{"title": "Deep Leakage from Gradients", "book": "Advances in Neural Information Processing Systems", "page_first": 14774, "page_last": 14784, "abstract": "Passing gradient is a widely used scheme in  modern multi-node learning system (e.g, distributed training, collaborative learning). In a long time, people used to believe that gradients are safe to share: i.e, the training set will not be leaked by gradient sharing.  However, in this paper, we show that we can obtain the private training set from the publicly shared gradients.  The leaking only takes few gradient steps to process and can obtain the original training set instead of look-alike alternatives.  We name this leakage as \\textit{deep leakage from gradient}  and practically validate the effectiveness of our algorithm on both computer vision and natural language processing tasks. We empirically show that our attack is much stronger than previous approaches and thereby and raise people's awareness to rethink the gradients' safety. We also discuss some possible strategies to defend this deep leakage.", "full_text": "Deep Leakage from Gradients\n\nLigeng Zhu Zhijian Liu\nMassachusetts Institute of Technology\n{ligeng, zhijian, songhan}@mit.edu\n\nSong Han\n\nAbstract\n\nExchanging gradients is a widely used method in modern multi-node machine\nlearning system (e.g., distributed training, collaborative learning). For a long time,\npeople believed that gradients are safe to share: i.e., the training data will not be\nleaked by gradients exchange. However, we show that it is possible to obtain the\nprivate training data from the publicly shared gradients. We name this leakage as\nDeep Leakage from Gradient and empirically validate the effectiveness on both\ncomputer vision and natural language processing tasks. Experimental results show\nthat our attack is much stronger than previous approaches: the recovery is pixel-\nwise accurate for images and token-wise matching for texts. Thereby we want to\nraise people\u2019s awareness to rethink the gradient\u2019s safety. We also discuss several\npossible strategies to prevent such deep leakage. Without changes on training\nsetting, the most effective defense method is gradient pruning.\n\n1\n\nIntroduction\n\nDistributed training becomes necessary to speedup training on large-scale datasets. In a distributed\nlearning system, the computation is executed parallely on each worker and synchronized via exchang-\ning gradients (both parameter server [15, 23] and all-reduce [3, 30]). The distribution of computation\nnaturally leads to the splitting of data: Each client has its own the training data and only communicates\ngradient during training (says the training set never leaves local machine). It allows to train a model\nusing data from multiple sources without centralizing them. This scheme is named as collaborative\nlearning and widely used when the training set contains private information [18, 20]. For example,\nmultiple hospitals train a model jointly without sharing their patients\u2019 medical data [17, 26].\nDistributed training and collaborative learning have been widely used in large scale machine learning\ntasks. However, does the \u201cgradient sharing\u201d scheme protect the privacy of the training datasets\nof each participant? In most scenarios, people assume that gradients are safe to share and will\nnot expose the training data. Some recent studies show that gradients reveal some properties of\nthe training data, for example, property classi\ufb01er [27] (whether a sample with certain property is\nin the batch) and using generative adversarial networks to generate pictures that look similar to the\ntraining images [9, 13, 27]. Here we consider a more challenging case: can we completely steal the\ntraining data from gradients? Formally, given a machine learning model F () and its weights W , if\nwe have the gradients \u2207w w.r.t a pair of input and label, can we obtain the training data reversely?\nConventional wisdom suggests that the answer is no, but we show that this is actually possible.\nIn this work, we demonstrate Deep Leakage from Gradients (DLG): sharing the gradients can leak\nprivate training data. We present an optimization algorithm that can obtain both the training inputs\nand the labels in just few iterations. To perform the attack, we \ufb01rst randomly generate a pair of\n\u201cdummy\u201d inputs and labels and then perform the usual forward and backward. After deriving the\ndummy gradients from the dummy data, instead of optimizing model weights as in typical training,\nwe optimize the dummy inputs and labels to minimize the distance between dummy gradients and\nreal gradients (illustrated in Fig. 2). Matching the gradients makes the dummy data close to the\n\n33rd Conference on Neural Information Processing Systems (NeurIPS 2019), Vancouver, Canada.\n\n\f(a) Distributed training with a centralized server\n\n(b) Distributed training without a centralized server\nFigure 1: The deep leakage scenarios in two categories of classical multi-node training. The little red\ndemon appears in the location where the deep leakage might happen. When performing centralized\ntraining, the parameter server is capable to steal all training data from gradients received from worker\nnodes. While training in a decentralized manner (e.g., ring all reduce [30]), any participant can be\nmalicious and steal the training data from its neighbors.\n\noriginal ones (Fig. 4). When the optimization \ufb01nishes, the private training data (both inputs and\nlabels) will be fully revealed.\nConventional \u201cshallow\u201d leakages (property inference [27, 34] and generative model [13] using class\nlabels) requires extra label information and can only generate similar synthetic images. Our \u201cdeep\u201d\nleakage is an optimization process and does not depend on any generative models; therefore, DLG\ndoes not require any other extra prior about the training set, instead, it can infer the label from shared\ngradients and the results produced by DLG (both images and texts) are the exact original training\nsamples instead of synthetic look-alike alternatives. We evaluate the effectiveness of our algorithm on\nboth vision (image classi\ufb01cation) and language tasks (masked language model). On various datasets\nand tasks, DLG fully recovers the training data in just a few gradient steps. Such a deep leakage\nfrom gradients is \ufb01rst discovered and we want to raise people\u2019s awareness of rethinking the safety of\ngradients.\nThe deep leakage puts a severe challenge to the multi-node machine learning system. The fundamental\ngradient sharing scheme, as shown in our work, is not always reliable to protect the privacy of the\ntraining data. In centralized distributed training (Fig. 1a), the parameter server, which usually does\nnot store any training data, is able to steal local training data of all participants. For decentralized\ndistributed training (Fig. 1b), it becomes even worse since any participant can steal its neighbors\u2019\nprivate training data. To prevent the deep leakage, we demonstrate three defense strategies: gradient\nperturbation, low precision, and gradient compression. For gradient perturbation, we \ufb01nd both\nGaussian and Laplacian noise with a scale higher than 10\u22122 would be a good defense. While half\nprecision fails to protect, gradient compression successfully defends the attack with the pruned\ngradient is more than 20%.\nOur contributions include:\n\n\u2022 We demonstrate that it is possible to obtain the private training data from the publicly shared\n\ngradients. To our best knowledge, DLG is the \ufb01rst algorithm achieving it.\n\n\u2022 DLG only requires the gradients and can reveal pixel-wise accurate images and token-wise\nmatching texts. While conventional approaches usually need extra information to attack and\nonly produce partial properties or synthetic alternatives.\n\n\u2022 To prevent potential leakage of important data, we analyze the attack dif\ufb01culties in various\n\nsettings and discuss several defense strategies against the attack.\n\n2\n\nParameter ServerW1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>W1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>(1) Distributed training with a centralized server(2) Distributed training without a centralized server(1) Distributed training with a centralized server(2) Distributed training without a centralized serverParameter ServerW1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>W1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>(2) Distributed training without a centralized serverParameter Server\u2026FlowerCat\u2026FlowerCatLeakrW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>rW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>FlowerCatLeakrW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>rW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>FlowerCatParameter ServerW1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>W1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>(1) Distributed training with a centralized server(2) Distributed training without a centralized server(1) Distributed training with a centralized server(2) Distributed training without a centralized serverParameter ServerW1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>W1<latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit><latexit sha1_base64=\"K3SAkvXn+lryYWGHf203kFgdJgw=\">AAAB8XicbVDLSgNBEOz1GeMr6tHLYBA8hV0RzDGgB48RzAOTEGYnnWTI7Owy0yuEkL/w4kERr/6NN//GSbIHTSxoKKq66e4KEyUt+f63t7a+sbm1ndvJ7+7tHxwWjo7rNk6NwJqIVWyaIbeopMYaSVLYTAzyKFTYCEc3M7/xhMbKWD/QOMFOxAda9qXg5KTH9i0q4qzRDbqFol/y52CrJMhIETJUu4Wvdi8WaYSahOLWtgI/oc6EG5JC4TTfTi0mXIz4AFuOah6h7UzmF0/ZuVN6rB8bV5rYXP09MeGRteModJ0Rp6Fd9mbif14rpX65M5E6SQm1WCzqp4pRzGbvs540KEiNHeHCSHcrE0NuuCAXUt6FECy/vErql6XALwX3V8VKOYsjB6dwBhcQwDVU4A6qUAMBGp7hFd486714797HonXNy2ZO4A+8zx+KjZAh</latexit>(2) Distributed training without a centralized serverParameter Server\u2026FlowerCat\u2026FlowerCatLeakrW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>rW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>FlowerCatLeakrW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>rW<latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit><latexit sha1_base64=\"5IzzVUcy5d0XJ5bDlcrRTgLMUCA=\">AAAB73icbVBNS8NAEJ3Ur1q/qh69LBbBU0lEsMeCF48V7Ae0oUy2m3bpZhN3N0IJ/RNePCji1b/jzX/jNs1BWx8MPN6bYWZekAiujet+O6WNza3tnfJuZW//4PCoenzS0XGqKGvTWMSqF6BmgkvWNtwI1ksUwygQrBtMbxd+94kpzWP5YGYJ8yMcSx5yisZKvYHEQCDpDqs1t+7mIOvEK0gNCrSG1a/BKKZpxKShArXue25i/AyV4VSweWWQapYgneKY9S2VGDHtZ/m9c3JhlREJY2VLGpKrvycyjLSeRYHtjNBM9Kq3EP/z+qkJG37GZZIaJulyUZgKYmKyeJ6MuGLUiJklSBW3txI6QYXU2IgqNgRv9eV10rmqe27du7+uNRtFHGU4g3O4BA9uoAl30II2UBDwDK/w5jw6L86787FsLTnFzCn8gfP5A393j5E=</latexit>FlowerCat\f2 Related Work\n\n2.1 Distributed Training\n\nTraining large machine learning models (e.g., deep neural networks) is computationally intensive. In\norder to \ufb01nish the training process in a reasonable time, many studies worked on distributed training\nto speedup. There are many works that aim to improve the scalability of distributed training, both at\nthe algorithm level [7, 11, 16, 23, 32] and at the framework level [1, 2, 6, 29, 33]. Most of them adapt\nsynchronous SGD as the backbone because the stable performance while scaling up.\nIn general, distributed training can be classi\ufb01ed into two categories: with a parameter server (central-\nized) [15, 19, 23] and without a parameter server (decentralized) [3, 30, 33]). In both schemes, each\nnode \ufb01rst performs the computation to update its local weights, and then sends gradients to other\nnodes. For the centralized mode, the gradients \ufb01rst get aggregated and then delivered back to each\nnode. For decentralized mode, gradients are exchanged between neighboring nodes.\nIn many application scenarios, the training data is privacy-sensitive. For example, a patient\u2019s medical\ncondition can not be shared across hospitals. To avoid the sensitive information being leaked,\ncollaborative learning has recently emerged [17, 18, 26] where two or more participants can jointly\ntrain a model while the training dataset never leave each participants\u2019 local server. Only the gradients\nare shared across the network. This technique has been used to train models for medical treatments\nacross multiple hospitals [18], analyze patient survival situations from various countries [17] and\nbuild predictive keyboards to improve typing experience [4, 20, 26].\n\n2.2\n\n\u201cShallow\u201d Leakage from Gradients\n\nPrevious works have made some explorations on how to infer the information of training data from\ngradients. For some layers, the gradients already leak certain level of information. For example,\nthe embedding layer in language tasks only produces gradients for words occurred in training data,\nwhich reveals what words have been used in other participant\u2019s training set [27]. But such leakage\nis \u201cshallow\u201d: The leaked words is unordered and and it is hard to infer the original sentence due to\nambiguity. Another case is fully connected layers, where observations of gradient updates can be\nused to infer output feature values. However, this cannot extend to convolutional layers because the\nsize of the features is far larger than the size of weights.\nSome recent works develop learning-based methods to infer properties of the batch. They show that a\nbinary classi\ufb01er trained on gradients is able to determine whether an exact data record (membership\ninference [27, 34]) or a data record with certain properties (property inference [27]) is included in the\nother participant\u2019s\u2019 batch. Furthermore, they train GAN models [10] to synthesis images look similar\nto training data from the gradient [9, 13, 27], but the attack is limited and only works when all class\nmembers look alike (e.g., face recognition).\n\n3 Method\n\nWe show that it\u2019s possible to steal an image pixel-wise and steal a sentence token-wise from the\ngradients. We focus on the standard synchronous distributed training: At each step t, every node i\nsamples a minibatch (xt,i, yt,i) from its own dataset to compute the gradients\n\nThe gradients are averaged across the N servers and then used to update the weights:\n\n\u2207Wt =\n\n1\nN\n\n\u2207Wt,j; Wt+1 = Wt \u2212 \u03b7\u2207Wt\n\n\u2207Wt,i =\n\n\u2202(cid:96)(F (xt,i, Wt), yt,i)\n\n\u2202Wt\n\nN(cid:88)\n\nj\n\n(1)\n\n(2)\n\nGiven gradients \u2207Wt,k received from other participant k, we aim to steal participant k\u2019s training data\n(xt,k, yt,k). Note F () and Wt are shared by default for synchronized distributed optimization.\n\n3\n\n\fFigure 2: The overview of our DLG algorithm. Variables to be updated are marked with a bold\nborder. While normal participants calculate \u2207W to update parameter using its private training data,\nthe malicious attacker updates its dummy inputs and labels to minimize the gradients distance. When\nthe optimization \ufb01nishes, the evil user is able to steal the training data from honest participants.\n\nAlgorithm 1 Deep Leakage from Gradients.\n\nInput: F (x; W ): Differentiable machine learning model; W : parameter weights; \u2207W : gradi-\n\nOutput: private training data x, y\n1 \u2190 N (0, 1)\ni, Wt), y(cid:48)\nDi , y(cid:48)\n\nents calculated by training data\n1: procedure DLG(F , W , \u2207W )\n2:\n3:\n4:\n5:\n6:\n7:\n8:\n9: end procedure\n\n1 \u2190 N (0, 1) , y(cid:48)\nx(cid:48)\nfor i \u2190 1 to n do\n\u2207W (cid:48)\ni \u2190 \u2202(cid:96)(F (x(cid:48)\nDi \u2190 ||\u2207W (cid:48)\ni \u2212 \u2207W||2\ni+1 \u2190 x(cid:48)\ni \u2212 \u03b7\u2207x(cid:48)\nx(cid:48)\nend for\nn+1, y(cid:48)\nreturn x(cid:48)\n\nn+1\n\ni)/\u2202Wt\ni+1 \u2190 y(cid:48)\n\ni \u2212 \u03b7\u2207y(cid:48)\n\ni\n\ni\n\n(cid:46) Initialize dummy inputs and labels.\n\n(cid:46) Compute dummy gradients.\n\nDi\n\n(cid:46) Update data to match gradients.\n\nTo recover the data from gradients, we \ufb01rst randomly initialize a dummy input x(cid:48) and label input y(cid:48)\n(line 2 in Algo. 1). We then feed these \u201cdummy data\u201d into models and get \u201cdummy gradients\u201d.\n\n\u2207W (cid:48) =\n\n\u2202(cid:96)(F (x(cid:48), W ), y(cid:48))\n\n\u2202W\n\n(3)\n\nOptimizing the dummy gradients close as to original also makes the dummy data close to the real\ntraining data (the trends shown in Fig. 4). Given gradients at a certain step, we obtain the training\ndata by minimizing the following objective\n\nx(cid:48)\u2217\n\n, y(cid:48)\u2217\n\n= arg min\n\nx(cid:48),y(cid:48)\n\n||\u2207W (cid:48) \u2212 \u2207W||2 = arg min\nx(cid:48),y(cid:48)\n\n|| \u2202(cid:96)(F (x(cid:48), W ), y(cid:48))\n\n\u2202W\n\n\u2212 \u2207W||2\n\n(4)\n\nThe distance ||\u2207W (cid:48) \u2212 \u2207W||2 is differentiable w.r.t dummy inputs x(cid:48) and labels y(cid:48) can thus can be\noptimized using standard gradient-based methods. Note that this optimization requires 2nd order\nderivatives. We make a mild assumption that F is twice differentiable, which holds for the majority\nof modern machine learning models (e.g., most neural networks) and tasks.\n\n4\n\nf(),W,W<latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"hP+6LrUf2d3tZaldqaQQvEKMXyw=\">AAAB2XicbZDNSgMxFIXv1L86Vq1rN8EiuCozbnQpuHFZwbZCO5RM5k4bmskMyR2hDH0BF25EfC93vo3pz0JbDwQ+zknIvSculLQUBN9ebWd3b/+gfugfNfzjk9Nmo2fz0gjsilzl5jnmFpXU2CVJCp8LgzyLFfbj6f0i77+gsTLXTzQrMMr4WMtUCk7O6oyaraAdLMW2IVxDC9YaNb+GSS7KDDUJxa0dhEFBUcUNSaFw7g9LiwUXUz7GgUPNM7RRtRxzzi6dk7A0N+5oYkv394uKZ9bOstjdzDhN7Ga2MP/LBiWlt1EldVESarH6KC0Vo5wtdmaJNChIzRxwYaSblYkJN1yQa8Z3HYSbG29D77odBu3wMYA6nMMFXEEIN3AHD9CBLghI4BXevYn35n2suqp569LO4I+8zx84xIo4</latexit><latexit sha1_base64=\"GdWVN1k7EtO+FhtRAVNVXIsyRRw=\">AAAB7XicbZDNSgMxFIXv1L9aqx3dugkWoUIpM250KejCZQXbKbRDyaR32tBMZkgyQi19EjcuFPF13Pk2pj8LbT0Q+Dgn4d6cKBNcG8/7dgpb2zu7e8X90kH58KjiHpfbOs0VwxZLRao6EdUouMSW4UZgJ1NIk0hgEI1v53nwhErzVD6aSYZhQoeSx5xRY62+W4lrF/Wg3rtDYSgJSN+teg1vIbIJ/gqqsFKz7371BinLE5SGCap11/cyE06pMpwJnJV6ucaMsjEdYteipAnqcLpYfEbOrTMgcarskYYs3N8vpjTRepJE9mZCzUivZ3Pzv6ybm/g6nHKZ5QYlWw6Kc0FMSuYtkAFXyIyYWKBMcbsrYSOqKDO2q5ItwV//8ia0Lxu+1/AfPCjCKZxBDXy4ghu4hya0gEEOL/AG786z8+p8LOsqOKveTuCPnM8f/MCQIQ==</latexit><latexit sha1_base64=\"GdWVN1k7EtO+FhtRAVNVXIsyRRw=\">AAAB7XicbZDNSgMxFIXv1L9aqx3dugkWoUIpM250KejCZQXbKbRDyaR32tBMZkgyQi19EjcuFPF13Pk2pj8LbT0Q+Dgn4d6cKBNcG8/7dgpb2zu7e8X90kH58KjiHpfbOs0VwxZLRao6EdUouMSW4UZgJ1NIk0hgEI1v53nwhErzVD6aSYZhQoeSx5xRY62+W4lrF/Wg3rtDYSgJSN+teg1vIbIJ/gqqsFKz7371BinLE5SGCap11/cyE06pMpwJnJV6ucaMsjEdYteipAnqcLpYfEbOrTMgcarskYYs3N8vpjTRepJE9mZCzUivZ3Pzv6ybm/g6nHKZ5QYlWw6Kc0FMSuYtkAFXyIyYWKBMcbsrYSOqKDO2q5ItwV//8ia0Lxu+1/AfPCjCKZxBDXy4ghu4hya0gEEOL/AG786z8+p8LOsqOKveTuCPnM8f/MCQIQ==</latexit><latexit sha1_base64=\"3KYNHBQTHEpbUyiCrWc9JnS/jLY=\">AAAB+HicbVDLSgNBEOyNrxgfWfXoZTAIEULY9WKOAT14jGCyQrKE2clsMmT2wUyvEEO+xIsHRbz6Kd78GyfJHjSxoKGo6qa7K0il0Og431ZhY3Nre6e4W9rbPzgs20fHHZ1kivE2S2SiHgKquRQxb6NAyR9SxWkUSO4F4+u57z1ypUUS3+Mk5X5Eh7EIBaNopL5dDqsXNa/Wu+ESKfFI3644dWcBsk7cnFQgR6tvf/UGCcsiHiOTVOuu66ToT6lCwSSflXqZ5illYzrkXUNjGnHtTxeHz8i5UQYkTJSpGMlC/T0xpZHWkygwnRHFkV715uJ/XjfDsOFPRZxmyGO2XBRmkmBC5imQgVCcoZwYQpkS5lbCRlRRhiarkgnBXX15nXQu665Td++cSrORx1GEUziDKrhwBU24hRa0gUEGz/AKb9aT9WK9Wx/L1oKVz5zAH1ifPzwrkXY=</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"hP+6LrUf2d3tZaldqaQQvEKMXyw=\">AAAB2XicbZDNSgMxFIXv1L86Vq1rN8EiuCozbnQpuHFZwbZCO5RM5k4bmskMyR2hDH0BF25EfC93vo3pz0JbDwQ+zknIvSculLQUBN9ebWd3b/+gfugfNfzjk9Nmo2fz0gjsilzl5jnmFpXU2CVJCp8LgzyLFfbj6f0i77+gsTLXTzQrMMr4WMtUCk7O6oyaraAdLMW2IVxDC9YaNb+GSS7KDDUJxa0dhEFBUcUNSaFw7g9LiwUXUz7GgUPNM7RRtRxzzi6dk7A0N+5oYkv394uKZ9bOstjdzDhN7Ga2MP/LBiWlt1EldVESarH6KC0Vo5wtdmaJNChIzRxwYaSblYkJN1yQa8Z3HYSbG29D77odBu3wMYA6nMMFXEEIN3AHD9CBLghI4BXevYn35n2suqp569LO4I+8zx84xIo4</latexit><latexit sha1_base64=\"GdWVN1k7EtO+FhtRAVNVXIsyRRw=\">AAAB7XicbZDNSgMxFIXv1L9aqx3dugkWoUIpM250KejCZQXbKbRDyaR32tBMZkgyQi19EjcuFPF13Pk2pj8LbT0Q+Dgn4d6cKBNcG8/7dgpb2zu7e8X90kH58KjiHpfbOs0VwxZLRao6EdUouMSW4UZgJ1NIk0hgEI1v53nwhErzVD6aSYZhQoeSx5xRY62+W4lrF/Wg3rtDYSgJSN+teg1vIbIJ/gqqsFKz7371BinLE5SGCap11/cyE06pMpwJnJV6ucaMsjEdYteipAnqcLpYfEbOrTMgcarskYYs3N8vpjTRepJE9mZCzUivZ3Pzv6ybm/g6nHKZ5QYlWw6Kc0FMSuYtkAFXyIyYWKBMcbsrYSOqKDO2q5ItwV//8ia0Lxu+1/AfPCjCKZxBDXy4ghu4hya0gEEOL/AG786z8+p8LOsqOKveTuCPnM8f/MCQIQ==</latexit><latexit sha1_base64=\"GdWVN1k7EtO+FhtRAVNVXIsyRRw=\">AAAB7XicbZDNSgMxFIXv1L9aqx3dugkWoUIpM250KejCZQXbKbRDyaR32tBMZkgyQi19EjcuFPF13Pk2pj8LbT0Q+Dgn4d6cKBNcG8/7dgpb2zu7e8X90kH58KjiHpfbOs0VwxZLRao6EdUouMSW4UZgJ1NIk0hgEI1v53nwhErzVD6aSYZhQoeSx5xRY62+W4lrF/Wg3rtDYSgJSN+teg1vIbIJ/gqqsFKz7371BinLE5SGCap11/cyE06pMpwJnJV6ucaMsjEdYteipAnqcLpYfEbOrTMgcarskYYs3N8vpjTRepJE9mZCzUivZ3Pzv6ybm/g6nHKZ5QYlWw6Kc0FMSuYtkAFXyIyYWKBMcbsrYSOqKDO2q5ItwV//8ia0Lxu+1/AfPCjCKZxBDXy4ghu4hya0gEEOL/AG786z8+p8LOsqOKveTuCPnM8f/MCQIQ==</latexit><latexit sha1_base64=\"3KYNHBQTHEpbUyiCrWc9JnS/jLY=\">AAAB+HicbVDLSgNBEOyNrxgfWfXoZTAIEULY9WKOAT14jGCyQrKE2clsMmT2wUyvEEO+xIsHRbz6Kd78GyfJHjSxoKGo6qa7K0il0Og431ZhY3Nre6e4W9rbPzgs20fHHZ1kivE2S2SiHgKquRQxb6NAyR9SxWkUSO4F4+u57z1ypUUS3+Mk5X5Eh7EIBaNopL5dDqsXNa/Wu+ESKfFI3644dWcBsk7cnFQgR6tvf/UGCcsiHiOTVOuu66ToT6lCwSSflXqZ5illYzrkXUNjGnHtTxeHz8i5UQYkTJSpGMlC/T0xpZHWkygwnRHFkV715uJ/XjfDsOFPRZxmyGO2XBRmkmBC5imQgVCcoZwYQpkS5lbCRlRRhiarkgnBXX15nXQu665Td++cSrORx1GEUziDKrhwBU24hRa0gUEGz/AKb9aT9WK9Wx/L1oKVz5zAH1ifPzwrkXY=</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit><latexit sha1_base64=\"B96ZSK9vvSqPDAS/5unvlM98V5I=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEIFUpJRLDHgh48VrBNoQ1ls920SzebsLsRaugv8eJBEa/+FG/+G7dtDtr6YODx3gwz84KEM6Ud59sqbGxube8Ud0t7+weHZfvouKPiVBLaJjGPZTfAinImaFszzWk3kRRHAadeMLmZ+94jlYrF4kFPE+pHeCRYyAjWRhrY5bB6UfNq/VvKNUYeGtgVp+4sgNaJm5MK5GgN7K/+MCZpRIUmHCvVc51E+xmWmhFOZ6V+qmiCyQSPaM9QgSOq/Gxx+AydG2WIwliaEhot1N8TGY6UmkaB6YywHqtVby7+5/VSHTb8jIkk1VSQ5aIw5UjHaJ4CGjJJieZTQzCRzNyKyBhLTLTJqmRCcFdfXiedy7rr1N37q0qzkcdRhFM4gyq4cA1NuIMWtIFACs/wCm/Wk/VivVsfy9aClc+cwB9Ynz89a5F6</latexit>GT: CatNormal ClientMalicious AttackerDifferentiable Model f(x; W)PredLossShared Information:minimize||W0W||22<latexit sha1_base64=\"JFN8C39v9ltXBBEGnSa3ZlBpMJE=\">AAACFnicbVDLSgMxFM34rPU16tJNsIhuWmaKYJcFXbisYB/Q1pJJb9vQJDMkGaFO+xVu/BU3LhRxK+78G9OHoK0HAodz7uXmnCDiTBvP+3KWlldW19ZTG+nNre2dXXdvv6LDWFEo05CHqhYQDZxJKBtmONQiBUQEHKpB/2LsV+9AaRbKGzOIoClIV7IOo8RYqeVmG4KYnhKJYJIJdg+j4bBxCdwQXD3BWfzDh8NW/jbfcjNezpsALxJ/RjJohlLL/Wy0QxoLkIZyonXd9yLTTIgyjHIYpRuxhojQPulC3VJJBOhmMok1wsdWaeNOqOyTBk/U3xsJEVoPRGAnxyH0vDcW//PqsekUmgmTUWxA0umhTsyxCfG4I9xmCqjhA0sIVcz+FdMeUYQa22TaluDPR14klXzO93L+9VmmWJjVkUKH6AidIh+doyK6QiVURhQ9oCf0gl6dR+fZeXPep6NLzmznAP2B8/ENWgyewQ==</latexit><latexit sha1_base64=\"JFN8C39v9ltXBBEGnSa3ZlBpMJE=\">AAACFnicbVDLSgMxFM34rPU16tJNsIhuWmaKYJcFXbisYB/Q1pJJb9vQJDMkGaFO+xVu/BU3LhRxK+78G9OHoK0HAodz7uXmnCDiTBvP+3KWlldW19ZTG+nNre2dXXdvv6LDWFEo05CHqhYQDZxJKBtmONQiBUQEHKpB/2LsV+9AaRbKGzOIoClIV7IOo8RYqeVmG4KYnhKJYJIJdg+j4bBxCdwQXD3BWfzDh8NW/jbfcjNezpsALxJ/RjJohlLL/Wy0QxoLkIZyonXd9yLTTIgyjHIYpRuxhojQPulC3VJJBOhmMok1wsdWaeNOqOyTBk/U3xsJEVoPRGAnxyH0vDcW//PqsekUmgmTUWxA0umhTsyxCfG4I9xmCqjhA0sIVcz+FdMeUYQa22TaluDPR14klXzO93L+9VmmWJjVkUKH6AidIh+doyK6QiVURhQ9oCf0gl6dR+fZeXPep6NLzmznAP2B8/ENWgyewQ==</latexit><latexit sha1_base64=\"JFN8C39v9ltXBBEGnSa3ZlBpMJE=\">AAACFnicbVDLSgMxFM34rPU16tJNsIhuWmaKYJcFXbisYB/Q1pJJb9vQJDMkGaFO+xVu/BU3LhRxK+78G9OHoK0HAodz7uXmnCDiTBvP+3KWlldW19ZTG+nNre2dXXdvv6LDWFEo05CHqhYQDZxJKBtmONQiBUQEHKpB/2LsV+9AaRbKGzOIoClIV7IOo8RYqeVmG4KYnhKJYJIJdg+j4bBxCdwQXD3BWfzDh8NW/jbfcjNezpsALxJ/RjJohlLL/Wy0QxoLkIZyonXd9yLTTIgyjHIYpRuxhojQPulC3VJJBOhmMok1wsdWaeNOqOyTBk/U3xsJEVoPRGAnxyH0vDcW//PqsekUmgmTUWxA0umhTsyxCfG4I9xmCqjhA0sIVcz+FdMeUYQa22TaluDPR14klXzO93L+9VmmWJjVkUKH6AidIh+doyK6QiVURhQ9oCf0gl6dR+fZeXPep6NLzmznAP2B8/ENWgyewQ==</latexit><latexit sha1_base64=\"JFN8C39v9ltXBBEGnSa3ZlBpMJE=\">AAACFnicbVDLSgMxFM34rPU16tJNsIhuWmaKYJcFXbisYB/Q1pJJb9vQJDMkGaFO+xVu/BU3LhRxK+78G9OHoK0HAodz7uXmnCDiTBvP+3KWlldW19ZTG+nNre2dXXdvv6LDWFEo05CHqhYQDZxJKBtmONQiBUQEHKpB/2LsV+9AaRbKGzOIoClIV7IOo8RYqeVmG4KYnhKJYJIJdg+j4bBxCdwQXD3BWfzDh8NW/jbfcjNezpsALxJ/RjJohlLL/Wy0QxoLkIZyonXd9yLTTIgyjHIYpRuxhojQPulC3VJJBOhmMok1wsdWaeNOqOyTBk/U3xsJEVoPRGAnxyH0vDcW//PqsekUmgmTUWxA0umhTsyxCfG4I9xmCqjhA0sIVcz+FdMeUYQa22TaluDPR14klXzO93L+9VmmWJjVkUKH6AidIh+doyK6QiVURhQ9oCf0gl6dR+fZeXPep6NLzmznAP2B8/ENWgyewQ==</latexit>Dummy LabelDifferentiable Model f(x; W)PredLossW0<latexit sha1_base64=\"D+xByVWKvot2StJCmToE4fD2eYY=\">AAAB8HicbVBNS8NAEJ3Ur1q/qh69LBbRU0lEsMeCHjxWsB/ShrLZbtqlu0nYnQgl9Fd48aCIV3+ON/+N2zYHbX0w8Hhvhpl5QSKFQdf9dgpr6xubW8Xt0s7u3v5B+fCoZeJUM95ksYx1J6CGSxHxJgqUvJNoTlUgeTsY38z89hPXRsTRA04S7is6jEQoGEUrPfZuuURK2uf9csWtunOQVeLlpAI5Gv3yV28Qs1TxCJmkxnQ9N0E/oxoFk3xa6qWGJ5SN6ZB3LY2o4sbP5gdPyZlVBiSMta0IyVz9PZFRZcxEBbZTURyZZW8m/ud1UwxrfiaiJEUescWiMJUEYzL7ngyE5gzlxBLKtLC3EjaimjK0GZVsCN7yy6ukdVn13Kp3f1Wp1/I4inACp3ABHlxDHe6gAU1goOAZXuHN0c6L8+58LFoLTj5zDH/gfP4Aw0qPrg==</latexit><latexit sha1_base64=\"D+xByVWKvot2StJCmToE4fD2eYY=\">AAAB8HicbVBNS8NAEJ3Ur1q/qh69LBbRU0lEsMeCHjxWsB/ShrLZbtqlu0nYnQgl9Fd48aCIV3+ON/+N2zYHbX0w8Hhvhpl5QSKFQdf9dgpr6xubW8Xt0s7u3v5B+fCoZeJUM95ksYx1J6CGSxHxJgqUvJNoTlUgeTsY38z89hPXRsTRA04S7is6jEQoGEUrPfZuuURK2uf9csWtunOQVeLlpAI5Gv3yV28Qs1TxCJmkxnQ9N0E/oxoFk3xa6qWGJ5SN6ZB3LY2o4sbP5gdPyZlVBiSMta0IyVz9PZFRZcxEBbZTURyZZW8m/ud1UwxrfiaiJEUescWiMJUEYzL7ngyE5gzlxBLKtLC3EjaimjK0GZVsCN7yy6ukdVn13Kp3f1Wp1/I4inACp3ABHlxDHe6gAU1goOAZXuHN0c6L8+58LFoLTj5zDH/gfP4Aw0qPrg==</latexit><latexit sha1_base64=\"D+xByVWKvot2StJCmToE4fD2eYY=\">AAAB8HicbVBNS8NAEJ3Ur1q/qh69LBbRU0lEsMeCHjxWsB/ShrLZbtqlu0nYnQgl9Fd48aCIV3+ON/+N2zYHbX0w8Hhvhpl5QSKFQdf9dgpr6xubW8Xt0s7u3v5B+fCoZeJUM95ksYx1J6CGSxHxJgqUvJNoTlUgeTsY38z89hPXRsTRA04S7is6jEQoGEUrPfZuuURK2uf9csWtunOQVeLlpAI5Gv3yV28Qs1TxCJmkxnQ9N0E/oxoFk3xa6qWGJ5SN6ZB3LY2o4sbP5gdPyZlVBiSMta0IyVz9PZFRZcxEBbZTURyZZW8m/ud1UwxrfiaiJEUescWiMJUEYzL7ngyE5gzlxBLKtLC3EjaimjK0GZVsCN7yy6ukdVn13Kp3f1Wp1/I4inACp3ABHlxDHe6gAU1goOAZXuHN0c6L8+58LFoLTj5zDH/gfP4Aw0qPrg==</latexit><latexit sha1_base64=\"D+xByVWKvot2StJCmToE4fD2eYY=\">AAAB8HicbVBNS8NAEJ3Ur1q/qh69LBbRU0lEsMeCHjxWsB/ShrLZbtqlu0nYnQgl9Fd48aCIV3+ON/+N2zYHbX0w8Hhvhpl5QSKFQdf9dgpr6xubW8Xt0s7u3v5B+fCoZeJUM95ksYx1J6CGSxHxJgqUvJNoTlUgeTsY38z89hPXRsTRA04S7is6jEQoGEUrPfZuuURK2uf9csWtunOQVeLlpAI5Gv3yV28Qs1TxCJmkxnQ9N0E/oxoFk3xa6qWGJ5SN6ZB3LY2o4sbP5gdPyZlVBiSMta0IyVz9PZFRZcxEBbZTURyZZW8m/ud1UwxrfiaiJEUescWiMJUEYzL7ngyE5gzlxBLKtLC3EjaimjK0GZVsCN7yy6ukdVn13Kp3f1Wp1/I4inACp3ABHlxDHe6gAU1goOAZXuHN0c6L8+58LFoLTj5zDH/gfP4Aw0qPrg==</latexit>[0.17, 0.2, 0.73]Differentiable Model f(x, W)Pred\u2019Loss\u2019rWLoss<latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit>[1.0, 0, 0]Differentiable Model f(x, W)PredLossrWLoss<latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit><latexit sha1_base64=\"bhOtvWaf4NML8EAFWbV91QG2/q8=\">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkoigj0WvHjwUMF+QBvCZrtpl252w+5GqKG/xIsHRbz6U7z5b9y2OWjrg4HHezPMzItSzrTxvG+ntLG5tb1T3q3s7R8cVt2j446WmSK0TSSXqhdhTTkTtG2Y4bSXKoqTiNNuNLmZ+91HqjST4sFMUxokeCRYzAg2Vgrd6kDgiOMw787QndQ6dGte3VsArRO/IDUo0Ardr8FQkiyhwhCOte77XmqCHCvDCKezyiDTNMVkgke0b6nACdVBvjh8hs6tMkSxVLaEQQv190SOE62nSWQ7E2zGetWbi/95/czEjSBnIs0MFWS5KM44MhLNU0BDpigxfGoJJorZWxEZY4WJsVlVbAj+6svrpHNZ9726f39VazaKOMpwCmdwAT5cQxNuoQVtIJDBM7zCm/PkvDjvzseyteQUMyfwB87nD5gJkwA=</latexit>rWLoss0<latexit sha1_base64=\"lIuGqVxXUca2973zm1Y44JIhdMM=\">AAAB+XicbVBNS8NAEJ3Ur1q/oh69LBbRU0lEsMeCFw8eKtgPaEPYbDft0s1u2N0USug/8eJBEa/+E2/+G7dtDtr6YODx3gwz86KUM20879spbWxube+Udyt7+weHR+7xSVvLTBHaIpJL1Y2wppwJ2jLMcNpNFcVJxGknGt/N/c6EKs2keDLTlAYJHgoWM4KNlULX7QsccRzmnRl6kFpfhm7Vq3kLoHXiF6QKBZqh+9UfSJIlVBjCsdY930tNkGNlGOF0VulnmqaYjPGQ9iwVOKE6yBeXz9CFVQYolsqWMGih/p7IcaL1NIlsZ4LNSK96c/E/r5eZuB7kTKSZoYIsF8UZR0aieQxowBQlhk8twUQxeysiI6wwMTasig3BX315nbSva75X8x9vqo16EUcZzuAcrsCHW2jAPTShBQQm8Ayv8Obkzovz7nwsW0tOMXMKf+B8/gD+DZMx</latexit><latexit sha1_base64=\"lIuGqVxXUca2973zm1Y44JIhdMM=\">AAAB+XicbVBNS8NAEJ3Ur1q/oh69LBbRU0lEsMeCFw8eKtgPaEPYbDft0s1u2N0USug/8eJBEa/+E2/+G7dtDtr6YODx3gwz86KUM20879spbWxube+Udyt7+weHR+7xSVvLTBHaIpJL1Y2wppwJ2jLMcNpNFcVJxGknGt/N/c6EKs2keDLTlAYJHgoWM4KNlULX7QsccRzmnRl6kFpfhm7Vq3kLoHXiF6QKBZqh+9UfSJIlVBjCsdY930tNkGNlGOF0VulnmqaYjPGQ9iwVOKE6yBeXz9CFVQYolsqWMGih/p7IcaL1NIlsZ4LNSK96c/E/r5eZuB7kTKSZoYIsF8UZR0aieQxowBQlhk8twUQxeysiI6wwMTasig3BX315nbSva75X8x9vqo16EUcZzuAcrsCHW2jAPTShBQQm8Ayv8Obkzovz7nwsW0tOMXMKf+B8/gD+DZMx</latexit><latexit sha1_base64=\"lIuGqVxXUca2973zm1Y44JIhdMM=\">AAAB+XicbVBNS8NAEJ3Ur1q/oh69LBbRU0lEsMeCFw8eKtgPaEPYbDft0s1u2N0USug/8eJBEa/+E2/+G7dtDtr6YODx3gwz86KUM20879spbWxube+Udyt7+weHR+7xSVvLTBHaIpJL1Y2wppwJ2jLMcNpNFcVJxGknGt/N/c6EKs2keDLTlAYJHgoWM4KNlULX7QsccRzmnRl6kFpfhm7Vq3kLoHXiF6QKBZqh+9UfSJIlVBjCsdY930tNkGNlGOF0VulnmqaYjPGQ9iwVOKE6yBeXz9CFVQYolsqWMGih/p7IcaL1NIlsZ4LNSK96c/E/r5eZuB7kTKSZoYIsF8UZR0aieQxowBQlhk8twUQxeysiI6wwMTasig3BX315nbSva75X8x9vqo16EUcZzuAcrsCHW2jAPTShBQQm8Ayv8Obkzovz7nwsW0tOMXMKf+B8/gD+DZMx</latexit><latexit sha1_base64=\"lIuGqVxXUca2973zm1Y44JIhdMM=\">AAAB+XicbVBNS8NAEJ3Ur1q/oh69LBbRU0lEsMeCFw8eKtgPaEPYbDft0s1u2N0USug/8eJBEa/+E2/+G7dtDtr6YODx3gwz86KUM20879spbWxube+Udyt7+weHR+7xSVvLTBHaIpJL1Y2wppwJ2jLMcNpNFcVJxGknGt/N/c6EKs2keDLTlAYJHgoWM4KNlULX7QsccRzmnRl6kFpfhm7Vq3kLoHXiF6QKBZqh+9UfSJIlVBjCsdY930tNkGNlGOF0VulnmqaYjPGQ9iwVOKE6yBeXz9CFVQYolsqWMGih/p7IcaL1NIlsZ4LNSK96c/E/r5eZuB7kTKSZoYIsF8UZR0aieQxowBQlhk8twUQxeysiI6wwMTasig3BX315nbSva75X8x9vqo16EUcZzuAcrsCHW2jAPTShBQQm8Ayv8Obkzovz7nwsW0tOMXMKf+B8/gD+DZMx</latexit>D=||W0W||2<latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"hP+6LrUf2d3tZaldqaQQvEKMXyw=\">AAAB2XicbZDNSgMxFIXv1L86Vq1rN8EiuCozbnQpuHFZwbZCO5RM5k4bmskMyR2hDH0BF25EfC93vo3pz0JbDwQ+zknIvSculLQUBN9ebWd3b/+gfugfNfzjk9Nmo2fz0gjsilzl5jnmFpXU2CVJCp8LgzyLFfbj6f0i77+gsTLXTzQrMMr4WMtUCk7O6oyaraAdLMW2IVxDC9YaNb+GSS7KDDUJxa0dhEFBUcUNSaFw7g9LiwUXUz7GgUPNM7RRtRxzzi6dk7A0N+5oYkv394uKZ9bOstjdzDhN7Ga2MP/LBiWlt1EldVESarH6KC0Vo5wtdmaJNChIzRxwYaSblYkJN1yQa8Z3HYSbG29D77odBu3wMYA6nMMFXEEIN3AHD9CBLghI4BXevYn35n2suqp569LO4I+8zx84xIo4</latexit><latexit sha1_base64=\"r1cJvcq9VF93K8CUdnoVf60bMk0=\">AAACBXicbZDLSgMxGIX/qbdaq45u3QSL1I1lphvdCIJduKxgL9AZSybNtKGZC0lGKDN9BDe+ihsXivgK7nwbM20FbT0Q+DgnIf9/vJgzqSzryyisrW9sbhW3Szvl3b1986DcllEiCG2RiEei62FJOQtpSzHFaTcWFAcepx1vfJ3nnQcqJIvCOzWJqRvgYch8RrDSVt+sOgFWI89LG1N0ibLMaVCuMOpU0Rn64Sy7r/fNilWzZkKrYC+gAgs1++anM4hIEtBQEY6l7NlWrNwUC8UIp9OSk0gaYzLGQ9rTGOKASjedLTRFJ9oZID8S+oQKzdzfL1IcSDkJPH0zH18uZ7n5X9ZLlH/hpiyME0VDMv/ITzhSEcrbQQMmKFF8ogETwfSsiIywwETpDku6BHt55VVo12u2VbNvLSjCERzDKdhwDldwA01oAYFHeIZXeDOejBfjfV5XwVj0dgh/ZHx8A1AQmcc=</latexit><latexit sha1_base64=\"r1cJvcq9VF93K8CUdnoVf60bMk0=\">AAACBXicbZDLSgMxGIX/qbdaq45u3QSL1I1lphvdCIJduKxgL9AZSybNtKGZC0lGKDN9BDe+ihsXivgK7nwbM20FbT0Q+DgnIf9/vJgzqSzryyisrW9sbhW3Szvl3b1986DcllEiCG2RiEei62FJOQtpSzHFaTcWFAcepx1vfJ3nnQcqJIvCOzWJqRvgYch8RrDSVt+sOgFWI89LG1N0ibLMaVCuMOpU0Rn64Sy7r/fNilWzZkKrYC+gAgs1++anM4hIEtBQEY6l7NlWrNwUC8UIp9OSk0gaYzLGQ9rTGOKASjedLTRFJ9oZID8S+oQKzdzfL1IcSDkJPH0zH18uZ7n5X9ZLlH/hpiyME0VDMv/ITzhSEcrbQQMmKFF8ogETwfSsiIywwETpDku6BHt55VVo12u2VbNvLSjCERzDKdhwDldwA01oAYFHeIZXeDOejBfjfV5XwVj0dgh/ZHx8A1AQmcc=</latexit><latexit sha1_base64=\"hvDkPWDSaNBgE/XR+Cd7hisrvZY=\">AAACEHicbZDLSsNAFIYnXmu9RV26GSxSN5akG7sRCnbhsoK9QBPLZDpph04mYWYilKSP4MZXceNCEbcu3fk2TtoI2vrDwMd/zmHO+b2IUaks68tYWV1b39gsbBW3d3b39s2Dw7YMY4FJC4csFF0PScIoJy1FFSPdSBAUeIx0vPFVVu/cEyFpyG/VJCJugIac+hQjpa2+WXYCpEaelzSm8BKmqdMgTCHYKcNz+MNpelftmyWrYs0El8HOoQRyNfvmpzMIcRwQrjBDUvZsK1JugoSimJFp0YkliRAeoyHpaeQoINJNZgdN4al2BtAPhX5cwZn7eyJBgZSTwNOd2fpysZaZ/9V6sfJrbkJ5FCvC8fwjP2ZQhTBLBw6oIFixiQaEBdW7QjxCAmGlMyzqEOzFk5ehXa3YVsW+sUr1Wh5HARyDE3AGbHAB6uAaNEELYPAAnsALeDUejWfjzXift64Y+cwR+CPj4xv2Rps0</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"hP+6LrUf2d3tZaldqaQQvEKMXyw=\">AAAB2XicbZDNSgMxFIXv1L86Vq1rN8EiuCozbnQpuHFZwbZCO5RM5k4bmskMyR2hDH0BF25EfC93vo3pz0JbDwQ+zknIvSculLQUBN9ebWd3b/+gfugfNfzjk9Nmo2fz0gjsilzl5jnmFpXU2CVJCp8LgzyLFfbj6f0i77+gsTLXTzQrMMr4WMtUCk7O6oyaraAdLMW2IVxDC9YaNb+GSS7KDDUJxa0dhEFBUcUNSaFw7g9LiwUXUz7GgUPNM7RRtRxzzi6dk7A0N+5oYkv394uKZ9bOstjdzDhN7Ga2MP/LBiWlt1EldVESarH6KC0Vo5wtdmaJNChIzRxwYaSblYkJN1yQa8Z3HYSbG29D77odBu3wMYA6nMMFXEEIN3AHD9CBLghI4BXevYn35n2suqp569LO4I+8zx84xIo4</latexit><latexit sha1_base64=\"r1cJvcq9VF93K8CUdnoVf60bMk0=\">AAACBXicbZDLSgMxGIX/qbdaq45u3QSL1I1lphvdCIJduKxgL9AZSybNtKGZC0lGKDN9BDe+ihsXivgK7nwbM20FbT0Q+DgnIf9/vJgzqSzryyisrW9sbhW3Szvl3b1986DcllEiCG2RiEei62FJOQtpSzHFaTcWFAcepx1vfJ3nnQcqJIvCOzWJqRvgYch8RrDSVt+sOgFWI89LG1N0ibLMaVCuMOpU0Rn64Sy7r/fNilWzZkKrYC+gAgs1++anM4hIEtBQEY6l7NlWrNwUC8UIp9OSk0gaYzLGQ9rTGOKASjedLTRFJ9oZID8S+oQKzdzfL1IcSDkJPH0zH18uZ7n5X9ZLlH/hpiyME0VDMv/ITzhSEcrbQQMmKFF8ogETwfSsiIywwETpDku6BHt55VVo12u2VbNvLSjCERzDKdhwDldwA01oAYFHeIZXeDOejBfjfV5XwVj0dgh/ZHx8A1AQmcc=</latexit><latexit sha1_base64=\"r1cJvcq9VF93K8CUdnoVf60bMk0=\">AAACBXicbZDLSgMxGIX/qbdaq45u3QSL1I1lphvdCIJduKxgL9AZSybNtKGZC0lGKDN9BDe+ihsXivgK7nwbM20FbT0Q+DgnIf9/vJgzqSzryyisrW9sbhW3Szvl3b1986DcllEiCG2RiEei62FJOQtpSzHFaTcWFAcepx1vfJ3nnQcqJIvCOzWJqRvgYch8RrDSVt+sOgFWI89LG1N0ibLMaVCuMOpU0Rn64Sy7r/fNilWzZkKrYC+gAgs1++anM4hIEtBQEY6l7NlWrNwUC8UIp9OSk0gaYzLGQ9rTGOKASjedLTRFJ9oZID8S+oQKzdzfL1IcSDkJPH0zH18uZ7n5X9ZLlH/hpiyME0VDMv/ITzhSEcrbQQMmKFF8ogETwfSsiIywwETpDku6BHt55VVo12u2VbNvLSjCERzDKdhwDldwA01oAYFHeIZXeDOejBfjfV5XwVj0dgh/ZHx8A1AQmcc=</latexit><latexit sha1_base64=\"hvDkPWDSaNBgE/XR+Cd7hisrvZY=\">AAACEHicbZDLSsNAFIYnXmu9RV26GSxSN5akG7sRCnbhsoK9QBPLZDpph04mYWYilKSP4MZXceNCEbcu3fk2TtoI2vrDwMd/zmHO+b2IUaks68tYWV1b39gsbBW3d3b39s2Dw7YMY4FJC4csFF0PScIoJy1FFSPdSBAUeIx0vPFVVu/cEyFpyG/VJCJugIac+hQjpa2+WXYCpEaelzSm8BKmqdMgTCHYKcNz+MNpelftmyWrYs0El8HOoQRyNfvmpzMIcRwQrjBDUvZsK1JugoSimJFp0YkliRAeoyHpaeQoINJNZgdN4al2BtAPhX5cwZn7eyJBgZSTwNOd2fpysZaZ/9V6sfJrbkJ5FCvC8fwjP2ZQhTBLBw6oIFixiQaEBdW7QjxCAmGlMyzqEOzFk5ehXa3YVsW+sUr1Wh5HARyDE3AGbHAB6uAaNEELYPAAnsALeDUejWfjzXift64Y+cwR+CPj4xv2Rps0</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit><latexit sha1_base64=\"JDUXy6L/L94Jrb1LapMxrXDZo0k=\">AAACEHicbZDLSsNAFIYn9VbrLerSzWCRurEkRbAboWAXLivYCzSxTKaTduhkEmYmQkn6CG58FTcuFHHr0p1v47SNoK0/DHz85xzmnN+LGJXKsr6M3Mrq2vpGfrOwtb2zu2fuH7RkGAtMmjhkoeh4SBJGOWkqqhjpRIKgwGOk7Y2upvX2PRGShvxWjSPiBmjAqU8xUtrqmSUnQGroeUl9Ai9hmjp1whSC7RI8gz+cpneVnlm0ytZMcBnsDIogU6Nnfjr9EMcB4QozJGXXtiLlJkgoihmZFJxYkgjhERqQrkaOAiLdZHbQBJ5opw/9UOjHFZy5vycSFEg5DjzdOV1fLtam5n+1bqz8qptQHsWKcDz/yI8ZVCGcpgP7VBCs2FgDwoLqXSEeIoGw0hkWdAj24snL0KqUbats35wXa9Usjjw4AsfgFNjgAtTANWiAJsDgATyBF/BqPBrPxpvxPm/NGdnMIfgj4+Mb94abOA==</latexit>rXD<latexit sha1_base64=\"4QmnqVAZoGZcfv4Vrd2WoALPJTw=\">AAAB/nicbVDLSsNAFL2pr1pfUXHlZrAIrkoigl0WdOGygn1AE8JkOmmHTiZhZiKUUPBX3LhQxK3f4c6/cdJmoa0HBg7n3Ms9c8KUM6Ud59uqrK1vbG5Vt2s7u3v7B/bhUVclmSS0QxKeyH6IFeVM0I5mmtN+KimOQ0574eSm8HuPVCqWiAc9Takf45FgESNYGymwTzyBQ46DPkJejPU4DPPbGQrsutNw5kCrxC1JHUq0A/vLGyYki6nQhGOlBq6Taj/HUjPC6azmZYqmmEzwiA4MFTimys/n8Wfo3ChDFCXSPKHRXP29keNYqWkcmskiolr2CvE/b5DpqOnnTKSZpoIsDkUZRzpBRRdoyCQlmk8NwUQykxWRMZaYaNNYzZTgLn95lXQvG67TcO+v6q1mWUcVTuEMLsCFa2jBHbShAwRyeIZXeLOerBfr3fpYjFascucY/sD6/AEl75Tq</latexit><latexit sha1_base64=\"4QmnqVAZoGZcfv4Vrd2WoALPJTw=\">AAAB/nicbVDLSsNAFL2pr1pfUXHlZrAIrkoigl0WdOGygn1AE8JkOmmHTiZhZiKUUPBX3LhQxK3f4c6/cdJmoa0HBg7n3Ms9c8KUM6Ud59uqrK1vbG5Vt2s7u3v7B/bhUVclmSS0QxKeyH6IFeVM0I5mmtN+KimOQ0574eSm8HuPVCqWiAc9Takf45FgESNYGymwTzyBQ46DPkJejPU4DPPbGQrsutNw5kCrxC1JHUq0A/vLGyYki6nQhGOlBq6Taj/HUjPC6azmZYqmmEzwiA4MFTimys/n8Wfo3ChDFCXSPKHRXP29keNYqWkcmskiolr2CvE/b5DpqOnnTKSZpoIsDkUZRzpBRRdoyCQlmk8NwUQykxWRMZaYaNNYzZTgLn95lXQvG67TcO+v6q1mWUcVTuEMLsCFa2jBHbShAwRyeIZXeLOerBfr3fpYjFascucY/sD6/AEl75Tq</latexit><latexit sha1_base64=\"4QmnqVAZoGZcfv4Vrd2WoALPJTw=\">AAAB/nicbVDLSsNAFL2pr1pfUXHlZrAIrkoigl0WdOGygn1AE8JkOmmHTiZhZiKUUPBX3LhQxK3f4c6/cdJmoa0HBg7n3Ms9c8KUM6Ud59uqrK1vbG5Vt2s7u3v7B/bhUVclmSS0QxKeyH6IFeVM0I5mmtN+KimOQ0574eSm8HuPVCqWiAc9Takf45FgESNYGymwTzyBQ46DPkJejPU4DPPbGQrsutNw5kCrxC1JHUq0A/vLGyYki6nQhGOlBq6Taj/HUjPC6azmZYqmmEzwiA4MFTimys/n8Wfo3ChDFCXSPKHRXP29keNYqWkcmskiolr2CvE/b5DpqOnnTKSZpoIsDkUZRzpBRRdoyCQlmk8NwUQykxWRMZaYaNNYzZTgLn95lXQvG67TcO+v6q1mWUcVTuEMLsCFa2jBHbShAwRyeIZXeLOerBfr3fpYjFascucY/sD6/AEl75Tq</latexit><latexit sha1_base64=\"4QmnqVAZoGZcfv4Vrd2WoALPJTw=\">AAAB/nicbVDLSsNAFL2pr1pfUXHlZrAIrkoigl0WdOGygn1AE8JkOmmHTiZhZiKUUPBX3LhQxK3f4c6/cdJmoa0HBg7n3Ms9c8KUM6Ud59uqrK1vbG5Vt2s7u3v7B/bhUVclmSS0QxKeyH6IFeVM0I5mmtN+KimOQ0574eSm8HuPVCqWiAc9Takf45FgESNYGymwTzyBQ46DPkJejPU4DPPbGQrsutNw5kCrxC1JHUq0A/vLGyYki6nQhGOlBq6Taj/HUjPC6azmZYqmmEzwiA4MFTimys/n8Wfo3ChDFCXSPKHRXP29keNYqWkcmskiolr2CvE/b5DpqOnnTKSZpoIsDkUZRzpBRRdoyCQlmk8NwUQykxWRMZaYaNNYzZTgLn95lXQvG67TcO+v6q1mWUcVTuEMLsCFa2jBHbShAwRyeIZXeLOerBfr3fpYjFascucY/sD6/AEl75Tq</latexit>rYD<latexit sha1_base64=\"rSL6014zJx4Aw6fEEBNoQy0TIIk=\">AAAB/nicbVDLSsNAFL3xWesrKq7cDBbBVUlEsMuCLlxWsA9pQphMJ+3QySTMTIQSCv6KGxeKuPU73Pk3TtostPXAwOGce7lnTphyprTjfFsrq2vrG5uVrer2zu7evn1w2FFJJgltk4QnshdiRTkTtK2Z5rSXSorjkNNuOL4u/O4jlYol4l5PUurHeChYxAjWRgrsY0/gkOPgASEvxnoUhvnNFAV2zak7M6Bl4pakBiVagf3lDRKSxVRowrFSfddJtZ9jqRnhdFr1MkVTTMZ4SPuGChxT5eez+FN0ZpQBihJpntBopv7eyHGs1CQOzWQRUS16hfif18901PBzJtJMU0Hmh6KMI52gogs0YJISzSeGYCKZyYrICEtMtGmsakpwF7+8TDoXddepu3eXtWajrKMCJ3AK5+DCFTThFlrQBgI5PMMrvFlP1ov1bn3MR1escucI/sD6/AEngJTr</latexit><latexit sha1_base64=\"rSL6014zJx4Aw6fEEBNoQy0TIIk=\">AAAB/nicbVDLSsNAFL3xWesrKq7cDBbBVUlEsMuCLlxWsA9pQphMJ+3QySTMTIQSCv6KGxeKuPU73Pk3TtostPXAwOGce7lnTphyprTjfFsrq2vrG5uVrer2zu7evn1w2FFJJgltk4QnshdiRTkTtK2Z5rSXSorjkNNuOL4u/O4jlYol4l5PUurHeChYxAjWRgrsY0/gkOPgASEvxnoUhvnNFAV2zak7M6Bl4pakBiVagf3lDRKSxVRowrFSfddJtZ9jqRnhdFr1MkVTTMZ4SPuGChxT5eez+FN0ZpQBihJpntBopv7eyHGs1CQOzWQRUS16hfif18901PBzJtJMU0Hmh6KMI52gogs0YJISzSeGYCKZyYrICEtMtGmsakpwF7+8TDoXddepu3eXtWajrKMCJ3AK5+DCFTThFlrQBgI5PMMrvFlP1ov1bn3MR1escucI/sD6/AEngJTr</latexit><latexit sha1_base64=\"rSL6014zJx4Aw6fEEBNoQy0TIIk=\">AAAB/nicbVDLSsNAFL3xWesrKq7cDBbBVUlEsMuCLlxWsA9pQphMJ+3QySTMTIQSCv6KGxeKuPU73Pk3TtostPXAwOGce7lnTphyprTjfFsrq2vrG5uVrer2zu7evn1w2FFJJgltk4QnshdiRTkTtK2Z5rSXSorjkNNuOL4u/O4jlYol4l5PUurHeChYxAjWRgrsY0/gkOPgASEvxnoUhvnNFAV2zak7M6Bl4pakBiVagf3lDRKSxVRowrFSfddJtZ9jqRnhdFr1MkVTTMZ4SPuGChxT5eez+FN0ZpQBihJpntBopv7eyHGs1CQOzWQRUS16hfif18901PBzJtJMU0Hmh6KMI52gogs0YJISzSeGYCKZyYrICEtMtGmsakpwF7+8TDoXddepu3eXtWajrKMCJ3AK5+DCFTThFlrQBgI5PMMrvFlP1ov1bn3MR1escucI/sD6/AEngJTr</latexit><latexit sha1_base64=\"rSL6014zJx4Aw6fEEBNoQy0TIIk=\">AAAB/nicbVDLSsNAFL3xWesrKq7cDBbBVUlEsMuCLlxWsA9pQphMJ+3QySTMTIQSCv6KGxeKuPU73Pk3TtostPXAwOGce7lnTphyprTjfFsrq2vrG5uVrer2zu7evn1w2FFJJgltk4QnshdiRTkTtK2Z5rSXSorjkNNuOL4u/O4jlYol4l5PUurHeChYxAjWRgrsY0/gkOPgASEvxnoUhvnNFAV2zak7M6Bl4pakBiVagf3lDRKSxVRowrFSfddJtZ9jqRnhdFr1MkVTTMZ4SPuGChxT5eez+FN0ZpQBihJpntBopv7eyHGs1CQOzWQRUS16hfif18901PBzJtJMU0Hmh6KMI52gogs0YJISzSeGYCKZyYrICEtMtGmsakpwF7+8TDoXddepu3eXtWajrKMCJ3AK5+DCFTThFlrQBgI5PMMrvFlP1ov1bn3MR1escucI/sD6/AEngJTr</latexit>Normal ClientMalicious Attacker[0.2, 0.7, 0.1]Differentiable Model F(x\u2019, W)Pred\u2019Loss\u2019[0, 1, 0]Differentiable Model F(x, W)PredLossNormal ParticipantMalicious AttackerTry to matchTable 1@D/@X<latexit sha1_base64=\"exZPuHJPrYbR0p/+Aezm6ffhGNM=\">AAACCXicbVDLSsNAFL2pr1pfUZduBovgqiYi2GVBFy4r2Ac0oUymk3boZBJmJkIJ3brxV9y4UMStf+DOv3HSBtTWAwOHc+69c+8JEs6Udpwvq7Syura+Ud6sbG3v7O7Z+wdtFaeS0BaJeSy7AVaUM0FbmmlOu4mkOAo47QTjq9zv3FOpWCzu9CShfoSHgoWMYG2kvo28BEvNMEdehPUoCLLrKTr7Ubt9u+rUnBnQMnELUoUCzb796Q1ikkZUaMKxUj3XSbSf5fMIp9OKlyqaYDLGQ9ozVOCIKj+bXTJFJ0YZoDCW5gmNZurvjgxHSk2iwFTm66pFLxf/83qpDut+xkSSairI/KMw5UjHKI8FDZikRPOJIZhIZnZFZIQlJtqEVzEhuIsnL5P2ec11au7tRbVRL+IowxEcwym4cAkNuIEmtIDAAzzBC7xaj9az9Wa9z0tLVtFzCH9gfXwDet6ZgA==</latexit><latexit sha1_base64=\"exZPuHJPrYbR0p/+Aezm6ffhGNM=\">AAACCXicbVDLSsNAFL2pr1pfUZduBovgqiYi2GVBFy4r2Ac0oUymk3boZBJmJkIJ3brxV9y4UMStf+DOv3HSBtTWAwOHc+69c+8JEs6Udpwvq7Syura+Ud6sbG3v7O7Z+wdtFaeS0BaJeSy7AVaUM0FbmmlOu4mkOAo47QTjq9zv3FOpWCzu9CShfoSHgoWMYG2kvo28BEvNMEdehPUoCLLrKTr7Ubt9u+rUnBnQMnELUoUCzb796Q1ikkZUaMKxUj3XSbSf5fMIp9OKlyqaYDLGQ9ozVOCIKj+bXTJFJ0YZoDCW5gmNZurvjgxHSk2iwFTm66pFLxf/83qpDut+xkSSairI/KMw5UjHKI8FDZikRPOJIZhIZnZFZIQlJtqEVzEhuIsnL5P2ec11au7tRbVRL+IowxEcwym4cAkNuIEmtIDAAzzBC7xaj9az9Wa9z0tLVtFzCH9gfXwDet6ZgA==</latexit><latexit sha1_base64=\"exZPuHJPrYbR0p/+Aezm6ffhGNM=\">AAACCXicbVDLSsNAFL2pr1pfUZduBovgqiYi2GVBFy4r2Ac0oUymk3boZBJmJkIJ3brxV9y4UMStf+DOv3HSBtTWAwOHc+69c+8JEs6Udpwvq7Syura+Ud6sbG3v7O7Z+wdtFaeS0BaJeSy7AVaUM0FbmmlOu4mkOAo47QTjq9zv3FOpWCzu9CShfoSHgoWMYG2kvo28BEvNMEdehPUoCLLrKTr7Ubt9u+rUnBnQMnELUoUCzb796Q1ikkZUaMKxUj3XSbSf5fMIp9OKlyqaYDLGQ9ozVOCIKj+bXTJFJ0YZoDCW5gmNZurvjgxHSk2iwFTm66pFLxf/83qpDut+xkSSairI/KMw5UjHKI8FDZikRPOJIZhIZnZFZIQlJtqEVzEhuIsnL5P2ec11au7tRbVRL+IowxEcwym4cAkNuIEmtIDAAzzBC7xaj9az9Wa9z0tLVtFzCH9gfXwDet6ZgA==</latexit><latexit sha1_base64=\"exZPuHJPrYbR0p/+Aezm6ffhGNM=\">AAACCXicbVDLSsNAFL2pr1pfUZduBovgqiYi2GVBFy4r2Ac0oUymk3boZBJmJkIJ3brxV9y4UMStf+DOv3HSBtTWAwOHc+69c+8JEs6Udpwvq7Syura+Ud6sbG3v7O7Z+wdtFaeS0BaJeSy7AVaUM0FbmmlOu4mkOAo47QTjq9zv3FOpWCzu9CShfoSHgoWMYG2kvo28BEvNMEdehPUoCLLrKTr7Ubt9u+rUnBnQMnELUoUCzb796Q1ikkZUaMKxUj3XSbSf5fMIp9OKlyqaYDLGQ9ozVOCIKj+bXTJFJ0YZoDCW5gmNZurvjgxHSk2iwFTm66pFLxf/83qpDut+xkSSairI/KMw5UjHKI8FDZikRPOJIZhIZnZFZIQlJtqEVzEhuIsnL5P2ec11au7tRbVRL+IowxEcwym4cAkNuIEmtIDAAzzBC7xaj9az9Wa9z0tLVtFzCH9gfXwDet6ZgA==</latexit>@D/@Y<latexit sha1_base64=\"y0X4btE7egLo85xycGd8zg1c7+I=\">AAACCXicbVDLSsNAFL3xWesr6tLNYBFc1UQEuyzowmUF+5AmlMl00g6dTMLMRCihWzf+ihsXirj1D9z5N07agNp6YOBwzr137j1BwpnSjvNlLS2vrK6tlzbKm1vbO7v23n5LxakktEliHstOgBXlTNCmZprTTiIpjgJO28HoMvfb91QqFotbPU6oH+GBYCEjWBupZyMvwVIzzJEXYT0Mguxqgk5/1LueXXGqzhRokbgFqUCBRs/+9PoxSSMqNOFYqa7rJNrP8nmE00nZSxVNMBnhAe0aKnBElZ9NL5mgY6P0URhL84RGU/V3R4YjpcZRYCrzddW8l4v/ed1UhzU/YyJJNRVk9lGYcqRjlMeC+kxSovnYEEwkM7siMsQSE23CK5sQ3PmTF0nrrOo6VffmvFKvFXGU4BCO4ARcuIA6XEMDmkDgAZ7gBV6tR+vZerPeZ6VLVtFzAH9gfXwDfGKZgQ==</latexit><latexit sha1_base64=\"y0X4btE7egLo85xycGd8zg1c7+I=\">AAACCXicbVDLSsNAFL3xWesr6tLNYBFc1UQEuyzowmUF+5AmlMl00g6dTMLMRCihWzf+ihsXirj1D9z5N07agNp6YOBwzr137j1BwpnSjvNlLS2vrK6tlzbKm1vbO7v23n5LxakktEliHstOgBXlTNCmZprTTiIpjgJO28HoMvfb91QqFotbPU6oH+GBYCEjWBupZyMvwVIzzJEXYT0Mguxqgk5/1LueXXGqzhRokbgFqUCBRs/+9PoxSSMqNOFYqa7rJNrP8nmE00nZSxVNMBnhAe0aKnBElZ9NL5mgY6P0URhL84RGU/V3R4YjpcZRYCrzddW8l4v/ed1UhzU/YyJJNRVk9lGYcqRjlMeC+kxSovnYEEwkM7siMsQSE23CK5sQ3PmTF0nrrOo6VffmvFKvFXGU4BCO4ARcuIA6XEMDmkDgAZ7gBV6tR+vZerPeZ6VLVtFzAH9gfXwDfGKZgQ==</latexit><latexit sha1_base64=\"y0X4btE7egLo85xycGd8zg1c7+I=\">AAACCXicbVDLSsNAFL3xWesr6tLNYBFc1UQEuyzowmUF+5AmlMl00g6dTMLMRCihWzf+ihsXirj1D9z5N07agNp6YOBwzr137j1BwpnSjvNlLS2vrK6tlzbKm1vbO7v23n5LxakktEliHstOgBXlTNCmZprTTiIpjgJO28HoMvfb91QqFotbPU6oH+GBYCEjWBupZyMvwVIzzJEXYT0Mguxqgk5/1LueXXGqzhRokbgFqUCBRs/+9PoxSSMqNOFYqa7rJNrP8nmE00nZSxVNMBnhAe0aKnBElZ9NL5mgY6P0URhL84RGU/V3R4YjpcZRYCrzddW8l4v/ed1UhzU/YyJJNRVk9lGYcqRjlMeC+kxSovnYEEwkM7siMsQSE23CK5sQ3PmTF0nrrOo6VffmvFKvFXGU4BCO4ARcuIA6XEMDmkDgAZ7gBV6tR+vZerPeZ6VLVtFzAH9gfXwDfGKZgQ==</latexit><latexit sha1_base64=\"y0X4btE7egLo85xycGd8zg1c7+I=\">AAACCXicbVDLSsNAFL3xWesr6tLNYBFc1UQEuyzowmUF+5AmlMl00g6dTMLMRCihWzf+ihsXirj1D9z5N07agNp6YOBwzr137j1BwpnSjvNlLS2vrK6tlzbKm1vbO7v23n5LxakktEliHstOgBXlTNCmZprTTiIpjgJO28HoMvfb91QqFotbPU6oH+GBYCEjWBupZyMvwVIzzJEXYT0Mguxqgk5/1LueXXGqzhRokbgFqUCBRs/+9PoxSSMqNOFYqa7rJNrP8nmE00nZSxVNMBnhAe0aKnBElZ9NL5mgY6P0URhL84RGU/V3R4YjpcZRYCrzddW8l4v/ed1UhzU/YyJJNRVk9lGYcqRjlMeC+kxSovnYEEwkM7siMsQSE23CK5sQ3PmTF0nrrOo6VffmvFKvFXGU4BCO4ARcuIA6XEMDmkDgAZ7gBV6tR+vZerPeZ6VLVtFzAH9gfXwDfGKZgQ==</latexit>D=||rW0rW||2<latexit sha1_base64=\"ZHcrSD9GJX5ix03Zh0PiGAM2nZo=\">AAACEnicbVDLSsNAFJ34rPUVdelmsIi6sCRFsBuhoAuXFewDmlgm00k7dDIJMxOhpPkGN/6KGxeKuHXlzr9x0kbQ1gMDh3Pu5c45XsSoVJb1ZSwsLi2vrBbWiusbm1vb5s5uU4axwKSBQxaKtockYZSThqKKkXYkCAo8Rlre8DLzW/dESBryWzWKiBugPqc+xUhpqWueOAFSA89LrlJ4AcdjhyOPIdg6gqfwh4/Hd0kl7Zolq2xNAOeJnZMSyFHvmp9OL8RxQLjCDEnZsa1IuQkSimJG0qITSxIhPER90tGUo4BIN5lESuGhVnrQD4V+XMGJ+nsjQYGUo8DTk1kAOetl4n9eJ1Z+1U0oj2JFOJ4e8mMGVQizfmCPCoIVG2mCsKD6rxAPkEBY6RaLugR7NvI8aVbKtlW2b85KtWpeRwHsgwNwDGxwDmrgGtRBA2DwAJ7AC3g1Ho1n4814n44uGPnOHvgD4+MbFOmcbA==</latexit><latexit sha1_base64=\"ZHcrSD9GJX5ix03Zh0PiGAM2nZo=\">AAACEnicbVDLSsNAFJ34rPUVdelmsIi6sCRFsBuhoAuXFewDmlgm00k7dDIJMxOhpPkGN/6KGxeKuHXlzr9x0kbQ1gMDh3Pu5c45XsSoVJb1ZSwsLi2vrBbWiusbm1vb5s5uU4axwKSBQxaKtockYZSThqKKkXYkCAo8Rlre8DLzW/dESBryWzWKiBugPqc+xUhpqWueOAFSA89LrlJ4AcdjhyOPIdg6gqfwh4/Hd0kl7Zolq2xNAOeJnZMSyFHvmp9OL8RxQLjCDEnZsa1IuQkSimJG0qITSxIhPER90tGUo4BIN5lESuGhVnrQD4V+XMGJ+nsjQYGUo8DTk1kAOetl4n9eJ1Z+1U0oj2JFOJ4e8mMGVQizfmCPCoIVG2mCsKD6rxAPkEBY6RaLugR7NvI8aVbKtlW2b85KtWpeRwHsgwNwDGxwDmrgGtRBA2DwAJ7AC3g1Ho1n4814n44uGPnOHvgD4+MbFOmcbA==</latexit><latexit sha1_base64=\"ZHcrSD9GJX5ix03Zh0PiGAM2nZo=\">AAACEnicbVDLSsNAFJ34rPUVdelmsIi6sCRFsBuhoAuXFewDmlgm00k7dDIJMxOhpPkGN/6KGxeKuHXlzr9x0kbQ1gMDh3Pu5c45XsSoVJb1ZSwsLi2vrBbWiusbm1vb5s5uU4axwKSBQxaKtockYZSThqKKkXYkCAo8Rlre8DLzW/dESBryWzWKiBugPqc+xUhpqWueOAFSA89LrlJ4AcdjhyOPIdg6gqfwh4/Hd0kl7Zolq2xNAOeJnZMSyFHvmp9OL8RxQLjCDEnZsa1IuQkSimJG0qITSxIhPER90tGUo4BIN5lESuGhVnrQD4V+XMGJ+nsjQYGUo8DTk1kAOetl4n9eJ1Z+1U0oj2JFOJ4e8mMGVQizfmCPCoIVG2mCsKD6rxAPkEBY6RaLugR7NvI8aVbKtlW2b85KtWpeRwHsgwNwDGxwDmrgGtRBA2DwAJ7AC3g1Ho1n4814n44uGPnOHvgD4+MbFOmcbA==</latexit><latexit sha1_base64=\"ZHcrSD9GJX5ix03Zh0PiGAM2nZo=\">AAACEnicbVDLSsNAFJ34rPUVdelmsIi6sCRFsBuhoAuXFewDmlgm00k7dDIJMxOhpPkGN/6KGxeKuHXlzr9x0kbQ1gMDh3Pu5c45XsSoVJb1ZSwsLi2vrBbWiusbm1vb5s5uU4axwKSBQxaKtockYZSThqKKkXYkCAo8Rlre8DLzW/dESBryWzWKiBugPqc+xUhpqWueOAFSA89LrlJ4AcdjhyOPIdg6gqfwh4/Hd0kl7Zolq2xNAOeJnZMSyFHvmp9OL8RxQLjCDEnZsa1IuQkSimJG0qITSxIhPER90tGUo4BIN5lESuGhVnrQD4V+XMGJ+nsjQYGUo8DTk1kAOetl4n9eJ1Z+1U0oj2JFOJ4e8mMGVQizfmCPCoIVG2mCsKD6rxAPkEBY6RaLugR7NvI8aVbKtlW2b85KtWpeRwHsgwNwDGxwDmrgGtRBA2DwAJ7AC3g1Ho1n4814n44uGPnOHvgD4+MbFOmcbA==</latexit>rW0<latexit sha1_base64=\"Im5GdX2QSqf9bsuGMt3KJ1EK1Gw=\">AAAB8HicdVDLSgMxFM3UV62vqks3wSK6GjKtj7oruHFZwT6kHUomzbShSWZIMkIZ+hVuXCji1s9x59+YaUdQ0QMXDufcy733BDFn2iD04RSWlldW14rrpY3Nre2d8u5eW0eJIrRFIh6pboA15UzSlmGG026sKBYBp51gcpX5nXuqNIvkrZnG1Bd4JFnICDZWuutLHHAMO8eDcgW5l8g7r3sQuWiOjJzVqtUa9HKlAnI0B+X3/jAiiaDSEI617nkoNn6KlWGE01mpn2gaYzLBI9qzVGJBtZ/OD57BI6sMYRgpW9LAufp9IsVC66kIbKfAZqx/e5n4l9dLTFj3UybjxFBJFovChEMTwex7OGSKEsOnlmCimL0VkjFWmBibUcmG8PUp/J+0q66HXO/mtNKo53EUwQE4BCfAAxegAa5BE7QAAQI8gCfw7Cjn0XlxXhetBSef2Qc/4Lx9Ahymj+o=</latexit><latexit sha1_base64=\"Im5GdX2QSqf9bsuGMt3KJ1EK1Gw=\">AAAB8HicdVDLSgMxFM3UV62vqks3wSK6GjKtj7oruHFZwT6kHUomzbShSWZIMkIZ+hVuXCji1s9x59+YaUdQ0QMXDufcy733BDFn2iD04RSWlldW14rrpY3Nre2d8u5eW0eJIrRFIh6pboA15UzSlmGG026sKBYBp51gcpX5nXuqNIvkrZnG1Bd4JFnICDZWuutLHHAMO8eDcgW5l8g7r3sQuWiOjJzVqtUa9HKlAnI0B+X3/jAiiaDSEI617nkoNn6KlWGE01mpn2gaYzLBI9qzVGJBtZ/OD57BI6sMYRgpW9LAufp9IsVC66kIbKfAZqx/e5n4l9dLTFj3UybjxFBJFovChEMTwex7OGSKEsOnlmCimL0VkjFWmBibUcmG8PUp/J+0q66HXO/mtNKo53EUwQE4BCfAAxegAa5BE7QAAQI8gCfw7Cjn0XlxXhetBSef2Qc/4Lx9Ahymj+o=</latexit><latexit sha1_base64=\"Im5GdX2QSqf9bsuGMt3KJ1EK1Gw=\">AAAB8HicdVDLSgMxFM3UV62vqks3wSK6GjKtj7oruHFZwT6kHUomzbShSWZIMkIZ+hVuXCji1s9x59+YaUdQ0QMXDufcy733BDFn2iD04RSWlldW14rrpY3Nre2d8u5eW0eJIrRFIh6pboA15UzSlmGG026sKBYBp51gcpX5nXuqNIvkrZnG1Bd4JFnICDZWuutLHHAMO8eDcgW5l8g7r3sQuWiOjJzVqtUa9HKlAnI0B+X3/jAiiaDSEI617nkoNn6KlWGE01mpn2gaYzLBI9qzVGJBtZ/OD57BI6sMYRgpW9LAufp9IsVC66kIbKfAZqx/e5n4l9dLTFj3UybjxFBJFovChEMTwex7OGSKEsOnlmCimL0VkjFWmBibUcmG8PUp/J+0q66HXO/mtNKo53EUwQE4BCfAAxegAa5BE7QAAQI8gCfw7Cjn0XlxXhetBSef2Qc/4Lx9Ahymj+o=</latexit><latexit sha1_base64=\"Im5GdX2QSqf9bsuGMt3KJ1EK1Gw=\">AAAB8HicdVDLSgMxFM3UV62vqks3wSK6GjKtj7oruHFZwT6kHUomzbShSWZIMkIZ+hVuXCji1s9x59+YaUdQ0QMXDufcy733BDFn2iD04RSWlldW14rrpY3Nre2d8u5eW0eJIrRFIh6pboA15UzSlmGG026sKBYBp51gcpX5nXuqNIvkrZnG1Bd4JFnICDZWuutLHHAMO8eDcgW5l8g7r3sQuWiOjJzVqtUa9HKlAnI0B+X3/jAiiaDSEI617nkoNn6KlWGE01mpn2gaYzLBI9qzVGJBtZ/OD57BI6sMYRgpW9LAufp9IsVC66kIbKfAZqx/e5n4l9dLTFj3UybjxFBJFovChEMTwex7OGSKEsOnlmCimL0VkjFWmBibUcmG8PUp/J+0q66HXO/mtNKo53EUwQE4BCfAAxegAa5BE7QAAQI8gCfw7Cjn0XlxXhetBSef2Qc/4Lx9Ahymj+o=</latexit>rW<latexit sha1_base64=\"rSfF52eD299KNblyESkZ7BtO9ek=\">AAAB73icdVDLSgNBEOz1GeMr6tHLYBA8LbOJj3gLePEYwTwgWcLsZDYZMju7zswKIeQnvHhQxKu/482/cTZZQUULGoqqbrq7gkRwbTD+cJaWV1bX1gsbxc2t7Z3d0t5+S8epoqxJYxGrTkA0E1yypuFGsE6iGIkCwdrB+Crz2/dMaR7LWzNJmB+RoeQhp8RYqdOTJBAEtfulMnYvsXde8xB28RwZOatWKlXk5UoZcjT6pffeIKZpxKShgmjd9XBi/ClRhlPBZsVeqllC6JgMWddSSSKm/en83hk6tsoAhbGyJQ2aq98npiTSehIFtjMiZqR/e5n4l9dNTVjzp1wmqWGSLhaFqUAmRtnzaMAVo0ZMLCFUcXsroiOiCDU2oqIN4etT9D9pVVwPu97Nabley+MowCEcwQl4cAF1uIYGNIGCgAd4gmfnznl0XpzXReuSk88cwA84b5+5uI+5</latexit><latexit sha1_base64=\"rSfF52eD299KNblyESkZ7BtO9ek=\">AAAB73icdVDLSgNBEOz1GeMr6tHLYBA8LbOJj3gLePEYwTwgWcLsZDYZMju7zswKIeQnvHhQxKu/482/cTZZQUULGoqqbrq7gkRwbTD+cJaWV1bX1gsbxc2t7Z3d0t5+S8epoqxJYxGrTkA0E1yypuFGsE6iGIkCwdrB+Crz2/dMaR7LWzNJmB+RoeQhp8RYqdOTJBAEtfulMnYvsXde8xB28RwZOatWKlXk5UoZcjT6pffeIKZpxKShgmjd9XBi/ClRhlPBZsVeqllC6JgMWddSSSKm/en83hk6tsoAhbGyJQ2aq98npiTSehIFtjMiZqR/e5n4l9dNTVjzp1wmqWGSLhaFqUAmRtnzaMAVo0ZMLCFUcXsroiOiCDU2oqIN4etT9D9pVVwPu97Nabley+MowCEcwQl4cAF1uIYGNIGCgAd4gmfnznl0XpzXReuSk88cwA84b5+5uI+5</latexit><latexit sha1_base64=\"rSfF52eD299KNblyESkZ7BtO9ek=\">AAAB73icdVDLSgNBEOz1GeMr6tHLYBA8LbOJj3gLePEYwTwgWcLsZDYZMju7zswKIeQnvHhQxKu/482/cTZZQUULGoqqbrq7gkRwbTD+cJaWV1bX1gsbxc2t7Z3d0t5+S8epoqxJYxGrTkA0E1yypuFGsE6iGIkCwdrB+Crz2/dMaR7LWzNJmB+RoeQhp8RYqdOTJBAEtfulMnYvsXde8xB28RwZOatWKlXk5UoZcjT6pffeIKZpxKShgmjd9XBi/ClRhlPBZsVeqllC6JgMWddSSSKm/en83hk6tsoAhbGyJQ2aq98npiTSehIFtjMiZqR/e5n4l9dNTVjzp1wmqWGSLhaFqUAmRtnzaMAVo0ZMLCFUcXsroiOiCDU2oqIN4etT9D9pVVwPu97Nabley+MowCEcwQl4cAF1uIYGNIGCgAd4gmfnznl0XpzXReuSk88cwA84b5+5uI+5</latexit><latexit sha1_base64=\"rSfF52eD299KNblyESkZ7BtO9ek=\">AAAB73icdVDLSgNBEOz1GeMr6tHLYBA8LbOJj3gLePEYwTwgWcLsZDYZMju7zswKIeQnvHhQxKu/482/cTZZQUULGoqqbrq7gkRwbTD+cJaWV1bX1gsbxc2t7Z3d0t5+S8epoqxJYxGrTkA0E1yypuFGsE6iGIkCwdrB+Crz2/dMaR7LWzNJmB+RoeQhp8RYqdOTJBAEtfulMnYvsXde8xB28RwZOatWKlXk5UoZcjT6pffeIKZpxKShgmjd9XBi/ClRhlPBZsVeqllC6JgMWddSSSKm/en83hk6tsoAhbGyJQ2aq98npiTSehIFtjMiZqR/e5n4l9dNTVjzp1wmqWGSLhaFqUAmRtnzaMAVo0ZMLCFUcXsroiOiCDU2oqIN4etT9D9pVVwPu97Nabley+MowCEcwQl4cAF1uIYGNIGCgAd4gmfnznl0XpzXReuSk88cwA84b5+5uI+5</latexit>\fIters=0\n\nIters=10\n\nIters=50\n\nIters=100\n\nIters=500 Melis [27] Ground Truth\n\nFigure 3: The visualization showing the deep leakage on images from MNIST [22], CIFAR-100 [21],\nSVHN [28] and LFW [14] respectively. Our algorithm fully recovers the four images while previous\nwork only succeeds on simple images with clean backgrounds.\n\nFigure 4: Layer-i means MSE between real and\ndummy gradients of ith layer. When the gradients\u2019\ndistance gets smaller, the MSE between leaked\nimage and the original image also gets smaller.\n\nFigure 5: Compassion of the MSE of images\nleaked by different algorithms and the ground\ntruth. Our method consistently outperforms\nprevious approach by a large margin.\n\n4 Experiments\n\nSetup.\nImplementing algorithm. 1 requires to calculate the high order gradients and we choose\nPyTorch [29] as our experiment platform. We use L-BFGS [25] with learning rate 1, history size\n100 and max iterations 20 and optimize for 1200 iterations and 100 iterations for image and text\ntask respectively. We aim to match gradients from all trainable parameters. Notably, DLG has no\nrequirements on the model\u2019s convergence status, in another word, the attack can happen anytime\nduring the training. To be more general, all our experiments are using randomly initialized weights.\nMore task-speci\ufb01c details can be found in the following sub-sections.\n\n4.1 Deep Leakage on Image Classi\ufb01cation\n\nGiven an image containing objects, images classi\ufb01cation aims to determine the class of the item.\nWe experiment our algorithm on modern CNN architectures ResNet-56 [12] and pictures from\nMNIST [22], CIFAR-100 [21], SVHN [28] and LFW [14]. Two changes we have made to the models\nare replacing activation ReLU to Sigmoid and removing strides, as our algorithm requires the model\nto be twice-differentiable. For image labels, instead of directly optimizing the discrete categorical\nvalues, we random initialize a vector with shape N \u00d7 C where N is the batch size and C is the\nnumber of classes, and then take its softmax output as the one-hot label for optimization.\nThe leaking process is visualized in Fig. 3. We start with random Gaussian noise (\ufb01rst column) and\ntry to match the gradients produced by the dummy data and real ones. As shown in Fig 4, minimizing\nthe distance between gradients also reduces the gap between data. We observe that monochrome\n\n5\n\nMean Square Error0.00.10.20.20.3MNISTCIFARSVHNLFWMelisOursTable 1MNISTCIFARSVHNLFWOurs0.00380.00690.00510.0055Melis0.22750.25780.27710.2951Mean Square Error0.00.10.20.20.3MNISTCIFARSVHNLFWMelisOursTable 1MNISTCIFARSVHNLFWOurs0.00380.00690.00510.0055Melis0.22750.25780.27710.2951\fInitial Sen-\ntence\n\nIters = 10\n\nIters = 20\n\nIters = 30\n\nOriginal\nText\n\nExample 1\ntilting \ufb01ll given **less word\n**itude \ufb01ne **nton over-\nheard living vegas **vac\n**vation *f forte **dis ce-\nrambycidae ellison **don\nyards marne **kali\ntilting \ufb01ll given **less full\nsolicitor other ligue shrill\nliving vegas rider treatment\ncarry played sculptures life-\nlong ellison net yards marne\n**kali\nregistration , volunteer ap-\nplications , at student travel\napplication open the ; week\nof played ; child care will be\nglare .\n\nregistration , volunteer ap-\nplications , and student\ntravel application open the\n\ufb01rst week of september .\nchild care will be available .\n\nRegistration,\nvolunteer\napplications, and student\ntravel application open the\n\ufb01rst week of September.\nChild care will be available.\n\nExample 2\ntoni **enting asbestos cut-\nler km nail **oof **dation\n**ori righteous **xie lucan\n**hot **ery at **tle ordered\npa **eit smashing proto\n\ntoni **enting asbestos cutter\nkm nail undefeated **dation\nhole righteous **xie lucan\n**hot **ery at **tle ordered\npa **eit smashing proto\n\nwe welcome proposals for\ntutor **ials on either core\nmachine denver softly or\ntopics of emerging impor-\ntance for machine learning\n.\nwe welcome proposals for\ntutor **ials on either core\nmachine learning topics or\ntopics of emerging impor-\ntance for machine learning\n.\nWe welcome proposals for\ntutorials on either core ma-\nchine learning topics or top-\nics of emerging importance\nfor machine learning.\n\n**ry\n\nExample 3\n[MASK]\ntoppled\n**wled major relief dive\ndisplaced **lice [CLS] us\napps _ **face **bet\n\n[MASK] **ry toppled iden-\nti\ufb01ed major relief gin dive\ndisplaced **lice doll us\napps _ **face space\n\none **ry toppled hold major\nritual \u2019 dive annual confer-\nence days 1924 apps novel-\nist dude space\n\nwe invite submissions for\nthe thirty - third annual con-\nference on neural informa-\ntion processing systems .\n\nWe invite submissions for\nthe Thirty-Third Annual\nConference on Neural Infor-\nmation Processing Systems.\n\nTable 1: The progress of deep leakage on language tasks.\n\nimages with a clean background (MNIST) are easiest to recover, while complex images like face take\nmore iterations to recover (Fig. 3). When the optimization \ufb01nishes, the recover results are almost\nidentical to ground truth images, despite few negligible artifact pixels.\nWe visually compare the results from other method [27] and ours in Fig. 3. The previous method\nuses GAN models when the class label is given and only works well on MNIST. The result on\nSVHN, though is still visually recognizable as digit \u201c9\u201d, is no longer the original training image. The\ncases are even worse on LFW and collapse on CIFAR. We also make a numerical comparison by\nperforming leaking and measuring the MSE on all dataset images in Fig. 5. Images are normalized to\nthe range [0, 1] and our algorithm appears much better results (ours < 0.03 v.s. previous > 0.2) on\nall four datasets.\n\n4.2 Deep Leakage on Masked Language Model\n\nFor language task, we verify our algorithm on Masked Language Model (MLM) task. In each\nsequence, 15% of the words are replaced with a [MASK] token and MLM model attempts to predict\nthe original value of the masked words from a given context. We choose BERT [8] as our backbone\nand adapt hyperparameters from the of\ufb01cial implementation \u2217.\nDifferent from vision tasks where RGB inputs are continuous values, language models need to\npreprocess discrete words into embeddings. We apply DLG on embedding space and minimize the\ngradients distance between dummy embeddings and real ones. After optimization \ufb01nishes, we derive\noriginal words by \ufb01nding the closest entry in the embedding matrix reversely.\nIn Tab. 1, we exhibit the leaking history on three sentences selected from NeurIPS conference page.\nSimilar to the vision task, we start with randomly initialized embedding: the reverse query results at\niteration 0 is meaningless. During the optimization, the gradients produced by dummy embedding\ngradually match the original ones and so the embeddings. In later iterations, part of sequence\n\n\u2217https://github.com/google-research/bert\n\n6\n\n\fInitial\n\nMiddle Stage\n\nFully Leaked\n\nGround Truth\n\nFigure 6: Results of deep leakage of batched data. Though the order may not be the same and there\nare more artifact pixels, DLG still produces images very close to the original ones.\n\ngradually appears. In example 3, at iteration 20, \u2018annual conference\u2019 appeared and at iteration 30 and\nthe leaked sentence is already close to the original one. When DLG \ufb01nishes, though there are few\nmismatches caused by the ambiguity in tokenizing, the main content is already fully leaked.\n\n4.3 Deep Leakage for Batched Data\n\nThe algo. 1 works well when there is only a single pair of input and label in the batch. However when\nwe naively apply it to the case where batch size N \u2265 1, the algorithm would be too slow to converge.\nWe think the reason is that batched data can have N ! different permutations and thus make optimizer\nhard to choose gradient directions. To force the optimization closer to a solution, instead of updating\nthe whole batch, we update a single training sample instead. We modify the line 6 in algo. 1 to :\n\nt+1 \u2190 x(cid:48)i mod N\nx(cid:48)i mod N\nt+1 \u2190 y(cid:48)i mod N\ny(cid:48)i mod N\n\nt\n\nt\n\n\u2212 \u2207x(cid:48)i mod N\n\u2212 \u2207y(cid:48)i mod N\n\nt+1\n\nt+1\n\nD\nD\n\n(5)\n\nThen we can observe fast and stable convergence. We list the iterations required for convergence for\ndifferent batch sizes in Tab. 2 and provide visualized results in Fig. 6. The larger the batch size is, the\nmore iterations DLG requires to attack.\n\nResNet-20\n\nBS=1 BS=2 BS=4 BS=8\n2711\n270\n\n1173\n\n602\n\nTable 2: The iterations required for restore batched data on CIFAR [21] dataset.\n\n5 Defense Strategies\n\n5.1 Noisy Gradients\n\nOne straightforward attempt to defense DLG is to add noise on gradients before sharing. To evaluate,\nwe experiment Gaussian and Laplacian noise (widely used in differential privacy studies) distributions\nwith variance range from 10\u22121 to 10\u22124 and central 0. From Fig. 7a and 7b, we observe that the\ndefense effect mainly depends on the magnitude of distribution variance and less related to the noise\ntypes. When variance is at the scale of 10\u22124, the noisy gradients do not prevent the leak. For noise\nwith variance 10\u22123, though with artifacts, the leakage can still be performed. Only when the variance\nis larger than 10\u22122 and the noise is starting to affect the accuracy, DLG will fail to execute and\nLaplacian tends to slight better at scale 10\u22123. However, noise with variance larger than 10\u22122 will\ndegrade the accuracy signi\ufb01cantly (Tab. 3).\nAnother common perturbation on gradients is half-precision, which was initially designed to save\nGPU memory footprints and also widely used to reduce communication bandwidth. We test two\npopular half-precision implementations IEEE \ufb02oat16 (Single-precision \ufb02oating-point format) and\n\n7\n\n\f(a) Defend with different magnitude Gaussian noise.\n\n(b) Defend with different magnitude Laplacian noise.\n\n(c) Defend with fp16 convertion.\n\n(d) Defend with gradient pruning.\n\nFigure 7: The effectiveness of various defense strategies.\n\nAccuracy\n\nDefendability\n\nAccuracy\n\nDefendability\n\nOriginal G-10\u22124 G-10\u22123 G-10\u22122 G-10\u22121 FP-16\n\u22641% 76.1%\n76.3%\n\u0013\nInt-8\n\u22641% 53.7%\n\u0013\n\n75.6% 73.3% 45.3%\nL-10\u22124 L-10\u22123 L-10\u22122 L-10\u22121\n75.6% 73.4% 46.2%\n\n\u0013\n\n\u0013\n\n\u0017\n\n\u0017\n\n\u0017\n\n\u0017\n\n\u2013\n\n\u2013\n\u2013\n\n\u0017\n\n\u0013\n\nTable 3: The trade-off between accuracy and defendability. G: Gaussian noise, L: Laplacian noise,\nFP: Floating number, Int: Integer quantization. \u0013 means it successfully defends against DLG while\n\u0017 means fails to defend (whether the results are visually recognizable). The accuracy is evaluated on\nCIFAR-100.\n\nb\ufb02oat16 (Brain Floating Point [35], a truncated version of 32 bit \ufb02oat). Shown in Fig. 7c, both half-\nprecision formats fail to protect the training data. We also test another popular low-bit representation\nInt-8. Though it successfully prevents leakage, the performance drops seriously (Tab. 3).\n\n5.2 Gradient Compression and Sparsi\ufb01cation\n\nWe next experimented to defend by gradient compression [24, 36]: Gradients with small magnitudes\nare pruned to zero. It\u2019s more dif\ufb01cult for DLG to match the gradients as the optimization targets are\npruned. We evaluate how different levels of sparsities (range from 1% to 70%) defense the leakage.\nWhen sparsity is 1% to 10%, it has almost no effects against DLG. When prune ratio increases to\n20%, as shown in Fig. 7d, there are obvious artifact pixels on the recover images. We notice that the\nmaximum tolerance of sparsity is around 20%. When pruning ratio is larger, the recovered images\nare no longer visually recognizable and thus gradient compression successfully prevents the leakage.\nPrevious work [24, 36] show that gradients can be compressed by more than 300\u00d7 without losing\naccuracy by error compensation techniques. In this case, the sparsity is above 99% and already\n\n8\n\n020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalgaussian-104gaussian-103gaussian-102gaussian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginallaplacian-104laplacian-103laplacian-102laplacian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalIEEE-fp16B-fp16Deep Leakage020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalprune-ratio-1%prune-ratio-10%prune-ratio-20%prune-ratio-30%prune-ratio-50%prune-ratio-70%Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalgaussian-104gaussian-103gaussian-102gaussian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginallaplacian-104laplacian-103laplacian-102laplacian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalIEEE-fp16B-fp16Deep Leakage020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalprune-ratio-1%prune-ratio-10%prune-ratio-20%prune-ratio-30%prune-ratio-50%prune-ratio-70%Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalgaussian-104gaussian-103gaussian-102gaussian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginallaplacian-104laplacian-103laplacian-102laplacian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalIEEE-fp16B-fp16Deep Leakage020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalprune-ratio-1%prune-ratio-10%prune-ratio-20%prune-ratio-30%prune-ratio-50%prune-ratio-70%Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalgaussian-104gaussian-103gaussian-102gaussian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginallaplacian-104laplacian-103laplacian-102laplacian-101Deep LeakageLeak with artifactsNo leak020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalIEEE-fp16B-fp16Deep Leakage020040060080010001200Iterations0.0000.0250.0500.0750.1000.1250.150GradientMatchLossoriginalprune-ratio-1%prune-ratio-10%prune-ratio-20%prune-ratio-30%prune-ratio-50%prune-ratio-70%Deep LeakageLeak with artifactsNo leak\fexceeds the maximum tolerance of DLG (which is around 20%). It suggests that compressing the\ngradients is a practical approach to avoid the deep leakage.\n\n5.3 Large Batch, High Resolution and Cryptology\n\nIf changes in training settings are allowed, then there are more defense strategies. As suggested in\nTab. 2, increasing the batch size makes the leakage more dif\ufb01cult because there are more variables\nto solve during optimization. Following the idea, upscaling the input images can also be a good\ndefense, though some changes on CNN architectures is required. According to our experiments, DLG\ncurrently only works for a batch size up to 8 and image resolution up to 64\u00d764.\nBeside methods above, cryptology can also be used to prevent the leakage: Bonawitz et al. [5] designs\na secure aggregation protocol and Phong et al. [31] proposes to encrypt the gradients before sending.\nAmong all defenses, cryptology is the most secure one. However, both methods have their limitations\nand not general enough: secure aggregation [5] requires gradients to be integers thus not compatible\nwith most CNNs, and homomorphic encryption [31] is against parameter server only.\n\n6 Conclusions\n\nIn this paper, we introduce the Deep Leakage from Gradients (DLG): an algorithm that can obtain the\nlocal training data from public shared gradients. DLG does not rely on any generative model or extra\nprior about the data. Our experiments on vision and language tasks both demonstrate the critical\nrisks of such deep leakage and show that such deep leakage can be only prevented when defense\nstrategies start to degrade the accuracy. This sets a challenge to modern multi-node learning systems\n(e.g., distributed training, federated learning). We hope this work would raise people\u2019s awareness\nabout the security of gradients and bring the community to rethink the safety of the existing gradient\nsharing scheme.\n\nAcknowledgments\n\nWe sincerely thank MIT-IBM Watson AI lab, Intel, Facebook and AWS for supporting this work. We\nsincerely thank John Cohn for the discussions.\n\nReferences\n\n[1] Mart\u00edn Abadi, Ashish Agarwal, Paul Barham, Eugene Brevdo, Zhifeng Chen, Craig Citro, Greg S. Corrado,\nAndy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Ian Goodfellow, Andrew Harp, Geoffrey\nIrving, Michael Isard, Yangqing Jia, Rafal Jozefowicz, Lukasz Kaiser, Manjunath Kudlur, Josh Levenberg,\nDan Man\u00e9, Rajat Monga, Sherry Moore, Derek Murray, Chris Olah, Mike Schuster, Jonathon Shlens,\nBenoit Steiner, Ilya Sutskever, Kunal Talwar, Paul Tucker, Vincent Vanhoucke, Vijay Vasudevan, Fernanda\nVi\u00e9gas, Oriol Vinyals, Pete Warden, Martin Wattenberg, Martin Wicke, Yuan Yu, and Xiaoqiang Zheng.\nTensorFlow: Large-scale machine learning on heterogeneous systems, 2015. Software available from\ntensor\ufb02ow.org. 3\n\n[2] Takuya Akiba, Keisuke Fukuda, and Shuji Suzuki. ChainerMN: Scalable Distributed Deep Learning\nFramework. In Proceedings of Workshop on ML Systems in The Thirty-\ufb01rst Annual Conference on Neural\nInformation Processing Systems (NIPS), 2017. 3\n\n[3] Blaise Barney et al. Introduction to parallel computing. 1, 3\n[4] Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov,\nChloe Kiddon, Jakub Konecny, Stefano Mazzocchi, H Brendan McMahan, et al. Towards federated\nlearning at scale: System design. arXiv preprint arXiv:1902.01046, 2019. 3\n\n[5] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel,\nDaniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for federated learning on\nuser-held data. CoRR, abs/1611.04482, 2016. 9\n\n[6] Tianqi Chen, Mu Li, Yutian Li, Min Lin, Naiyan Wang, Minjie Wang, Tianjun Xiao, Bing Xu, Chiyuan\nZhang, and Zheng Zhang. Mxnet: A \ufb02exible and ef\ufb01cient machine learning library for heterogeneous\ndistributed systems. arXiv preprint arXiv:1512.01274, 2015. 3\n\n[7] Jeffrey Dean, Greg Corrado, Rajat Monga, Kai Chen, Matthieu Devin, Mark Mao, Andrew Senior, Paul\nIn Advances in neural\n\nTucker, Ke Yang, Quoc V Le, et al. Large scale distributed deep networks.\ninformation processing systems, pages 1223\u20131231, 2012. 3\n\n9\n\n\f[8] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep\n\nbidirectional transformers for language understanding. CoRR, abs/1810.04805, 2018. 6\n\n[9] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit con\ufb01dence\ninformation and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer\nand Communications Security, pages 1322\u20131333. ACM, 2015. 1, 3\n\n[10] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron\nCourville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural information processing\nsystems, pages 2672\u20132680, 2014. 3\n\n[11] Priya Goyal, Piotr Doll\u00e1r, Ross Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew\nTulloch, Yangqing Jia, and Kaiming He. Accurate, large minibatch sgd: Training imagenet in 1 hour. arXiv\npreprint arXiv:1706.02677, 2017. 3\n\n[12] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition.\nIn Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770\u2013778, 2016.\n5\n\n[13] Briland Hitaj, Giuseppe Ateniese, and Fernando P\u00e9rez-Cruz. Deep models under the GAN: information\n\nleakage from collaborative deep learning. CoRR, abs/1702.07464, 2017. 1, 2, 3\n\n[14] Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. Labeled faces in the wild: A\ndatabase for studying face recognition in unconstrained environments. Technical Report 07-49, University\nof Massachusetts, Amherst, October 2007. 5\n\n[15] Forrest N Iandola, Matthew W Moskewicz, Khalid Ashraf, and Kurt Keutzer. Firecaffe: near-linear\nacceleration of deep neural network training on compute clusters. In Proceedings of the IEEE Conference\non Computer Vision and Pattern Recognition, pages 2592\u20132600, 2016. 1, 3\n\n[16] Xianyan Jia, Shutao Song, Wei He, Yangzihao Wang, Haidong Rong, Feihu Zhou, Liqiang Xie, Zhenyu\nGuo, Yuanzhou Yang, Liwei Yu, et al. Highly scalable deep learning training system with mixed-precision:\nTraining imagenet in four minutes. arXiv preprint arXiv:1807.11205, 2018. 3\n\n[17] Arthur Jochems, Timo M Deist, Issam El Naqa, Marc Kessler, Chuck Mayo, Jackson Reeves, Shruti\nJolly, Martha Matuszak, Randall Ten Haken, Johan van Soest, et al. Developing and validating a survival\nprediction model for nsclc patients through distributed learning across 3 countries. International Journal\nof Radiation Oncology* Biology* Physics, 99(2):344\u2013352, 2017. 1, 3\n\n[18] Arthur Jochems, Timo M Deist, Johan Van Soest, Michael Eble, Paul Bulens, Philippe Coucke, Wim Dries,\nPhilippe Lambin, and Andre Dekker. Distributed learning: developing a predictive model based on data\nfrom multiple hospitals without data leaving the hospital\u2013a real life proof of concept. Radiotherapy and\nOncology, 121(3):459\u2013467, 2016. 1, 3\n\n[19] Hanjoo Kim, Jaehong Park, Jaehee Jang, and Sungroh Yoon. Deepspark: Spark-based deep learning\n\nsupporting asynchronous updates and caffe compatibility. arXiv preprint arXiv:1602.08191, 2016. 3\n\n[20] Jakub Kone\u02c7cn\u00fd, H. Brendan McMahan, Felix X. Yu, Peter Richtarik, Ananda Theertha Suresh, and Dave\nBacon. Federated learning: Strategies for improving communication ef\ufb01ciency. In NIPS Workshop on\nPrivate Multi-Party Machine Learning, 2016. 1, 3\n\n[21] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.\n\n5, 7\n\n[22] Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/. 5\n[23] Mu Li, David G Andersen, Jun Woo Park, Alexander J Smola, Amr Ahmed, Vanja Josifovski, James\nLong, Eugene J Shekita, and Bor-Yiing Su. Scaling distributed machine learning with the parameter server.\nIn 11th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 14), pages\n583\u2013598, 2014. 1, 3\n\n[24] Yujun Lin, Song Han, Huizi Mao, Yu Wang, and William J Dally. Deep gradient compression: Reducing\n\nthe communication bandwidth for distributed training. arXiv preprint arXiv:1712.01887, 2017. 8\n\n[25] Dong C Liu and Jorge Nocedal. On the limited memory bfgs method for large scale optimization.\n\nMathematical programming, 45(1-3):503\u2013528, 1989. 5\n\n[26] H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al. Communication-ef\ufb01cient\n\nlearning of deep networks from decentralized data. arXiv preprint arXiv:1602.05629, 2016. 1, 3\n\n[27] Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended\n\nfeature leakage in collaborative learning. CoRR, abs/1805.04049, 2018. 1, 2, 3, 5, 6\n\n[28] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits\n\nin natural images with unsupervised feature learning. 2011. 5\n\n[29] Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming\nLin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. In NIPS-W,\n2017. 3, 5\n\n[30] Pitch Patarasuk and Xin Yuan. Bandwidth optimal all-reduce algorithms for clusters of workstations.\n\nJournal of Parallel and Distributed Computing, 69(2):117\u2013124, 2009. 1, 2, 3\n\n[31] Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy-preserving\ndeep learning via additively homomorphic encryption. IEEE Transactions on Information Forensics and\nSecurity, 13(5):1333\u20131345, 2018. 9\n\n10\n\n\f[32] Benjamin Recht, Christopher Re, Stephen Wright, and Feng Niu. Hogwild: A lock-free approach to\nparallelizing stochastic gradient descent. In Advances in neural information processing systems, pages\n693\u2013701, 2011. 3\n\n[33] Alexander Sergeev and Mike Del Balso. Horovod: fast and easy distributed deep learning in tensor\ufb02ow.\n\narXiv preprint arXiv:1802.05799, 2018. 3\n\n[34] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks\nagainst machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pages 3\u201318.\nIEEE, 2017. 2, 3\n\n[35] Giuseppe Tagliavini, Stefan Mach, Davide Rossi, Andrea Marongiu, and Luca Benini. A transprecision\n\n\ufb02oating-point platform for ultra-low power computing. CoRR, abs/1711.10374, 2017. 8\n\n[36] Yusuke Tsuzuku, Hiroto Imachi, and Takuya Akiba. Variance-based gradient compression for ef\ufb01cient\n\ndistributed deep learning. arXiv preprint arXiv:1802.06058, 2018. 8\n\n11\n\n\f", "award": [], "sourceid": 8389, "authors": [{"given_name": "Ligeng", "family_name": "Zhu", "institution": "MIT"}, {"given_name": "Zhijian", "family_name": "Liu", "institution": "MIT"}, {"given_name": "Song", "family_name": "Han", "institution": "MIT"}]}