{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T11:46:20Z","timestamp":1773402380557,"version":"3.50.1"},"reference-count":75,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key R&D Program of China","award":["2022YFB3103500"],"award-info":[{"award-number":["2022YFB3103500"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21A20463"],"award-info":[{"award-number":["U21A20463"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U20A20176"],"award-info":[{"award-number":["U20A20176"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62102052"],"award-info":[{"award-number":["62102052"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001381","name":"National Research Foundation Singapore","doi-asserted-by":"publisher","award":["NRF2018NCR-NCR009-0001"],"award-info":[{"award-number":["NRF2018NCR-NCR009-0001"]}],"id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001459","name":"Ministry of Education - Singapore","doi-asserted-by":"publisher","award":["AcRF Tier 2 MOE-T2EP20121-0006"],"award-info":[{"award-number":["AcRF Tier 2 MOE-T2EP20121-0006"]}],"id":[{"id":"10.13039\/501100001459","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001459","name":"Ministry of Education - Singapore","doi-asserted-by":"publisher","award":["AcRF Tier 1 RS02\/19"],"award-info":[{"award-number":["AcRF Tier 1 RS02\/19"]}],"id":[{"id":"10.13039\/501100001459","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001475","name":"Nanyang Technological University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001475","id-type":"DOI","asserted-by":"publisher"}]},{"name":"RIE2020 Industry Alignment Fund"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2023,9,1]]},"DOI":"10.1109\/tpami.2023.3262813","type":"journal-article","created":{"date-parts":[[2023,3,29]],"date-time":"2023-03-29T19:11:30Z","timestamp":1680117090000},"page":"10650-10668","source":"Crossref","is-referenced-by-count":9,"title":["Automatic Transformation Search Against Deep Leakage From Gradients"],"prefix":"10.1109","volume":"45","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7048-1722","authenticated-orcid":false,"given":"Wei","family":"Gao","sequence":"first","affiliation":[{"name":"S-Lab and School of Computer Science and Engineering, Nanyang Technological University, Singapore"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-5608-6955","authenticated-orcid":false,"given":"Xu","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Computer Science, Chongqing University, Chongqing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6443-5308","authenticated-orcid":false,"given":"Shangwei","family":"Guo","sequence":"additional","affiliation":[{"name":"College of Computer Science, Chongqing University, Chongqing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6595-6650","authenticated-orcid":false,"given":"Tianwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanyang Technological University, Singapore"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9439-4623","authenticated-orcid":false,"given":"Tao","family":"Xiang","sequence":"additional","affiliation":[{"name":"College of Computer Science, Chongqing University, Chongqing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2678-8070","authenticated-orcid":false,"given":"Han","family":"Qiu","sequence":"additional","affiliation":[{"name":"Institute for Network Sciences and Cyberspace, BNRist, Tsinghua University and Zhongguancun Laboratory, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2751-5114","authenticated-orcid":false,"given":"Yonggang","family":"Wen","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanyang Technological University, Singapore"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7300-9215","authenticated-orcid":false,"given":"Yang","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanyang Technological University, Singapore"}]}],"member":"263","reference":[{"key":"ref13","first-page":"16937","article-title":"Inverting gradients–how easy is it to break privacy in federated learning?","volume":"33","author":"geiping","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref57","first-page":"6377","article-title":"Pruning neural networks without any data by iteratively conserving synaptic flow","volume":"33","author":"tanaka","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref12","article-title":"iDLG: Improved deep leakage from gradients","author":"zhao","year":"2020"},{"key":"ref56","article-title":"Picking winning tickets before training by preserving gradient flow","author":"wang","year":"2020"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00018"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2011.2109730"},{"key":"ref14","article-title":"A framework for evaluating gradient leakage attacks in federated learning","author":"wei","year":"2020"},{"key":"ref58","first-page":"7588","article-title":"Neural architecture search without training","author":"mellor","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref53","article-title":"The hidden vulnerability of watermarking for deep neural networks","author":"guo","year":"2020"},{"key":"ref52","article-title":"Deepsweep: An evaluation framework for mitigating DNN backdoor attacks using data augmentation","author":"zeng","year":"2021"},{"key":"ref11","article-title":"Deep leakage from gradients","volume":"32","author":"zhu","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref55","article-title":"SNIP: Single-shot network pruning based on connection sensitivity","author":"lee","year":"2018"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref54","first-page":"1819","article-title":"DP-MERF: Differentially private mean embeddings with randomfeatures for practical privacy-preserving data generation","author":"harder","year":"2021","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683546"},{"key":"ref16","first-page":"1223","article-title":"Large scale distributed deep networks","author":"dean","year":"2012","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2640087.2644155"},{"key":"ref18","article-title":"Group knowledge transfer: Federated learning of large CNNs at the edge","author":"he","year":"2020"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3004498"},{"key":"ref50","article-title":"Mitigating advanced adversarial attacks with more advanced gradient obfuscation techniques","author":"qiu","year":"2020"},{"key":"ref46","article-title":"Privacy for free: How does dataset condensation help privacy?","author":"dong","year":"2022"},{"key":"ref45","first-page":"12674","article-title":"Dataset condensation with differentiable siamese augmentation","author":"zhao","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref48","first-page":"2366","article-title":"Image quality metrics: PSNR versus SSIM","author":"hore","year":"2010","journal-title":"Proc Pattern Recognit"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/WACV56688.2023.00645"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417238"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00919"},{"key":"ref44","article-title":"Dataset condensation with gradient matching","author":"zhao","year":"2021","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref43","first-page":"12673","article-title":"GS-WGAN: A gradient-sanitized approach for learning differentially private generators","author":"chen","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref49","article-title":"FenceBox: A platform for defeating adversarial examples with data augmentation techniques","author":"qiu","year":"2020"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijmedinf.2018.01.007"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900461"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"ref4","article-title":"Robust and privacy-preserving collaborative learning: A comprehensive survey","author":"guo","year":"2021"},{"key":"ref3","article-title":"Towards byzantine-resilient learning in decentralized systems","author":"guo","year":"2020"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2945367"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3161600"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_3"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref37","article-title":"Differentially private decentralized learning","author":"guo","year":"2020"},{"key":"ref36","first-page":"7683","article-title":"Scalable differential privacy with certified robustness in adversarial learning","author":"phan","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00989"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1670"},{"key":"ref30","first-page":"29898","article-title":"Gradient inversion with generative image prior","author":"jeon","year":"2021","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-2072"},{"key":"ref33","article-title":"How does a deep learning model architecture impact its privacy?","author":"zhang","year":"2022"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00978"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref39","article-title":"Practical secure aggregation for federated learning on user-held data","author":"bonawitz","year":"2016"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1002\/int.22241"},{"key":"ref71","first-page":"3817","article-title":"On the discrepancy between the theoretical analysis and practical implementations of compressed communication for distributed deep learning","author":"aritra","year":"2019","journal-title":"Proc AAAI Conf Artif Intell"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICEMI.2017.8265710"},{"key":"ref72","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume":"32","author":"paszke","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475602"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref23","article-title":"Fast autoaugment","volume":"32","author":"lim","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref25","article-title":"A survey on neural architecture search","author":"wistuba","year":"2019"},{"key":"ref69","article-title":"Visual transformers: Token-based image representation and processing for computer vision","author":"wu","year":"2020"},{"key":"ref20","article-title":"A decentralized parallel algorithm for training generative adversarial nets","author":"liu","year":"2019"},{"key":"ref64","article-title":"Bayesian framework for gradient leakage","author":"balunovi?","year":"2021"},{"key":"ref63","article-title":"Neural architecture search with reinforcement learning","author":"zoph","year":"2016"},{"key":"ref22","article-title":"AutoAugment - learning augmentation policies from data","author":"popien","year":"0"},{"key":"ref66","article-title":"Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms","author":"xiao","year":"2017"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i11.17173"},{"key":"ref65","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/BF01589116"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICVGIP.2008.47"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01607"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00020"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/IROS.2005.1545119"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1023\/A:1008923215028"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/10210213\/10086616.pdf?arnumber=10086616","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,28]],"date-time":"2023-08-28T17:55:48Z","timestamp":1693245348000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10086616\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,1]]},"references-count":75,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2023.3262813","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,1]]}}}