ref112","article-title":"FedSKETCH: Communication-efficient and private federated learning via sketching","author":"haddadpour","year":"2020","journal-title":"arXiv 2008 04975"},{"key":"ref233","article-title":"FederBoost: Private federated learning for GBDT","author":"tian","year":"2020","journal-title":"arXiv 2011 02796"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2015.46"},{"key":"ref230","first-page":"1876","article-title":"Multiparty differential privacy via aggregation of locally trained classifiers","author":"pathak","year":"2010","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref72","article-title":"Knock knock, who’s there? Membership inference on aggregate location data","author":"pyrgelis","year":"2017","journal-title":"arXiv 1708 06145"},{"key":"ref110","first-page":"1","article-title":"Rethinking the value of network pruning","author":"liu","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.14778\/3407790.3407811"},{"key":"ref68","article-title":"Exploiting unintended feature leakage in collaborative learning","author":"melis","year":"2018","journal-title":"arXiv 1805 04049"},{"key":"ref119","article-title":"Stochastic-sign SGD for federated learning with theoretical guarantees","author":"jin","year":"2020","journal-title":"arXiv 2002 10940"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-5421-1_9"},{"key":"ref117","first-page":"2021","article-title":"FedPAQ: A communication-efficient federated learning method with periodic averaging and quantization","volume":"108","author":"reisizadeh","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist (AISTATS)"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1007\/BF00058655"},{"key":"ref69","article-title":"Towards demystifying membership inference attacks","author":"truex","year":"2018","journal-title":"arXiv 1807 09173"},{"key":"ref118","first-page":"8253","article-title":"FetchSGD: Communication-efficient federated learning with sketching","volume":"119","author":"rothchild","year":"2020","journal-title":"Proc 37th Int Conf Mach Learn (ICML)"},{"key":"ref239","first-page":"227","article-title":"Toward parallel and distributed learning by meta-learning","author":"chan","year":"1993","journal-title":"Proc AAAI Workshop Knowl Discovery Databases"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.40"},{"key":"ref115","article-title":"Federated continual learning with weighted inter-client transfer","author":"yoon","year":"2020","journal-title":"arXiv 2003 03196"},{"key":"ref236","year":"2022","journal-title":"Overview-Fate"},{"key":"ref63","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing","author":"fredrikson","year":"2014","journal-title":"Proc Usenix Secur Symp"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787987"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.113406"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1145\/3183713.3196894"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403125"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134077"},{"key":"ref114","article-title":"Privacy for free: Communication-efficient learning with differential privacy using sketches","author":"li","year":"2019","journal-title":"arXiv 1911 00972"},{"key":"ref235","author":"yang","year":"2019","journal-title":"Federated Learning"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref122","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"srivastava","year":"2014","journal-title":"J Mach Learn Res"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0067"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-79228-4_1"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417238"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/DCC.2019.00101"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2010.2084571"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2925452"},{"key":"ref121","article-title":"Improving neural networks by preventing co-adaptation of feature detectors","author":"hinton","year":"2012","journal-title":"arXiv 1207 0580"},{"key":"ref242","article-title":"LOGAN: Membership inference attacks against generative models","author":"hayes","year":"2017","journal-title":"arXiv 1705 07663"},{"key":"ref240","first-page":"1100","article-title":"Simultaneously learning and advising in multiagent reinforcement learning","author":"silva","year":"2017","journal-title":"Proc AAMAS"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2931068"},{"key":"ref289","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516701"},{"key":"ref169","article-title":"Differentially private federated learning: A client level perspective","author":"geyer","year":"2017","journal-title":"arXiv 1712 07557"},{"key":"ref290","doi-asserted-by":"publisher","DOI":"10.1049\/iet-cta.2012.0048"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2988575"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1049\/iet-cta.2011.0047"},{"key":"ref177","first-page":"2029","article-title":"Shielding collaborative learning: Mitigating poisoning attacks through client-side detection","volume":"18","author":"zhao","year":"2021","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"ref298","first-page":"6357","article-title":"Ditto: Fair and robust federated learning through personalization","author":"li","year":"2021","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-38991-8_39"},{"key":"ref299","first-page":"930","article-title":"My fair bandit: Distributed learning of max-min fairness with multi-player bandits","volume":"119","author":"bistritz","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref175","article-title":"Byzantine-robust federated machine learning through adaptive model averaging","author":"mu\u00f1oz-gonz\u00e1lez","year":"2019","journal-title":"arXiv 1909 05125"},{"key":"ref296","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM41043.2020.9155268"},{"key":"ref176","article-title":"Attack-resistant federated learning with residual-based reweighting","author":"fu","year":"2019","journal-title":"arXiv 1912 11464"},{"key":"ref297","first-page":"8927","article-title":"Collaborative machine learning with incentive-aware model rewards","volume":"119","author":"sim","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref173","first-page":"2197","article-title":"vqSGD: Vector quantized stochastic gradient descent","volume":"130","author":"gandikota","year":"2021","journal-title":"Proc Int Conf Artif Intell Statist (AISTATS)"},{"key":"ref294","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3072611"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2929409"},{"key":"ref295","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363256"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3016835"},{"key":"ref292","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysconle.2011.10.013"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2019.2906574"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00057"},{"key":"ref179","first-page":"1551","article-title":"Formal trust model for multiagent systems","author":"wang","year":"2007","journal-title":"Proc Int Joint Conf Artif Intell (IJCAI)"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/IS.2018.8710454"},{"key":"ref181","first-page":"541","article-title":"Managing Byzantine robots via blockchain technology in a swarm robotics collective decision making scenario","author":"strobel","year":"2018","journal-title":"Proc Int Conf Auto Agents Multiagent Syst (AAMAS)"},{"key":"ref188","first-page":"8632","article-title":"A little is enough: Circumventing defenses for distributed learning","author":"baruch","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000783"},{"key":"ref186","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1561\/2200000083","article-title":"Advances and open problems in federated learning","volume":"14","author":"kairouz","year":"2019","journal-title":"Found Trends Mach Learn"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.5120\/7098-9826"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/FiCloud.2016.43"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30391-4_3"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2007.55"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2020.2993599"},{"key":"ref269","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-022-29763-x"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2974712"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1197\/jamia.M2716"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1145\/3404835.3462989"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2007.367856"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2022.01.063"},{"key":"ref155","article-title":"Efficient privacy preserving edge computing framework for image classification","author":"fagbohungbe","year":"2020","journal-title":"arXiv 2005 04563"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467169"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0030"},{"key":"ref277","first-page":"563","article-title":"VF2Boost: Very fast vertical federated gradient boosting for cross-enterprise learning","author":"fu","year":"2021","journal-title":"Proc Int Conf on Management of Data"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2022.3219501"},{"key":"ref154","first-page":"1","article-title":"Distributed learning, communication complexity and privacy","volume":"23","author":"balcan","year":"2012","journal-title":"Proc 19th Ann Conf Learning Theory (COLT)"},{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2022.3213345"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660348"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2021.3138848"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2016-0015"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2022.3213344"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01480"},{"key":"ref150","article-title":"Differential privacy and machine learning: A survey and review","author":"ji","year":"2014","journal-title":"arXiv 1412 7584 [cs]"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00993"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2011.78"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2015.40"},{"key":"ref278","article-title":"Vertical federated learning: Challenges, methodologies and experiments","author":"wei","year":"2022","journal-title":"arXiv 2202 04309"},{"key":"ref158","first-page":"644","article-title":"Secure and resilient distributed machine learning under adversarial environments","author":"zhang","year":"2015","journal-title":"Proc 18th Int Conf Inf Fusion (Fusion)"},{"key":"ref279","first-page":"7575","article-title":"CPSGD: Communication-efficient and differentially-private distributed SGD","author":"agarwal","year":"2018","journal-title":"Proc Annu Conf Neural Inf Process Syst (NIPS)"},{"key":"ref280","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00019"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24676-3_1"},{"key":"ref167","first-page":"1589","article-title":"Minimax-optimal privacy-preserving sparse PCA in distributed systems","volume":"84","author":"ge","year":"2018","journal-title":"Proc 21st Int Conf Artif Intell Statist (AISTATS)"},{"key":"ref288","first-page":"1","article-title":"Private set intersection: Are garbled circuits better than custom protocols?","author":"huang","year":"2012","journal-title":"Proc Network and Distributed System Security Symp (NDSS)"},{"key":"ref164","first-page":"368","article-title":"How you act tells a lot: Privacy-leaking attack on deep reinforcement learning","author":"pan","year":"2019","journal-title":"Proc Int Conf Auto Agents Multiagent Syst (AAMAS)"},{"key":"ref285","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455832"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-W50199.2020.00013"},{"key":"ref286","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1986.10022"},{"key":"ref162","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","volume":"97","author":"bhagoji","year":"2019","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref283","article-title":"A distributed privacy-preserving learning dynamics in general social networks","author":"tao","year":"2020","journal-title":"arXiv 2011 09845"},{"key":"ref163","first-page":"1605","article-title":"Local model poisoning attacks to Byzantine-robust federated learning","author":"fang","year":"2020","journal-title":"Proc Usenix Secur Symp"},{"key":"ref284","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1985.10011"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.2307\/2283137"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2841360"},{"key":"ref161","year":"2022","journal-title":"Learning With Privacy at Scale-Apple Machine Learning Research"},{"key":"ref282","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE48307.2020.00050"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/s13748-012-0035-5"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2694844"},{"key":"ref15","article-title":"An overview of privacy in machine learning","author":"de cristofaro","year":"2020","journal-title":"arXiv 2005 08679"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3377454"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SOCA.2014.58"},{"key":"ref10","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"papernot","year":"2016","journal-title":"arXiv 1610 05755"},{"key":"ref17","article-title":"No peek: A survey of private distributed deep learning","author":"vepakomma","year":"2018","journal-title":"arXiv 1812 03288"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3436755"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101921"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/MCI.2020.2976185"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jocs.2015.09.008"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2019.2921977"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/525"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62416-7_19"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00023"},{"key":"ref199","first-page":"7974","article-title":"Policy teaching via environment poisoning: Training-time adversarial attacks against reinforcement learning","volume":"119","author":"rakhsha","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403089"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6047"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218663"},{"key":"ref196","first-page":"11225","article-title":"Adaptive reward-poisoning attacks against reinforcement learning","author":"zhang","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref193","article-title":"Optimal attacks on reinforcement learning policies","author":"russo","year":"2019","journal-title":"arXiv 1907 13548"},{"key":"ref194","first-page":"14543","article-title":"Policy poisoning in batch reinforcement learning and control","author":"ma","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"}],"container-title":["Proceedings of the IEEE"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/5\/10251702\/10251703-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/5\/10251702\/10251703.pdf?arnumber=10251703","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,10,2]],"date-time":"2023-10-02T17:58:25Z","timestamp":1696269505000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10251703\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9]]},"references-count":324,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/jproc.2023.3306773","relation":{},"ISSN":["0018-9219","1558-2256"],"issn-type":[{"value":"0018-9219","type":"print"},{"value":"1558-2256","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9]]}}}