# A Systematic Review of Federated Generative Models

Ashkan Vedadi Gargary<EMAIL_ADDRESS>0009-0004-2128-5735 University of
California, RiversideDepartment of Computer Science and
EngineeringRiversideCaliforniaUSA92521 and  Emiliano De Cristofaro
<EMAIL_ADDRESS>0000-0002-7097-6346 University of California,
RiversideDepartment of Computer Science and
EngineeringRiversideCaliforniaUSA92521

(2024)

###### Abstract.

Federated Learning (FL) has emerged as a solution for distributed systems that
allow clients to train models on their data and only share models instead of
local data. Generative Models are designed to learn the distribution of a
dataset and generate new data samples that are similar to the original data.
Many prior works have tried proposing Federated Generative Models. Using
Federated Learning and Generative Models together can be susceptible to
attacks, and designing the optimal architecture remains challenging.

This survey covers the growing interest in the intersection of FL and
Generative Models by comprehensively reviewing research conducted from 2019 to
2024. We systematically compare nearly 100 papers, focusing on their FL and
Generative Model methods and privacy considerations. To make this field more
accessible to newcomers, we highlight the state-of-the-art advancements and
identify unresolved challenges, offering insights for future research in this
evolving field.

Federated Learning, Generative Model, Machine Learning

††copyright: acmcopyright††journal: CSUR††ccs: Computing methodologies Machine
learning algorithms††ccs: Security and privacy

##  1\. Introduction

Deep Generative Models (a class of Machine Learning models) are designed to
learn the underlying probability distribution of a dataset and generate new
data samples that are similar to the original data (Oussidi and Elhassouny,
2018). Many generative models such as GANs (Goodfellow et al., 2020), VAEs
(Wan et al., 2017), and Diffusion Models (Ho et al., 2020) have been used
during these years.

With more people wanting machine learning models that work on many devices
without sharing local files, Federated Learning has become popular (McMahan et
al., 2017a). This method allows clients to train models on their data and only
share models, not the actual data, with a central server, as shown in Figure
1. This keeps data private and facilitates the learning process.

Figure 1. Overview of Federated Learning

In recent years, many prior works have tried integrating generative models
into Federated Learning setups to protect sensitive data and increase model
performance by preventing data sharing with central servers. FL and Generative
Models can work together in various ways. We can split all the related
research into three groups: First, Generative Models can work in a federated
manner. This means we can facilitate the generative process in distributed
systems without sharing the raw local data with the central servers. Second,
Generative Models can attack FL models or protect them from different attack
methods, highlighting security concerns. Third, Generative Models can be used
within the FL model to address data heterogeneity and Non-IID.

##### Papers Finding Criteria and Roadmap

While extensive research has explored various combinations of Federated
Learning (FL) and generative models, this survey focuses explicitly on
Federated Generative Models. The main goal of using Federate Generative Models
is to keep data in each client to protect them compared to Centralized
methods. Finding the best approach according to different applications (e.g.,
Medical Images as diagnostic tools, Anomaly Detection, Data Augmentation, and
Financial Fraud Detection) is challenging for researchers.

We organized all the critical information into large tables. These tables
detail the generative model methods, FL methods, data types, privacy measures,
evaluation methods, the number of devices involved in the studies, and whether
the code is shared (see Section 4). Each paper and methodology is summarized
to provide an overview of each approach (see Section 5). Additionally, we
include a section dedicated to papers that evaluate integrity and privacy
within the context of Federated Generative Models (Section 6).

In Section 8, we discuss the main takeaways and state-of-the-art Federated
Generative Models for further research comparison.

##### Main Takeawyas

Overall, we find that:

  * •

Federated GANs have garnered significant attention from researchers, resulting
in numerous clinical applications. Many well-developed papers address privacy
and integrity evaluation, satisfying the differential privacy (DP) definition,
which enhances the robustness of Federated GANs for various applications such
as financial problems and IoT devices.

  * •

Recently, several Diffusion-based Federated Models have been proposed,
outperforming well-known GAN-based FL models regarding convergence and
communication costs.

  * •

Scalability and cross-device FL remain open research challenges that require
further investigation, particularly in the context of non-GAN-based FL.

  * •

Privacy and integrity consideration in tabular data-based models and non-GAN-
based FL remain unsolved and necessitate additional research.

  * •

One-shot FL, pre-trained Diffusion Models, and LLM-based generative FL are
emerging as hot topics, attracting significant interest from researchers.

##  2\. Background

In this section, we elaborate on background knowledge of FL and related
concepts (e.g., aggregation methods and different types of FL), DP, and
Generative Models.

###  2.1. Federated Learning

The Federated Learning proposed by Google operates as a decentralized machine
learning approach that trains across various clients without the necessity of
sharing their local data (McMahan et al., 2017a). There are two concepts in
FL: (i) Single Global Server and (ii) Multiple Clients. Instead of sharing
(possibly sensitive) training data with a central server, each client (a.k.a
participant), such as a smartphone or computer, train local models on their
individual datasets and only share model updates. The central server only sees
and aggregates the model updates and propagates the global model to the
clients (McMahan et al., 2017a). In general, the training process of a FL
system can be summarized in the following steps (Shown in Figure 1) (Wei et
al., 2020),

  1. (1)

Local Training: Each client trains on its local dataset and sends the model
updates to a centralized server locally.

  2. (2)

Aggregation: The server receives model updates from all participating clients
and performs secure aggregation over the uploaded parameters without learning
local information.

  3. (3)

Aggregated Parameters Broadcasting: The server broadcasts the aggregated
parameters of model updates to all clients.

  4. (4)

Updating Local Models: Each client updates its local model with the aggregate
parameter received from the server, thereby improving its performance.

####  2.1.1. Types of Federated Learning

Different Federated Learning (FL) types are based on the differences in
feature size and data type among clients and the central server.

##### Centralized vs. Decentralized

This category refers to how the training is designed. Centralized FL—the most
common approach—uses a central server to manage various model training and
aggregation steps across all local data sources. On the other hand,
Decentralized FL (also known as peer-to-peer) involves individual clients
coordinating among themselves without a central server. In this case, model
parameters are passed on from one client to the other in a chain for training.

##### Horizontal, Vertical, and Trasfer Learning

This type is based on how data among different clients are partitioned. In
Horizontal FL (a.k.a homogeneous or sample-based), the datasets of different
clients have the same features but (little) overlap in the sample space (Zhao
et al., 2021b; Yang et al., 2019). In contrast, Vertical FL (also known as
heterogeneous or feature-based) is used for datasets that contain different
feature sets (Wei et al., 2022; Liu et al., 2022). Additionally, Federated
Transfer Learning (FTL) combines concepts of FL and Transfer Learning by
transferring knowledge learned from one or more clients (which have plenty of
data) to a target domain (which has limited data) under the Federated Learning
setting (shown in Figure 2).

Assume we have two datasets named $D_{i},D_{j}$. Let $x_{i},x_{j}$ denote
feature space and $y_{i},y_{j}$ denote the label space of $D_{i},D_{j}$
respectively. Also, $I_{i},I_{j}$ represents the sample ID space. Equation 1
mathematically represents the concept of HFL. Equation 2 mathematically
demonstrates the concept of VFL and TFL (Guendouzi et al., 2023).

(1) $x_{i}=x_{j},y_{i}=y_{j},I_{i}\neq I_{j},\forall D_{i},D_{j},i\neq j$

(2) $x_{i}\neq x_{j},y_{i}\neq y_{j},I_{i}=I_{j},\forall D_{i},D_{j},i\neq j$

|  |
---|---|---
(a) Horizontal FL | (b) Vertical FL | (c) Federated Transfer Learning
Figure 2. Different data partition in Federated Learning.

##### Cross-Silo vs. Cross-Device

This category depends on the type and size of the devices involved. Cross-silo
FL involves models trained on data distributed across different organizations,
typically using larger computing devices with a relatively small number of
silos or training sets (Huang et al., 2022, 2021a; Tran et al., 2024). On the
other hand, cross-device FL occurs at the edge of IoT devices, such as
smartphones, involving many millions of devices with lower computing power
each (Karimireddy et al., 2021).

####  2.1.2. Types of Aggregation

An aggregation approach is essential to make the process of collaborating the
obtained results efficient, whether the messages exchanged are the models
themselves, some or all of their parameters, or gradients (Pillutla et al.,
2022).

Unlike traditional centralized approaches, training data are not pooled at a
central server. Each client trains its model on its data locally and then only
shares updated parameters with a server. The central server aggregates models
updated parameters from each client without access to the raw data. The
various aggregation methods are available in Federated Learning (Qi et al.,
2023). Typically, this happens over multiple rounds; eventually, the model
converges, and the parameters are finalized. Based on the different types of
Federated Learning (FL) discussed in Section 2.1.1 and different data
distribution will be discussed in Section 2.1.3, the appropriate choice of
model aggregation approach varies (Sharma and Kumar, 2023). The most common
methods for parameter aggregation in the reviewed paper include FedAVG, FedSGD
(McMahan et al., 2017a), and FedProx (Li et al., 2020b).

##### FedAvg

One of the earliest and most widely used methods in FL is FedAVG (Federated
Averaging) (McMahan et al., 2017a). During the aggregation, the parameters of
each client are weighted and averaged to produce a global model. The model is
training iteratively; let $\theta^{t}_{global}$ denote the latest global model
aggregated by the central server at the iteration step $t$, and $m_{i}$ (for
$i=1,2,3,4,...,K$) denote the devices of all K clients. The central server
first broadcasts $\theta^{t}_{global}$ to all $m_{i}$, then, every device (say
the $k$-th) initializes $\theta^{t}_{i}$ as $\theta^{t}_{global}$. Then, the
$i$-th clients performs $E$ (where $E>0$) local updates:

(3)
$\theta_{i}^{t}(k+1)=\theta_{i}^{t}(k)-\eta_{k}\nabla\ell\left(\theta_{i}^{t}(k),\left\\{x_{i,j},y_{i,j}\right\\}\right)$

where $k=1,2,3,...,E$ denotes the local training step and $\ell$ is the
classification loss function used by the $i$-th clients, while
$x_{i,j},y_{i,j}$ (where $j=1,2,3,...,|V_{i}|$) are the training instances
hosted locally by the $i$-th client. Finally, $\theta_{i}^{t}(k)$ is the local
model updated at the $k$-th step of the stochastic gradient descent performed
locally; note that $\theta_{i}^{t}(k)=\theta_{i}^{t}=\theta^{t}_{global}$ when
$k=0$.

After the clients finish training their local models, they send their
parameters to the central server. The global model is derived at the central
server and is then aggregated by averaging the local models:

(4) $\theta_{global}^{t+1}=\sum_{i=1}^{K}\theta^{t}_{i}(E)$

Note that $\theta^{t}_{i}(E)$ denotes the models trained locally, after $E$
(where $E>0$) rounds of gradients descent (Naseri et al., 2022; McMahan et
al., 2017a).

##### FedSGD

FedSGD (Federated Stochastic Gradient) is also one of the earliest proposed
aggregation methods. According to (McMahan et al., 2017a), FedSGD is a special
case of FedAVG. With FedSGD, the clients train their local models using batch
Gradient Descent with just one local epoch and upload their gradient
$\theta^{t}_{i}$. In other words, we have $E=1$, and the entire local dataset
is treated as a single minibatch for FedSGD.

FedAvg is generally preferred over FedSGD in many practical Federated Learning
scenarios due to its reduced communication requirements and better utilization
of local computation resources. However, the best choice can depend on
specific factors like network bandwidth, clients’ computational capabilities,
and data distribution.

##### FedProx

FedProx (Li et al., 2020b) extends FedAVG by focusing on handling data and
system heterogeneity in Federated Learning environments. In FedProx, clients
optimize the loss function by using a regularization term. This term helps
mitigate the divergence between the current local and previously obtained
global models. To address system heterogeneity, FedProx suggests directly
solving the previous objective function rather than training local models over
multiple epochs. This method can reduce computational overhead.

####  2.1.3. Non-IID vs. IID

In Federated Learning, IID (Independent and Identically Distributed) and Non-
IID data distribution refer to how the data is distributed among the clients.

In an IID setting, the assumption is that the data across different clients
are (i) independent of each other and (ii) drawn from the same probability
distribution. In other words, we suppose that we have $K$ clients and let
$D_{i}$ (for $i=1,2,3,...,K$) denote the dataset of each client that is used
to train a local model. We have an IID setting if, (Arafeh et al., 2022):

  * •

For any class $y$ and a feature set $\mathrm{X},P(X,y)=P(X).P(y)$
(Independent).

  * •

For any class $y,P\left(y\mid D_{1}\right)=P\left(y\mid
D_{2}\right)\ldots=P\left(y\mid D_{n}\right)$ (Identically Distributed).

Violating any of the abovementioned rules implies a Non-IID context (Zhao et
al., 2018).

###  2.2. Different Generative Models

Deep generative models (DGMs) are machine learning models designed to learn
the underlying probability distribution of a dataset and generate new data
samples similar to the original data. These models are powerful tools in both
supervised and unsupervised learning tasks, and they have a wide range of
applications from image synthesis to natural language processing (Oussidi and
Elhassouny, 2018).

Generative Model functionality can categorized into Data Generation, Learning
Data Distributions, Unsupervised Learning, Feature Learning, and Anomaly
Detection (Sun et al., 2021b).

The primary function of DGMs is to generate new data instances that mimic the
original dataset. DGMs can create realistic images, videos, sounds, and text
indistinguishable from real-world data (Salakhutdinov, 2015). DGMs learn to
capture the complex probability distributions of the input data by
understanding the patterns and structures within the data, which enables the
models to produce high-quality outputs (Oussidi and Elhassouny, 2018;
Jothiraj, 2023). Besides, By learning the normal distribution of a dataset,
generative models can identify outliers or anomalies that do not fit the
learned distribution. Anomaly detection is useful in fraud detection,
monitoring systems, and healthcare. Moreover, DGMs can learn from unlabeled
data as an unsupervised learning mechanism, particularly useful in scenarios
where labeled data is scarce or expensive to obtain (Harshvardhan et al.,
2020). In particular, DGMs are capable of learning useful features from the
data in an unsupervised manner (Zhao et al., 2017).

Here, we list the most common Generative Models:

##### Generative Adversarial Networks (GANs):

Generative Adversarial Networks (GANs) are a class of machine learning
algorithms characterized by two neural networks—the generator and the
discriminator—engaged in a min-max game. In this setup, the generator aims to
produce data so realistically that the discriminator cannot distinguish them
from actual data. On the other hand, the discriminator’s goal is to accurately
classify real data from the generator’s fakes (Goodfellow et al., 2020). This
min-max game refers to the optimization problem where the generator tries to
maximize the probability of the discriminator making a mistake (minimizing its
loss). In contrast, the discriminator tries to reduce this probability
(maximizing its accuracy). This dynamic competition drives both networks to
improve their performance, leading to the generation of realistic synthetic
data (Creswell et al., 2018).

##### Variational Auto-encoder (VAEs):

Variational Auto-encoders are a type of generative model that leverage the
architecture of auto-encoders to create high-dimensional data (Wan et al.,
2017). They consist of an encoder that compresses the input data into a lower-
dimensional representation and a decoder that reconstructs the data from this
representation. However, unlike traditional auto-encoders, VAEs introduce a
probabilistic approach to the encoding process, making them capable of
generating new data points by sampling from the learned distribution in the
latent space (Acs et al., 2018).

##### Diffusion Models:

Diffusion models are a class of generative models that simulate the gradual
process of adding and then removing noise to generate data (Kingma et al.,
2021; Jothiraj, 2023). The model starts with a distribution of pure noise and
gradually refines this into samples from a target distribution through a
reverse diffusion process. This approach generates highly detailed and
coherent samples, making Diffusion Models particularly effective in high-
quality image and audio generation. The Diffusion Model is a probabilistic
generative model that uses a parameterized Markov chain. It is trained through
variational inference to learn the process of reversing the gradual
degradation of training data structures (Wang et al., 2023b). (Ho et al.,
2020) introduced the Denoising Diffusion Probabilistic Models (DDPM), which
improve the original Diffusion Model’s mathematical framework.

This survey mainly focuses on using DGMs for data generation and synthetic
data. There are several reasons why synthetic data is used in machine
learning.

The first and most important, real-world data may contain sensitive
information. Synthetic data provides a way to create realistic data without
revealing important details, making it useful for training models without
privacy concerns. Second, synthetic data can augment existing datasets. By
generating additional samples, models can be trained on more diverse examples,
improving generalization and robustness. Also, in situations where the
distribution of classes in a dataset is imbalanced, synthetic data generation
can help balance the classes. Finally, When a model is trained on data from
one domain but needs to perform well in a different domain, synthetic data can
be generated to simulate the target domain (Oussidi and Elhassouny, 2018; De
Cristofaro, 2024).

###  2.3. Differential Privacy

DP is the established framework to define algorithms resilient to adversarial
inferences. It provides an unconditional upper bound on the privacy loss of
individual data subjects from the output of an algorithm by introducing
statistical noise (Dwork et al., 2006). In other words, It aims to protect
sensitive information by adding noise into the data generation process or data
sharing from client to server while maintaining the overall statistical
properties of the original dataset. It has become the state-of-the-art
paradigm for protecting individual privacy in statistical databases (Dwork et
al., 2006).

###### Definition 2.1 (Differential Privacy (Dwork et al., 2014)).

A randomized mechanism $\mathcal{M}:\mathcal{D}\rightarrow\mathcal{R}$ is
$(\epsilon,\delta)$-differentially private if for any two neighboring datasets
set ${d},d^{\prime}\in\mathcal{D}$ and $S\subseteq\mathcal{R}$

(5) $\mathrm{P}(\mathcal{M}(d)\in
S)\leq\mathrm{e}^{\epsilon}\mathrm{P}\left(\mathcal{M}\left(d^{\prime}\right)\in
S\right)+\delta$

According to the Definition 5, the definition of neighboring datasets depends
on the setting, and thus, it can vary. The $\epsilon$ parameter (a.k.a privacy
budget) is a metric of privacy loss (in a range from $0$ to $\infty$). It also
controls the privacy-utility trade-off, i.e., lower $\epsilon$ values indicate
higher levels of privacy but likely reduce utility too. The $\delta$ parameter
accounts for a (small) probability on which the upper bound $\epsilon$ does
not hold. The amount of noise needed to achieve DP is proportional to the
sensitivity of the output; this measures the maximum change in the output due
to the inclusion or removal of a single record (Annamalai et al., 2023; Naseri
et al., 2020).

To provide individual privacy in case of $\epsilon$-DP failure, the
recommended value for $\delta$ should be smaller than the inverse of the
database size, i.e., $\frac{1}{|\mathcal{D}|}$.

###  2.4. Differential Privacy in Federated Learning

As mentioned, in the context of FL, one can use one of two variants of DP,
namely, local and central.

####  2.4.1. Local Differential Private (LDP)

With LDP, each client performs the noise addition required for DP locally.
Each client runs a random perturbation algorithm $M$ and sends the results to
the server. The perturbed result is guaranteed to protect an individual’s data
according to the $\epsilon$ value. This is formally defined next (Naseri et
al., 2020).

###### Definition 2.2 (Locally Differential Private (Truex et al., 2020)).

Let X be a set of possible values and Y the noisy values. $M$ is ($\epsilon$,
$\delta$)-locally differentially private ($\epsilon$-LDP) if for all $x1,x2\in
X$ and for all $y\in Y$:

(6)
$\mathrm{P}(\mathcal{M}(x)=y)\leq\mathrm{e}^{\epsilon}\mathrm{P}(\mathcal{M}\left(x^{\prime}\right)=y)+\delta$

####  2.4.2. Central Differential Private (CDP)

With CDP, the FL aggregation function is perturbed by the server, and this
provides client-level DP. This guarantees that the output of the aggregation
function is indistinguishable, with probability bounded by $\epsilon$, to
whether or not a given client is part of the training process. In this
setting, clients need to trust the server: 1) with their model updates and 2)
to correctly perform perturbation by adding noise, etc. While some degree of
trust in the server is needed, this is a much weaker assumption than
entrusting the server with the data itself (Geyer et al., 2017; McMahan et
al., 2017b). If anything, inferring training set membership or properties from
the model updates is much less of a significant privacy threat than having
data in the clear. Moreover, in FL, clients do not share entire datasets for
efficiency reasons and because they might be unable to for policy or legal
reasons (Naseri et al., 2020).

In Algorithm 1, we elaborate on the details of the Federated Learning with
Average Aggregation (FedAVG) and Central Differential Private (Geyer et al.,
2017; McMahan et al., 2017b; Annamalai et al., 2023).

1

Input : initial model $\theta_{0}$, number of rounds $R$, number of clients
$W$, sampling probability $q$, noise scale $z$, clipping parameter $S$,
optimizer OPT

Output : trained model $\theta^{R+1}_{\text{global}}$

2 Function  _MAIN(_$\theta_{0}$ , $R$, $W$, $q$, $z$, $S$, OPT_)_:

3 $\theta^{1}_{\text{global}}\leftarrow\theta_{0}$

4 $\sigma\leftarrow\frac{zS}{qW}$

5 for  _round $r\leftarrow 1$ to $R$_ do

6 $P_{r}\leftarrow$ randomly select clients with probability $q$

7 for  _client $k\in P_{r}$_ do

8 $\Delta^{r+1}_{k}\leftarrow$ LOCAL_UPDATE(_$k$ ,
$\theta^{r}_{\text{global}}$, $S$, OPT_)

9

10 end for

11
$\theta^{r+1}_{\text{global}}\leftarrow\theta^{r}_{\text{global}}+\frac{1}{qW}\sum_{k\in
P_{r}}\Delta^{r+1}_{k}+\mathcal{N}(0,\sigma^{2}I)$

12

13 end for

14 return _$\theta^{R+1}_{\text{global}}$_

15

16

17Function  _LOCAL_UPDATE(_$k$ , $\theta^{r}_{\text{global}}$, $S$, OPT_)_:

18 $\theta\leftarrow\theta^{r}_{\text{global}}$

19 for  _local epoch $i\leftarrow 1$ to $E$_ do

$\theta\leftarrow\text{OPT}(\theta,D_{k})$

// local update with OPT

20 $\Delta\leftarrow\theta-\theta^{r}_{\text{global}}$

$\theta\leftarrow\theta^{r}_{\text{global}}+\min(1,\frac{S}{\|\Delta\|_{2}})\cdot\Delta$

// already clipped

21

22 end for

23 return _$\theta-\theta^{r}_{\text{global}}$_

24

25

Algorithm 1 DP-FedAvg Algorithm

##  3\. Attacks against Federated Learning

Prior work shows that FL may be vulnerable to attacks during and after the
learning phase, targeting robustness and privacy. Especially for sensitive
datasets such as Personal Information, Medical Records, Financial Reports,etc
(Bouacida and Mohapatra, 2021; Mamun et al., 2023).

We can split the type of attacks into two main groups: (i) privacy (e.g.,
Reconstruction, Inference Attacks, Model Inversion) and (ii) integrity (e.g.,
Backdoor, Model Poisoning) attacks. Here, we list the common attacks that
happen in Federated Learning and Generative Models (Sikandar et al., 2023)
based on privacy and integrity, as shown in Figure 3:

###  3.1. Privacy

####  3.1.1. Inference Attacks

Although the raw user data does not leave the local device, many ways exist to
infer the training data used in FL. These aim to exploit model updates
exchanged between the clients and the central server to extract information
about training data points. The goal is to infer properties of these points
that may be even uncorrelated with the main task or training set membership by
these updates.

These updates might accidentally give away more information than intended. We
have different inference attacks, such as Property Inference, Attribute
Inference, and Membership Inference (Nasr et al., 2019; Gu et al., 2022).

##### Membership Inference Attacks

Membership Inference attacks try to discover whether a data sample belongs to
the training data (Nasr et al., 2019). For instance, a membership inference
attack could reveal whether data from a specific patient was used in training
the model for predicting Alzheimer’s disease. If an attacker can find that a
particular patient’s data was included in the model’s training dataset, it
could use that the patient is either at risk of or is already diagnosed with
Alzheimer’s. This information could lead to privacy violations against the
patient.

##### Attribute Inference Attack

An attribute inference attack seeks to uncover specific attributes or
confidential information about individuals in a dataset. For example, consider
a dataset with anonymized user data featuring details such as age, location,
and browsing habits. An attacker might analyze observable patterns in this
data to infer private attributes like political preferences or health
conditions. The primary objective of such an attack is to predict sensitive
information about individuals using the data that is available (Gong and Liu,
2018).

##### Property Inference Attacks

Gradient exchange leakage can infer when a property appears and disappears in
the dataset during training (e.g., identifying when a person first appears in
the photos used to train a face recognition classifier). Property inference
attacks assume that the adversary has auxiliary training data correctly
labeled with the property he wants to infer (Nasr et al., 2019; Gu et al.,
2022).

There is a slight difference between Attribute and Membership inference.
Attribute inference attacks target individual records’ attributes, whereas
property inference attacks target collective properties of datasets or
characteristics inherent to models.

####  3.1.2. Reconstruction Attacks

Where an adversary attempts to reconstruct clients’ private data from shared
model updates, an attacker uses inference techniques and statistical analysis
to get properties of the original data from these updates (e.g., gradients
carry substantial information about the input data and output labels). An
attacker can potentially reconstruct the original input data by analyzing the
pattern and nature of these gradients or model updates. This might involve
making guesses about the data that would most likely produce such gradients
(Yang et al., 2022; Lyu and Chen, 2021).

####  3.1.3. Model Inversion Attacks

The core idea behind model inversion attacks is to take advantage of how
machine learning models capture and store information about the training data.
An attacker can derive the properties of the data on which it was trained by
analyzing the model’s behavior (e.g., how it responds to various inputs).
Model Inversion Attack is a common attack with models with high memorization
capacity and overly fitted to the training data (Huang et al., 2021b;
Hatamizadeh et al., 2023). For instance, by carefully tracking input queries
and observing the model’s outputs, an attacker can infer the characteristics
of the data used to train the model. Also, in some cases, the attacker might
reconstruct the data by the inferred characteristics of the data.

###  3.2. Integrity

####  3.2.1. Poisoning Attacks

These aim to make the target model misbehave; In general, we have two types of
poisoning attacks: (i) Data Poisoning and (ii) Model Poisoning (Tolpegin et
al., 2020).

Data poisoning: Attackers are messing with the training data of a machine
learning model during the local data collection. An attacker adds misleading
data to the ML database. As the model learns from this bad data, it starts
making harmful decisions (Naseri et al., 2022).

Model poisoning: Attackers might change the local updates of the model during
the model training, like changing the gradients, which can reduce the accuracy
of the whole system (Fang et al., 2020).

Poisoning attacks can be random or targeted; random ones reduce the utility of
the aggregated FL model, while targeted attacks make the aggregated FL model
output predefined labels (Naseri et al., 2022; Yang et al., 2023a).

####  3.2.2. Backdoor Attacks

A subclass of poisoning attacks, namely backdoor attacks, has recently
attracted much attention from the research community (Naseri et al., 2022;
Bhagoji et al., 2019; Shayegani et al., 2023). Backdoor attacks are targeted
model poisoning attacks where a malicious client injects a backdoor task into
the final model, typically using a model-replacement methodology (Naseri et
al., 2022). Like Poisoning Attacks, these attacks are tricky because they do
not make the model wrong. Instead, they keep the model doing its main job
right but sneak in secret weaknesses. In Federated Learning (FL), some clients
that help train the model might be set up to teach these hidden backdoors
using particular data. They adjust the model’s performance based on their
target while ensuring their effect remains unnoticed.

In Federated Learning, attackers can create these adjustments using models
similar to the target. FL makes it easier for attackers because they can see
how the model works and what makes it fail. A common trick is to change an
image’s pixels slightly so the system cannot recognize it correctly.

Figure 3. Overview of Different Types Common Attacks and Defences in Federated
Learning and Generative Models

##  4\. Review Criteria

As mentioned in Section 5, in this survey, our objective is to comprehensively
compare existing papers that discuss the combination of Federated Learning and
Generative Models with a primary focus on Federated Generative Models. We
provide tables summarizing critical information from each paper based on
various essential features. We have three main tables for those papers that
propose new models: (i) GAN-based FL, (ii) Diffusion Model and VAE-based FL,
and (iii) Other methods. Moreover, many papers consider security and privacy
for generative models based on FL: (iv) Consider Privacy Attacks, and (v)
Consider Integrity Attacks.

To comprehensively review all related papers, each review criterion will hold
important information, including details about generative models, where the
papers were published, the federated algorithms used, types of datasets, and
whether they support Differential Privacy. Additionally, these criteria
include details about how the papers were evaluated, the number of clients
considered, and if the code is available. This organized layout ensures that
the table not only summarizes the key features of each paper but also helps in
understanding how Federated Learning and Generative Models interact in various
ways. In the following paragraph, we are going to elaborate on the criteria of
our review:

##### Generative Model

This section is a focal point of our survey, detailing each paper’s specific
generative approach, such as WGAN, DP-CGAN, ACGAN, Vanilla GAN, Synthetic
Tabular Data, VAE, Diffusion Models, etc.

##### Federated Algorithm

As mentioned earlier, various federated algorithms exist based on different
aggregation approaches. Papers may focus on FedAVG, FedSGD, and MMD scores. We
cover them in the second column to compare various models.

##### Data Type and Datasets

Understanding the data type used in experiments is essential. While many
papers concentrate on image datasets (e.g., MNIST, CIFAR10, FMNIST), a few
articles explore tabular data (e.g., Adult, Cover-type, Credit), providing
valuable diversity.

##### Number of clients

Considering the distributed dataset, knowing the number of clients in each
paper’s model is essential for assessing scalability and comparisons. For
example, a model that only works with a maximum of 10 clients might not
address a Cross-Devices setup where the data is distributed above 100 clients.
We find the number of clients according to the experimental results of each
work they reported. Many papers focus on analyzing the scalability; others
only show their models’ performance on a fixed number of clients.

##### Differential Privacy

As mentioned in Section 5, Differential Privacy is a privacy-preserving
definition. We explore whether papers satisfy Differential Privacy in their
architectures or not.

##### Privacy/Integrity Attacks Evaluation

Federated Learning is a method used to protect data. If we introduce or modify
a model that uses Federated Learning, we have to make a lot of effort to check
its privacy and robustness. A paper in this area needs to evaluate privacy
(e.g., Reconstruction, Inference Attacks, Model Inversion) or integrity (e.g.,
Backdoor, Model Poisoning) attacks.

##### Non-IID Support

As we mentioned earlier, there are two different settings for FL problems: (i)
Non-IID and (ii) IID settings. Handling Non-IID settings in Federated Learning
is one of the most important details in every model. Many papers modify models
that only support the IID setting to accommodate Non-IID settings.

##### Code Availability

Code availability is noted, facilitating the re-running and modification of
experiments and distinguishing papers that only provide algorithms.

##  5\. Models Review

The main reason for bringing generative models into FL was to protect
individual data by preventing sensitive data sharing and communication
overhead by keeping it in their devices. On the other hand, some works focus
on using generative models independently in client or server to utilize the
applications of generative models such as anomaly detection, addressing Non-
IID and data heterogeneity challenges, inference attacks, and protection
against reconstruction attacks.

In summary, we can group the research that combines generative models and
Federated Learning into (i) Client-Generator, where synthetic data is
generated locally and then communicated to the server for the server model
updating; (ii) Server-Generator, where a centralized generator is used to
assist in updating the server and client model, (iii) Federated-Generator,
both clients and server working together to generate new dataset. However, our
primary focus will be on the Federated-Generator category.

In this section, we will review papers that discuss the combination of
Federated Models with generative models, organizing them into three sub-
sections. These are (i) those focusing on Generative Adversarial Networks
(GANs) based FL, (ii) those focusing on Diffusion Models and Variational
Autoencoders (VAEs) based FL, and (iii) those that do not fit within the first
two categories.

###  5.1. Generative Adversarial Networks based FL

As summarized in Table 1, this section reviews the contributions of Federated
GANs. Since the majority of papers focus exclusively on this area, we have
dedicated a single section to review all related papers that integrate GANs
with FL.

##### How did it start?

MD-GAN (Hardy et al., 2019), or Multi-Discriminator GAN, introduced the
concept of using GANs in distributed systems. This model is characterized by a
unique architecture that includes a single generator on the server side,
multiple discriminators distributed across client sides, and a peer-to-peer
communication pattern. Additionally, the performance of MD-GAN was evaluated
against an adapted model, FL-GAN, which implements GANs on both the clients
and the server.

##### Guarantees some intermediate Privacy

DP-FedAVG-GAN (Augenstein et al., 2019) show the efficacy of employing GANs in
a Federated Learning context with user-level Differential Privacy (DP)
guarantees. DP-FedAVG-GAN has effectively addressed many data issues when the
data cannot be directly inspected. (Xin et al., 2020) introduce a privacy-
centric approach to Federated Learning GANs (Private FL-GANs) by using
Differential Privacy in the training process. Their method involves serialized
training sessions among clients, where noise is added during training to
ensure privacy protection. Specifically, they apply this technique within the
Wasserstein GANs (WGAN) framework to generate synthetic data, enhancing data
privacy without losing the quality of the generated data.

(Cao et al., 2022) demonstrate the effect of DP-CGAN (Differentially Private
Conditional GAN) on each client independently, focusing on aggregating sampled
data on the server side before redistributing it back to each client.(Behera
et al., 2022) create a model capable of generating synthetic data in a
federated setup that reflects the data distribution of all clients using a DP
GAN. This is particularly beneficial for clients with limited data resources.

Additionally, (Pejic et al., 2022) explores using homomorphic encryption to
train FL-GANs, achieving a fully privacy-preserving model. This approach
allows data encryption during training, ensuring that sensitive information
remains secure while still having practical model training. (Tabassum et al.,
2022) explore using FedGAN to protect IoT and edge devices (as clients) by
employing one global and many local GANs. This approach ensures the secure
sharing of local gradients and global updates to enhance the integrity of IDS.

##### Reduce Communication Overhead

(Zhang et al., 2021d) proposed a distributed learning architecture for GANs
that adapts communication compression in response to available bandwidth and
supports data and model parallelism in GAN training. This architecture uses
the gossip mechanism and Stackelberg game to introduce AC-GAN, a model that
enhances training effectiveness while reducing communication overhead compared
to FL-GAN and MD-GAN. In other words, AC-GAN extends the MD-GAN into a multi-
server-multi-device framework, strategically deploying GANs at the network’s
edge. This approach effectively reduces the reliance on a single server(Zhang
et al., 2023b). Additionally, (Zhang et al., 2023b) proposes a Collaborative
Game Parallel Learning (CAP) strategy, where each client operates as a
separate information island, using a synthesis score for feedback aggregation
and a Mix-Generator to address fully non-IID sources.

(Wijesinghe et al., 2023c) introduce an unsupervised federated GAN, UFed-GAN,
which adeptly captures the data distribution at the user level without
necessitating local classification training. (Ekblom et al., 2022) addresses
client drift by generating data from an ensemble of locally fine-tuned GANs,
providing a solution to one of the key challenges in FL.

##### Combine GANs with FL to address non-IID and data heterogeneity
challenges

The idea of combining GANs with FL to address non-independent and identically
distributed (non-IID) data challenges is extensive and varied. Several
innovative approaches have been proposed.

FedGAN (Rasouli et al., 2020) is one such paper that extends the application
of GANs to FL settings, particularly when data across different sources are
non-IID. FedGAN introduces an architecture that employs local generators and
discriminators, which are periodically synchronized through an intermediary.
This intermediary is responsible for averaging and sharing the parameters of
the generator and discriminator, ensuring the model’s convergence, especially
in non-IID scenarios. FeGAN (Guerraoui et al., 2020), another GAN-based FL,
innovates by determining the aggregation weight to address non-IID issues in
distributed GAN setups. It uses the Kullback-Leibler distance between the
local and global label categories to fine-tune the aggregation process.
However, both FedGAN and FeGAN have been noted to require significant energy
and computational resources.

An additional noteworthy contribution is from Improved FL-GAN (Li et al.,
2023a), which proposes using Maximum Mean Discrepancy (MMD) for aggregation
instead of the weight or parameter averaging methods to address non-IID
sources.

(Zhang et al., 2021a) introduces a novel approach that simulates a centralized
discriminator by aggregating a mixture of all private discriminators, offering
a unique solution to the challenges of Federated Learning, named Universal
Aggregation. (Wijesinghe et al., 2023a) proposes a sharing and aggregation
strategy using one local conditional GAN (cGAN) at each client and two cGANs
on the server, addressing client heterogeneity in GAN-based FL.

##### Using GAN-based FL for Tabular Data

While the main focus of the research in this area is addressing image
datasets, there is a growing interest in exploring other data types, such as
tabular and time series data. (Chiaro et al., 2023) is one of the papers
focusing on image and tabular non-IID data. They enhance the non-IID issue
using established solutions like data selection, compression, and
augmentation. In other words, they use CGANs trained on the server level.

GDTS (Zhao et al., 2023a) and Fed-TGAN (Zhao et al., 2021a) are two other
papers focusing only on Tabular data. They introduce two distinct approaches:
(i) deploying one GAN for each client and (ii) adapting the MD-GAN framework
specifically for tabular data. They also show that the first version
outperforms the second version. (Zhao et al., 2023b) propose a method for
generating tabular data with Vertical Federated Learning using GANs with a
training-with-shuffling mechanism. They evaluate their mechanism in synthetic
data quality and training scalability.

(Maliakel et al., 2024) explores the capabilities of GANs in processing
tabular data within a federated setup. Their method focuses on privacy
preservation, synthetic data generation, and handling incomplete data
simultaneously, which outperforms all other Tabular-based GANs. To achieve
their objectives, they utilize a Federated Wasserstein GAN (WGAN) with class-
wise sampling and node grouping.

##### Using GAN-based FL for Time Series data and Anomaly Detection

(Chen et al., 2023b) propose a method for anomaly detection and repair of
hydrological telemetry data using Federated Learning, GANs, and utilizing the
advantages of long short-term memory (LSTM).

##### Using GAN-based FL for Clinical Application

(Rehman et al., 2024) explore the use of FL-based GAN for cancer diagnosis,
emphasizing the accuracy of diagnosis while protecting patient
confidentiality. This approach combines DP and Quasi Identifiers within
Federated Analytics to improve data confidentiality.

(Zhang et al., 2021b; Nguyen et al., 2021) are proposed for COVID-19
recognition. (Nguyen et al., 2021) combined the FedGAN design with Blockchain
networks on cloud devices for COVID-19 detection. FedDPGAN (Zhang et al.,
2021b) tried to resolve the non-IID issue using data augmentation and their
methods for training COVID-19 models. They used a distributed DPGAN by using
the FL framework. (Wang et al., 2023c) implement a new benchmark for cross-
modality brain image synthesis in a federated setup and greatly facilitate the
development of medical GAN with DP guarantees.

Table 1. Federated GANs Summary

Paper | Model | Federate Algorithm | Data Type | Datasets | DP | #Clients | non-IID | Code
---|---|---|---|---|---|---|---|---
Private FL-GAN (Xin et al., 2020) | WGAN | FedAVG | Image |  | MNIST, CelebA
---
✓ |  $\sim$20 | ✗ | ✗
PerFED-GAN (Cao et al., 2022) | DP-CCGAN | ✗ | Image |  | CIFAR10, CIFAR100, FMNIST
---
✓ |  $\sim$100 | ✓ | ✗
IFL-GAN (Li et al., 2023a) |  | DCGAN
---
MMD Score | Image |  | CIFAR10, MNIST, SVHN
---
✓ |  $\sim$10 | ✓ | ✗
MD-GAN (Hardy et al., 2019) | GAN | Separate G/D | Image |  | CIFAR10, MNIST, CelebA
---
✗ |  $\sim$50 | ✗ | ✗
FedGAN (Rasouli et al., 2020) | CGAN | FedAVG | Image |  | Toy Examples, MNIST
---
CIFAR10, CelebA
✗ |  $\sim$10 | ✓ | ✗
FedDPGAN (Zhang et al., 2021b) | DP-GAN | FedAVG | Image | COVID-19 | ✓ |  $\sim$100 | ✓ | ✗
Fed-TGAN (Zhao et al., 2021a) | GAN | Adopt FL-GAN | Tabular |  | Adult, Covertype
---
Credit, Intrusion
✓ |  $\sim$10 | ✓ | ✓
GDTS (Zhao et al., 2023a) | GAN | FedAVG | Tabular |  | Adult, Covertype
---
Credit, Intrusion
✓ |  $\sim$10 | ✓ | ✗
GTV (Zhao et al., 2023b) |  | CT-GAN
---
CTAB-GAN
| VFL
---
Tabular |  | Adult, Covtype, Loan
---
Intrusion, Credit
✗ | 2-5 | ✓ | ✗
FL-Enhance (Chiaro et al., 2023) | CGAN |  | FedAVG, Fednova, FedOPT
---
| Image
---
Tabular
| MNIST, FMNIST
---
CA Housing, Beijing PM2.5
✗ |  $\sim$100 | ✓ | ✗
FeGAN (Guerraoui et al., 2020) | CGAN |  | FedSGD
---
Image |  | MNIST, FMNIST
---
ImageNET
✗ |  $\sim$128 | ✓ | ✗
UFed-GAN (Wijesinghe et al., 2023c) | DCGAN | Share Gradients Update | Image |  | FMNIST, SVHN
---
CIFAR10
✓ |  $\sim$30 | ✓ | ✗
DANCE (AC-GAN) (Behera et al., 2022) | GAN |  | FedSGD
---
Image |  | MNIST, FMNIST
---
CIFAR10
✗ |  $\sim$10 | ✗ | ✗
Universal Aggregation (Zhang et al., 2021a) | CGAN | Discriminator Aggregation | Image |  | MNIST, FMNIST
---
✗ |  $\sim$10 | ✓ | ✓
| FedSyn
---
(Behera et al., 2022)
GAN |  | Average Noisy Parameters
---
HFL
| Image
---
| MNIST, CIFAR10
---
✓ | 3 | ✓ | ✗
FedCSCD-GAN (Rehman et al., 2024) | Cramer GAN | Secure Aggregation | Image |  | Prostate/Lung/Breast Cancer
---
✓ | 5 | ✗ | ✗
DP-FedAvg-GAN (Augenstein et al., 2019) | GAN | FedAVG | Image |  | MNIST, EMNIST
---
✓ | 10 | ✗ | ✓
FedLGAN (Chen et al., 2023b) | LSTM + GAN | FedAvg | Time Series | Hydrological Data | ✗ | ✗ | ✓ | ✓
FL-GAN + HE (Pejic et al., 2022) | GAN | FedAvg | Image | CIFAR10 | ✗ |  $\sim$3 | ✗ | ✗
FLIGAN (Maliakel et al., 2024) | GAN | FedAVG | Tabular |  | Albert, Bank, Adult
---
Creditcard, Intrusion
✗ | 4-8 | ✓ | ✗
FedMed-GAN (Wang et al., 2023c) | GAN | FedAVG | Image |  | IXI, BRATS2021
---
✓ | 2,4,8 | ✓ | ✓
EFFGAN (Ekblom et al., 2022) |  | DCGAN
---
Ensemble Model
| FedAVG
---
Fine-Tuning
Image |  | MNIST, FMNIST
---
✗ | 100 | ✓ | ✗
(Nguyen et al., 2021) | GAN | Block-Chain Based | Image |  | COVID-19 X-ray
---
DarkCOVID
✓ | 5 | ✓ | ✓
PFL-GAN (Wijesinghe et al., 2023a) | GAN | Weighted Collaborative Aggregation | Image |  | MNIST, FMNIST, EMNIST
---
✗ | 10, 20 | ✓ | ✗

###  5.2. Diffusion Models and VAEs based FL

As summarized in Table 2, this section reviews contributions to combine
VAEs/Diffusion Models with FL, highlighting advancements in addressing data
heterogeneity and non-iid challenges and enhancing recommender systems.

##### VAEs-based FL

(Pfitzner and Arnrich, 2022) introduce a VAE-based FL with a differentially
private decoder to synthesize labeled datasets while synchronizing the decoder
component with FL. Their method is evaluated in both private and non-private
FL settings. (Dugdale, 2023) focuses on employing FL with VAEs to generate
handwritten digits, specifically trained on the MNIST dataset.

##### Combine VAEs with FL to Address Non-IID and data Heterogeneity
challenges

(Chen and Vikalo, 2023) enrich client datasets with DP synthetic data using
VAEs and adding Gaussian noise and filtering mechanisms for efficient data
synthesis to reduce the effects of Non-IID data distributions. (Chen et al.,
2023a) introduce cVAE with label augmentation at the client side to reduce
divergence in label-wise distribution adaptive FL.

##### Using VAE-based FL for Time Series, Tabular, and Trajectory data

(Kaspour and Yassine, 2023) propose a VAE model for non-intrusive load
monitoring (NILM) in smart homes. This is the first paper that works on energy
time-series data by using VAE in a federated setup. (Jiang et al., 2023) focus
on using Federated VAEs with DP for decentralized trajectory data analysis.
(Lomurno et al., 2022) introduces a VAE-based method for tabular data in FL by
sharing the generator for aggregation.

##### Diffusion Models based FL

(de Goede, 2023) adapt the FedAvg algorithm to train a Denoising Diffusion
Model (DDPM). (Jothiraj, 2023) introduce training Denoising Diffusion
Probabilistic Models across distributed data sources using FL. (Li et al.,
2023b) propose DDPM as a local generator for synthetic data shuffling to
improve FL convergence under data heterogeneity. They also compare the
efficacy of using $\beta$-VAE as an alternative generative model. (Tun et al.,
2023) combine Diffusion Models and FL for privacy-sensitive data in vision-
related tasks. (Sattarov et al., 2024) is the only recent study on FL-based
Denoising Diffusion Probabilistic Models (DDPM) to address the inherent
complexities in tabular data, such as mixed attributes, implicit
relationships, and distribution imbalance.

##### Combine Diffusion Models with FL to Address Non-IID and Data
Heterogeneity Challenges

(Ahn et al., 2023) propose FedDif, a communication-efficient strategy for
improving FL performance with Non-IID clients by reducing weight divergence.
They designed the diffusion strategy based on auction theory and provided both
theoretical and empirical analyses of FedDif to show its success in mitigating
weight divergence.

##### One-Shot Federated Learning

One-shot Federated Learning (OSFL) has recently gained attention due to its
low communication cost, leading many researchers to explore its design
advantages. (Yang et al., 2023b) introduce Diffusion Models to OSFL, proposing
a new large-scale mechanism to use client guidance for generating data that
complies with clients’ distributions. (Heinbaugh et al., 2023) address the
challenge of high statistical heterogeneity in one-shot FL using VAEs, showing
the performance of their mechanism with varying numbers of clients. They
propose two methods that ensemble the decoders from clients: (i) FedCVAE-Ens
and (ii) FedCVAE-KD, with the latter also using knowledge distillation to
compress the ensemble of client decoders into a single decoder. (Yang et al.,
2024a) addresses the semi-FL problem with Non-IID clients by introducing
Diffusion Models into semi-FL for one-shot semi-supervised FL.

Table 2. Federated VAEs and Diffusion Models Summary

Paper | Model | Federate Algorithm | Data Type | Datasets | DP | #Clients | Non-IID | Code
---|---|---|---|---|---|---|---|---
DPD-fVAE (Pfitzner and Arnrich, 2022) | VAE |  | Average of Probabilities
---
Average of Decoder Weights
Image |  | MNIST, FMNIST, CelebA
---
✓ |  $\sim$100-10,000 | ✗ | ✓
FedDPMS (Chen and Vikalo, 2023) | VAE |  | Uploading Usable Noisy Latent Means
---
Image |  | CIFAR10, CIFAR100
---
FMNIST
✓ |  $\sim$10-50 | ✓ | ✗
FedVAE (Jiang et al., 2023) | VAE |  | FedAVG
---
Joint-Announcement Protocol
Trajectory | Microsoft’s Geolife | ✗ | 70 | ✗ | ✗
LEDA-FL (Chen et al., 2023a) | CVAE |  | Augment the Label-wise Features
---
Interaction Aggregation
Image | CIFAR100 | ✗ | 50 | ✓ | ✗
(Heinbaugh et al., 2023) | CVAE |  | One-shot FL
---
Knowledge Distillation
Decoder Aggregation
| Image
---
| MNIST, FMNIST, SVHN
---
✓ | 5,10,20,50 | ✓ | ✗
(Kaspour and Yassine, 2023) |  | VAE
---
NILM
FedAVG | Energy Time-Series | UK-DALE | ✓ | ✗ | ✗ | ✗
SGDE (Lomurno et al., 2022) |  $\beta$-VAE |  | Cross-Silo FL
---
Generator Aggregation
| Image
---
Tabular
| UCI ML Repo
---
MNIST, FMNIST
✓ | <100 | ✓ | ✗
(Dugdale, 2023) |  $\beta$-VAE | FedAVG | Image | MNIST | ✗ | 4 | ✗ | ✓
Phoenix (Jothiraj, 2023) | Diffusion Model | Weight Average after 100 Local Epochs | Image | CIFAR10 | ✗ | 10 | ✓ | ✗
FedDif (Ahn et al., 2023) | Diffusion Model |  | Cooperative FL
---
D2D Communication
| Image
---
| MNIST, FMNIST, CIFAR10
---
✗ | ✗ | ✓ | ✓
FedDM (Tun et al., 2023) | Diffusion Model | FedAvg |  | Image
---
| CIFAR10, MNIST, SVHN
---
SARS-CoV-2
✗ | 10,30,50 | ✗ | ✓
(de Goede, 2023) | Diffusion Model |  | FedAVG, Federated UNET
---
Cross-Silo FL
| Image
---
| CelebA, FMNIST
---
✗ | 1-10 | ✗ | ✗
FedCADO (Yang et al., 2023b) | Diffusion Model |  | One-Shot FL
---
| Image
---
| OpenImage, NICO++
---
Domain-Net
✗ | 20 | ✓ | ✓
FedDISC (Yang et al., 2024a) | Diffusion Model |  | One-Shot FL
---
FedAvg
| Image
---
| OpenImage, NICO++
---
Domain-Net
✗ | 5 | ✓ | ✗
FedTabDiff (Sattarov et al., 2024) | Diffusion Model (DDPM) |  | Weighted Averaging
---
| Tabular
---
| Philadelphia City Payments
---
Diabetes Hospital
✗ | 5 | ✓ | ✓
Fedssyn (Li et al., 2023b) |  | Diffusion Model (DDPM)
---
VAE
| FedAvg, FedProx, FedPVR
---
SCAFFOLD, FedDyn
| Image
---
dSprites
| CIFAR10, CIFAR100
---
✓ | 10, 40, 100 | ✓ | ✓

###  5.3. Other Application of FL and Generative Models

As mentioned in Table 3, we summarize a collection of studies that use
different Federated Learning (FL) methods to address challenges not
specifically aligned with the previously mentioned groups. These papers
introduce approaches to data heterogeneity, Non-IID distributions, knowledge
distillation, and data sharing to enhance the performance and efficiency of FL
systems across various applications.

##### Solving Data Heterogeneity and Non-IID

(Guo, 2023) propose a data augmentation method to solve data heterogeneity in
FL. This method to balance the Non-IID source effectively uses a generative
model locally on the client side to synthesize data reflective of the
distribution. (Duan et al., 2022a) introduce a federated tabular data
augmentation strategy designed for Non-IID data distributions. The approach
includes federated Gaussian Mixture Models (GMM), Inverse Distance Matrix
(IDM) frequency, and global covariance for aggregating global statistics.
(Yoon et al., 2021) propose a simple Mean Augmented FL, where clients send and
receive averaged augmented local data under highly Non-IID federated settings.

(Li et al., 2022) introduces a framework that handles the non-IID issue by
sharing differentially private (DP) synthetic data. Each client pre-trains a
local DP GAN to generate synthetic data in this setup. They are combined with
a parameter server to construct synthetic datasets with a pseudo-label update
mechanism. These data can be applied in supervised and semi-supervised
learning settings. (Ma et al., 2023) use GANs to reduce local biases through
synthesized samples for improving non-IID FL performance. This model uses
Fully Homomorphic Encryption (FHE) to ensure privacy.

(Duan et al., 2021) use VAEs in FedDNA to aggregate gradient parameters using
federated averaging and statistical parameters using a weighting method. This
approach aims to reduce divergence and optimize collaborative learning by
addressing cross-model distribution covariate shift (CDCS). (Duan et al.,
2023) proposes using VAEs to cluster heterogeneous client data distributions
by learning optimal parameters for virtual fusion components without risking
privacy leakage.

(Zhao et al., 2023c) introduce a Diffusion-based FL Model to handle Non-IID
data. They use Diffusion Models for data augmentations to address Non-IID
data. (Wang et al., 2023b) introduces a data augmentation framework for
handling Non-IID data using Diffusion Models on the central server.

##### Knowledge, Feature, and Model Distillation

To improve the performance of the smaller dataset, new approaches include
learning a synthetic set of original data or data distillation. Different
methods are proposed, such as meta-learning, gradient matching, distribution
matching, neural kernels, or generative models. (Zhu et al., 2021a) addresses
the issue of data heterogeneity in FL through data-free knowledge
distillation, also known as a teacher-student paradigm. Their strategy
enhances privacy and efficiency since it involves the server learning a
lightweight generator to ensemble user information without direct data access.
(Zhang et al., 2022) propose a two-stage, data-free, one-shot FL framework
focused on data generation and model distillation. The initial stage trains a
generator considering factors like similarity, stability, and transferability,
followed by employing ensemble models and generated data to train the global
model.

(Yang et al., 2024b) introduce a VAE-based framework that addresses data
heterogeneity by sharing partial features in the data. The framework also
elaborates on methods to reduce the risks of model inversion and membership
inference attacks.

(Wu et al., 2022) propose a method that employs GANs to protect clients by
exclusively sharing their generators with the server, thus strengthening
against DLG attacks. This approach entails sharing clients’ generators with
the server instead of extractors to merge clients’ collective knowledge to
enhance model performance.

##### Sharing (Synthetic) Data and Distribution Matching

(Xiong et al., 2023) introduce a communication-efficient FL, an iterative
distribution matching approach that learns a surrogate function by sending
differentially private synthesized data to the server. (Prediger et al., 2023)
propose a collaborative framework in that every client creates synthetic twin
data to share with the global server. Clients then decide whether to combine
this synthetic data with their real data for model training. (Zhou et al.,
2023) introduce a new communication-efficient Federated Learning method with a
single-step synthetic features compressor. Their method transmits only a tiny
set of model inputs and labels.

##### Using VAE-based FL for Recommender Systems

(Ding et al., 2023) use VAEs with AdaptiveDP in federated settings for
privacy-safe recommendations. Their method also analyzes the privacy risks of
VAE in federated collaborative filtering. (Li et al., 2023e) proposes a
Distributed VAE for a sequential recommendation that clusters clients into
virtual groups for local model training and server aggregation by GMM.

##### Federated Imputation of Incomplete Data

(Yao and Zhao, 2022) use a GAN at each client to address data imputation
challenges within the Federated Transfer Learning problem. (Zhou et al., 2021)
design a GAN imputation mechanism under an FL framework to address datasets
originating from various data owners without necessitating data sharing.
(Balelli et al., 2023) propose a federated version of MIWAE as a deep latent
variable model for missing data imputation with variational inference.

Table 3. Other Uses of Generative Models and Federated Learning

Paper | Model | Federate Algorithm | Data Type | Datasets | DP | #Clients | Non-IID | Code
---|---|---|---|---|---|---|---|---
(Prediger et al., 2023) | ✗ |  | Share Twin Data
---
Image | UK biobank | ✓ | 16 | ✗ | ✓
(Guo, 2023) |  | Data Augmentation
---
FedAVG | Image | Covid-19 Xray | ✗ | 6-10 | ✓ | ✗
| Fed-TDA
---
(Duan et al., 2022a)
| Data Augmentation
---
| Fed-VB-GMM
---
FedAvg, FedProx
Tabular |  | Clinical, Tuberculosis
---
CovType, Intrusion, Body
✓ | 60 | ✓ | ✓
| FedMix
---
(Yoon et al., 2021)
Mixup |  | Weight Average
---
Image |  | FMNIST, Shakespeare
---
CIFAR10, CIFAR100
✓ | 20, 40, 60 | ✓ | ✓
| 3SFC
---
(Zhou et al., 2023)
Synthetic Features |  | Synthetic Features Averaging
---
Image |  | MNIST, FMNIST, EMNIST
---
CIFAR10, CIFAR100
✓ | 20 | ✓ | ✗
| FedDM
---
(Xiong et al., 2023)
Synthetic Data (MMD) | Surrogate Function | Image |  | MNIST, CIFAR10, CIFAR100
---
✓ | 10 | ✓ | ✗
| FEDGEN
---
(Zhu et al., 2021a)
| Ensemble Model
---
Knowledge Distillation | Image |  | MNIST, EMNIST, CelebA
---
✗ | 20 | ✓ | ✓
| DENSE
---
(Zhang et al., 2022)
| 2-Stage Data Generation
---
Ensemble Model
| One Shot FL
---
Knowledge Distillation
Image |  | MNIST, FMNIST, SVHN
---
CIFAR10, CIFAR100
Tiny-ImageNet
✗ | 5-100 | ✓ | ✗
Fedtmi (Yao and Zhao, 2022) | GAN | Federated Transfer Learning | Image |  | Steam-driven Water Pumps
---
✗ | 3 | ✓ | ✗
FCGAI (Zhou et al., 2021) | GAN | FedAVG | Image |  | Air Pollutants
---
✗ | 3 | ✓ | ✓
FedCG (Wu et al., 2022) | DCGAN |  | Share Generators
---
Knowledge Distillation
Image |  | FMNIST, CIFAR10
---
Difit5, DomainNet
Office-Caltech10
✗ | 4-8 | ✓ | ✗
(Li et al., 2022) |  | WGAN-GP
---
AC-WGAN-GP
Pseudo Label Update | Image |  | MNIST, FMNIST
---
CIFAR10, SVHN
✓ |  $\sim$10 | ✓ | ✗
FLGAN (Ma et al., 2023) | FHE-based GAN |  | FedAVG
---
FedSGD
Image |  | MNIST, FMNIST, USPS
---
CIFAR10, CIFAR100
✗ |  $\sim$10 | ✓ | ✗
FedDDA (Zhao et al., 2023c) | Diffusion Model | FedAvg |  | Image
---
| CIFAR10, FMNIST
---
✗ | 2-4 | ✓ | ✗
FDA-CDM (Wang et al., 2023b) | Diffusion Model | Share Data |  | Image
---
| CIFAR10, MNIST
---
✗ | 20 | ✓ | ✗
pFedV (Mou et al., 2023) | VAE | FedAdam | Image |  | MNIST, MNIST-M, USPS
---
SVHN, Synthetic Digits
✗ | ✗ | ✓ | ✗
ADPFedVAE (Ding et al., 2023) | VAE |  | Randomly Select k Elements
---
FedAdam
Tabular |  | MovieLens-1M2,
---
Lastfm-2K3, Steam
✓ | 250 | ✗ | ✗
Fed-MIWAE (Balelli et al., 2023) | VAE |  | FedAvg, FedPROX, Scaffold
---
| Image
---
| ADNI
---
✗ | 3 | ✓ | ✗
FedFed (Yang et al., 2024b) | VAE |  | FedAvg, FedProx
---
SCAFFOLD, FedNova
\+ Information-Sharing
Image |  | FMNIST
---
SVHN
CIFAR10
CIFAR100
✓ | 10, 100 | ✓ | ✗
FedDNA (Duan et al., 2021) | VAE | Decoupled Parameter Aggregation |  | Image
---
NLP Prompt
| MNIST, FMNIST, CIFAR10
---
Sentiment140
✗ | 5-20 | ✓ | ✗
(Duan et al., 2023) | VAE |  | Distribution Fusion FL
---
Interaction Aggregation
Image |  | MNIST, FMNIST, CIFAR10
---
✗ | 20-100 | ✓ | ✓
DistVAE (Li et al., 2023e) | AC-VAE |  | Average Pooling
---
FedAVG (Virtual Groups)
| Tabular
---
| MovieLens Latest1
---
MovieLens-1m2
MovieTweet-ings3, PEEK
✗ | 4, 8, 16, 32, 64, 128 | ✓ | ✗

##  6\. Security and Privacy Review

As we mentioned earlier, we can split the type of attacks into two groups: (i)
Privacy Attacks (Table 4) and (ii) Integrity Attacks (Table 5). This section
will review papers discussing the combination of FL and Generative Models with
Privacy and Integrity evaluation and consideration. Although our primary focus
is on Federated Generative Models, we also try to summarize some Generative
Models based on attack and defense mechanisms in federated setup.

###  6.1. Consider Privacy Attacks

Table 4. Privacy Attacks Summary

Paper | Model | Federate Algorithm | Data Type | Datasets | DP? | #Clients |  | Explicitly evaluate
---
privacy attacks
Non-IID | Code
(Xin et al., 2022) | WGAN | FedAVG | Image |  | CelebA
---
MNIST
Fashion MNIST
✓ |  $\sim$20 | Membership Inference | ✓ | ✗
PP-FedGAN (Ghavamipour et al., 2023) | WGAN | FedAVG | Image |  | MNIST
---
SVHN
✓ |  $\sim$10 |  | Membership Inference
---
Property Inference
Reconstruction
✗ | ✗
HT-Fed-GAN (Duan et al., 2022b) | CGAN | Fed-VB-GMM | Tabular |  | Adult
---
Health
CovType
Intrusion
Body
✓ | 3 | Membership Inference | ✓ | ✓
GAFM (Han and Guan, 2023) | GAN |  | VFL
---
Vanilla SplitNN
Tabular |  | Spambase
---
IMDB
Criteo
ISIC
✗ |  $\sim$10 | Label Leakage | ✗ | ✗
PS-FedGAN (Wijesinghe et al., 2023b) | CGAN | Sharing Discriminator | Image |  | MNIST
---
FMNIST
SVHN
CIFAR10
✓ |  $\sim$30 | Reconstruction | ✓ | ✗
(Sun et al., 2021a) | GAN | Weight Average | Image |  | CIFAR10
---
MNIST
FMNIST
✗ |  $\sim$10 | Reconstruction | ✗ | ✗
(Ha and Dang, 2022) |  | GAN
---
✗ | Image |  | LFW
---
CIFAR10
✗ | ✗ | Inference | ✗ | ✗

##### Federated GAN with Privacy Attacks Evaluation and Optimization

(Xin et al., 2022) propose an extended version of private FL-GAN with DP,
specifically considering membership inference attacks in a cross-silo setting
of FL. (Ghavamipour et al., 2023) proposes a FL-based GAN with DP and CKKS
homomorphic encryption to counter membership inference attacks, optimizing the
private FL-GAN approach from (Xin et al., 2020). (Duan et al., 2022b) focuses
on preventing membership inference attacks within tabular GAN-based FL,
marking the first effort towards privacy-preserving data synthesis on
decentralized tabular datasets through a volitional Bayesian Gaussian mixture
model.

##### Using GANs for Defence Purpose in FL

(Wijesinghe et al., 2023b) propose a GAN-related FL framework to prevent
reconstruction attacks and handle heterogeneous data distributions across
clients. This method trains a generator at the server to mimic the data
distribution of the clients’ local GANs while sharing only the local
discriminator, not the generator. (Han and Guan, 2023) introduce GANs in
vertical Federated Learning for label protection during binary classification.
This approach improves label privacy protection by integrating splitNN with
GANs, aiming to reduce Label Leakage from Gradients (LLG).

##### Using GANs for Attack Purpose in FL

(Zhang et al., 2020; Ha and Dang, 2022) propose an attack methodology where
the attacker, an ”honest but curious” client, uses GANs to infer information.
Their study experiments with different GAN models: conditional GAN, control
GAN, and WGAN. (Sun et al., 2021a) use GANs to affect the learning process in
FL and reconstruct clients’ private data, focusing on a target-oriented data
reconstruction attack.

###  6.2. Consider Integrity Attacks

##### Federated GANs with Integrity Attacks Evaluation and Optimization

(Veeraragavan and Nygård, 2023) addresses security weaknesses in GAN-based FL
using Federated GANs, consortium blockchains, and Shamir Secret Sharing
algorithms to reduce model poisoning attacks. (Jin and Li, 2022, 2023) outline
a backdoor attack strategy targeting GAN-based medical image synthesis,
specifically within FedGAN frameworks. They implement a data poisoning
strategy against discriminators and introduce FedDetect, a defensive mechanism
to counter backdoor attacks. (Wang et al., 2023a) explores the potential for
fake gradient attacks within distributed GAN settings, showing how poisoned
gradients can disrupt the training process of generators. (Tabassum et al.,
2022) introduce an IDS using GAN, inspired by the FL-GAN architecture, to
detect cyber threats in IoT systems, including backdoor classification
efforts.

##### FL-based VAEs with Privacy Attacks Evaluation and Optimization

VAE-based Anomaly Detection Framework: (Gu et al., 2021) presents a VAE-based
framework for anomaly detection, using reconstruction error probability
distributions to identify benign model updates. It works with IID and non-IID
data sources and evaluates Byzantine and Backdoor Attacks’ robustness. (Gu and
Yang, 2021) further extends this concept with a CVAE-based framework for
detecting and removing malicious model updates to reduce the negative impact
of targeted model poisoning attacks.

##### Using GANs for Attack Purpose in FL

(Zhang et al., 2019; Psychogyios et al., 2023) introduces GAN-driven data
poisoning and label flipping attacks, showcasing how attackers can stealthily
generate and utilize poisoned data to compromise the FL process, proposing
methods to reduce such attacks.

##### Using GANs for Defence Purpose in FL

(Zhao et al., 2022) propose a mechanism to mitigate and detect poisoning
attacks in FL using GANs in the server. (Zhao et al., 2020) proposes a defense
mechanism against poisoning in FL using GANs to reconstruct training data from
model updates and evaluate client contributions for authenticity by filtering
out attackers based on a predefined accuracy threshold.

##### Using VAEs for Defence Purpose in FL

(Chelli et al., 2023) employ CVAE and selective parameter aggregation to
defend against poisoning attacks, including sign flipping and label flipping.

Table 5. Integrity Attack Summary

Paper | Model | Federate Algorithm | Data Type | Datasets | DP? | #Clients |  | Explicitly evaluate
---
integrity attacks
Non-IID | Code
FEDGAN-IDS (Tabassum et al., 2022) | ACGAN | FedAVG |  | Image
---
Tabular
Time-Series
| KDD-CUP99
---
NSL-KDD
UNSW-NB15
✗ |  $\sim$10 | Backdoor | ✓ | ✗
(Jin and Li, 2022) |  | WGAN-DP
---
Vanilla GAN
FedAVG | Image | ISIC | ✓ |  $\sim$10 | Backdoor | ✓ | ✓
(Jin and Li, 2023) | GAN | FedAVG | Image |  | ISIC
---
Chest X-ray
✓ | ✗ | Backdoor | ✓ | ✗
(Wang et al., 2023a) | WGAN | ✗ | Image |  | MNIST
---
CIFAR10
✗ |  $\sim$5 | Model Poisoning | ✗ | ✗
FREPD (Gu et al., 2021) | VAE | GeoMed | Image |  | Vehicle
---
MNIST
FMNIST
✗ | 10-50 |  | Byzantine
---
Backdoor
✓ | ✗
(Gu and Yang, 2021) | CVAE |  | FedAVG
---
GeoMed
Image |  | Vehicle
---
MNIST
FMNIST
✗ | 10, 50, 1000 |  | Byzantine
---
Poisoning
✓ | ✗
PDGAN (Zhao et al., 2020) | GAN | FedAVG | Image |  | MNIST
---
FMNIST
✗ | 10 | Poisoning | ✓ | ✗
(Zhao et al., 2022) | GAN | FedAVG | Image |  | MNIST
---
FMNIST
✗ |  $\sim$100 | Poisoning | ✗ | ✗
FedGuard (Chelli et al., 2023) | CVAE |  | FedAVG
---
Image | MNIST | ✗ | 100 | Poisoning | ✗ | ✓
(Zhang et al., 2019) | GAN | Weight Average | Image |  | MNIST
---
AT&T
✗ | 10-100 | Poisoning | ✗ | ✗
(Psychogyios et al., 2023) | GAN | ✗ | Image | Plant Leaf Diseases | ✗ | ✗ |  | Poisoning
---
✗ | ✗
(Veeraragavan and Nygård, 2023) | GAN | FedAVG | ✗ | ✗ | ✗ | ✗ | Model Poisoning | ✗ | ✗

##  7\. Related Work

In this section, we review a wide range of surveys on Federated Learning and
Generative Models and surveys that review the intersection of these two areas.
This overview will cover foundational and advanced topics, showing each
field’s importance and ongoing development.

###  7.1. Federated Learning Surveys

Federated Learning was introduced by Google in 2016, marking a change in the
focus of Machine Learning models between distributed datasets. Since then,
researchers have focused on enhancing performance and minimizing privacy
risks. There are many surveys for Federated Learning based on different
aspects.
First, many surveys cover the State-of-the-art and research challenges across
different subsets of FL, such as Non-IID, vertical Federated Learning,
heterogeneous data, and cross-silo Federated Learning. (Ye et al., 2023; Zhu
et al., 2021b; Ye et al., 2023; Wei et al., 2022) are some good surveys in
this specific areas and also flower (Beutel et al., 2022) is the best
framework for different Federated Learning setups. Second, Federated Learning
is applied across various fields, including finance, health records,
transportation, and NLP. Earlier studies like (Li et al., 2020a; Yang et al.,
2019; Aledhari et al., 2020; Banabilah et al., 2022; Kairouz et al., 2021;
Zhang et al., 2021c; Wen et al., 2023) provide general insights for beginning
research and cover application aspects. On the other hand, (Liu et al., 2024;
Rauniyar et al., 2023; Pandya et al., 2023; Che et al., 2023; Li et al.,
2023c; Rauniyar et al., 2023) focus on specific applications, offering
detailed reviews. Finally, considering privacy and security concerns in
Federated Learning is a common and ongoing research area. Recent surveys like
(Mothukuri et al., 2021; Rauniyar et al., 2023; Li et al., 2023c; Shao et al.,
2023; Zhang et al., 2023a; Rasha et al., 2023; Rodríguez-Barroso et al., 2023;
Gosselin et al., 2022; Lyu et al., 2020) extensively cover related issues of
threats, security, toxicity, and privacy in Federated Learning.

###  7.2. Generative Models Surveys

Deep Generative Models have many applications, such as data augmentation,
text, video, audio synthesis, anomaly detection, etc. Many surveys focus on
different applications and gather different state-of-the-art generative
models. (Salakhutdinov, 2015; Oussidi and Elhassouny, 2018; Ruthotto and
Haber, 2021) are some older surveys that cover the whole idea of Deep
Generative Models and can be used to introduce generative models. (Creswell et
al., 2018; Wang et al., 2017; Gui et al., 2021) are basic surveys that cover
applications of Generative Adversarial Networks. We have well-covered new
works for specific applications, like (Dash et al., 2023; de Souza et al.,
2023; Brophy et al., 2023). (Chakraborty et al., 2024; Megahed and Mohammed,
2024) are the newest surveys that cover the state-of-the-art of GANs over 10
years. On the other hand, many surveys cover variational autoencoders. (Zhai
et al., 2018; Ghojogh et al., 2021; Wan et al., 2017) provide us with good
intuition and familiarity with basic aspects and variants of autoencoders, and
(Bank et al., 2023; Papadopoulos and Karalis, 2023; Li et al., 2023d) are the
newest works in this area. Diffusion Models are a new trend in the field of
generative models, and (Cao et al., 2024; San-Roman et al., 2021; Yang et al.,
2023c; Croitoru et al., 2023) are well-organized surveys on generative
Diffusion Models. Generative Models can also be used for security aspects and
anomaly detection. (Vyas and Rajendran, 2023; Kos et al., 2018; Sun et al.,
2021b; Cai et al., 2021) are some general reviews in this area.

###  7.3. Federated Learning and Generative Models Surveys

Since we cover the specific combination of Generative Models and Federated
Learning, not many reviews cover both in one place. (Little et al., 2023) is
the only survey that covers the FL and Synthetic data. Their scoping review
only focuses on 69 research papers in this area, including Federated
synthesis, Improving FL using augmentation, Developing FL, and Using
Generative Models for Synthetic Data. Additionally, they describe some state-
of-the-art methods such as Fed-TGAN, GTV, and SGDE. Moreover, they only cover
synthetic data in a federated setup and consider Generative Models as a method
for synthetic data.

The main difference between our works and (Little et al., 2023) is we mainly
focus on reviewing all related papers, but their primary goal is having a
numerical review and only elaborating on a few important papers. Their primary
focus is on using Synthetic Data, whether they use Generative Models or not.
Their review also did not consider the privacy and integrity aspects of
different papers, which was one of our main goals.

In the context of an attack on Federated Learning using Generative Models,
many surveys mentioned it as the application of Generative Models or Threats
of Federated Learning (Lyu et al., 2020). (Ma et al., 2022) is a good survey
that covers how to handle solving Non-IID data in Federated Learning using
GANs.

##  8\. Discussion and Conclusion

###  8.1. State-of-the-Arts Summary

##### Most Used Federated GANs:

Most papers compare the performance of their new models with GAN-based FL: MD-
GAN, AC-GAN, FL-GAN, DP-FedAvg-GAN, and IFL-GAN.

##### Available Code:

Among those papers with available code, these are the most common for
comparison: DPD-fVAE, HT-Fed-GAN, DP-fedAvg-GAN, Fed-TGAN.

##### Tabular Data:

For tabular data, the most used papers to compare are Fed-TGAN, HT-Fed-GAN,
and GDTS.

##### VAE and Diffusion Model-based FL:

For VAE and Diffusion Model-based papers, DPD-fVAE, FedDPMS, ADPFedVAE,
Phoenix, and FedTabDiff are the most used papers for comparison.

##### Common Attacks:

As all common attacks in FL, Membership Inference and Poisoning Attacks are
the most common in FL-based Generative Models (based on the number of research
focusing on these areas). Additionally, researchers commonly use Generative
Models for Attack/Defence purposes, but it was not the focus of our surveys.

##### Satisfy DP:

Fed-TGAN, HT-Fed-GAN, Private FL-GAN, DP-FedAVG-GAN, DPD-fVAE, and SGDE are
the most common papers that evaluate different values of Privacy Parameters to
satisfy DP definition.

##### Aggregated Methods:

FedAvg is the most common aggregation method used among different methods.
However, model aggregation, MMD Score, FedProx, and FedSGD are also used in
different models.

##### Datasets

Majority of the evaluation datasets in Image-based Models are MNIST, FMNIST,
SVHN, CelebA, CIFAR10/CIFAR100, and Breast Cancer Wisconsin,. On the other
hand, for Tabular Data, the most used datasets are from the UCI Machine
Learning Repository (e.g., ADULT, Covertype, Housing, Credit, Body),
Intrusion, and MovieLens. Additionally, Microsoft’s Geolife is used for
Trajectory data, and OpenImage, NICO++, and Domain-Net are used for One-Shot
FL papers.

###  8.2. What have we learned?

As we mentioned in Section 5, the main focus of this survey is on Federated
Generative Models among all papers that combine FL and GANs. After learning
about the SOTA in Federated Generative Models, we elaborate on anything we
learned from papers in this section.

##### Main Reason of Federate Generative Models:

Among all of the papers that we reviewed, we can summarize the main points of
using Federated Generative Models into the following groups:

  1. (1)

Lack of Sufficient Data in Single Clients: Using FL-based Generative Models
for edge devices with a small amount of data can be efficient. In other words,
it benefits clients with limited data resources, such as medical records,
finance fraud detection, and recommendation systems for distributed devices.

  2. (2)

Prevent Sharing Clients’ Data and Privacy-Preserving: As all FL models, using
Federated Generative Models will leverage the advantage of keeping data local
in the generating process.

  3. (3)

Communication Efficient: Learning to generate data at the central server, and
not at the clients, is communication efficient and does not require more
computational power from the clients. Many research studies have proposed an
efficient communication method for Federated Generative Models.

##### Different Types of Federated GANs:

For Federated GANs, we can categorize them into three groups:

  1. (1)

Similar to MD-GAN: One generator at the server, many discriminators at
clients.

  2. (2)

Similar to FL-GAN: One GAN at the server, many GANs at clients (Federated
Learning Adapted to GAN).

  3. (3)

Splitted GAN: Having GANs at clients and only having a Generator/Discriminator
at the server.

##### Satisfy DP:

Federated Generative Models efficiently satisfy the Differential Privacy (DP)
definition, and many research papers test different values of privacy
parameters.

##### Various Types of Data:

Much research focuses on using Federated Generative Models for data types such
as images, tabular, time-series, and trajectories. It increases research for
many applications, such as clinical applications, financial datasets, and IoT
devices. A major research focus is also using VAE and FL for recommender
systems in federated settings and clustering data.

##### Generative Models and FL:

On the other hand, Many papers focus on using Generative Models only for
clients or only at servers to solve data heterogeneity and Non-IID challenges,
Anomaly Detection, ensure privacy, and prevent poisoning attacks. This is also
one use of FL and Generative Models, which is not the focus of this survey.

###  8.3. Future Works and Open Problems

As we mentioned earlier, the main reason for bringing generative models into
FL was to protect individual data by preventing sensitive data sharing and
communication overhead by keeping it in their devices. On the other hand, some
works focus on using generative models in client or server to utilize the
applications of generative models such as anomaly detection, addressing Non-
IID and data heterogeneity challenges, inference attacks, and protection
against reconstruction attacks.

##### Privacy and Security:

Reviewing papers reveals many open research problems regarding privacy and
security. None of the papers focusing on Integrity Attacks consider Tabular
datasets. None of the papers focus on Privacy and Integrity attacks in
Diffusion-based FL models. Ranking-based training of Federated Learning to
Resist Poisoning Attacks is an interesting topic recently proposed (Mozaffari
et al., 2023), and combining its idea with Federated Generative Models can
guarantee more privacy-preserving.

##### Encryption:

Although some research exists on parameter-sharing encryption in image-based
Federated Models, the impact of using encryption for sharing gradients and
parameters in tabular data models or anomaly detection models remains
unresolved. Furthermore, the application of parameter-sharing encryption in
Diffusion Models and Variational Autoencoders (VAEs) is still an open problem.

##### Diffusion Models

In recent months, due to the convergence challenges faced by GANs in both
centralized and federated setups, many research efforts have shifted towards
using Diffusion Models, particularly in diffusion-based Federated Learning
(FL). The competitive focus on Federated Diffusion Models has increased
significant research potential in this area.

##### Scalability:

Most papers focus on the small size of clients; increasing the number of
clients might affect the performance and robustness of different Federated
Models. Scalability analysis and consideration are still open problems among
Generative-based FL models, specifically for Federated VAEs and Diffusion
Models.

##### IoT Devices:

Developing lightweight generative models suitable for FL in resource-
constrained environments like IoT devices. This includes optimizing models for
energy efficiency and memory usage. Currently, only GANs are used for IoT
devices, which is not a lightweight generative model. Using other generative
models and making them more efficient is still an open problem.

##### One-shot FL / Pre-Trained Models:

  * •

Methods in one-shot FL have demonstrated strong performance under substantial
communication constraints. One-shot FL is an open and interesting topic in FL-
related research, and only three papers try to use Generative Models for one-
shot FL.

  * •

Only (Heinbaugh et al., 2023) in one-shot FL did an experiment with high
statistical heterogeneity. It is still an open problem that can focus on it.

  * •

Only a few studies have focused on the potential of pre-trained Diffusion
Models in FL.

##### Ensemble Models:

Ensemble Models combining all weak learner or well-chosen strong models can be
an open problem to gain more robustness. For example, different generative
models can be used for different clients, or different generative models can
be used on servers to recognize poisoning attacks based on their method.

##### Prompt-Based + Generative AI

The foundation generative models are still under-explored in Federated
Learning, though a few related works study foundation models in Federated
Learning. Moreover, combining Prompt-based and Generative AI with FL and
Diffusion Models can still be a good research idea that can focus on it.

##### Multi-objective Optimization:

(Ran et al., 2024) propose a Multi-objective evolutionary GAN for tabular data
synthesis and applying it to federated-based GANs can be an open research
problem.

## References

  * (1)
  * Acs et al. (2018) Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. 2018.  Differentially Private Mixture of Generative Neural Networks.  arXiv:1709.04514 [cs.LG]
  * Ahn et al. (2023) Seyoung Ahn, Soohyeong Kim, Yongseok Kwon, Joohan Park, Jiseung Youn, and Sunghyun Cho. 2023.  Communication-Efficient Diffusion Strategy for Performance Improvement of Federated Learning with Non-IID Data.  arXiv:2207.07493 [cs.DC]
  * Aledhari et al. (2020) Mohammed Aledhari, Rehma Razzak, Reza M Parizi, and Fahad Saeed. 2020.  Federated learning: A survey on enabling technologies, protocols, and applications.  _IEEE Access_ 8 (2020), 140699–140725.
  * Annamalai et al. (2023) Meenatchi Sundaram Muthu Selva Annamalai, Igor Bilogrevic, and Emiliano De Cristofaro. 2023.  FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting.  _arXiv:2311.16940_ (2023).
  * Arafeh et al. (2022) Mohamad Arafeh, Ahmad Hammoud, Hadi Otrok, Azzam Mourad, Chamseddine Talhi, and Zbigniew Dziong. 2022.  Independent and identically distributed (iid) data assessment in federated learning. In _GLOBECOM 2022-2022 IEEE Global Communications Conference_. IEEE, 293–298.
  * Augenstein et al. (2019) Sean Augenstein, H Brendan McMahan, Daniel Ramage, Swaroop Ramaswamy, Peter Kairouz, Mingqing Chen, Rajiv Mathews, et al. 2019\.  Generative models for effective ML on private, decentralized datasets.  _arXiv:1911.06679_ (2019).
  * Balelli et al. (2023) Irene Balelli, Aude Sportisse, Francesco Cremonesi, Pierre-Alexandre Mattei, and Marco Lorenzi. 2023.  Fed-MIWAE: Federated Imputation of Incomplete Data via Deep Generative Models.  _arXiv:2304.08054_ (2023).
  * Banabilah et al. (2022) Syreen Banabilah, Moayad Aloqaily, Eitaa Alsayed, Nida Malik, and Yaser Jararweh. 2022.  Federated learning review: Fundamentals, enabling technologies, and future applications.  _Information processing & management_ 59, 6 (2022), 103061.
  * Bank et al. (2023) Dor Bank, Noam Koenigstein, and Raja Giryes. 2023.  Autoencoders.  _Machine learning for data science handbook: data mining and knowledge discovery handbook_ (2023), 353–374.
  * Behera et al. (2022) Monik Raj Behera, Sudhir Upadhyay, Suresh Shetty, Sudha Priyadarshini, Palka Patel, and Ker Farn Lee. 2022.  Fedsyn: Synthetic data generation using federated learning.  _arXiv:2203.05931_ (2022).
  * Beutel et al. (2022) Daniel J. Beutel, Taner Topal, Akhil Mathur, Xinchi Qiu, Javier Fernandez-Marques, Yan Gao, Lorenzo Sani, Kwing Hei Li, Titouan Parcollet, Pedro Porto Buarque de Gusmão, and Nicholas D. Lane. 2022.  Flower: A Friendly Federated Learning Research Framework.  arXiv:2007.14390 [cs.LG]
  * Bhagoji et al. (2019) Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. 2019.  Analyzing federated learning through an adversarial lens. In _International Conference on Machine Learning_. PMLR, 634–643.
  * Bouacida and Mohapatra (2021) Nader Bouacida and Prasant Mohapatra. 2021.  Vulnerabilities in Federated Learning.  _IEEE Access_ 9 (2021), 63229–63249.  https://doi.org/10.1109/ACCESS.2021.3075203
  * Brophy et al. (2023) Eoin Brophy, Zhengwei Wang, Qi She, and Tomás Ward. 2023.  Generative adversarial networks in time series: A systematic literature review.  _Comput. Surveys_ 55, 10 (2023), 1–31.
  * Cai et al. (2021) Zhipeng Cai, Zuobin Xiong, Honghui Xu, Peng Wang, Wei Li, and Yi Pan. 2021.  Generative adversarial networks: A survey toward private and secure applications.  _ACM Computing Surveys (CSUR)_ 54, 6 (2021), 1–38.
  * Cao et al. (2024) Hanqun Cao, Cheng Tan, Zhangyang Gao, Yilun Xu, Guangyong Chen, Pheng-Ann Heng, and Stan Z Li. 2024.  A survey on generative diffusion models.  _IEEE Transactions on Knowledge and Data Engineering_ (2024).
  * Cao et al. (2022) Xingjian Cao, Gang Sun, Hongfang Yu, and Mohsen Guizani. 2022.  PerFED-GAN: Personalized federated learning via generative adversarial networks.  _IEEE Internet of Things Journal_ 10, 5 (2022), 3749–3762.
  * Chakraborty et al. (2024) Tanujit Chakraborty, Ujjwal Reddy KS, Shraddha M Naik, Madhurima Panja, and Bayapureddy Manvitha. 2024.  Ten years of generative adversarial nets (GANs): a survey of the state-of-the-art.  _Machine Learning: Science and Technology_ 5, 1 (2024), 011001.
  * Che et al. (2023) Liwei Che, Jiaqi Wang, Yao Zhou, and Fenglong Ma. 2023.  Multimodal federated learning: A survey.  _Sensors_ 23, 15 (2023), 6986.
  * Chelli et al. (2023) Melvin Chelli, Cédric Prigent, René Schubotz, Alexandru Costan, Gabriel Antoniu, Loïc Cudennec, and Philipp Slusallek. 2023.  FedGuard: Selective Parameter Aggregation for Poisoning Attack Mitigation in Federated Learning. In _2023 IEEE International Conference on Cluster Computing (CLUSTER)_. IEEE, 72–81.
  * Chen et al. (2023a) Baojian Chen, Hongjia Li, Lu Guo, and Liming Wang. 2023a.  Label-wise Distribution Adaptive Federated Learning on Non-IID Data. In _2023 IEEE Wireless Communications and Networking Conference (WCNC)_. IEEE, 1–6.
  * Chen and Vikalo (2023) Huancheng Chen and Haris Vikalo. 2023.  Federated learning in non-iid settings aided by differentially private synthetic data. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 5026–5035.
  * Chen et al. (2023b) Zheliang Chen, Xianhan Ni, Huan Li, and Xiangjie Kong. 2023b.  FedLGAN: a method for anomaly detection and repair of hydrological telemetry data based on federated learning.  _PeerJ Computer Science_ 9 (2023), e1664.
  * Chiaro et al. (2023) Diletta Chiaro, Edoardo Prezioso, Michele Ianni, and Fabio Giampaolo. 2023.  FL-Enhance: A federated learning framework for balancing non-IID data with augmented and shared compressed samples.  _Information Fusion_ 98 (2023), 101836.
  * Creswell et al. (2018) Antonia Creswell, Tom White, Vincent Dumoulin, Kai Arulkumaran, Biswa Sengupta, and Anil A Bharath. 2018.  Generative adversarial networks: An overview.  _IEEE signal processing magazine_ 35, 1 (2018), 53–65.
  * Croitoru et al. (2023) Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. 2023.  Diffusion models in vision: A survey.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ (2023).
  * Dash et al. (2023) Ankan Dash, Junyi Ye, and Guiling Wang. 2023.  A review of Generative Adversarial Networks (GANs) and its applications in a wide variety of disciplines: From Medical to Remote Sensing.  _IEEE Access_ (2023).
  * De Cristofaro (2024) Emiliano De Cristofaro. 2024.  Synthetic Data: Methods, Use Cases, and Risks.  _IEEE Security & Privacy_ (2024).
  * de Goede (2023) Matthijs de Goede. 2023.  Training diffusion models with federated learning: A communication-efficient model for cross-silo federated image generation.  https://repository.tudelft.nl/islandora/object/uuid:49e11cf3-5a0a-40bc-9a62-1d7fe05fbe4d.
  * de Souza et al. (2023) Vinicius Luis Trevisan de Souza, Bruno Augusto Dorta Marques, Harlen Costa Batagelo, and João Paulo Gois. 2023.  A review on generative adversarial networks for image generation.  _Computers & Graphics_ (2023).
  * Ding et al. (2023) Xuanang Ding, Guohui Li, Ling Yuan, Lu Zhang, and Qian Rong. 2023.  Combining Autoencoder with Adaptive Differential Privacy for Federated Collaborative Filtering. In _International Conference on Database Systems for Advanced Applications_. Springer, 661–676.
  * Duan et al. (2021) Jian-Hui Duan, Wenzhong Li, and Sanglu Lu. 2021.  FedDNA: Federated learning with decoupled normalization-layer aggregation for non-iid data. In _Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13–17, 2021, Proceedings, Part I 21_. Springer, 722–737.
  * Duan et al. (2023) Jian-hui Duan, Wenzhong Li, Derun Zou, Ruichen Li, and Sanglu Lu. 2023.  Federated Learning With Data-Agnostic Distribution Fusion. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 8074–8083.
  * Duan et al. (2022a) Shaoming Duan, Chuanyi Liu, Peiyi Han, Tianyu He, Yifeng Xu, and Qiyuan Deng. 2022a.  Fed-TDA: Federated Tabular Data Augmentation on Non-IID Data.  _arXiv:2211.13116_ (2022).
  * Duan et al. (2022b) Shaoming Duan, Chuanyi Liu, Peiyi Han, Xiaopeng Jin, Xinyi Zhang, Tianyu He, Hezhong Pan, and Xiayu Xiang. 2022b.  HT-Fed-GAN: Federated Generative Model for Decentralized Tabular Data Synthesis.  _Entropy_ 25, 1 (2022), 88.
  * Dugdale (2023) Hugo Dugdale. 2023.  Federated Learning with Variational Autoencoders.  https://openreview.net/forum?id=mvo72yTjhTl.
  * Dwork et al. (2006) Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006.  Calibrating noise to sensitivity in private data analysis. In _Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3_. Springer, 265–284.
  * Dwork et al. (2014) Cynthia Dwork, Aaron Roth, et al. 2014\.  The algorithmic foundations of differential privacy.  _Foundations and Trends® in Theoretical Computer Science_ 9, 3–4 (2014), 211–407.
  * Ekblom et al. (2022) Ebba Ekblom, Edvin Listo Zec, and Olof Mogren. 2022.  EFFGAN: Ensembles of fine-tuned federated GANs. In _2022 IEEE International Conference on Big Data (Big Data)_. IEEE, 884–892.
  * Fang et al. (2020) Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020.  Local model poisoning attacks to $\\{$Byzantine-Robust$\\}$ federated learning. In _29th USENIX security symposium (USENIX Security 20)_. 1605–1622.
  * Geyer et al. (2017) Robin C Geyer, Tassilo Klein, and Moin Nabi. 2017.  Differentially private federated learning: A client level perspective.  _arXiv:1712.07557_ (2017).
  * Ghavamipour et al. (2023) Ali Reza Ghavamipour, Fatih Turkmen, Rui Wang, and Kaitai Liang. 2023.  Federated Synthetic Data Generation with Stronger Security Guarantees. In _Proceedings of the 28th ACM Symposium on Access Control Models and Technologies_. 31–42.
  * Ghojogh et al. (2021) Benyamin Ghojogh, Ali Ghodsi, Fakhri Karray, and Mark Crowley. 2021.  Factor analysis, probabilistic principal component analysis, variational inference, and variational autoencoder: Tutorial and survey.  _arXiv:2101.00734_ (2021).
  * Gong and Liu (2018) Neil Zhenqiang Gong and Bin Liu. 2018.  Attribute inference attacks in online social networks.  _ACM Transactions on Privacy and Security (TOPS)_ 21, 1 (2018), 1–30.
  * Goodfellow et al. (2020) Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2020.  Generative adversarial networks.  _Commun. ACM_ 63, 11 (2020), 139–144.
  * Gosselin et al. (2022) Rémi Gosselin, Loïc Vieu, Faiza Loukil, and Alexandre Benoit. 2022.  Privacy and security in federated learning: A survey.  _Applied Sciences_ 12, 19 (2022), 9901.
  * Gu et al. (2022) Yuhao Gu, Yuebin Bai, and Shubin Xu. 2022.  CS-MIA: Membership inference attack based on prediction confidence series in federated learning.  _Journal of Information Security and Applications_ 67 (2022), 103201.
  * Gu et al. (2021) Zhipin Gu, Liangzhong He, Peiyan Li, Peng Sun, Jiangyong Shi, and Yuexiang Yang. 2021.  FREPD: A Robust Federated Learning Framework on Variational Autoencoder.  _Comput. Syst. Sci. Eng._ 39, 3 (2021), 307–320.
  * Gu and Yang (2021) Zhipin Gu and Yuexiang Yang. 2021.  Detecting malicious model updates from federated learning on conditional variational autoencoder. In _2021 IEEE international parallel and distributed processing symposium (IPDPS)_. IEEE, 671–680.
  * Guendouzi et al. (2023) Badra Souhila Guendouzi, Samir Ouchani, Hiba EL Assaad, and Madeleine EL Zaher. 2023.  A systematic review of federated learning: Challenges, aggregation methods, and development tools.  _Journal of Network and Computer Applications_ (2023), 103714.
  * Guerraoui et al. (2020) Rachid Guerraoui, Arsany Guirguis, Anne-Marie Kermarrec, and Erwan Le Merrer. 2020.  Fegan: Scaling distributed gans. In _Proceedings of the 21st International Middleware Conference_. 193–206.
  * Gui et al. (2021) Jie Gui, Zhenan Sun, Yonggang Wen, Dacheng Tao, and Jieping Ye. 2021.  A review on generative adversarial networks: Algorithms, theory, and applications.  _IEEE transactions on knowledge and data engineering_ 35, 4 (2021), 3313–3332.
  * Guo (2023) Zihao Guo. 2023.  Enhancing Federated Learning Efficiency with Generative Model-Based Data Augmentation for Non-IID Data. In _2023 European Conference on Communication Systems (ECCS)_. 24–28.  https://doi.org/10.1109/ECCS58882.2023.00013
  * Ha and Dang (2022) Trung Ha and Tran Khanh Dang. 2022.  Inference attacks based on GAN in federated learning.  _International Journal of Web Information Systems_ 18, 2/3 (2022), 117–136.
  * Han and Guan (2023) Yujin Han and Leying Guan. 2023.  GAN-based federated learning for label protection in binary classification.  _arXiv:2302.02245_ (2023).
  * Hardy et al. (2019) Corentin Hardy, Erwan Le Merrer, and Bruno Sericola. 2019.  Md-gan: Multi-discriminator generative adversarial networks for distributed datasets. In _2019 IEEE international parallel and distributed processing symposium (IPDPS)_. IEEE, 866–877.
  * Harshvardhan et al. (2020) GM Harshvardhan, Mahendra Kumar Gourisaria, Manjusha Pandey, and Siddharth Swarup Rautaray. 2020.  A comprehensive survey and analysis of generative models in machine learning.  _Computer Science Review_ 38 (2020), 100285.
  * Hatamizadeh et al. (2023) Ali Hatamizadeh, Hongxu Yin, Pavlo Molchanov, Andriy Myronenko, Wenqi Li, Prerna Dogra, Andrew Feng, Mona G Flores, Jan Kautz, Daguang Xu, et al. 2023\.  Do gradient inversion attacks make federated learning unsafe?  _IEEE Transactions on Medical Imaging_ (2023).
  * Heinbaugh et al. (2023) Clare Elizabeth Heinbaugh, Emilio Luz-Ricca, and Huajie Shao. 2023.  Data-Free One-Shot Federated Learning Under Very High Statistical Heterogeneity. In _The Eleventh International Conference on Learning Representations_.  https://openreview.net/forum?id=_hb4vM3jspB
  * Ho et al. (2020) Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020.  Denoising diffusion probabilistic models.  _Advances in neural information processing systems_ 33 (2020), 6840–6851.
  * Huang et al. (2022) Chao Huang, Jianwei Huang, and Xin Liu. 2022.  Cross-silo federated learning: Challenges and opportunities.  _arXiv:2206.12949_ (2022).
  * Huang et al. (2021a) Yutao Huang, Lingyang Chu, Zirui Zhou, Lanjun Wang, Jiangchuan Liu, Jian Pei, and Yong Zhang. 2021a.  Personalized cross-silo federated learning on non-iid data. In _Proceedings of the AAAI conference on artificial intelligence_. 7865–7873.
  * Huang et al. (2021b) Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. 2021b.  Evaluating gradient inversion attacks and defenses in federated learning.  _Advances in Neural Information Processing Systems_ 34 (2021), 7232–7241.
  * Jiang et al. (2023) Yuchen Jiang, Ying Wu, Shiyao Zhang, and JQ James. 2023.  FedVAE: Trajectory privacy preserving based on Federated Variational AutoEncoder. In _2023 IEEE 98th Vehicular Technology Conference (VTC2023-Fall)_. IEEE, 1–7.
  * Jin and Li (2022) Ruinan Jin and Xiaoxiao Li. 2022.  Backdoor attack is a devil in federated GAN-based medical image synthesis. In _International Workshop on Simulation and Synthesis in Medical Imaging_. Springer, 154–165.
  * Jin and Li (2023) Ruinan Jin and Xiaoxiao Li. 2023.  Backdoor attack and defense in federated generative adversarial network-based medical image synthesis.  _Medical Image Analysis_ 90 (2023), 102965.
  * Jothiraj (2023) Fiona Victoria Stanley Jothiraj. 2023.  _Phoenix: Federated Learning for Generative Diffusion Model_.  Ph. D. Dissertation. University of Washington.
  * Kairouz et al. (2021) Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021\.  Advances and open problems in federated learning.  _Foundations and Trends® in Machine Learning_ 14, 1–2 (2021), 1–210.
  * Karimireddy et al. (2021) Sai Praneeth Karimireddy, Martin Jaggi, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian U Stich, and Ananda Theertha Suresh. 2021.  Breaking the centralized barrier for cross-device federated learning.  _Advances in Neural Information Processing Systems_ 34 (2021), 28663–28676.
  * Kaspour and Yassine (2023) Shamisa Kaspour and Abdulsalam Yassine. 2023.  Variational Auto-Encoder Model and Federated Approach for Non-Intrusive Load Monitoring in Smart Homes. In _2023 IEEE Symposium on Computers and Communications (ISCC)_. IEEE, 1110–1115.
  * Kingma et al. (2021) Diederik Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. 2021.  Variational diffusion models.  _Advances in neural information processing systems_ 34 (2021), 21696–21707.
  * Kos et al. (2018) Jernej Kos, Ian Fischer, and Dawn Song. 2018.  Adversarial examples for generative models. In _2018 ieee security and privacy workshops (spw)_. IEEE, 36–42.
  * Li et al. (2023b) Bo Li, Yasin Esfandiari, Mikkel N Schmidt, Tommy S Alstrøm, and Sebastian U Stich. 2023b.  Synthetic data shuffling accelerates the convergence of federated learning under data heterogeneity.  _arXiv:2306.13263_ (2023).
  * Li et al. (2023c) Hao Li, Chengcheng Li, Jian Wang, Aimin Yang, Zezhong Ma, Zunqian Zhang, and Dianbo Hua. 2023c.  Review on security of federated learning and its application in healthcare.  _Future Generation Computer Systems_ 144 (2023), 271–290.
  * Li et al. (2020a) Li Li, Yuxi Fan, Mike Tse, and Kuo-Yi Lin. 2020a.  A review of applications in federated learning.  _Computers & Industrial Engineering_ 149 (2020), 106854.
  * Li et al. (2023e) Li Li, Jianbing Xiahou, Fan Lin, and Songzhi Su. 2023e.  DistVAE: Distributed Variational Autoencoder for sequential recommendation.  _Knowledge-Based Systems_ 264 (2023), 110313.
  * Li et al. (2023d) Pengzhi Li, Yan Pei, and Jianqiang Li. 2023d.  A comprehensive survey on design and application of autoencoder in deep learning.  _Applied Soft Computing_ (2023), 110176.
  * Li et al. (2020b) Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. 2020b.  Federated optimization in heterogeneous networks.  _Proceedings of Machine learning and systems_ 2 (2020), 429–450.
  * Li et al. (2023a) Wei Li, Jinlin Chen, Zhenyu Wang, Zhidong Shen, Chao Ma, and Xiaohui Cui. 2023a.  IFL-GAN: Improved Federated Learning Generative Adversarial Network With Maximum Mean Discrepancy Model Aggregation.  _IEEE Transactions on Neural Networks and Learning Systems_ 34, 12 (2023), 10502–10515.  https://doi.org/10.1109/TNNLS.2022.3167482
  * Li et al. (2022) Zijian Li, Jiawei Shao, Yuyi Mao, Jessie Hui Wang, and Jun Zhang. 2022.  Federated learning with gan-based data synthesis for non-iid clients. In _International Workshop on Trustworthy Federated Learning_. Springer, 17–32.
  * Little et al. (2023) Claire Little, Mark Elliot, and Richard Allmendinger. 2023.  Federated learning for generating synthetic data: a scoping review.  _International Journal of Population Data Science_ 8, 1 (2023).
  * Liu et al. (2022) Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. 2022.  Vertical federated learning.  _arXiv:2211.12814_ (2022).
  * Liu et al. (2024) Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. 2024.  Vertical Federated Learning: Concepts, Advances, and Challenges.  _IEEE Transactions on Knowledge and Data Engineering_ (2024).
  * Lomurno et al. (2022) Eugenio Lomurno, Alberto Archetti, Lorenzo Cazzella, Stefano Samele, Leonardo Di Perna, and Matteo Matteucci. 2022.  SGDE: Secure generative data exchange for cross-silo federated learning. In _Proceedings of the 2022 5th International Conference on Artificial Intelligence and Pattern Recognition_. 205–214.
  * Lyu and Chen (2021) Lingjuan Lyu and Chen Chen. 2021.  A novel attribute reconstruction attack in federated learning.  _arXiv:2108.06910_ (2021).
  * Lyu et al. (2020) Lingjuan Lyu, Han Yu, Jun Zhao, and Qiang Yang. 2020.  Threats to federated learning.  _Federated Learning: Privacy and Incentive_ (2020), 3–16.
  * Ma et al. (2022) Xiaodong Ma, Jia Zhu, Zhihao Lin, Shanxuan Chen, and Yangjie Qin. 2022.  A state-of-the-art survey on solving non-IID data in Federated Learning.  _Future Generation Computer Systems_ 135 (2022), 244–258.
  * Ma et al. (2023) Zhuoran Ma, Yang Liu, Yinbin Miao, Guowen Xu, Ximeng Liu, Jianfeng Ma, and Robert H. Deng. 2023.  FLGAN: GAN-Based Unbiased FederatedLearning under Non-IID Settings.  _IEEE Transactions on Knowledge and Data Engineering_ (2023), 1–16.  https://doi.org/10.1109/TKDE.2023.3309858
  * Maliakel et al. (2024) Paul Joe Maliakel, Shashikant Ilager, and Ivona Brandic. 2024.  FLIGAN: Enhancing Federated Learning with Incomplete Data using GAN.  arXiv:2403.16930 [cs.LG]
  * Mamun et al. (2023) Md Abdullah Al Mamun, Quazi Mishkatul Alam, Erfan Shaigani, Pedram Zaree, Ihsen Alouani, and Nael Abu-Ghazaleh. 2023.  DeepMem: ML Models as storage channels and their (mis-) applications.  _arXiv preprint arXiv:2307.08811_ (2023).
  * McMahan et al. (2017a) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017a.  Communication-efficient learning of deep networks from decentralized data. In _Artificial intelligence and statistics_. PMLR, 1273–1282.
  * McMahan et al. (2017b) H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. 2017b.  Learning differentially private recurrent language models.  _arXiv:1710.06963_ (2017).
  * Megahed and Mohammed (2024) Mohammed Megahed and Ammar Mohammed. 2024.  A comprehensive review of generative adversarial networks: Fundamentals, applications, and challenges.  _Wiley Interdisciplinary Reviews: Computational Statistics_ 16, 1 (2024), e1629.
  * Mothukuri et al. (2021) Viraaji Mothukuri, Reza M Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. 2021.  A survey on security and privacy of federated learning.  _Future Generation Computer Systems_ 115 (2021), 619–640.
  * Mou et al. (2023) Yongli Mou, Jiahui Geng, Feng Zhou, Oya Beyan, Chunming Rong, and Stefan Decker. 2023.  pFedV: Mitigating Feature Distribution Skewness via Personalized Federated Learning with Variational Distribution Constraints. In _Pacific-Asia Conference on Knowledge Discovery and Data Mining_. Springer, 283–294.
  * Mozaffari et al. (2023) Hamid Mozaffari, Virat Shejwalkar, and Amir Houmansadr. 2023.  Every Vote Counts:$\\{$Ranking-Based$\\}$ Training of Federated Learning to Resist Poisoning Attacks. In _32nd USENIX Security Symposium (USENIX Security 23)_. 1721–1738.
  * Naseri et al. (2022) Mohammad Naseri, Yufei Han, Enrico Mariconti, Yun Shen, Gianluca Stringhini, and Emiliano De Cristofaro. 2022.  Cerberus: exploring federated prediction of security events. In _Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security_. 2337–2351.
  * Naseri et al. (2020) Mohammad Naseri, Jamie Hayes, and Emiliano De Cristofaro. 2020.  Local and central differential privacy for robustness and privacy in federated learning.  _arXiv:2009.03561_ (2020).
  * Nasr et al. (2019) Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019.  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In _2019 IEEE symposium on security and privacy (SP)_. IEEE, 739–753.
  * Nguyen et al. (2021) Dinh C Nguyen, Ming Ding, Pubudu N Pathirana, Aruna Seneviratne, and Albert Y Zomaya. 2021.  Federated learning for COVID-19 detection with generative adversarial networks in edge cloud computing.  _IEEE Internet of Things Journal_ 9, 12 (2021), 10257–10271.
  * Oussidi and Elhassouny (2018) Achraf Oussidi and Azeddine Elhassouny. 2018.  Deep generative models: Survey. In _2018 International conference on intelligent systems and computer vision (ISCV)_. IEEE, 1–8.
  * Pandya et al. (2023) Sharnil Pandya, Gautam Srivastava, Rutvij Jhaveri, M Rajasekhara Babu, Sweta Bhattacharya, Praveen Kumar Reddy Maddikunta, Spyridon Mastorakis, Md Jalil Piran, and Thippa Reddy Gadekallu. 2023.  Federated learning for smart cities: A comprehensive survey.  _Sustainable Energy Technologies and Assessments_ 55 (2023), 102987.
  * Papadopoulos and Karalis (2023) Dimitris Papadopoulos and Vangelis D Karalis. 2023.  Variational Autoencoders for Data Augmentation in Clinical Studies.  _Applied Sciences_ 13, 15 (2023), 8793.
  * Pejic et al. (2022) Ignjat Pejic, Rui Wang, and Kaitai Liang. 2022.  Effect of Homomorphic Encryption on the Performance of Training Federated Learning Generative Adversarial Networks.  _arXiv:2207.00263_ (2022).
  * Pfitzner and Arnrich (2022) Bjarne Pfitzner and Bert Arnrich. 2022.  Dpd-fvae: Synthetic data generation using federated variational autoencoders with differentially-private decoder.  _arXiv:2211.11591_ (2022).
  * Pillutla et al. (2022) Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. 2022.  Robust aggregation for federated learning.  _IEEE Transactions on Signal Processing_ 70 (2022), 1142–1154.
  * Prediger et al. (2023) Lukas Prediger, Joonas Jälkö, Antti Honkela, and Samuel Kaski. 2023.  Collaborative Learning From Distributed Data With Differentially Private Synthetic Twin Data.  _arXiv:2308.04755_ (2023).
  * Psychogyios et al. (2023) Konstantinos Psychogyios, Terpsichori-Helen Velivassaki, Stavroula Bourou, Artemis Voulkidis, Dimitrios Skias, and Theodore Zahariadis. 2023.  GAN-Driven Data Poisoning Attacks and Their Mitigation in Federated Learning Systems.  _Electronics_ 12, 8 (2023), 1805.
  * Qi et al. (2023) Pian Qi, Diletta Chiaro, Antonella Guzzo, Michele Ianni, Giancarlo Fortino, and Francesco Piccialli. 2023.  Model aggregation techniques in federated learning: A comprehensive survey.  _Future Generation Computer Systems_ (2023).
  * Ran et al. (2024) Nian Ran, Bahrul Ilmi Nasution, Claire Little, Richard Allmendinger, and Mark Elliot. 2024.  Multi-objective evolutionary GAN for tabular data synthesis.  _arXiv:2404.10176_ (2024).
  * Rasha et al. (2023) Al-Huthaifi Rasha, Tianrui Li, Wei Huang, Jin Gu, and Chongshou Li. 2023.  Federated learning in smart cities: Privacy and security survey.  _Information Sciences_ (2023).
  * Rasouli et al. (2020) Mohammad Rasouli, Tao Sun, and Ram Rajagopal. 2020.  Fedgan: Federated generative adversarial networks for distributed data.  _arXiv:2006.07228_ (2020).
  * Rauniyar et al. (2023) Ashish Rauniyar, Desta Haileselassie Hagos, Debesh Jha, Jan Erik Håkegård, Ulas Bagci, Danda B Rawat, and Vladimir Vlassov. 2023.  Federated learning for medical applications: A taxonomy, current trends, challenges, and future research directions.  _IEEE Internet of Things Journal_ (2023).
  * Rehman et al. (2024) Amir Rehman, Huanlai Xing, Li Feng, Mehboob Hussain, Nighat Gulzar, Muhammad Adnan Khan, Abid Hussain, and Dhekra Saeed. 2024.  FedCSCD-GAN: A secure and collaborative framework for clinical cancer diagnosis via optimized federated learning and GAN.  _Biomedical Signal Processing and Control_ 89 (2024), 105893.
  * Rodríguez-Barroso et al. (2023) Nuria Rodríguez-Barroso, Daniel Jiménez-López, M Victoria Luzón, Francisco Herrera, and Eugenio Martínez-Cámara. 2023.  Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges.  _Information Fusion_ 90 (2023), 148–173.
  * Ruthotto and Haber (2021) Lars Ruthotto and Eldad Haber. 2021.  An introduction to deep generative modeling.  _GAMM-Mitteilungen_ 44, 2 (2021), e202100008.
  * Salakhutdinov (2015) Ruslan Salakhutdinov. 2015.  Learning deep generative models.  _Annual Review of Statistics and Its Application_ 2 (2015), 361–385.
  * San-Roman et al. (2021) Robin San-Roman, Eliya Nachmani, and Lior Wolf. 2021.  Noise estimation for generative diffusion models.  _arXiv:2104.02600_ (2021).
  * Sattarov et al. (2024) Timur Sattarov, Marco Schreyer, and Damian Borth. 2024.  FedTabDiff: Federated Learning of Diffusion Probabilistic Models for Synthetic Mixed-Type Tabular Data Generation.  arXiv:2401.06263 [cs.LG]
  * Shao et al. (2023) Jiawei Shao, Zijian Li, Wenqiang Sun, Tailin Zhou, Yuchang Sun, Lumin Liu, Zehong Lin, and Jun Zhang. 2023.  A survey of what to share in federated learning: perspectives on model utility, privacy leakage, and communication efficiency.  _arXiv:2307.10655_ (2023).
  * Sharma and Kumar (2023) Sunena Sharma and Sunil Kumar. 2023.  Federated Learning Approaches to Diverse Machine Learning Model: A Review. In _International Conference on Information and Communication Technology for Intelligent Systems_. Springer, 259–269.
  * Shayegani et al. (2023) Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. 2023.  Survey of vulnerabilities in large language models revealed by adversarial attacks.  _arXiv:2310.10844_ (2023).
  * Sikandar et al. (2023) Hira Shahzadi Sikandar, Huda Waheed, Sibgha Tahir, Saif UR Malik, and Waqas Rafique. 2023.  A Detailed Survey on Federated Learning Attacks and Defenses.  _Electronics_ 12, 2 (2023), 260.
  * Sun et al. (2021b) Hui Sun, Tianqing Zhu, Zhiqiu Zhang, Dawei Jin, Ping Xiong, and Wanlei Zhou. 2021b.  Adversarial attacks against deep generative models on data: a survey.  _IEEE Transactions on Knowledge and Data Engineering_ (2021).
  * Sun et al. (2021a) Yuwei Sun, Ng ST Chong, and Hideya Ochiai. 2021a.  Information stealing in federated learning systems based on generative adversarial networks. In _2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC)_. IEEE, 2749–2754.
  * Tabassum et al. (2022) Aliya Tabassum, Aiman Erbad, Wadha Lebda, Amr Mohamed, and Mohsen Guizani. 2022.  Fedgan-ids: Privacy-preserving ids using gan and federated learning.  _Computer Communications_ 192 (2022), 299–310.
  * Tolpegin et al. (2020) Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020.  Data poisoning attacks against federated learning systems. In _Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 25_. Springer, 480–501.
  * Tran et al. (2024) Van-Tuan Tran, Huy-Hieu Pham, and Kok-Seng Wong. 2024.  Personalized privacy-preserving framework for cross-silo federated learning.  _IEEE Transactions on Emerging Topics in Computing_ (2024).
  * Truex et al. (2020) Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei. 2020.  LDP-Fed: Federated learning with local differential privacy. In _Proceedings of the third ACM international workshop on edge systems, analytics and networking_. 61–66.
  * Tun et al. (2023) Ye Lin Tun, Chu Myaet Thwal, Ji Su Yoon, Sun Moo Kang, Chaoning Zhang, and Choong Seon Hong. 2023.  Federated learning with diffusion models for privacy-sensitive vision tasks. In _2023 International Conference on Advanced Technologies for Communications (ATC)_. IEEE, 305–310.
  * Veeraragavan and Nygård (2023) Narasimha Raghavan Veeraragavan and Jan Franz Nygård. 2023.  Securing Federated GANs: Enabling Synthetic Data Generation for Health Registry Consortiums. In _Proceedings of the 18th International Conference on Availability, Reliability and Security_ (¡conf-loc¿, ¡city¿Benevento¡/city¿, ¡country¿Italy¡/country¿, ¡/conf-loc¿) _(ARES ’23)_. Association for Computing Machinery, New York, NY, USA, Article 89, 9 pages.  https://doi.org/10.1145/3600160.3605041
  * Vyas and Rajendran (2023) Bhuman Vyas and Rajashree Manjulalayam Rajendran. 2023.  Generative Adversarial Networks for Anomaly Detection in Medical Images.  _International Journal of Multidisciplinary Innovation and Research Methodology, ISSN: 2960-2068_ 2, 4 (2023), 52–58.
  * Wan et al. (2017) Zhiqiang Wan, Yazhou Zhang, and Haibo He. 2017.  Variational autoencoder based synthetic data generation for imbalanced learning. In _2017 IEEE symposium series on computational intelligence (SSCI)_. IEEE, 1–7.
  * Wang et al. (2023a) Chao Wang, Xiuyuan Liu, Yunhua He, Ke Xiao, and Wei Li. 2023a.  Poisoning the Competition: Fake Gradient Attacks on Distributed Generative Adversarial Networks. In _2023 IEEE 20th International Conference on Mobile Ad Hoc and Smart Systems (MASS)_. 487–495.  https://doi.org/10.1109/MASS58611.2023.00067
  * Wang et al. (2023c) Jinbao Wang, Guoyang Xie, Yawen Huang, Jiayi Lyu, Feng Zheng, Yefeng Zheng, and Yaochu Jin. 2023c.  FedMed-GAN: Federated domain translation on unsupervised cross-modality brain image synthesis.  _Neurocomputing_ 546 (2023), 126282.  https://doi.org/10.1016/j.neucom.2023.126282
  * Wang et al. (2017) Kunfeng Wang, Chao Gou, Yanjie Duan, Yilun Lin, Xinhu Zheng, and Fei-Yue Wang. 2017.  Generative adversarial networks: introduction and outlook.  _IEEE/CAA Journal of Automatica Sinica_ 4, 4 (2017), 588–598.
  * Wang et al. (2023b) Yue Wang, Hongjuan Wang, Fang Zhang, and Xuxin Li. 2023b.  FDA-CDM: Data Augmentation Framework for Personalized Federated Learning in Non-IID Scenarios. In _Proceedings of the 2023 International Conference on Electronics, Computers and Communication Technology_. 71–76.
  * Wei et al. (2020) Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. 2020.  Federated learning with differential privacy: Algorithms and performance analysis.  _IEEE transactions on information forensics and security_ 15 (2020), 3454–3469.
  * Wei et al. (2022) Kang Wei, Jun Li, Chuan Ma, Ming Ding, Sha Wei, Fan Wu, Guihai Chen, and Thilina Ranbaduge. 2022.  Vertical federated learning: Challenges, methodologies and experiments.  _arXiv:2202.04309_ (2022).
  * Wen et al. (2023) Jie Wen, Zhixia Zhang, Yang Lan, Zhihua Cui, Jianghui Cai, and Wensheng Zhang. 2023.  A survey on federated learning: challenges and applications.  _International Journal of Machine Learning and Cybernetics_ 14, 2 (2023), 513–535.
  * Wijesinghe et al. (2023a) Achintha Wijesinghe, Songyang Zhang, and Zhi Ding. 2023a.  PFL-GAN: When Client Heterogeneity Meets Generative Models in Personalized Federated Learning.  _arXiv:2308.12454_ (2023).
  * Wijesinghe et al. (2023b) Achintha Wijesinghe, Songyang Zhang, and Zhi Ding. 2023b.  PS-FedGAN: An Efficient Federated Learning Framework Based on Partially Shared Generative Adversarial Networks For Data Privacy.  _arXiv:2305.11437_ (2023).
  * Wijesinghe et al. (2023c) Achintha Wijesinghe, Songyang Zhang, Siyu Qi, and Zhi Ding. 2023c.  UFed-GAN: A Secure Federated Learning Framework with Constrained Computation and Unlabeled Data.  _arXiv:2308.05870_ (2023).
  * Wu et al. (2022) Yuezhou Wu, Yan Kang, Jiahuan Luo, Yuanqin He, Lixin Fan, Rong Pan, and Qiang Yang. 2022.  FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning. In _Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence_ _(IJCAI-2022)_. International Joint Conferences on Artificial Intelligence Organization.  https://doi.org/10.24963/ijcai.2022/324
  * Xin et al. (2022) Bangzhou Xin, Yangyang Geng, Teng Hu, Sheng Chen, Wei Yang, Shaowei Wang, and Liusheng Huang. 2022.  Federated synthetic data generation with differential privacy.  _Neurocomputing_ 468 (2022), 1–10.  https://doi.org/10.1016/j.neucom.2021.10.027
  * Xin et al. (2020) Bangzhou Xin, Wei Yang, Yangyang Geng, Sheng Chen, Shaowei Wang, and Liusheng Huang. 2020.  Private FL-GAN: Differential Privacy Synthetic Data Generation Based on Federated Learning. In _ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. 2927–2931.  https://doi.org/10.1109/ICASSP40776.2020.9054559
  * Xiong et al. (2023) Yuanhao Xiong, Ruochen Wang, Minhao Cheng, Felix Yu, and Cho-Jui Hsieh. 2023.  Feddm: Iterative distribution matching for communication-efficient federated learning. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 16323–16332.
  * Yang et al. (2022) Haomiao Yang, Mengyu Ge, Kunlan Xiang, and Jingwei Li. 2022.  Using highly compressed gradients in federated learning for data reconstruction attacks.  _IEEE Transactions on Information Forensics and Security_ 18 (2022), 818–830.
  * Yang et al. (2023c) Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. 2023c.  Diffusion models: A comprehensive survey of methods and applications.  _Comput. Surveys_ 56, 4 (2023), 1–39.
  * Yang et al. (2023a) Ming Yang, Hang Cheng, Fei Chen, Ximeng Liu, Meiqing Wang, and Xibin Li. 2023a.  Model poisoning attack in differential privacy-based federated learning.  _Information Sciences_ 630 (2023), 158–172.
  * Yang et al. (2023b) Mingzhao Yang, Shangchao Su, Bin Li, and Xiangyang Xue. 2023b.  One-Shot Federated Learning with Classifier-Guided Diffusion Models.  _arXiv:2311.08870_ (2023).
  * Yang et al. (2024a) Mingzhao Yang, Shangchao Su, Bin Li, and Xiangyang Xue. 2024a.  Exploring One-Shot Semi-supervised Federated Learning with Pre-trained Diffusion Models. In _Proceedings of the AAAI Conference on Artificial Intelligence_. 16325–16333.
  * Yang et al. (2019) Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019.  Federated machine learning: Concept and applications.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ 10, 2 (2019), 1–19.
  * Yang et al. (2024b) Zhiqin Yang, Yonggang Zhang, Yu Zheng, Xinmei Tian, Hao Peng, Tongliang Liu, and Bo Han. 2024b.  FedFed: Feature distillation against data heterogeneity in federated learning.  _Advances in Neural Information Processing Systems_ 36 (2024).
  * Yao and Zhao (2022) Zoujing Yao and Chunhui Zhao. 2022.  FedTMI: Knowledge aided federated transfer learning for industrial missing data imputation.  _Journal of Process Control_ 117 (2022), 206–215.  https://doi.org/10.1016/j.jprocont.2022.08.004
  * Ye et al. (2023) Mang Ye, Xiuwen Fang, Bo Du, Pong C Yuen, and Dacheng Tao. 2023.  Heterogeneous federated learning: State-of-the-art and research challenges.  _Comput. Surveys_ 56, 3 (2023), 1–44.
  * Yoon et al. (2021) Tehrim Yoon, Sumin Shin, Sung Ju Hwang, and Eunho Yang. 2021.  FedMix: Approximation of Mixup under Mean Augmented Federated Learning. In _International Conference on Learning Representations_.  https://openreview.net/forum?id=Ogga20D2HO-
  * Zhai et al. (2018) Junhai Zhai, Sufang Zhang, Junfen Chen, and Qiang He. 2018.  Autoencoder and its various variants. In _2018 IEEE international conference on systems, man, and cybernetics (SMC)_. IEEE, 415–419.
  * Zhang et al. (2021c) Chen Zhang, Yu Xie, Hang Bai, Bin Yu, Weihong Li, and Yuan Gao. 2021c.  A survey on federated learning.  _Knowledge-Based Systems_ 216 (2021), 106775.
  * Zhang et al. (2022) Jie Zhang, Chen Chen, Bo Li, Lingjuan Lyu, Shuang Wu, Shouhong Ding, Chunhua Shen, and Chao Wu. 2022.  DENSE: Data-Free One-Shot Federated Learning. In _Advances in Neural Information Processing Systems_ , Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (Eds.).  https://openreview.net/forum?id=QFQoxCFYEkA
  * Zhang et al. (2019) Jiale Zhang, Junjun Chen, Di Wu, Bing Chen, and Shui Yu. 2019.  Poisoning attack in federated learning using generative adversarial nets. In _2019 18th IEEE international conference on trust, security and privacy in computing and communications/13th IEEE international conference on big data science and engineering (TrustCom/BigDataSE)_. IEEE, 374–380.
  * Zhang et al. (2020) Jingwen Zhang, Jiale Zhang, Junjun Chen, and Shui Yu. 2020.  GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning. In _ICC 2020 - 2020 IEEE International Conference on Communications (ICC)_. 1–6.  https://doi.org/10.1109/ICC40277.2020.9148790
  * Zhang et al. (2023b) Jiaxin Zhang, Liang Zhao, Keping Yu, Geyong Min, Ahmed Y. Al-Dubai, and Albert Y. Zomaya. 2023b.  A Novel Federated Learning Scheme for Generative Adversarial Networks.  _IEEE Transactions on Mobile Computing_ (2023), 1–17.  https://doi.org/10.1109/TMC.2023.3278668
  * Zhang et al. (2021b) Longling Zhang, Bochen Shen, Ahmed Barnawi, Shan Xi, Neeraj Kumar, and Yi Wu. 2021b.  FedDPGAN: federated differentially private generative adversarial networks framework for the detection of COVID-19 pneumonia.  _Information Systems Frontiers_ 23, 6 (2021), 1403–1415.
  * Zhang et al. (2021d) Xiongtao Zhang, Xiaomin Zhu, Ji Wang, Weidong Bao, and Laurence T Yang. 2021d.  Dance: Distributed generative adversarial networks with communication compression.  _ACM Transactions on Internet Technology (TOIT)_ 22, 2 (2021), 1–32.
  * Zhang et al. (2023a) Yi Zhang, Yunfan Lu, and Fengxia Liu. 2023a.  A systematic survey for differential privacy techniques in federated learning.  _Journal of Information Security_ 14, 2 (2023), 111–135.
  * Zhang et al. (2021a) Yikai Zhang, Hui Qu, Qi Chang, Huidong Liu, Dimitris Metaxas, and Chao Chen. 2021a.  Training federated GANs with theoretical guarantees: A universal aggregation approach.  _arXiv:2102.04655_ (2021).
  * Zhao et al. (2021b) Jie Zhao, Xinghua Zhu, Jianzong Wang, and Jing Xiao. 2021b.  Efficient client contribution evaluation for horizontal federated learning. In _ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 3060–3064.
  * Zhao et al. (2017) Shengjia Zhao, Jiaming Song, and Stefano Ermon. 2017.  Learning hierarchical features from deep generative models. In _International Conference on Machine Learning_. PMLR, 4091–4099.
  * Zhao et al. (2022) Ying Zhao, Junjun Chen, Jiale Zhang, Di Wu, Michael Blumenstein, and Shui Yu. 2022.  Detecting and mitigating poisoning attacks in federated learning using generative adversarial networks.  _Concurrency and Computation: Practice and Experience_ 34, 7 (2022), e5906.
  * Zhao et al. (2020) Ying Zhao, Junjun Chen, Jiale Zhang, Di Wu, Jian Teng, and Shui Yu. 2020.  PDGAN: A novel poisoning defense method in federated learning using generative adversarial network. In _Algorithms and Architectures for Parallel Processing: 19th International Conference, ICA3PP 2019, Melbourne, VIC, Australia, December 9–11, 2019, Proceedings, Part I 19_. Springer, 595–609.
  * Zhao et al. (2018) Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. 2018.  Federated learning with non-iid data.  _arXiv:1806.00582_ (2018).