@article{zhu2019deep,
  title={Deep leakage from gradients},
  author={Zhu, Ligeng and Liu, Zhijian and Han, Song},
  journal={Advances in Neural Information Processing Systems},
  volume={32},
  year={2019}
}

@article{zhao2020idlg,
  title={idlg: Improved deep leakage from gradients},
  author={Zhao, Bo and Mopuri, Konda Reddy and Bilen, Hakan},
  journal={arXiv preprint arXiv:2001.02610},
  year={2020}
}

@article{deng2021tag,
  title={TAG: Gradient Attack on Transformer-based Language Models},
  author={Deng, Jieren and Wang, Yijue and Li, Ji and Shang, Chao and Liu, Hang and Rajasekaran, Sanguthevar and Ding, Caiwen},
  journal={arXiv preprint arXiv:2103.06819},
  year={2021}
}

@article{fowl2021robbing,
  title={Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models},
  author={Fowl, Liam and Geiping, Jonas and Czaja, Wojtek and Goldblum, Micah and Goldstein, Tom},
  journal={arXiv preprint arXiv:2110.13057},
  year={2021}
}

@article{fowl2022decepticons,
  title={Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Models},
  author={Fowl, Liam and Geiping, Jonas and Reich, Steven and Wen, Yuxin and Czaja, Wojtek and Goldblum, Micah and Goldstein, Tom},
  journal={arXiv preprint arXiv:2201.12675},
  year={2022}
}

@inproceedings{mcmahan2017communication,
  title={Communication-efficient learning of deep networks from decentralized data},
  author={McMahan, Brendan and Moore, Eider and Ramage, Daniel and Hampson, Seth and y Arcas, Blaise Aguera},
  booktitle={Artificial intelligence and statistics},
  pages={1273--1282},
  year={2017},
  organization={PMLR}
}

@article{bonawitz2016practical,
  title={Practical secure aggregation for federated learning on user-held data},
  author={Bonawitz, Keith and Ivanov, Vladimir and Kreuter, Ben and Marcedone, Antonio and McMahan, H Brendan and Patel, Sarvar and Ramage, Daniel and Segal, Aaron and Seth, Karn},
  journal={arXiv preprint arXiv:1611.04482},
  year={2016}
}

@article{dwork2014algorithmic,
  title={The algorithmic foundations of differential privacy.},
  author={Dwork, Cynthia and Roth, Aaron and others},
  journal={Found. Trends Theor. Comput. Sci.},
  volume={9},
  number={3-4},
  pages={211--407},
  year={2014}
}


@book{bishop1995neural,
  title={Neural networks for pattern recognition},
  author={Bishop, Christopher M and others},
  year={1995},
  publisher={Oxford university press}
}
@inproceedings{bernstein2018signsgd,
  title={signSGD: Compressed optimisation for non-convex problems},
  author={Bernstein, Jeremy and Wang, Yu-Xiang and Azizzadenesheli, Kamyar and Anandkumar, Animashree},
  booktitle={International Conference on Machine Learning},
  pages={560--569},
  year={2018},
  organization={PMLR}
}

@article{geiping2020inverting,
  title={Inverting gradients-how easy is it to break privacy in federated learning?},
  author={Geiping, Jonas and Bauermeister, Hartmut and Dr{\"o}ge, Hannah and Moeller, Michael},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={16937--16947},
  year={2020}
}

@inproceedings{yin2021see,
  title={See through gradients: Image batch recovery via gradinversion},
  author={Yin, Hongxu and Mallya, Arun and Vahdat, Arash and Alvarez, Jose M and Kautz, Jan and Molchanov, Pavlo},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={16337--16346},
  year={2021}
}

@article{jeon2021gradient,
  title={Gradient inversion with generative image prior},
  author={Jeon, Jinwoo and Lee, Kangwook and Oh, Sewoong and Ok, Jungseul and others},
  journal={Advances in Neural Information Processing Systems},
  volume={34},
  pages={29898--29908},
  year={2021}
}

@inproceedings{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={770--778},
  year={2016}
}

@article{vaswani2017attention,
  title={Attention is all you need},
  author={Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser, {\L}ukasz and Polosukhin, Illia},
  journal={Advances in neural information processing systems},
  volume={30},
  year={2017}
}

@inproceedings{weinberger2009feature,
  title={Feature hashing for large scale multitask learning},
  author={Weinberger, Kilian and Dasgupta, Anirban and Langford, John and Smola, Alex and Attenberg, Josh},
  booktitle={Proceedings of the 26th annual international conference on machine learning},
  pages={1113--1120},
  year={2009}
}

@misc{merity2016pointer,
      title={Pointer Sentinel Mixture Models},
      author={Stephen Merity and Caiming Xiong and James Bradbury and Richard Socher},
      year={2016},
      eprint={1609.07843},
      archivePrefix={arXiv},
      primaryClass={cs.CL}
}

@article{aji2017sparse,
  title={Sparse communication for distributed gradient descent},
  author={Aji, Alham Fikri and Heafield, Kenneth},
  journal={arXiv preprint arXiv:1704.05021},
  year={2017}
}

@article{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey and others},
  year={2009},
  publisher={Citeseer}
}

@article{boenisch2021curious,
  title={When the Curious Abandon Honesty: Federated Learning Is Not Private},
  author={Boenisch, Franziska and Dziedzic, Adam and Schuster, Roei and Shamsabadi, Ali Shahin and Shumailov, Ilia and Papernot, Nicolas},
  journal={arXiv preprint arXiv:2112.02918},
  year={2021}
}

@inproceedings{abadi2016deep,
  title={Deep learning with differential privacy},
  author={Abadi, Martin and Chu, Andy and Goodfellow, Ian and McMahan, H Brendan and Mironov, Ilya and Talwar, Kunal and Zhang, Li},
  booktitle={Proceedings of the 2016 ACM SIGSAC conference on computer and communications security},
  pages={308--318},
  year={2016}
}

@inproceedings{shokri2017membership,
  title={Membership inference attacks against machine learning models},
  author={Shokri, Reza and Stronati, Marco and Song, Congzheng and Shmatikov, Vitaly},
  booktitle={2017 IEEE symposium on security and privacy (SP)},
  pages={3--18},
  year={2017},
  organization={IEEE}
}

@article{kasiviswanathan2011can,
  title={What can we learn privately?},
  author={Kasiviswanathan, Shiva Prasad and Lee, Homin K and Nissim, Kobbi and Raskhodnikova, Sofya and Smith, Adam},
  journal={SIAM Journal on Computing},
  volume={40},
  number={3},
  pages={793--826},
  year={2011},
  publisher={SIAM}
}

@article{kingma2014adam,
  title={Adam: A method for stochastic optimization},
  author={Kingma, Diederik P and Ba, Jimmy},
  journal={arXiv preprint arXiv:1412.6980},
  year={2014}
}

@article{simonyan2014very,
  title={Very deep convolutional networks for large-scale image recognition},
  author={Simonyan, Karen and Zisserman, Andrew},
  journal={arXiv preprint arXiv:1409.1556},
  year={2014}
}

@inproceedings{dwork2006calibrating,
  title={Calibrating noise to sensitivity in private data analysis},
  author={Dwork, Cynthia and McSherry, Frank and Nissim, Kobbi and Smith, Adam},
  booktitle={Theory of cryptography conference},
  pages={265--284},
  year={2006},
  organization={Springer}
}

@article{gupta2022recovering,
  title={Recovering Private Text in Federated Learning of Language Models},
  author={Gupta, Samyak and Huang, Yangsibo and Zhong, Zexuan and Gao, Tianyu and Li, Kai and Chen, Danqi},
  journal={arXiv preprint arXiv:2205.08514},
  year={2022}
}

@article{lecun1998gradient,
  title={Gradient-based learning applied to document recognition},
  author={LeCun, Yann and Bottou, L{\'e}on and Bengio, Yoshua and Haffner, Patrick},
  journal={Proceedings of the IEEE},
  volume={86},
  number={11},
  pages={2278--2324},
  year={1998},
  publisher={Ieee}
}

@inproceedings{sun2019fine,
  title={How to fine-tune bert for text classification?},
  author={Sun, Chi and Qiu, Xipeng and Xu, Yige and Huang, Xuanjing},
  booktitle={China national conference on Chinese computational linguistics},
  pages={194--206},
  year={2019},
  organization={Springer}
}

@article{zhang2019deep,
  title={Deep set prediction networks},
  author={Zhang, Yan and Hare, Jonathon and Prugel-Bennett, Adam},
  journal={Advances in Neural Information Processing Systems},
  volume={32},
  year={2019}
}

@inproceedings{devlin-etal-2019-bert,
    title = "{BERT}: Pre-training of Deep Bidirectional Transformers for Language Understanding",
    author = "Devlin, Jacob  and
      Chang, Ming-Wei  and
      Lee, Kenton  and
      Toutanova, Kristina",
    booktitle = "Conference of the North {A}merican Chapter of the Association for Computational Linguistics",
    year = "2019",
    address = "Minneapolis, Minnesota",
    publisher = "Association for Computational Linguistics",
    pages = "4171--4186",
}

@article{warstadt2018neural,
    title={Neural Network Acceptability Judgments},
    author={Warstadt, Alex and Singh, Amanpreet and Bowman, Samuel R},
    journal={arXiv preprint arXiv:1805.12471},
    year={2018}
}
