Lecture 12 · AI4ST

Federated Learning

Training a shared model across many devices without ever moving their raw data: the FedAvg mechanism, asynchronous & heterogeneous variants, the non-IID problem and its fixes, and whether sharing only weights truly protects privacy.

⏱ ~60 min 📚 6 sections ✅ 15 MCQ + 2 open-ended ⭐ Includes sim Q2 · Q17 · Q18 — three sim MCQs
1

From Centralized to Federated

Recap: how models are trained

Sibling set — three training settings
A recurring exam triplet: tell them apart by whose data trains and tests the model.
SettingSlide definition
Subject-independentTrained on data from several subjects, with the objective of generalizing on unseen subjects — the most challenging setting
Subject-dependentTrained and tested on data from the same subjects — the most accurate
HybridCombines the strengths of the two above — a bit less accurate than subject-dependent

Collaborative learning

The most accurate solutions are subject-dependent, but the real bottleneck is data acquisition and labeling. Collaborative learning distributes labeled data collection over a large number of users to build a single global model (subject-independent or hybrid, depending on the scenario). There are three ways to organise it:

Centralized vs Distributed vs Federated

ApproachHow it works & its problems
CentralizedEach client transmits its labeled data to a central server, which combines all of it into one training set and builds a single collaborative model. Problems: privacy (sensor data may reveal personal habits / health conditions) and scalability (communication latency from transmitting lots of data + computational cost of training on huge labeled sets)
Distributed on-siteTraining and inference are done only on locally collected data; the server distributes a pre-trained model and each device personalizes it (privacy mitigated). Problems: nodes may have limited labeled samples, get no benefit from peers' data, and the local models can not generalize
FederatedEach client trains a local model on its own labeled data; only the local model parameters (not the data!) are shared with the server, which aggregates them in a privacy-preserving fashion to generate a global model

An early application: GBoard

One of the first uses of FL: suggesting the next word in Android keyboards. When users "click" or "ignore" a suggestion they implicitly provide labels; a personal model is trained locally, and the local models are merged by a server into a stronger model thanks to collaborative learning. FL has since been applied to federated HAR, smart energy, pervasive healthcare, smart-city pollution sensing, and autonomous driving.

2

The Basic Federated Learning Approach

The FL mechanism — a communication round

Server selects available clients Broadcast global model Each client trains locally on its labeled data Clients send local parameters Server aggregates → new global model

Periodically the server updates the global model: it selects a number of available clients, each selected client receives the global model, trains it on its available labeled data, and sends the resulting local model parameters back. The server aggregates them into an updated global model. The process repeats until convergence — each iteration is a communication round.

FedSGD vs FedAvg

FedSGD (naïve)

  • Each client computes the average gradient on its local data at the current model and sends the gradient
  • The server does a weighted aggregation of gradients and updates the model with one step of SGD

FedAvg (standard)

  • Each client performs several SGD steps locally and sends the resulting weights
  • The server does a weighted aggregation of the weights → the new global model

FedAvg requires more computation on each client (several SGD steps), but it lets the model converge with a significantly reduced number of communication rounds — it is the standard approach generally used in FL. The weighted aggregation uses each client's data size: nk/n.

Client selection

FL targets scenarios with a large number of clients (e.g., thousands); considering all of them each round is not scalable, and some may be unavailable.

Sibling set — selection strategies
Two ways to choose who trains each round; the utility branch itself splits in two.
  • Random sampling from the available devices — local training is costly (energy, usability), so a device may be available e.g. at night while charging; the server asks for availability and samples a random subset.
  • Selection through utility — pick the clients with the best utility. Statistical utility: the usefulness of a client's local update to the global model (e.g., number of training samples, local cumulative loss, difference between local and global model). System utility: different hardware leads to different overheads (training/transmission time) — slow devices (stragglers) prolong the round, so a threshold on response time can be used.
3

Asynchronous Federated Learning

Problem — synchronous FL
Classic FL is synchronous: a subset of clients is selected and aggregation happens only when every selected client has transmitted its local update. This is not optimal when the model must be updated frequently and quickly: some devices may become unresponsive (failures, network), and devices with different resources need different training times — those with significant delays are straggler devices.

When the global model must stay constantly updated, asynchronous FL is considered — the goal is reaching convergence quicker than FedAvg. Each client transmits its local update as soon as it is available; the server tracks the timestamps at which each global model was created to weight the updates — intuitively, a local model that arrives "late" may contain old information and should impact the global model less.

FedAsync & staleness

  • The server periodically schedules a global update and contacts each client separately, transmitting the current model xτ (τ = the timestamp at which the global model was created).
  • As soon as possible the client submits (xnew, τ); the server immediately updates the model: xt ← (1 − αt) xt−1 + αt xnew.
  • Staleness is assessed via the difference t − τ: larger staleness → greater error when updating (using old information). Hence αt ← α × s(t − τ) controls the update considering staleness (one possible formula: s(t − τ) = 1/(t − τ + 1)).
Where sim Q18 lives
The server periodically schedules a round (triggers clients to train), but the aggregation is immediate: it updates the global model as soon as one local update is received, without waiting for all clients. FedAsync exists to mitigate straggler devices (slower than others), not the non-IID problem. Q18 is a 2×2 grid over exactly those two axes — don't confuse the periodic scheduler with the immediate update.
4

Heterogeneity & the non-IID Problem

Clients may be heterogeneous

FL clients differ along several axes: communication heterogeneity (4G/Wi-Fi/2G), model heterogeneity, statistical heterogeneity, and device heterogeneity.

Model heterogeneity → HeteroFL

A widely accepted assumption is that local models share the same architecture as the global model — but that forces limiting the global model's complexity for resource-constrained devices, whose capabilities may vary (even dynamically). HeteroFL provides "smaller" versions of the global model to constrained devices by reducing the width of hidden channels (hence the number of parameters); local and global architectures stay within the same model class to stabilize aggregation, and each client contributes to a different number of parameters based on its model size.

Task heterogeneity → multi-task learning

By keeping part of the parameters private and part public, FL can rely on transfer learning to collaboratively learn multiple tasks: FL learns the shared layers that may be general across tasks, and each client fine-tunes its local model on a specific task.

Statistical heterogeneity: the non-IID problem

The global model should generalize over many clients, but each client's local model typically refers to a specific user (physical characteristics, age, habits). So data from different clients are non identically and independently distributed (non-IID), and FL solutions based only on local optimization (e.g., FedAvg) are not adequate.

Sibling set — skewness in sensor data
Two datasets are non-IID if some skewness (asymmetry in distributions) is observed. The three common ones in sensor data:
SkewSlide definition
Feature distribution skewEach subject may generate peculiar sensor data (e.g., walking inertial patterns of a young vs an elder subject)
Label distribution skewDifferent subjects may have different routines (e.g., a sporty subject spends more time running than a sedentary one)
Quantity distribution skewDifferent subjects may have significantly different availability of labeled data

Tackling non-IID with transfer learning

The layers closest to the input represent features that may be general across clients (feature-extraction component); the layers closest to the output represent client-specific characteristics (fully-connected output layers). So after the server generates a global model, each client can locally fine-tune the personalized layers — sharing the feature extractor, personalizing the head. (This is exactly sim Q17.)

Federated Clustering

The above fixes use a single global model fine-tuned per client, but trading off personalization vs generalization is hard. Federated Clustering tackles non-IID by grouping clients by similarity, giving a global model per group — within a group the clients are similar, so they look IID. A general global model trained on all clients is still kept for generalization and for non-clustered clients.

  • Similarity between users: raw data isn't available in FL, but two local models with similar weights were likely trained on similar data → similar users. Usually the cosine similarity between model parameters is computed, considering only the personal layers (they reflect the most client-specific characteristics).
  • Hierarchical clustering: compute pairwise similarity; start with one cluster per user; repeatedly merge the two most similar clusters, generating a new specialized model (e.g., via FedAvg) until convergence (threshold on similarity). Clusters with only one client are non-clustered.
  • Server side: for the first r−1 rounds a single global model is trained; at the r-th round hierarchical clustering produces specialized models; in the remaining rounds the server updates the specialized global models. The clustering round must be tuned: too soon → local models not trained enough; too late → local models too similar.
  • ProtoHAR (for label/quantity skew): each client sends its feature-extractor parameters plus a prototype of each activity (latent space); the server builds a global feature extractor + global prototypes; during local training each client minimizes the distance of its local prototypes to the global ones, performing better on locally under-represented classes.
5

Labeled Data Scarcity in FL

FL requires participating clients to have some labeled data for local training — an assumption that is not realistic in Ambient Intelligence. Several strategies mitigate this:

Semi-supervised FL

  • The global model is initialized with a limited labeled training set; each client receives this pre-trained global model.
  • Locally, each client uses semi-supervised strategies to obtain pseudo-labels; the pseudo-labels are used for local training, so the local parameters can be transmitted to the server.

Combining active learning & label propagation

  • Each client starts from a pre-trained model; each unlabeled sample is stored locally.
  • Active learning labels a small number of unlabeled points (querying the user); periodically (e.g., at the end of each day) label propagation spreads those labels to a larger pool of unlabeled points; the resulting pseudo-labeled dataset trains the local model.

Combining clients with and without labels

Active learning isn't always possible (it needs human interaction). Sometimes some clients have labels (or pseudo-labels) while others have only unlabeled data → aggregation strategies transfer knowledge from "labeled clients" to "unlabeled clients": compute supervised model weights from labeled clients, unsupervised weights from unlabeled clients (e.g., self-supervised learning), and aggregate the two types.

Self-supervised FL (worst case: no labels anywhere)

Each client leverages large amounts of unlabeled data to perform self-supervised learning locally (a local feature representation); the server aggregates the locally trained feature extractors into a global self-supervised model, which is finally fine-tuned with a small amount of labeled data (e.g., publicly available datasets).

6

Is FL Really Protecting Privacy?

The core caveat
In FL each client only shares model weights (not data) — a way to protect privacy. But this may not be enough: the weights of a deep model can still leak information about the participating users, and there are several techniques to attack a model (e.g., the global model) to obtain sensitive information.

The four attacks

Sibling set — attacks on deep learning models
Four distinct attacker goals. Several use shadow datasets/models and a binary classifier, so read the objective carefully.
AttackObjective & mechanism
Model InversionReconstruct typical samples of a class the attacker only knows by label. Idea: feed random noise to the target model, backpropagate the loss, but optimize the input (not the weights) to minimize it — generating the input the model thinks is the most likely sample of a class (notably used for face recognition)
Property InferenceInfer a property of the training set the owner didn't intend to share (e.g., the men/women ratio). The attacker builds shadow datasets (with or without property P), trains a shadow model on each, and trains a meta-classifier (binary: has P or not) to attack the target
Membership InferenceInfer whether a specific sample was used to train the target model. A binary attack model is trained by observing the behaviour of a shadow model on member vs non-member data; outputs a Membership Probability (≈1 member, ≈0 non-member). Can be black-box or white-box
Model ExtractionReconstruct a black-box model f by creating a substitute model f′ that behaves similarly, to obtain a white-box version attackable by other methods. Reconstructed from input/response pairs with few queries (e.g., via distillation)

A countermeasure: Local Differential Privacy (LDP)

Before uploading, each client adds noise to its gradients (a noisy gradient) so the server can't recover sensitive information from the updates while still aggregating a useful global model. Defenses more broadly include differential privacy, adversarial ML, watermarking and cryptography techniques.

ThinkA hospital runs federated HAR over patient wearables and never uploads raw data. A curious server wants to know whether a particular patient's recordings were part of training, and separately wants to recover a representative signal for the "fall" class. Which two attacks match, and how do they differ?
Answer: "Was this patient's sample in the training set?" is a membership inference attack — a binary attack model trained on a shadow model's behaviour over member vs non-member data, outputting a membership probability. "Recover a representative signal of the fall class" is a model inversion attack — feed noise and optimize the input (not the weights) until the model is maximally confident it's a "fall". Different objectives: membership inference asks "was x in D?"; model inversion asks "what does a typical member of class y look like?". Both show that sharing only weights (FL) is not enough — hence LDP's noisy gradients.

Final Quiz — Exam Style

15 MCQs + 2 open-ended. Three are the actual simulation questions (Q2, Q17, Q18) reproduced verbatim; the rest follow the professor's recipe — sibling distractors, one-word swaps, a 2×2 grid, and a FALSE question hiding an absolutizer.

1
Which describes a subject-independent model?
ATrained on data from several subjects, with the objective of generalizing on unseen subjects
BTrained and tested on data from the same subjects, reaching the highest accuracy
CCombining the strengths of the two strategies, slightly less accurate than the others
DTrained on a single subject and deployed unchanged to every other subject
A — verbatim: several subjects, generalize to unseen ones (the most challenging setting). B is subject-dependent (most accurate), C is hybrid; D is a fabricated mutation. Drill the triplet by "whose data trains and tests it".
2
What distinguishes Federated Learning from the centralized approach?
AEach client transmits its labeled data to a server that combines it into one training set
BEach device trains in isolation on local data and never communicates with a server
CEach client shares only its local model parameters, which the server aggregates into a global model
DThe server distributes a pre-trained model that each device only personalizes locally
C — in FL only model parameters (not data) are shared and aggregated privacy-preservingly. A is the centralized approach (the privacy/scalability culprit), B/D describe distributed on-site learning (isolated models that can't generalize). The whole point of FL is "parameters travel, data stays".
3
How does FedAvg differ from the naïve FedSGD?
AEach client sends one local gradient and the server applies a single SGD step
BEach client runs several local SGD steps and sends weights, which the server aggregates
CEach client sends its raw data and the server trains the whole model centrally
DThe server updates the model as soon as any single client update arrives
B — FedAvg: several local SGD steps → send weights → weighted aggregation of weights. A is exactly FedSGD (one gradient, one server SGD step). FedAvg costs more local compute but converges in far fewer communication rounds (the standard FL method). C breaks FL's no-data rule; D is asynchronous FL.
4
In client selection through utility, what is statistical utility?
AThe training and transmission time overhead caused by a client's hardware configuration
BThe probability that a client is available, e.g. while charging at night
CThe amount of noise a client adds to its gradients before uploading them
DThe usefulness of a client's local update to the global model (e.g., number of samples, local loss)
D — statistical utility = usefulness of the local update (data size, cumulative loss, local-vs-global difference). A is system utility (hardware overhead, stragglers, response-time threshold). B describes plain random availability sampling; C is LDP. Two utility flavours: "how useful" vs "how costly".
5
In asynchronous FL, what is staleness?
AThe difference t − τ between now and the global-model timestamp the client trained on
BThe number of local SGD steps a client runs before transmitting its update
CThe cosine distance between a client's personal layers and the global model
DThe amount of labeled data a client lacks to perform local training
A — staleness = t − τ; larger staleness means a "late" update carries older information and should impact the global model less, so αt = α·s(t−τ) shrinks its weight (e.g., 1/(t−τ+1)). B/C/D borrow vocabulary from FedAvg, federated clustering and data scarcity respectively.
6
Simulation exam · Q18
Which of these sentences better describes the asynchronous aggregation process "FedAsync" in Federated Learning?
AIn FedAsync, the global model is periodically updated based on some heuristics. FedAsync mitigates the problem of non-IID clients.
BIn FedAsync, the global model is periodically updated based on some heuristics. FedAsync mitigates the problem of "stragger" devices that are slower than others in generating local models.
CIn FedAsync, the global model is updated as soon as a local model update is received. FedAsync mitigates the problem of non-IID clients.
DIn FedAsync, the global model is updated as soon as a local model update is received. FedAsync mitigates the problem of "straggler" devices that are slower than others in generating local models.
D — a 2×2 grid; decide each axis. Watch the trap: FedAsync's server has two threads — a scheduler that "periodically schedules" (triggers clients to train) and an updater that does the aggregation. Axis 1 asks about the aggregation, which is immediate: "the server immediately updates the current model" as soon as a client's update arrives — it does not wait for all clients → "updated as soon as a local model update is received". The "periodically" in the slide is the scheduler, not the update. Axis 2: async FL mitigates straggler devices (slower than others), not non-IID. → D. (The typo "stragger" is in the original exam option.)
7
Why are client datasets in FL described as non-IID?
ABecause each client runs a different model architecture from the global model
BBecause each local model typically refers to a specific user, so data are not identically distributed across clients
CBecause clients communicate over different network technologies (4G, Wi-Fi, 2G)
DBecause some clients are unresponsive and arrive late to aggregation
B — statistical heterogeneity: each client's data reflects a specific user (characteristics, age, habits), so data are non identically and independently distributed, and FedAvg-style local-only optimization is inadequate. A is model heterogeneity, C is communication heterogeneity, D is the straggler/async issue.
8
Which is an example of label distribution skew in sensor data?
AA young and an elder subject generate different inertial patterns for the same walking activity
BDifferent subjects have significantly different availability of labeled data
CA sporty subject spends much more time running than a sedentary one, so their activity labels differ
DTwo clients run global models of different width to fit their hardware
C — label skew = different routines/habits → different label distributions. A is feature distribution skew (same label, different signal), B is quantity distribution skew (different amount of labeled data). D isn't a skew at all — it's HeteroFL. Drill the three skews as a sibling set.
9
Simulation exam · Q17
In Federated Learning, how to use transfer learning to mitigate the non-IID problem?
Aeach client sends to the server only the local shared layers (e.g., feature extractor), the resulting global model is then adapted locally (using fine-tuning)
Bit is not possible to combine transfer learning and federated learning
Ceach client sends to the server only the personalized (e.g., the classification head) layers, the resulting global model is then adapted locally (using fine-tuning)
Deach client performs local training before sending the whole local model to the server
A — the input-side / shared layers (feature extractor) are general across clients, so they are federated; the output-side personalized layers (head) are fine-tuned locally. C is the shared↔personalized swap (you'd federate the head and keep the extractor private — backwards). B is the nihilist "not possible" option (never correct), D is plain FedAvg with no personalization.
10
How does HeteroFL give resource-constrained clients a smaller model?
ABy reducing the numerical precision of the weights through quantization
BBy reducing the width of the hidden channels, lowering the number of parameters
CBy pruning the layers closest to the output and keeping only the feature extractor
DBy distilling the global model into a separate substitute network per client
B — HeteroFL shrinks the model by reducing the width of hidden channels (fewer parameters), keeping local and global within the same model class so aggregation stays stable; each client then contributes to a different number of parameters. A is quantization (Lecture 7b), C/D are unrelated mechanisms.
11
In Federated Clustering, how is the similarity between two clients usually computed?
AAs the cosine similarity between the raw sensor data streams of the two clients
BAs the Euclidean distance between the number of labeled samples on each client
CAs the cosine similarity between the shared feature-extraction layers of the two models
DAs the cosine similarity between the personal layers of the two clients' models
D — raw data isn't available in FL, so similarity is the cosine similarity of model parameters, considering only the personal layers (they reflect the most client-specific characteristics). A violates FL (no raw data); C uses the wrong layers (shared layers are general, not discriminative); B measures quantity, not similarity.
12
Which of these sentences on privacy in Federated Learning is FALSE?
AIn FL each client shares only the model weights and not its raw data
BThe weights of a deep model can still leak information about the participating users
CSince only weights are shared, FL fully guarantees that no sensitive information can ever leak
DLocal Differential Privacy adds noise to the gradients to mitigate information leakage
C is FALSE — the slides stress that sharing weights "may not be enough": model inversion, property/membership inference and extraction can still leak data. "fully guarantees … ever" is the absolutizer tell. A, B, D are true. In a FALSE question, hunt fully / always / never / ever.
13
What is the core idea of a model inversion attack?
ATrain shadow models on datasets with/without a property and a meta-classifier to detect it
BFeed random noise and optimize the input (not the weights) to reconstruct a typical sample of a class
CBuild a substitute model that behaves like the black-box target using input/response pairs
DTrain a binary classifier to decide whether a sample was in the training set
B — model inversion: keep weights fixed, optimize the input to maximize the model's confidence for a class → reconstruct a representative sample (famous in face recognition). A is property inference, C is model extraction, D is membership inference. All four attacks are siblings — match by the attacker's goal.
14
A property inference attack aims to:
AInfer a property of the training set the owner did not intend to share (e.g., the men/women ratio)
BReconstruct a representative input sample for a class known only by its label
CDetermine whether one specific sample belonged to the model's training set
DObtain a white-box substitute of a black-box model with few queries
A — property inference extracts a global property the model learned unintentionally (e.g., gender ratio in a patient set, or sensitive health properties from sensor data). It uses shadow datasets (with/without P), shadow models, and a binary meta-classifier. B = model inversion, C = membership inference, D = model extraction.
15
Simulation exam · Q2
How does the "membership inference attack" train the attack model?
AThe attack model is generated by perturbing the target model.
BThe attack model is obtained by reconstructing a black-box target model only from its observable inputs and outputs.
CThe attack model is trained by observing the behavior of a "target model" while processing "member" and "non-member" data.
DThe attack model is trained by observing the behavior of a "shadow model" while processing "member" and "non-member" data.
D — the attacker has no access to the real training data, so it trains a shadow model and observes its behaviour on member vs non-member data to train the binary attack model. C is the shadow↔target swap (you can't observe member/non-member behaviour on the target you're attacking — that's the whole reason for the shadow model). A is closer to extraction, B is model extraction. Same swap trick the exam uses elsewhere.
16
Open-ended · From collaborative to federated learning
a) Compare centralized, distributed on-site, and federated learning, listing the problems each one solves or introduces. Then describe a communication round.
b) Explain FedSGD vs FedAvg and why FedAvg is preferred, then describe client selection (random vs utility) and asynchronous FL with staleness.
Model answer

a) Centralized: every client sends its labeled data to a server that merges it into one training set and trains a single model — but this raises privacy (sensor data reveals habits/health) and scalability issues (communication latency from large data transfers, computational cost of training on huge labeled sets). Distributed on-site: training and inference happen only on locally collected data (the server distributes a pre-trained model that each device personalizes), mitigating privacy — but nodes may have limited labels, get no benefit from peers' data, and the local models cannot generalize. Federated: each client trains a local model and shares only the parameters (not the data); the server aggregates them privacy-preservingly into a global model — combining peers' knowledge without moving data. Communication round: the server selects a subset of available clients, broadcasts the global model, each client trains locally on its labeled data and returns its local parameters, and the server aggregates them into an updated global model; this repeats until convergence.

b) FedSGD: each client computes the average gradient on its local data and sends the gradient; the server does a weighted aggregation and applies one SGD step. FedAvg: each client performs several local SGD steps and sends the resulting weights; the server does a weighted aggregation of the weights (by data size nk/n). FedAvg costs more local computation but converges in far fewer communication rounds, so it is the standard. Client selection: FL targets thousands of clients, so not all participate each round; the simplest strategy is random sampling of available devices (a device may be available at night while charging); alternatively, utility-based selection picks the best clients by statistical utility (usefulness of the update — sample count, local loss, local-vs-global difference) or system utility (hardware overhead; a response-time threshold avoids stragglers). Asynchronous FL: synchronous FL aggregates only after every selected client returns, which stalls on unresponsive or slow straggler devices; async FL lets each client transmit as soon as ready and the server updates immediately, weighting each update by its staleness t − τ (older updates impact less, e.g. αt = α·s(t−τ)).

17
Open-ended · non-IID and privacy
a) Define the non-IID problem and the three skewness types, then describe two ways to tackle it (transfer-learning personalization and federated clustering).
b) Explain why sharing only weights may not protect privacy, describe the four attacks (model inversion, property inference, membership inference, model extraction), and a countermeasure.
Model answer

a) non-IID: the global model must generalize over many clients, but each local model reflects a specific user (characteristics, age, habits), so client data are not identically and independently distributed and FedAvg-style local-only optimization is inadequate. The three skews: feature distribution skew (same activity, different sensor patterns — young vs elder walking), label distribution skew (different routines — sporty vs sedentary), quantity distribution skew (different amounts of labeled data). Transfer-learning personalization: the input-side layers are general (feature extractor) and are federated, while the output-side personalized layers (head) are fine-tuned locally on each client. Federated clustering: group clients by similarity (cosine similarity of their personal layers, since raw data is unavailable) via hierarchical clustering — start one cluster per user, merge the two most similar repeatedly (new specialized model via FedAvg) until a similarity threshold; this yields a global model per group (clients within a group look IID), keeping a general model for non-clustered clients. (ProtoHAR additionally shares class prototypes and pulls local prototypes toward global ones to fight label/quantity skew.)

b) In FL only weights are shared, but the weights of a deep model can still leak information about participants. Model inversion: feed random noise and optimize the input (not the weights) to reconstruct a typical sample of a class (e.g., a face). Property inference: infer an unintended property of the training set (e.g., gender ratio) by training shadow models on datasets with/without property P and a binary meta-classifier. Membership inference: decide whether a specific sample was in the training set by training an attack model on a shadow model's behaviour over member vs non-member data, outputting a Membership Probability (≈1 member, ≈0 non-member); black-box or white-box. Model extraction: reconstruct a black-box model as a substitute model from input/response pairs (few queries, e.g. distillation) to obtain a white-box version attackable by the others. Countermeasure — Local Differential Privacy: each client adds noise to its gradients before uploading, so the server can't recover sensitive info while still aggregating a useful model (other defenses: differential privacy, adversarial ML, watermarking, cryptography).

0/15
MCQ score 0/15