id	sid	tid	token	lemma	pos
fcis-25103	1	1	frontiers	frontier	NOUN
fcis-25103	1	2	in	in	ADP
fcis-25103	1	3	computing	computing	NOUN
fcis-25103	1	4	and	and	CCONJ
fcis-25103	1	5	intelligent	intelligent	ADJ
fcis-25103	1	6	systems	system	NOUN
fcis-25103	1	7	issn	issn	VERB
fcis-25103	1	8	:	:	PUNCT
fcis-25103	1	9	2832	2832	NUM
fcis-25103	1	10	-	-	SYM
fcis-25103	1	11	6024	6024	NUM
fcis-25103	1	12	|	|	NOUN
fcis-25103	1	13	vol	vol	NOUN
fcis-25103	1	14	.	.	PROPN
fcis-25103	2	1	9	9	NUM
fcis-25103	2	2	,	,	PUNCT
fcis-25103	2	3	no	no	INTJ
fcis-25103	2	4	.	.	NOUN
fcis-25103	2	5	2	2	NUM
fcis-25103	2	6	,	,	PUNCT
fcis-25103	2	7	2024	2024	NUM
fcis-25103	2	8	31	31	NUM
fcis-25103	2	9	differential	differential	ADJ
fcis-25103	2	10	private	private	ADJ
fcis-25103	2	11	defense	defense	NOUN
fcis-25103	2	12	against	against	ADP
fcis-25103	2	13	backdoor	backdoor	NOUN
fcis-25103	2	14	attacks	attack	NOUN
fcis-25103	2	15	in	in	ADP
fcis-25103	2	16	federated	federated	ADJ
fcis-25103	2	17	learning	learning	NOUN
fcis-25103	2	18	lu	lu	PROPN
fcis-25103	2	19	miao	miao	PROPN
fcis-25103	2	20	*	*	PROPN
fcis-25103	2	21	,	,	PUNCT
fcis-25103	2	22	weibo	weibo	PROPN
fcis-25103	2	23	li	li	PROPN
fcis-25103	2	24	,	,	PUNCT
fcis-25103	2	25	jia	jia	PROPN
fcis-25103	2	26	zhao	zhao	PROPN
fcis-25103	2	27	,	,	PUNCT
fcis-25103	2	28	xin	xin	PROPN
fcis-25103	2	29	zhou	zhou	PROPN
fcis-25103	2	30	,	,	PUNCT
fcis-25103	2	31	yao	yao	PROPN
fcis-25103	2	32	wu	wu	PROPN
fcis-25103	2	33	state	state	PROPN
fcis-25103	2	34	grid	grid	PROPN
fcis-25103	2	35	shanxi	shanxi	PROPN
fcis-25103	2	36	electric	electric	PROPN
fcis-25103	2	37	power	power	PROPN
fcis-25103	2	38	company	company	PROPN
fcis-25103	2	39	,	,	PUNCT
fcis-25103	2	40	taiyuan	taiyuan	PROPN
fcis-25103	2	41	,	,	PUNCT
fcis-25103	2	42	shanxi	shanxi	PROPN
fcis-25103	2	43	,	,	PUNCT
fcis-25103	2	44	china	china	PROPN
fcis-25103	2	45	*	*	PUNCT
fcis-25103	2	46	corresponding	correspond	VERB
fcis-25103	2	47	author	author	NOUN
fcis-25103	2	48	:	:	PUNCT
fcis-25103	2	49	lu	lu	PROPN
fcis-25103	2	50	miao	miao	PROPN
fcis-25103	2	51	(	(	PUNCT
fcis-25103	2	52	email	email	NOUN
fcis-25103	2	53	:	:	PUNCT
fcis-25103	2	54	miaolu@ustc.edu	miaolu@ustc.edu	ADJ
fcis-25103	2	55	)	)	PUNCT
fcis-25103	2	56	abstract	abstract	NOUN
fcis-25103	2	57	:	:	PUNCT
fcis-25103	2	58	federated	federated	ADJ
fcis-25103	2	59	learning	learning	NOUN
fcis-25103	2	60	has	have	AUX
fcis-25103	2	61	been	be	AUX
fcis-25103	2	62	applied	apply	VERB
fcis-25103	2	63	in	in	ADP
fcis-25103	2	64	a	a	DET
fcis-25103	2	65	wide	wide	ADJ
fcis-25103	2	66	variety	variety	NOUN
fcis-25103	2	67	of	of	ADP
fcis-25103	2	68	applications	application	NOUN
fcis-25103	2	69	,	,	PUNCT
fcis-25103	2	70	in	in	ADP
fcis-25103	2	71	which	which	PRON
fcis-25103	2	72	clients	client	NOUN
fcis-25103	2	73	upload	upload	VERB
fcis-25103	2	74	their	their	PRON
fcis-25103	2	75	local	local	ADJ
fcis-25103	2	76	updates	update	NOUN
fcis-25103	2	77	instead	instead	ADV
fcis-25103	2	78	of	of	ADP
fcis-25103	2	79	providing	provide	VERB
fcis-25103	2	80	their	their	PRON
fcis-25103	2	81	datasets	dataset	NOUN
fcis-25103	2	82	to	to	PART
fcis-25103	2	83	jointly	jointly	ADV
fcis-25103	2	84	train	train	VERB
fcis-25103	2	85	a	a	DET
fcis-25103	2	86	global	global	ADJ
fcis-25103	2	87	model	model	NOUN
fcis-25103	2	88	.	.	PUNCT
fcis-25103	3	1	however	however	ADV
fcis-25103	3	2	,	,	PUNCT
fcis-25103	3	3	the	the	DET
fcis-25103	3	4	training	training	NOUN
fcis-25103	3	5	process	process	NOUN
fcis-25103	3	6	of	of	ADP
fcis-25103	3	7	federated	federated	ADJ
fcis-25103	3	8	learning	learning	NOUN
fcis-25103	3	9	is	be	AUX
fcis-25103	3	10	vulnerable	vulnerable	ADJ
fcis-25103	3	11	to	to	ADP
fcis-25103	3	12	adversarial	adversarial	ADJ
fcis-25103	3	13	attacks	attack	NOUN
fcis-25103	3	14	(	(	PUNCT
fcis-25103	3	15	e.g.	e.g.	ADV
fcis-25103	3	16	,	,	PUNCT
fcis-25103	3	17	backdoor	backdoor	NOUN
fcis-25103	3	18	attack	attack	NOUN
fcis-25103	3	19	)	)	PUNCT
fcis-25103	3	20	in	in	ADP
fcis-25103	3	21	presence	presence	NOUN
fcis-25103	3	22	of	of	ADP
fcis-25103	3	23	malicious	malicious	ADJ
fcis-25103	3	24	clients	client	NOUN
fcis-25103	3	25	.	.	PUNCT
fcis-25103	4	1	previous	previous	ADJ
fcis-25103	4	2	works	work	NOUN
fcis-25103	4	3	showed	show	VERB
fcis-25103	4	4	that	that	SCONJ
fcis-25103	4	5	differential	differential	NOUN
fcis-25103	4	6	privacy	privacy	NOUN
fcis-25103	4	7	(	(	PUNCT
fcis-25103	4	8	dp	dp	NOUN
fcis-25103	4	9	)	)	PUNCT
fcis-25103	4	10	can	can	AUX
fcis-25103	4	11	be	be	AUX
fcis-25103	4	12	used	use	VERB
fcis-25103	4	13	to	to	PART
fcis-25103	4	14	defend	defend	VERB
fcis-25103	4	15	against	against	ADP
fcis-25103	4	16	backdoor	backdoor	NOUN
fcis-25103	4	17	attacks	attack	NOUN
fcis-25103	4	18	,	,	PUNCT
fcis-25103	4	19	at	at	ADP
fcis-25103	4	20	the	the	DET
fcis-25103	4	21	cost	cost	NOUN
fcis-25103	4	22	of	of	ADP
fcis-25103	4	23	vastly	vastly	ADV
fcis-25103	4	24	losing	lose	VERB
fcis-25103	4	25	model	model	NOUN
fcis-25103	4	26	utility	utility	NOUN
fcis-25103	4	27	.	.	PUNCT
fcis-25103	5	1	in	in	ADP
fcis-25103	5	2	this	this	DET
fcis-25103	5	3	work	work	NOUN
fcis-25103	5	4	,	,	PUNCT
fcis-25103	5	5	we	we	PRON
fcis-25103	5	6	study	study	VERB
fcis-25103	5	7	two	two	NUM
fcis-25103	5	8	kinds	kind	NOUN
fcis-25103	5	9	of	of	ADP
fcis-25103	5	10	backdoor	backdoor	NOUN
fcis-25103	5	11	attacks	attack	NOUN
fcis-25103	5	12	and	and	CCONJ
fcis-25103	5	13	propose	propose	VERB
fcis-25103	5	14	a	a	DET
fcis-25103	5	15	method	method	NOUN
fcis-25103	5	16	based	base	VERB
fcis-25103	5	17	on	on	ADP
fcis-25103	5	18	differential	differential	ADJ
fcis-25103	5	19	privacy	privacy	NOUN
fcis-25103	5	20	,	,	PUNCT
fcis-25103	5	21	called	call	VERB
fcis-25103	5	22	clip	clip	NOUN
fcis-25103	5	23	norm	norm	NOUN
fcis-25103	5	24	decay	decay	NOUN
fcis-25103	5	25	(	(	PUNCT
fcis-25103	5	26	cnd	cnd	PROPN
fcis-25103	5	27	)	)	PUNCT
fcis-25103	5	28	to	to	PART
fcis-25103	5	29	defend	defend	VERB
fcis-25103	5	30	against	against	ADP
fcis-25103	5	31	them	they	PRON
fcis-25103	5	32	,	,	PUNCT
fcis-25103	5	33	which	which	PRON
fcis-25103	5	34	maintains	maintain	VERB
fcis-25103	5	35	utility	utility	NOUN
fcis-25103	5	36	when	when	SCONJ
fcis-25103	5	37	defending	defend	VERB
fcis-25103	5	38	against	against	ADP
fcis-25103	5	39	backdoor	backdoor	NOUN
fcis-25103	5	40	attacks	attack	NOUN
fcis-25103	5	41	with	with	ADP
fcis-25103	5	42	dp	dp	PROPN
fcis-25103	5	43	.	.	PROPN
fcis-25103	5	44	cnd	cnd	PROPN
fcis-25103	5	45	decreases	decrease	VERB
fcis-25103	5	46	the	the	DET
fcis-25103	5	47	clipping	clip	VERB
fcis-25103	5	48	threshold	threshold	NOUN
fcis-25103	5	49	of	of	ADP
fcis-25103	5	50	model	model	NOUN
fcis-25103	5	51	updates	update	NOUN
fcis-25103	5	52	through	through	ADP
fcis-25103	5	53	the	the	DET
fcis-25103	5	54	whole	whole	ADJ
fcis-25103	5	55	training	training	NOUN
fcis-25103	5	56	process	process	NOUN
fcis-25103	5	57	to	to	PART
fcis-25103	5	58	reduce	reduce	VERB
fcis-25103	5	59	the	the	DET
fcis-25103	5	60	injected	inject	VERB
fcis-25103	5	61	noise	noise	NOUN
fcis-25103	5	62	.	.	PUNCT
fcis-25103	6	1	empirical	empirical	ADJ
fcis-25103	6	2	results	result	NOUN
fcis-25103	6	3	show	show	VERB
fcis-25103	6	4	that	that	SCONJ
fcis-25103	6	5	cnd	cnd	PROPN
fcis-25103	6	6	can	can	AUX
fcis-25103	6	7	substantially	substantially	ADV
fcis-25103	6	8	enhance	enhance	VERB
fcis-25103	6	9	the	the	DET
fcis-25103	6	10	accuracy	accuracy	NOUN
fcis-25103	6	11	of	of	ADP
fcis-25103	6	12	the	the	DET
fcis-25103	6	13	main	main	ADJ
fcis-25103	6	14	task	task	NOUN
fcis-25103	6	15	.	.	PUNCT
fcis-25103	7	1	in	in	ADP
fcis-25103	7	2	particular	particular	ADJ
fcis-25103	7	3	,	,	PUNCT
fcis-25103	7	4	cnd	cnd	PROPN
fcis-25103	7	5	bounds	bound	VERB
fcis-25103	7	6	the	the	DET
fcis-25103	7	7	norm	norm	NOUN
fcis-25103	7	8	of	of	ADP
fcis-25103	7	9	malicious	malicious	ADJ
fcis-25103	7	10	updates	update	NOUN
fcis-25103	7	11	by	by	ADP
fcis-25103	7	12	adaptively	adaptively	ADV
fcis-25103	7	13	setting	set	VERB
fcis-25103	7	14	the	the	DET
fcis-25103	7	15	appropriate	appropriate	ADJ
fcis-25103	7	16	thresholds	threshold	NOUN
fcis-25103	7	17	according	accord	VERB
fcis-25103	7	18	to	to	ADP
fcis-25103	7	19	the	the	DET
fcis-25103	7	20	current	current	ADJ
fcis-25103	7	21	model	model	NOUN
fcis-25103	7	22	updates	update	VERB
fcis-25103	7	23	.	.	PUNCT
fcis-25103	8	1	empirical	empirical	ADJ
fcis-25103	8	2	results	result	NOUN
fcis-25103	8	3	show	show	VERB
fcis-25103	8	4	that	that	SCONJ
fcis-25103	8	5	cnd	cnd	PROPN
fcis-25103	8	6	can	can	AUX
fcis-25103	8	7	substantially	substantially	ADV
fcis-25103	8	8	enhance	enhance	VERB
fcis-25103	8	9	the	the	DET
fcis-25103	8	10	accuracy	accuracy	NOUN
fcis-25103	8	11	of	of	ADP
fcis-25103	8	12	the	the	DET
fcis-25103	8	13	main	main	ADJ
fcis-25103	8	14	task	task	NOUN
fcis-25103	8	15	when	when	SCONJ
fcis-25103	8	16	defending	defend	VERB
fcis-25103	8	17	against	against	ADP
fcis-25103	8	18	backdoor	backdoor	NOUN
fcis-25103	8	19	attacks	attack	NOUN
fcis-25103	8	20	.	.	PUNCT
fcis-25103	9	1	moreover	moreover	ADV
fcis-25103	9	2	,	,	PUNCT
fcis-25103	9	3	extensive	extensive	ADJ
fcis-25103	9	4	experiments	experiment	NOUN
fcis-25103	9	5	demonstrate	demonstrate	VERB
fcis-25103	9	6	that	that	SCONJ
fcis-25103	9	7	our	our	PRON
fcis-25103	9	8	method	method	NOUN
fcis-25103	9	9	performs	perform	VERB
fcis-25103	9	10	better	well	ADJ
fcis-25103	9	11	defense	defense	NOUN
fcis-25103	9	12	than	than	ADP
fcis-25103	9	13	the	the	DET
fcis-25103	9	14	original	original	ADJ
fcis-25103	9	15	dp	dp	NOUN
fcis-25103	9	16	,	,	PUNCT
fcis-25103	9	17	further	far	ADV
fcis-25103	9	18	reducing	reduce	VERB
fcis-25103	9	19	the	the	DET
fcis-25103	9	20	attack	attack	NOUN
fcis-25103	9	21	success	success	NOUN
fcis-25103	9	22	rate	rate	NOUN
fcis-25103	9	23	,	,	PUNCT
fcis-25103	9	24	even	even	ADV
fcis-25103	9	25	in	in	ADP
fcis-25103	9	26	a	a	DET
fcis-25103	9	27	strong	strong	ADJ
fcis-25103	9	28	assumption	assumption	NOUN
fcis-25103	9	29	of	of	ADP
fcis-25103	9	30	threat	threat	NOUN
fcis-25103	9	31	model	model	NOUN
fcis-25103	9	32	.	.	PUNCT
fcis-25103	10	1	additional	additional	ADJ
fcis-25103	10	2	experiments	experiment	NOUN
fcis-25103	10	3	about	about	ADP
fcis-25103	10	4	property	property	NOUN
fcis-25103	10	5	inference	inference	NOUN
fcis-25103	10	6	attack	attack	NOUN
fcis-25103	10	7	indicate	indicate	VERB
fcis-25103	10	8	that	that	SCONJ
fcis-25103	10	9	cnd	cnd	PROPN
fcis-25103	10	10	also	also	ADV
fcis-25103	10	11	maintains	maintain	VERB
fcis-25103	10	12	utility	utility	NOUN
fcis-25103	10	13	when	when	SCONJ
fcis-25103	10	14	defending	defend	VERB
fcis-25103	10	15	against	against	ADP
fcis-25103	10	16	privacy	privacy	NOUN
fcis-25103	10	17	attacks	attack	NOUN
fcis-25103	10	18	and	and	CCONJ
fcis-25103	10	19	does	do	AUX
fcis-25103	10	20	not	not	PART
fcis-25103	10	21	weaken	weaken	VERB
fcis-25103	10	22	the	the	DET
fcis-25103	10	23	privacy	privacy	NOUN
fcis-25103	10	24	preservation	preservation	NOUN
fcis-25103	10	25	of	of	ADP
fcis-25103	10	26	dp	dp	PROPN
fcis-25103	10	27	.	.	PUNCT
fcis-25103	11	1	keywords	keyword	NOUN
fcis-25103	11	2	:	:	PUNCT
fcis-25103	11	3	adversarial	adversarial	ADJ
fcis-25103	11	4	machine	machine	NOUN
fcis-25103	11	5	learning	learning	NOUN
fcis-25103	11	6	;	;	PUNCT
fcis-25103	11	7	backdoor	backdoor	NOUN
fcis-25103	11	8	attack	attack	NOUN
fcis-25103	11	9	;	;	PUNCT
fcis-25103	11	10	differential	differential	NOUN
fcis-25103	11	11	privacy	privacy	NOUN
fcis-25103	11	12	;	;	PUNCT
fcis-25103	11	13	federated	federated	ADJ
fcis-25103	11	14	learning	learning	NOUN
fcis-25103	11	15	.	.	PUNCT
fcis-25103	12	1	1	1	X
fcis-25103	12	2	.	.	X
fcis-25103	12	3	introduction	introduction	NOUN
fcis-25103	12	4	nowadays	nowadays	ADV
fcis-25103	12	5	,	,	PUNCT
fcis-25103	12	6	more	more	ADJ
fcis-25103	12	7	and	and	CCONJ
fcis-25103	12	8	more	more	ADJ
fcis-25103	12	9	machine	machine	NOUN
fcis-25103	12	10	learning	learn	VERB
fcis-25103	12	11	systems	system	NOUN
fcis-25103	12	12	need	need	VERB
fcis-25103	12	13	to	to	PART
fcis-25103	12	14	collect	collect	VERB
fcis-25103	12	15	a	a	DET
fcis-25103	12	16	large	large	ADJ
fcis-25103	12	17	amount	amount	NOUN
fcis-25103	12	18	of	of	ADP
fcis-25103	12	19	personal	personal	ADJ
fcis-25103	12	20	information	information	NOUN
fcis-25103	12	21	,	,	PUNCT
fcis-25103	12	22	such	such	ADJ
fcis-25103	12	23	as	as	ADP
fcis-25103	12	24	mobile	mobile	ADJ
fcis-25103	12	25	keyboard	keyboard	NOUN
fcis-25103	12	26	prediction	prediction	NOUN
fcis-25103	13	1	[	[	X
fcis-25103	13	2	1	1	NUM
fcis-25103	13	3	]	]	PUNCT
fcis-25103	13	4	,	,	PUNCT
fcis-25103	13	5	chat	chat	VERB
fcis-25103	13	6	bot	bot	NOUN
fcis-25103	14	1	[	[	X
fcis-25103	14	2	2	2	NUM
fcis-25103	14	3	]	]	PUNCT
fcis-25103	14	4	.	.	PUNCT
fcis-25103	15	1	with	with	ADP
fcis-25103	15	2	the	the	DET
fcis-25103	15	3	rising	rising	NOUN
fcis-25103	15	4	of	of	ADP
fcis-25103	15	5	people	people	NOUN
fcis-25103	15	6	’s	’s	PART
fcis-25103	15	7	safety	safety	NOUN
fcis-25103	15	8	awareness	awareness	NOUN
fcis-25103	15	9	,	,	PUNCT
fcis-25103	15	10	privacy	privacy	NOUN
fcis-25103	15	11	preservation	preservation	NOUN
fcis-25103	15	12	has	have	AUX
fcis-25103	15	13	become	become	VERB
fcis-25103	15	14	a	a	DET
fcis-25103	15	15	hot	hot	ADJ
fcis-25103	15	16	issue	issue	NOUN
fcis-25103	15	17	.	.	PUNCT
fcis-25103	16	1	since	since	SCONJ
fcis-25103	16	2	personal	personal	ADJ
fcis-25103	16	3	data	data	NOUN
fcis-25103	16	4	contains	contain	VERB
fcis-25103	16	5	users	user	NOUN
fcis-25103	16	6	’	’	PART
fcis-25103	16	7	private	private	ADJ
fcis-25103	16	8	information	information	NOUN
fcis-25103	16	9	and	and	CCONJ
fcis-25103	16	10	can	can	AUX
fcis-25103	16	11	not	not	PART
fcis-25103	16	12	be	be	AUX
fcis-25103	16	13	collected	collect	VERB
fcis-25103	16	14	directly	directly	ADV
fcis-25103	16	15	,	,	PUNCT
fcis-25103	16	16	traditional	traditional	ADJ
fcis-25103	16	17	centralized	centralized	ADJ
fcis-25103	16	18	machine	machine	NOUN
fcis-25103	16	19	learning	learning	NOUN
fcis-25103	16	20	will	will	AUX
fcis-25103	16	21	no	no	ADV
fcis-25103	16	22	longer	long	ADV
fcis-25103	16	23	be	be	AUX
fcis-25103	16	24	applicable	applicable	ADJ
fcis-25103	16	25	.	.	PUNCT
fcis-25103	17	1	in	in	ADP
fcis-25103	17	2	order	order	NOUN
fcis-25103	17	3	to	to	PART
fcis-25103	17	4	protect	protect	VERB
fcis-25103	17	5	privacy	privacy	NOUN
fcis-25103	17	6	,	,	PUNCT
fcis-25103	17	7	the	the	DET
fcis-25103	17	8	concept	concept	NOUN
fcis-25103	17	9	of	of	ADP
fcis-25103	17	10	federated	federated	ADJ
fcis-25103	17	11	learning	learning	NOUN
fcis-25103	17	12	(	(	PUNCT
fcis-25103	17	13	fl	fl	NOUN
fcis-25103	17	14	)	)	PUNCT
fcis-25103	18	1	[	[	X
fcis-25103	18	2	3	3	NUM
fcis-25103	18	3	,	,	PUNCT
fcis-25103	18	4	4	4	NUM
fcis-25103	18	5	]	]	PUNCT
fcis-25103	18	6	was	be	AUX
fcis-25103	18	7	proposed	propose	VERB
fcis-25103	18	8	,	,	PUNCT
fcis-25103	18	9	in	in	ADP
fcis-25103	18	10	which	which	PRON
fcis-25103	18	11	a	a	DET
fcis-25103	18	12	client	client	NOUN
fcis-25103	18	13	does	do	AUX
fcis-25103	18	14	not	not	PART
fcis-25103	18	15	provide	provide	VERB
fcis-25103	18	16	its	its	PRON
fcis-25103	18	17	dataset	dataset	NOUN
fcis-25103	18	18	,	,	PUNCT
fcis-25103	18	19	but	but	CCONJ
fcis-25103	18	20	downloads	download	VERB
fcis-25103	18	21	the	the	DET
fcis-25103	18	22	model	model	NOUN
fcis-25103	18	23	from	from	ADP
fcis-25103	18	24	the	the	DET
fcis-25103	18	25	server	server	NOUN
fcis-25103	18	26	to	to	ADP
fcis-25103	18	27	the	the	DET
fcis-25103	18	28	local	local	ADJ
fcis-25103	18	29	device	device	NOUN
fcis-25103	18	30	for	for	ADP
fcis-25103	18	31	training	training	NOUN
fcis-25103	18	32	and	and	CCONJ
fcis-25103	18	33	uploads	upload	VERB
fcis-25103	18	34	model	model	NOUN
fcis-25103	18	35	updates	update	NOUN
fcis-25103	18	36	.	.	PUNCT
fcis-25103	19	1	the	the	DET
fcis-25103	19	2	server	server	NOUN
fcis-25103	19	3	collects	collect	VERB
fcis-25103	19	4	model	model	NOUN
fcis-25103	19	5	updates	update	NOUN
fcis-25103	19	6	from	from	ADP
fcis-25103	19	7	various	various	ADJ
fcis-25103	19	8	clients	client	NOUN
fcis-25103	19	9	and	and	CCONJ
fcis-25103	19	10	aggregates	aggregate	VERB
fcis-25103	19	11	them	they	PRON
fcis-25103	19	12	to	to	PART
fcis-25103	19	13	generate	generate	VERB
fcis-25103	19	14	a	a	DET
fcis-25103	19	15	new	new	ADJ
fcis-25103	19	16	global	global	ADJ
fcis-25103	19	17	model	model	NOUN
fcis-25103	19	18	.	.	PUNCT
fcis-25103	20	1	in	in	ADP
fcis-25103	20	2	this	this	DET
fcis-25103	20	3	way	way	NOUN
fcis-25103	20	4	,	,	PUNCT
fcis-25103	20	5	all	all	DET
fcis-25103	20	6	clients	client	NOUN
fcis-25103	20	7	train	train	VERB
fcis-25103	20	8	the	the	DET
fcis-25103	20	9	global	global	ADJ
fcis-25103	20	10	model	model	NOUN
fcis-25103	20	11	collaboratively	collaboratively	ADV
fcis-25103	20	12	without	without	ADP
fcis-25103	20	13	having	have	VERB
fcis-25103	20	14	to	to	PART
fcis-25103	20	15	provide	provide	VERB
fcis-25103	20	16	their	their	PRON
fcis-25103	20	17	own	own	ADJ
fcis-25103	20	18	data	datum	NOUN
fcis-25103	20	19	.	.	PUNCT
fcis-25103	21	1	however	however	ADV
fcis-25103	21	2	,	,	PUNCT
fcis-25103	21	3	there	there	PRON
fcis-25103	21	4	are	be	VERB
fcis-25103	21	5	new	new	ADJ
fcis-25103	21	6	threats	threat	NOUN
fcis-25103	21	7	to	to	ADP
fcis-25103	21	8	federated	federated	ADJ
fcis-25103	21	9	learning	learning	NOUN
fcis-25103	21	10	due	due	ADP
fcis-25103	21	11	to	to	ADP
fcis-25103	21	12	its	its	PRON
fcis-25103	21	13	distributed	distribute	VERB
fcis-25103	21	14	nature	nature	NOUN
fcis-25103	21	15	.	.	PUNCT
fcis-25103	22	1	the	the	DET
fcis-25103	22	2	process	process	NOUN
fcis-25103	22	3	of	of	ADP
fcis-25103	22	4	local	local	ADJ
fcis-25103	22	5	training	training	NOUN
fcis-25103	22	6	is	be	AUX
fcis-25103	22	7	not	not	PART
fcis-25103	22	8	under	under	ADP
fcis-25103	22	9	the	the	DET
fcis-25103	22	10	control	control	NOUN
fcis-25103	22	11	of	of	ADP
fcis-25103	22	12	the	the	DET
fcis-25103	22	13	server	server	NOUN
fcis-25103	22	14	and	and	CCONJ
fcis-25103	22	15	therefore	therefore	ADV
fcis-25103	22	16	is	be	AUX
fcis-25103	22	17	highly	highly	ADV
fcis-25103	22	18	vulnerable	vulnerable	ADJ
fcis-25103	22	19	to	to	ADP
fcis-25103	22	20	attacks	attack	NOUN
fcis-25103	22	21	.	.	PUNCT
fcis-25103	23	1	an	an	DET
fcis-25103	23	2	adversary	adversary	NOUN
fcis-25103	23	3	may	may	AUX
fcis-25103	23	4	tamper	tamper	VERB
fcis-25103	23	5	with	with	ADP
fcis-25103	23	6	the	the	DET
fcis-25103	23	7	local	local	ADJ
fcis-25103	23	8	dataset	dataset	NOUN
fcis-25103	23	9	to	to	PART
fcis-25103	23	10	inject	inject	VERB
fcis-25103	23	11	a	a	DET
fcis-25103	23	12	backdoor	backdoor	NOUN
fcis-25103	23	13	into	into	ADP
fcis-25103	23	14	the	the	DET
fcis-25103	23	15	model	model	NOUN
fcis-25103	23	16	.	.	PUNCT
fcis-25103	24	1	backdoors	backdoor	NOUN
fcis-25103	25	1	[	[	X
fcis-25103	25	2	5	5	NUM
fcis-25103	25	3	]	]	PUNCT
fcis-25103	25	4	are	be	AUX
fcis-25103	25	5	hidden	hide	VERB
fcis-25103	25	6	patterns	pattern	NOUN
fcis-25103	25	7	learned	learn	VERB
fcis-25103	25	8	by	by	ADP
fcis-25103	25	9	a	a	DET
fcis-25103	25	10	dnn	dnn	PROPN
fcis-25103	25	11	model	model	NOUN
fcis-25103	25	12	,	,	PUNCT
fcis-25103	25	13	misleading	mislead	VERB
fcis-25103	25	14	the	the	DET
fcis-25103	25	15	model	model	NOUN
fcis-25103	25	16	to	to	PART
fcis-25103	25	17	output	output	VERB
fcis-25103	25	18	wrong	wrong	ADJ
fcis-25103	25	19	labels	label	NOUN
fcis-25103	25	20	when	when	SCONJ
fcis-25103	25	21	inferring	infer	VERB
fcis-25103	25	22	samples	sample	NOUN
fcis-25103	25	23	with	with	ADP
fcis-25103	25	24	backdoor	backdoor	NOUN
fcis-25103	25	25	features	feature	NOUN
fcis-25103	25	26	(	(	PUNCT
fcis-25103	25	27	aka	aka	ADV
fcis-25103	25	28	trigger	trigger	NOUN
fcis-25103	25	29	inputs	input	NOUN
fcis-25103	25	30	)	)	PUNCT
fcis-25103	25	31	.	.	PUNCT
fcis-25103	26	1	backdoor	backdoor	NOUN
fcis-25103	26	2	features	feature	NOUN
fcis-25103	26	3	can	can	AUX
fcis-25103	26	4	be	be	AUX
fcis-25103	26	5	existing	exist	VERB
fcis-25103	26	6	features	feature	NOUN
fcis-25103	26	7	in	in	ADP
fcis-25103	26	8	training	training	NOUN
fcis-25103	26	9	data	datum	NOUN
fcis-25103	26	10	,	,	PUNCT
fcis-25103	26	11	or	or	CCONJ
fcis-25103	26	12	patterns	pattern	NOUN
fcis-25103	26	13	designed	design	VERB
fcis-25103	26	14	by	by	ADP
fcis-25103	26	15	the	the	DET
fcis-25103	26	16	attackers	attacker	NOUN
fcis-25103	26	17	.	.	PUNCT
fcis-25103	27	1	it	it	PRON
fcis-25103	27	2	is	be	AUX
fcis-25103	27	3	difficult	difficult	ADJ
fcis-25103	27	4	for	for	SCONJ
fcis-25103	27	5	the	the	DET
fcis-25103	27	6	server	server	NOUN
fcis-25103	27	7	to	to	PART
fcis-25103	27	8	determine	determine	VERB
fcis-25103	27	9	whether	whether	SCONJ
fcis-25103	27	10	there	there	PRON
fcis-25103	27	11	is	be	VERB
fcis-25103	27	12	a	a	DET
fcis-25103	27	13	malicious	malicious	ADJ
fcis-25103	27	14	client	client	NOUN
fcis-25103	27	15	.	.	PUNCT
fcis-25103	28	1	if	if	SCONJ
fcis-25103	28	2	the	the	DET
fcis-25103	28	3	attack	attack	NOUN
fcis-25103	28	4	is	be	AUX
fcis-25103	28	5	successful	successful	ADJ
fcis-25103	28	6	,	,	PUNCT
fcis-25103	28	7	it	it	PRON
fcis-25103	28	8	will	will	AUX
fcis-25103	28	9	lead	lead	VERB
fcis-25103	28	10	to	to	ADP
fcis-25103	28	11	the	the	DET
fcis-25103	28	12	misclassification	misclassification	NOUN
fcis-25103	28	13	of	of	ADP
fcis-25103	28	14	specific	specific	ADJ
fcis-25103	28	15	samples	sample	NOUN
fcis-25103	28	16	,	,	PUNCT
fcis-25103	28	17	causing	cause	VERB
fcis-25103	28	18	serious	serious	ADJ
fcis-25103	28	19	consequences	consequence	NOUN
fcis-25103	28	20	.	.	PUNCT
fcis-25103	29	1	for	for	ADP
fcis-25103	29	2	instance	instance	NOUN
fcis-25103	29	3	,	,	PUNCT
fcis-25103	29	4	once	once	SCONJ
fcis-25103	29	5	the	the	DET
fcis-25103	29	6	image	image	NOUN
fcis-25103	29	7	classifier	classifier	NOUN
fcis-25103	29	8	of	of	ADP
fcis-25103	29	9	a	a	DET
fcis-25103	29	10	self	self	NOUN
fcis-25103	29	11	-	-	PUNCT
fcis-25103	29	12	driving	drive	VERB
fcis-25103	29	13	automobile	automobile	NOUN
fcis-25103	29	14	is	be	AUX
fcis-25103	29	15	attacked	attack	VERB
fcis-25103	29	16	,	,	PUNCT
fcis-25103	29	17	it	it	PRON
fcis-25103	29	18	may	may	AUX
fcis-25103	29	19	output	output	VERB
fcis-25103	29	20	a	a	DET
fcis-25103	29	21	wrong	wrong	ADJ
fcis-25103	29	22	instruction	instruction	NOUN
fcis-25103	29	23	when	when	SCONJ
fcis-25103	29	24	capturing	capture	VERB
fcis-25103	29	25	a	a	DET
fcis-25103	29	26	carefully	carefully	ADV
fcis-25103	29	27	crafted	craft	VERB
fcis-25103	29	28	picture	picture	NOUN
fcis-25103	29	29	,	,	PUNCT
fcis-25103	29	30	which	which	PRON
fcis-25103	29	31	is	be	AUX
fcis-25103	29	32	very	very	ADV
fcis-25103	29	33	dangerous	dangerous	ADJ
fcis-25103	29	34	in	in	ADP
fcis-25103	29	35	real	real	ADJ
fcis-25103	29	36	life	life	NOUN
fcis-25103	29	37	.	.	PUNCT
fcis-25103	30	1	traditional	traditional	ADJ
fcis-25103	30	2	backdoor	backdoor	NOUN
fcis-25103	30	3	detection	detection	NOUN
fcis-25103	30	4	methods	method	NOUN
fcis-25103	30	5	either	either	CCONJ
fcis-25103	30	6	assume	assume	VERB
fcis-25103	30	7	an	an	DET
fcis-25103	30	8	iid	iid	NOUN
fcis-25103	30	9	setting	set	VERB
fcis-25103	30	10	[	[	X
fcis-25103	30	11	6	6	NUM
fcis-25103	30	12	,	,	PUNCT
fcis-25103	30	13	7	7	NUM
fcis-25103	30	14	]	]	PUNCT
fcis-25103	30	15	,	,	PUNCT
fcis-25103	30	16	which	which	PRON
fcis-25103	30	17	is	be	AUX
fcis-25103	30	18	not	not	PART
fcis-25103	30	19	realistic	realistic	ADJ
fcis-25103	30	20	for	for	ADP
fcis-25103	30	21	fl	fl	PROPN
fcis-25103	30	22	,	,	PUNCT
fcis-25103	30	23	or	or	CCONJ
fcis-25103	30	24	require	require	VERB
fcis-25103	30	25	the	the	DET
fcis-25103	30	26	defender	defender	NOUN
fcis-25103	30	27	to	to	AUX
fcis-25103	30	28	access	access	NOUN
fcis-25103	30	29	training	training	NOUN
fcis-25103	30	30	data	datum	NOUN
fcis-25103	30	31	or	or	CCONJ
fcis-25103	30	32	the	the	DET
fcis-25103	30	33	final	final	ADJ
fcis-25103	30	34	model	model	NOUN
fcis-25103	30	35	[	[	X
fcis-25103	30	36	8	8	NUM
fcis-25103	30	37	]	]	PUNCT
fcis-25103	30	38	,	,	PUNCT
fcis-25103	30	39	violating	violate	VERB
fcis-25103	30	40	the	the	DET
fcis-25103	30	41	privacy	privacy	NOUN
fcis-25103	30	42	principle	principle	NOUN
fcis-25103	30	43	of	of	ADP
fcis-25103	30	44	fl	fl	PROPN
fcis-25103	30	45	.	.	PUNCT
fcis-25103	31	1	in	in	ADP
fcis-25103	31	2	the	the	DET
fcis-25103	31	3	context	context	NOUN
fcis-25103	31	4	of	of	ADP
fcis-25103	31	5	fl	fl	PROPN
fcis-25103	31	6	,	,	PUNCT
fcis-25103	31	7	differential	differential	ADJ
fcis-25103	31	8	privacy	privacy	NOUN
fcis-25103	31	9	(	(	PUNCT
fcis-25103	31	10	dp	dp	NOUN
fcis-25103	31	11	)	)	PUNCT
fcis-25103	32	1	[	[	X
fcis-25103	32	2	9	9	NUM
fcis-25103	32	3	]	]	PUNCT
fcis-25103	32	4	was	be	AUX
fcis-25103	32	5	originally	originally	ADV
fcis-25103	32	6	used	use	VERB
fcis-25103	32	7	to	to	PART
fcis-25103	32	8	address	address	VERB
fcis-25103	32	9	the	the	DET
fcis-25103	32	10	threat	threat	NOUN
fcis-25103	32	11	of	of	ADP
fcis-25103	32	12	privacy	privacy	NOUN
fcis-25103	32	13	leakage	leakage	NOUN
fcis-25103	32	14	,	,	PUNCT
fcis-25103	32	15	providing	provide	VERB
fcis-25103	32	16	different	different	ADJ
fcis-25103	32	17	levels	level	NOUN
fcis-25103	32	18	of	of	ADP
fcis-25103	32	19	privacy	privacy	NOUN
fcis-25103	32	20	guarantee	guarantee	NOUN
fcis-25103	32	21	,	,	PUNCT
fcis-25103	32	22	i.e.	i.e.	X
fcis-25103	32	23	,	,	PUNCT
fcis-25103	32	24	record	record	NOUN
fcis-25103	32	25	-	-	PUNCT
fcis-25103	32	26	level	level	NOUN
fcis-25103	32	27	[	[	X
fcis-25103	32	28	10	10	NUM
fcis-25103	32	29	,	,	PUNCT
fcis-25103	32	30	11	11	NUM
fcis-25103	32	31	]	]	PUNCT
fcis-25103	32	32	and	and	CCONJ
fcis-25103	32	33	user	user	NOUN
fcis-25103	32	34	-	-	PUNCT
fcis-25103	32	35	level	level	NOUN
fcis-25103	32	36	[	[	X
fcis-25103	32	37	12	12	NUM
fcis-25103	32	38	,	,	PUNCT
fcis-25103	32	39	13	13	NUM
fcis-25103	32	40	]	]	PUNCT
fcis-25103	32	41	.	.	PUNCT
fcis-25103	33	1	recently	recently	ADV
fcis-25103	33	2	,	,	PUNCT
fcis-25103	33	3	there	there	PRON
fcis-25103	33	4	has	have	AUX
fcis-25103	33	5	been	be	AUX
fcis-25103	33	6	some	some	DET
fcis-25103	33	7	research	research	NOUN
fcis-25103	33	8	on	on	ADP
fcis-25103	33	9	the	the	DET
fcis-25103	33	10	defense	defense	NOUN
fcis-25103	33	11	against	against	ADP
fcis-25103	33	12	backdoor	backdoor	NOUN
fcis-25103	33	13	attacks	attack	NOUN
fcis-25103	33	14	with	with	ADP
fcis-25103	33	15	dp	dp	PROPN
fcis-25103	33	16	.	.	PUNCT
fcis-25103	34	1	their	their	PRON
fcis-25103	34	2	motivation	motivation	NOUN
fcis-25103	34	3	is	be	AUX
fcis-25103	34	4	to	to	PART
fcis-25103	34	5	eliminate	eliminate	VERB
fcis-25103	34	6	the	the	DET
fcis-25103	34	7	difference	difference	NOUN
fcis-25103	34	8	between	between	ADP
fcis-25103	34	9	the	the	DET
fcis-25103	34	10	malicious	malicious	ADJ
fcis-25103	34	11	gradient	gradient	NOUN
fcis-25103	34	12	and	and	CCONJ
fcis-25103	34	13	the	the	DET
fcis-25103	34	14	normal	normal	ADJ
fcis-25103	34	15	gradient	gradient	NOUN
fcis-25103	34	16	by	by	ADP
fcis-25103	34	17	perturbing	perturb	VERB
fcis-25103	34	18	the	the	DET
fcis-25103	34	19	gradient	gradient	NOUN
fcis-25103	34	20	uploaded	upload	VERB
fcis-25103	34	21	in	in	ADP
fcis-25103	34	22	federated	federated	ADJ
fcis-25103	34	23	learning	learning	NOUN
fcis-25103	34	24	.	.	PUNCT
fcis-25103	35	1	weak	weak	ADJ
fcis-25103	35	2	dp	dp	NOUN
fcis-25103	36	1	[	[	X
fcis-25103	36	2	14	14	NUM
fcis-25103	36	3	]	]	PUNCT
fcis-25103	36	4	could	could	AUX
fcis-25103	36	5	reduce	reduce	VERB
fcis-25103	36	6	the	the	DET
fcis-25103	36	7	success	success	NOUN
fcis-25103	36	8	rate	rate	NOUN
fcis-25103	36	9	of	of	ADP
fcis-25103	36	10	backdoor	backdoor	NOUN
fcis-25103	36	11	attacks	attack	NOUN
fcis-25103	36	12	to	to	ADP
fcis-25103	36	13	a	a	DET
fcis-25103	36	14	relatively	relatively	ADV
fcis-25103	36	15	low	low	ADJ
fcis-25103	36	16	level	level	NOUN
fcis-25103	36	17	.	.	PUNCT
fcis-25103	37	1	cdp	cdp	NOUN
fcis-25103	37	2	and	and	CCONJ
fcis-25103	37	3	ldp	ldp	PROPN
fcis-25103	38	1	[	[	X
fcis-25103	38	2	15	15	NUM
fcis-25103	38	3	]	]	X
fcis-25103	38	4	could	could	AUX
fcis-25103	38	5	further	far	ADV
fcis-25103	38	6	reduce	reduce	VERB
fcis-25103	38	7	the	the	DET
fcis-25103	38	8	success	success	NOUN
fcis-25103	38	9	rate	rate	NOUN
fcis-25103	38	10	by	by	ADP
fcis-25103	38	11	injecting	inject	VERB
fcis-25103	38	12	much	much	ADV
fcis-25103	38	13	more	more	ADJ
fcis-25103	38	14	noise	noise	NOUN
fcis-25103	38	15	,	,	PUNCT
fcis-25103	38	16	whereas	whereas	SCONJ
fcis-25103	38	17	at	at	ADP
fcis-25103	38	18	the	the	DET
fcis-25103	38	19	cost	cost	NOUN
fcis-25103	38	20	of	of	ADP
fcis-25103	38	21	decreasing	decrease	VERB
fcis-25103	38	22	the	the	DET
fcis-25103	38	23	main	main	ADJ
fcis-25103	38	24	task	task	NOUN
fcis-25103	38	25	accuracy	accuracy	NOUN
fcis-25103	38	26	heavily	heavily	ADV
fcis-25103	38	27	.	.	PUNCT
fcis-25103	39	1	our	our	PRON
fcis-25103	39	2	research	research	NOUN
fcis-25103	39	3	aims	aim	VERB
fcis-25103	39	4	to	to	PART
fcis-25103	39	5	solve	solve	VERB
fcis-25103	39	6	the	the	DET
fcis-25103	39	7	problem	problem	NOUN
fcis-25103	39	8	in	in	ADP
fcis-25103	39	9	defense	defense	NOUN
fcis-25103	39	10	methods	method	NOUN
fcis-25103	39	11	with	with	ADP
fcis-25103	39	12	dp	dp	PROPN
fcis-25103	39	13	.	.	PUNCT
fcis-25103	40	1	we	we	PRON
fcis-25103	40	2	first	first	ADV
fcis-25103	40	3	focus	focus	VERB
fcis-25103	40	4	on	on	ADP
fcis-25103	40	5	two	two	NUM
fcis-25103	40	6	kinds	kind	NOUN
fcis-25103	40	7	of	of	ADP
fcis-25103	40	8	backdoor	backdoor	NOUN
fcis-25103	40	9	attacks	attack	NOUN
fcis-25103	40	10	in	in	ADP
fcis-25103	40	11	fl	fl	NOUN
fcis-25103	40	12	:	:	PUNCT
fcis-25103	40	13	single	single	ADJ
fcis-25103	40	14	-	-	PUNCT
fcis-25103	40	15	pixel	pixel	NOUN
fcis-25103	40	16	attack	attack	NOUN
fcis-25103	40	17	and	and	CCONJ
fcis-25103	40	18	semantic	semantic	ADJ
fcis-25103	40	19	backdoor	backdoor	NOUN
fcis-25103	40	20	attack	attack	NOUN
fcis-25103	40	21	,	,	PUNCT
fcis-25103	40	22	and	and	CCONJ
fcis-25103	40	23	study	study	VERB
fcis-25103	40	24	several	several	ADJ
fcis-25103	40	25	factors	factor	NOUN
fcis-25103	40	26	related	relate	VERB
fcis-25103	40	27	to	to	ADP
fcis-25103	40	28	backdoor	backdoor	NOUN
fcis-25103	40	29	attacks	attack	NOUN
fcis-25103	40	30	empirically	empirically	ADV
fcis-25103	40	31	.	.	PUNCT
fcis-25103	41	1	we	we	PRON
fcis-25103	41	2	find	find	VERB
fcis-25103	41	3	that	that	SCONJ
fcis-25103	41	4	the	the	DET
fcis-25103	41	5	success	success	NOUN
fcis-25103	41	6	rate	rate	NOUN
fcis-25103	41	7	of	of	ADP
fcis-25103	41	8	backdoor	backdoor	NOUN
fcis-25103	41	9	attacks	attack	NOUN
fcis-25103	41	10	rises	rise	VERB
fcis-25103	41	11	as	as	ADP
fcis-25103	41	12	the	the	DET
fcis-25103	41	13	number	number	NOUN
fcis-25103	41	14	of	of	ADP
fcis-25103	41	15	malicious	malicious	ADJ
fcis-25103	41	16	clients	client	NOUN
fcis-25103	41	17	increases	increase	NOUN
fcis-25103	41	18	.	.	PUNCT
fcis-25103	42	1	when	when	SCONJ
fcis-25103	42	2	the	the	DET
fcis-25103	42	3	number	number	NOUN
fcis-25103	42	4	of	of	ADP
fcis-25103	42	5	backdoored	backdoore	VERB
fcis-25103	42	6	samples	sample	NOUN
fcis-25103	42	7	is	be	AUX
fcis-25103	42	8	fixed	fix	VERB
fcis-25103	42	9	,	,	PUNCT
fcis-25103	42	10	the	the	DET
fcis-25103	42	11	attack	attack	NOUN
fcis-25103	42	12	with	with	ADP
fcis-25103	42	13	denser	dense	ADJ
fcis-25103	42	14	backdoored	backdoore	VERB
fcis-25103	42	15	samples	sample	NOUN
fcis-25103	42	16	has	have	VERB
fcis-25103	42	17	a	a	DET
fcis-25103	42	18	higher	high	ADJ
fcis-25103	42	19	success	success	NOUN
fcis-25103	42	20	rate	rate	NOUN
fcis-25103	42	21	.	.	PUNCT
fcis-25103	43	1	then	then	ADV
fcis-25103	43	2	,	,	PUNCT
fcis-25103	43	3	we	we	PRON
fcis-25103	43	4	discover	discover	VERB
fcis-25103	43	5	the	the	DET
fcis-25103	43	6	relation	relation	NOUN
fcis-25103	43	7	between	between	ADP
fcis-25103	43	8	backdoor	backdoor	NOUN
fcis-25103	43	9	attacks	attack	NOUN
fcis-25103	43	10	and	and	CCONJ
fcis-25103	43	11	model	model	NOUN
fcis-25103	43	12	overfitting	overfitting	NOUN
fcis-25103	43	13	.	.	PUNCT
fcis-25103	44	1	that	that	PRON
fcis-25103	44	2	is	is	ADV
fcis-25103	44	3	,	,	PUNCT
fcis-25103	44	4	the	the	DET
fcis-25103	44	5	process	process	NOUN
fcis-25103	44	6	of	of	ADP
fcis-25103	44	7	malicious	malicious	ADJ
fcis-25103	44	8	clients	client	NOUN
fcis-25103	44	9	training	train	VERB
fcis-25103	44	10	their	their	PRON
fcis-25103	44	11	local	local	ADJ
fcis-25103	44	12	models	model	NOUN
fcis-25103	44	13	involves	involve	VERB
fcis-25103	44	14	overfitting	overfitte	VERB
fcis-25103	44	15	.	.	PUNCT
fcis-25103	45	1	experimental	experimental	ADJ
fcis-25103	45	2	results	result	NOUN
fcis-25103	45	3	show	show	VERB
fcis-25103	45	4	that	that	SCONJ
fcis-25103	45	5	when	when	SCONJ
fcis-25103	45	6	learning	learn	VERB
fcis-25103	45	7	parameters	parameter	NOUN
fcis-25103	45	8	are	be	AUX
fcis-25103	45	9	set	set	VERB
fcis-25103	45	10	to	to	PART
fcis-25103	45	11	suppress	suppress	VERB
fcis-25103	45	12	overfitting	overfitting	NOUN
fcis-25103	45	13	,	,	PUNCT
fcis-25103	45	14	the	the	DET
fcis-25103	45	15	success	success	NOUN
fcis-25103	45	16	rate	rate	NOUN
fcis-25103	45	17	of	of	ADP
fcis-25103	45	18	backdoor	backdoor	NOUN
fcis-25103	45	19	attacks	attack	NOUN
fcis-25103	45	20	decreases	decrease	VERB
fcis-25103	45	21	to	to	ADP
fcis-25103	45	22	some	some	DET
fcis-25103	45	23	extent	extent	NOUN
fcis-25103	45	24	.	.	PUNCT
fcis-25103	46	1	in	in	ADP
fcis-25103	46	2	this	this	DET
fcis-25103	46	3	paper	paper	NOUN
fcis-25103	46	4	,	,	PUNCT
fcis-25103	46	5	we	we	PRON
fcis-25103	46	6	propose	propose	VERB
fcis-25103	46	7	a	a	DET
fcis-25103	46	8	method	method	NOUN
fcis-25103	46	9	to	to	PART
fcis-25103	46	10	maintain	maintain	VERB
fcis-25103	46	11	a	a	DET
fcis-25103	46	12	high	high	ADJ
fcis-25103	46	13	accuracy	accuracy	NOUN
fcis-25103	46	14	on	on	ADP
fcis-25103	46	15	the	the	DET
fcis-25103	46	16	main	main	ADJ
fcis-25103	46	17	task	task	NOUN
fcis-25103	46	18	when	when	SCONJ
fcis-25103	46	19	defending	defend	VERB
fcis-25103	46	20	against	against	ADP
fcis-25103	46	21	backdoor	backdoor	NOUN
fcis-25103	46	22	attacks	attack	NOUN
fcis-25103	46	23	with	with	ADP
fcis-25103	46	24	dp	dp	PROPN
fcis-25103	46	25	.	.	PUNCT
fcis-25103	47	1	the	the	DET
fcis-25103	47	2	method	method	NOUN
fcis-25103	47	3	is	be	AUX
fcis-25103	47	4	called	call	VERB
fcis-25103	47	5	clip	clip	NOUN
fcis-25103	47	6	norm	norm	NOUN
fcis-25103	47	7	decay	decay	NOUN
fcis-25103	47	8	(	(	PUNCT
fcis-25103	47	9	cnd	cnd	PROPN
fcis-25103	47	10	)	)	PUNCT
fcis-25103	47	11	,	,	PUNCT
fcis-25103	47	12	which	which	PRON
fcis-25103	47	13	decreases	decrease	VERB
fcis-25103	47	14	the	the	DET
fcis-25103	47	15	original	original	ADJ
fcis-25103	47	16	clipping	clipping	NOUN
fcis-25103	47	17	threshold	threshold	NOUN
fcis-25103	47	18	of	of	ADP
fcis-25103	47	19	model	model	NOUN
fcis-25103	47	20	updates	update	NOUN
fcis-25103	47	21	before	before	ADP
fcis-25103	47	22	a	a	DET
fcis-25103	47	23	round	round	NOUN
fcis-25103	47	24	starts	start	NOUN
fcis-25103	47	25	,	,	PUNCT
fcis-25103	47	26	and	and	CCONJ
fcis-25103	47	27	sends	send	VERB
fcis-25103	47	28	the	the	DET
fcis-25103	47	29	new	new	ADJ
fcis-25103	47	30	threshold	threshold	NOUN
fcis-25103	47	31	with	with	ADP
fcis-25103	47	32	the	the	DET
fcis-25103	47	33	global	global	ADJ
fcis-25103	47	34	model	model	NOUN
fcis-25103	47	35	to	to	ADP
fcis-25103	47	36	selected	select	VERB
fcis-25103	47	37	clients	client	NOUN
fcis-25103	47	38	.	.	PUNCT
fcis-25103	48	1	we	we	PRON
fcis-25103	48	2	design	design	VERB
fcis-25103	48	3	a	a	DET
fcis-25103	48	4	method	method	NOUN
fcis-25103	48	5	for	for	SCONJ
fcis-25103	48	6	cnd	cnd	PROPN
fcis-25103	48	7	to	to	PART
fcis-25103	48	8	set	set	VERB
fcis-25103	48	9	a	a	DET
fcis-25103	48	10	new	new	ADJ
fcis-25103	48	11	threshold	threshold	NOUN
fcis-25103	48	12	according	accord	VERB
fcis-25103	48	13	to	to	ADP
fcis-25103	48	14	the	the	DET
fcis-25103	48	15	32	32	NUM
fcis-25103	48	16	collected	collect	VERB
fcis-25103	48	17	model	model	NOUN
fcis-25103	48	18	updates	update	NOUN
fcis-25103	48	19	.	.	PUNCT
fcis-25103	49	1	since	since	SCONJ
fcis-25103	49	2	the	the	DET
fcis-25103	49	3	magnitude	magnitude	NOUN
fcis-25103	49	4	of	of	ADP
fcis-25103	49	5	injected	inject	VERB
fcis-25103	49	6	noise	noise	NOUN
fcis-25103	49	7	is	be	AUX
fcis-25103	49	8	proportional	proportional	ADJ
fcis-25103	49	9	to	to	ADP
fcis-25103	49	10	the	the	DET
fcis-25103	49	11	clipping	clip	VERB
fcis-25103	49	12	threshold	threshold	NOUN
fcis-25103	49	13	,	,	PUNCT
fcis-25103	49	14	reducing	reduce	VERB
fcis-25103	49	15	the	the	DET
fcis-25103	49	16	clipping	clip	VERB
fcis-25103	49	17	threshold	threshold	NOUN
fcis-25103	49	18	can	can	AUX
fcis-25103	49	19	introduce	introduce	VERB
fcis-25103	49	20	less	less	ADJ
fcis-25103	49	21	noise	noise	NOUN
fcis-25103	49	22	and	and	CCONJ
fcis-25103	49	23	obtain	obtain	VERB
fcis-25103	49	24	a	a	DET
fcis-25103	49	25	higher	high	ADJ
fcis-25103	49	26	model	model	NOUN
fcis-25103	49	27	accuracy	accuracy	NOUN
fcis-25103	49	28	.	.	PUNCT
fcis-25103	50	1	we	we	PRON
fcis-25103	50	2	implement	implement	VERB
fcis-25103	50	3	our	our	PRON
fcis-25103	50	4	method	method	NOUN
fcis-25103	50	5	against	against	ADP
fcis-25103	50	6	two	two	NUM
fcis-25103	50	7	kinds	kind	NOUN
fcis-25103	50	8	of	of	ADP
fcis-25103	50	9	backdoor	backdoor	NOUN
fcis-25103	50	10	attacks	attack	NOUN
fcis-25103	50	11	:	:	PUNCT
fcis-25103	50	12	single	single	ADJ
fcis-25103	50	13	-	-	PUNCT
fcis-25103	50	14	pixel	pixel	NOUN
fcis-25103	50	15	attack	attack	NOUN
fcis-25103	50	16	and	and	CCONJ
fcis-25103	50	17	semantic	semantic	ADJ
fcis-25103	50	18	backdoor	backdoor	NOUN
fcis-25103	50	19	attack	attack	NOUN
fcis-25103	50	20	,	,	PUNCT
fcis-25103	50	21	under	under	ADP
fcis-25103	50	22	the	the	DET
fcis-25103	50	23	assumption	assumption	NOUN
fcis-25103	50	24	that	that	SCONJ
fcis-25103	50	25	the	the	DET
fcis-25103	50	26	attacker	attacker	NOUN
fcis-25103	50	27	can	can	AUX
fcis-25103	50	28	modify	modify	VERB
fcis-25103	50	29	the	the	DET
fcis-25103	50	30	training	training	NOUN
fcis-25103	50	31	dataset	dataset	NOUN
fcis-25103	50	32	and	and	CCONJ
fcis-25103	50	33	the	the	DET
fcis-25103	50	34	training	training	NOUN
fcis-25103	50	35	process	process	NOUN
fcis-25103	50	36	of	of	ADP
fcis-25103	50	37	malicious	malicious	ADJ
fcis-25103	50	38	clients	client	NOUN
fcis-25103	50	39	.	.	PUNCT
fcis-25103	51	1	experimental	experimental	ADJ
fcis-25103	51	2	results	result	NOUN
fcis-25103	51	3	show	show	VERB
fcis-25103	51	4	that	that	SCONJ
fcis-25103	51	5	,	,	PUNCT
fcis-25103	51	6	cnd	cnd	NOUN
fcis-25103	51	7	indeed	indeed	ADV
fcis-25103	51	8	greatly	greatly	ADV
fcis-25103	51	9	improves	improve	VERB
fcis-25103	51	10	the	the	DET
fcis-25103	51	11	accuracy	accuracy	NOUN
fcis-25103	51	12	on	on	ADP
fcis-25103	51	13	the	the	DET
fcis-25103	51	14	main	main	ADJ
fcis-25103	51	15	task	task	NOUN
fcis-25103	51	16	(	(	PUNCT
fcis-25103	51	17	more	more	ADJ
fcis-25103	51	18	than	than	ADP
fcis-25103	51	19	20	20	NUM
fcis-25103	51	20	%	%	NOUN
fcis-25103	51	21	)	)	PUNCT
fcis-25103	51	22	,	,	PUNCT
fcis-25103	51	23	making	make	VERB
fcis-25103	51	24	it	it	PRON
fcis-25103	51	25	possible	possible	ADJ
fcis-25103	51	26	to	to	PART
fcis-25103	51	27	apply	apply	VERB
fcis-25103	51	28	dp	dp	NOUN
fcis-25103	51	29	under	under	ADP
fcis-25103	51	30	a	a	DET
fcis-25103	51	31	low	low	ADJ
fcis-25103	51	32	privacy	privacy	NOUN
fcis-25103	51	33	budget	budget	NOUN
fcis-25103	51	34	while	while	SCONJ
fcis-25103	51	35	maintaining	maintain	VERB
fcis-25103	51	36	model	model	NOUN
fcis-25103	51	37	utility	utility	NOUN
fcis-25103	51	38	.	.	PUNCT
fcis-25103	52	1	besides	besides	SCONJ
fcis-25103	52	2	,	,	PUNCT
fcis-25103	52	3	it	it	PRON
fcis-25103	52	4	also	also	ADV
fcis-25103	52	5	reduces	reduce	VERB
fcis-25103	52	6	the	the	DET
fcis-25103	52	7	success	success	NOUN
fcis-25103	52	8	rate	rate	NOUN
fcis-25103	52	9	of	of	ADP
fcis-25103	52	10	backdoor	backdoor	NOUN
fcis-25103	52	11	attacks	attack	NOUN
fcis-25103	52	12	compared	compare	VERB
fcis-25103	52	13	with	with	ADP
fcis-25103	52	14	the	the	DET
fcis-25103	52	15	original	original	ADJ
fcis-25103	52	16	dp	dp	NOUN
fcis-25103	52	17	,	,	PUNCT
fcis-25103	52	18	on	on	ADP
fcis-25103	52	19	account	account	NOUN
fcis-25103	52	20	of	of	ADP
fcis-25103	52	21	cnd	cnd	PROPN
fcis-25103	52	22	suppressing	suppress	VERB
fcis-25103	52	23	the	the	DET
fcis-25103	52	24	norms	norm	NOUN
fcis-25103	52	25	of	of	ADP
fcis-25103	52	26	malicious	malicious	ADJ
fcis-25103	52	27	updates	update	NOUN
fcis-25103	52	28	throughout	throughout	ADP
fcis-25103	52	29	the	the	DET
fcis-25103	52	30	whole	whole	ADJ
fcis-25103	52	31	training	training	NOUN
fcis-25103	52	32	process	process	NOUN
fcis-25103	52	33	.	.	PUNCT
fcis-25103	53	1	in	in	ADP
fcis-25103	53	2	addition	addition	NOUN
fcis-25103	53	3	,	,	PUNCT
fcis-25103	53	4	to	to	PART
fcis-25103	53	5	verify	verify	VERB
fcis-25103	53	6	that	that	SCONJ
fcis-25103	53	7	reducing	reduce	VERB
fcis-25103	53	8	clipping	clip	VERB
fcis-25103	53	9	threshold	threshold	NOUN
fcis-25103	53	10	does	do	AUX
fcis-25103	53	11	not	not	PART
fcis-25103	53	12	introduce	introduce	VERB
fcis-25103	53	13	privacy	privacy	NOUN
fcis-25103	53	14	risk	risk	NOUN
fcis-25103	53	15	,	,	PUNCT
fcis-25103	53	16	we	we	PRON
fcis-25103	53	17	implement	implement	VERB
fcis-25103	53	18	cnd	cnd	PROPN
fcis-25103	53	19	to	to	PART
fcis-25103	53	20	defend	defend	VERB
fcis-25103	53	21	against	against	ADP
fcis-25103	53	22	property	property	NOUN
fcis-25103	53	23	inference	inference	NOUN
fcis-25103	53	24	attack	attack	NOUN
fcis-25103	53	25	proposed	propose	VERB
fcis-25103	53	26	by	by	ADP
fcis-25103	53	27	previous	previous	ADJ
fcis-25103	53	28	work	work	NOUN
fcis-25103	53	29	.	.	PUNCT
fcis-25103	54	1	the	the	DET
fcis-25103	54	2	result	result	NOUN
fcis-25103	54	3	indicates	indicate	VERB
fcis-25103	54	4	that	that	SCONJ
fcis-25103	54	5	our	our	PRON
fcis-25103	54	6	method	method	NOUN
fcis-25103	54	7	provides	provide	VERB
fcis-25103	54	8	the	the	DET
fcis-25103	54	9	same	same	ADJ
fcis-25103	54	10	privacy	privacy	NOUN
fcis-25103	54	11	preservation	preservation	NOUN
fcis-25103	54	12	capability	capability	NOUN
fcis-25103	54	13	as	as	ADP
fcis-25103	54	14	the	the	DET
fcis-25103	54	15	original	original	ADJ
fcis-25103	54	16	dp	dp	NOUN
fcis-25103	54	17	and	and	CCONJ
fcis-25103	54	18	enhances	enhance	VERB
fcis-25103	54	19	the	the	DET
fcis-25103	54	20	main	main	ADJ
fcis-25103	54	21	task	task	NOUN
fcis-25103	54	22	accuracy	accuracy	NOUN
fcis-25103	54	23	significantly	significantly	ADV
fcis-25103	54	24	.	.	PUNCT
fcis-25103	55	1	this	this	PRON
fcis-25103	55	2	means	mean	VERB
fcis-25103	55	3	cnd	cnd	PROPN
fcis-25103	55	4	can	can	AUX
fcis-25103	55	5	be	be	AUX
fcis-25103	55	6	applied	apply	VERB
fcis-25103	55	7	in	in	ADP
fcis-25103	55	8	federated	federated	ADJ
fcis-25103	55	9	learning	learning	NOUN
fcis-25103	55	10	to	to	PART
fcis-25103	55	11	defend	defend	VERB
fcis-25103	55	12	against	against	ADP
fcis-25103	55	13	both	both	PRON
fcis-25103	55	14	security	security	NOUN
fcis-25103	55	15	and	and	CCONJ
fcis-25103	55	16	privacy	privacy	NOUN
fcis-25103	55	17	attacks	attack	NOUN
fcis-25103	55	18	.	.	PUNCT
fcis-25103	56	1	to	to	PART
fcis-25103	56	2	summarize	summarize	VERB
fcis-25103	56	3	,	,	PUNCT
fcis-25103	56	4	our	our	PRON
fcis-25103	56	5	contributions	contribution	NOUN
fcis-25103	56	6	can	can	AUX
fcis-25103	56	7	be	be	AUX
fcis-25103	56	8	described	describe	VERB
fcis-25103	56	9	as	as	ADP
fcis-25103	56	10	follows	follow	VERB
fcis-25103	56	11	:	:	PUNCT
fcis-25103	56	12			X
fcis-25103	56	13	we	we	PRON
fcis-25103	56	14	show	show	VERB
fcis-25103	56	15	several	several	ADJ
fcis-25103	56	16	factors	factor	NOUN
fcis-25103	56	17	that	that	PRON
fcis-25103	56	18	contribute	contribute	VERB
fcis-25103	56	19	to	to	ADP
fcis-25103	56	20	the	the	DET
fcis-25103	56	21	success	success	NOUN
fcis-25103	56	22	of	of	ADP
fcis-25103	56	23	backdoor	backdoor	NOUN
fcis-25103	56	24	attacks	attack	NOUN
fcis-25103	56	25	in	in	ADP
fcis-25103	56	26	federated	federated	ADJ
fcis-25103	56	27	learning	learning	NOUN
fcis-25103	56	28	,	,	PUNCT
fcis-25103	56	29	e.g.	e.g.	ADV
fcis-25103	56	30	,	,	PUNCT
fcis-25103	56	31	the	the	DET
fcis-25103	56	32	degree	degree	NOUN
fcis-25103	56	33	of	of	ADP
fcis-25103	56	34	backdoored	backdoore	VERB
fcis-25103	56	35	samples	sample	NOUN
fcis-25103	56	36	’	'	PUNCT
fcis-25103	56	37	concentration	concentration	NOUN
fcis-25103	56	38	.	.	PUNCT
fcis-25103	57	1	our	our	PRON
fcis-25103	57	2	experiment	experiment	NOUN
fcis-25103	57	3	also	also	ADV
fcis-25103	57	4	substantiates	substantiate	VERB
fcis-25103	57	5	that	that	SCONJ
fcis-25103	57	6	overfitting	overfitting	NOUN
fcis-25103	57	7	occurs	occur	VERB
fcis-25103	57	8	in	in	ADP
fcis-25103	57	9	the	the	DET
fcis-25103	57	10	process	process	NOUN
fcis-25103	57	11	of	of	ADP
fcis-25103	57	12	backdoor	backdoor	NOUN
fcis-25103	57	13	attack	attack	NOUN
fcis-25103	57	14	.	.	PUNCT
fcis-25103	58	1			PROPN
fcis-25103	58	2	we	we	PRON
fcis-25103	58	3	propose	propose	VERB
fcis-25103	58	4	cnd	cnd	PRON
fcis-25103	58	5	to	to	PART
fcis-25103	58	6	solve	solve	VERB
fcis-25103	58	7	the	the	DET
fcis-25103	58	8	long	long	ADV
fcis-25103	58	9	-	-	PUNCT
fcis-25103	58	10	standing	stand	VERB
fcis-25103	58	11	problem	problem	NOUN
fcis-25103	58	12	of	of	ADP
fcis-25103	58	13	losing	lose	VERB
fcis-25103	58	14	model	model	NOUN
fcis-25103	58	15	utility	utility	NOUN
fcis-25103	58	16	when	when	SCONJ
fcis-25103	58	17	applying	apply	VERB
fcis-25103	58	18	dp	dp	NOUN
fcis-25103	58	19	in	in	ADP
fcis-25103	58	20	federated	federated	ADJ
fcis-25103	58	21	learning	learning	NOUN
fcis-25103	58	22	.	.	PUNCT
fcis-25103	59	1	cnd	cnd	PROPN
fcis-25103	59	2	enhances	enhance	VERB
fcis-25103	59	3	the	the	DET
fcis-25103	59	4	main	main	ADJ
fcis-25103	59	5	task	task	NOUN
fcis-25103	59	6	accuracy	accuracy	NOUN
fcis-25103	59	7	to	to	ADP
fcis-25103	59	8	a	a	DET
fcis-25103	59	9	quite	quite	ADV
fcis-25103	59	10	high	high	ADJ
fcis-25103	59	11	level	level	NOUN
fcis-25103	59	12	when	when	SCONJ
fcis-25103	59	13	defending	defend	VERB
fcis-25103	59	14	against	against	ADP
fcis-25103	59	15	backdoor	backdoor	NOUN
fcis-25103	59	16	attacks	attack	NOUN
fcis-25103	59	17	.	.	PUNCT
fcis-25103	60	1	besides	besides	SCONJ
fcis-25103	60	2	,	,	PUNCT
fcis-25103	60	3	compared	compare	VERB
fcis-25103	60	4	to	to	ADP
fcis-25103	60	5	previous	previous	ADJ
fcis-25103	60	6	work	work	NOUN
fcis-25103	60	7	,	,	PUNCT
fcis-25103	60	8	our	our	PRON
fcis-25103	60	9	method	method	NOUN
fcis-25103	60	10	reduces	reduce	VERB
fcis-25103	60	11	the	the	DET
fcis-25103	60	12	success	success	NOUN
fcis-25103	60	13	rate	rate	NOUN
fcis-25103	60	14	of	of	ADP
fcis-25103	60	15	the	the	DET
fcis-25103	60	16	attack	attack	NOUN
fcis-25103	60	17	to	to	ADP
fcis-25103	60	18	a	a	DET
fcis-25103	60	19	lower	low	ADJ
fcis-25103	60	20	level	level	NOUN
fcis-25103	60	21	.	.	PUNCT
fcis-25103	61	1			PROPN
fcis-25103	61	2	we	we	PRON
fcis-25103	61	3	empirically	empirically	ADV
fcis-25103	61	4	verify	verify	VERB
fcis-25103	61	5	that	that	SCONJ
fcis-25103	61	6	cnd	cnd	PROPN
fcis-25103	61	7	also	also	ADV
fcis-25103	61	8	works	work	VERB
fcis-25103	61	9	in	in	ADP
fcis-25103	61	10	the	the	DET
fcis-25103	61	11	defense	defense	NOUN
fcis-25103	61	12	against	against	ADP
fcis-25103	61	13	privacy	privacy	NOUN
fcis-25103	61	14	threats	threat	NOUN
fcis-25103	61	15	,	,	PUNCT
fcis-25103	61	16	greatly	greatly	ADV
fcis-25103	61	17	improving	improve	VERB
fcis-25103	61	18	the	the	DET
fcis-25103	61	19	main	main	ADJ
fcis-25103	61	20	task	task	NOUN
fcis-25103	61	21	accuracy	accuracy	NOUN
fcis-25103	61	22	.	.	PUNCT
fcis-25103	62	1	moreover	moreover	ADV
fcis-25103	62	2	,	,	PUNCT
fcis-25103	62	3	our	our	PRON
fcis-25103	62	4	method	method	NOUN
fcis-25103	62	5	does	do	AUX
fcis-25103	62	6	not	not	PART
fcis-25103	62	7	introduce	introduce	VERB
fcis-25103	62	8	privacy	privacy	NOUN
fcis-25103	62	9	risk	risk	NOUN
fcis-25103	62	10	and	and	CCONJ
fcis-25103	62	11	provides	provide	VERB
fcis-25103	62	12	the	the	DET
fcis-25103	62	13	same	same	ADJ
fcis-25103	62	14	capability	capability	NOUN
fcis-25103	62	15	of	of	ADP
fcis-25103	62	16	privacy	privacy	NOUN
fcis-25103	62	17	preservation	preservation	NOUN
fcis-25103	62	18	as	as	ADP
fcis-25103	62	19	the	the	DET
fcis-25103	62	20	original	original	ADJ
fcis-25103	62	21	dp	dp	NOUN
fcis-25103	62	22	.	.	PROPN
fcis-25103	62	23	2	2	NUM
fcis-25103	62	24	.	.	X
fcis-25103	62	25	preliminary	preliminary	ADJ
fcis-25103	62	26	and	and	CCONJ
fcis-25103	62	27	threat	threat	NOUN
fcis-25103	62	28	model	model	NOUN
fcis-25103	62	29	2.1	2.1	NUM
fcis-25103	62	30	.	.	PUNCT
fcis-25103	63	1	differential	differential	PROPN
fcis-25103	63	2	privacy	privacy	PROPN
fcis-25103	63	3	differential	differential	PROPN
fcis-25103	63	4	privacy	privacy	NOUN
fcis-25103	63	5	provides	provide	VERB
fcis-25103	63	6	precise	precise	ADJ
fcis-25103	63	7	privacy	privacy	NOUN
fcis-25103	63	8	guarantee	guarantee	NOUN
fcis-25103	63	9	to	to	ADP
fcis-25103	63	10	a	a	DET
fcis-25103	63	11	dataset	dataset	NOUN
fcis-25103	63	12	by	by	ADP
fcis-25103	63	13	perturbing	perturb	VERB
fcis-25103	63	14	the	the	DET
fcis-25103	63	15	query	query	NOUN
fcis-25103	63	16	results	result	NOUN
fcis-25103	63	17	of	of	ADP
fcis-25103	63	18	it	it	PRON
fcis-25103	63	19	.	.	PUNCT
fcis-25103	64	1	after	after	ADP
fcis-25103	64	2	a	a	DET
fcis-25103	64	3	randomized	randomized	ADJ
fcis-25103	64	4	algorithm	algorithm	NOUN
fcis-25103	64	5	adding	add	VERB
fcis-25103	64	6	calibrated	calibrate	VERB
fcis-25103	64	7	noise	noise	NOUN
fcis-25103	64	8	to	to	ADP
fcis-25103	64	9	the	the	DET
fcis-25103	64	10	output	output	NOUN
fcis-25103	64	11	of	of	ADP
fcis-25103	64	12	the	the	DET
fcis-25103	64	13	dataset	dataset	NOUN
fcis-25103	64	14	,	,	PUNCT
fcis-25103	64	15	an	an	DET
fcis-25103	64	16	adversary	adversary	NOUN
fcis-25103	64	17	can	can	AUX
fcis-25103	64	18	not	not	PART
fcis-25103	64	19	distinguish	distinguish	VERB
fcis-25103	64	20	whether	whether	SCONJ
fcis-25103	64	21	a	a	DET
fcis-25103	64	22	single	single	ADJ
fcis-25103	64	23	data	data	NOUN
fcis-25103	64	24	record	record	NOUN
fcis-25103	64	25	is	be	AUX
fcis-25103	64	26	included	include	VERB
fcis-25103	64	27	in	in	ADP
fcis-25103	64	28	the	the	DET
fcis-25103	64	29	dataset	dataset	NOUN
fcis-25103	64	30	or	or	CCONJ
fcis-25103	64	31	not	not	PART
fcis-25103	64	32	.	.	PUNCT
fcis-25103	65	1	definition	definition	NOUN
fcis-25103	65	2	1	1	NUM
fcis-25103	65	3	(	(	PUNCT
fcis-25103	65	4	(	(	PUNCT
fcis-25103	65	5	ϵ,δ)-differential	ϵ,δ)-differential	PROPN
fcis-25103	65	6	privacy	privacy	NOUN
fcis-25103	66	1	[	[	X
fcis-25103	66	2	9	9	NUM
fcis-25103	66	3	]	]	PUNCT
fcis-25103	66	4	)	)	PUNCT
fcis-25103	66	5	.	.	PUNCT
fcis-25103	67	1	a	a	DET
fcis-25103	67	2	randomized	randomized	ADJ
fcis-25103	67	3	mechanism	mechanism	NOUN
fcis-25103	67	4	m	m	NOUN
fcis-25103	67	5	:	:	PUNCT
fcis-25103	67	6	d→r	d→r	NOUN
fcis-25103	67	7	provides	provide	VERB
fcis-25103	67	8	(	(	PUNCT
fcis-25103	67	9	ϵ,δ)-differential	ϵ,δ)-differential	PROPN
fcis-25103	67	10	privacy	privacy	NOUN
fcis-25103	67	11	if	if	SCONJ
fcis-25103	67	12	for	for	ADP
fcis-25103	67	13	any	any	DET
fcis-25103	67	14	two	two	NUM
fcis-25103	67	15	neighboring	neighboring	NOUN
fcis-25103	67	16	databases	database	NOUN
fcis-25103	67	17	,	,	PUNCT
fcis-25103	67	18	d1	d1	PROPN
fcis-25103	67	19	and	and	CCONJ
fcis-25103	67	20	d2	d2	PROPN
fcis-25103	67	21	,	,	PUNCT
fcis-25103	67	22	which	which	PRON
fcis-25103	67	23	differ	differ	VERB
fcis-25103	67	24	in	in	ADP
fcis-25103	67	25	only	only	ADV
fcis-25103	67	26	a	a	DET
fcis-25103	67	27	single	single	ADJ
fcis-25103	67	28	record	record	NOUN
fcis-25103	67	29	,	,	PUNCT
fcis-25103	67	30	and	and	CCONJ
fcis-25103	67	31	for	for	ADP
fcis-25103	67	32	any	any	DET
fcis-25103	67	33	subset	subset	NOUN
fcis-25103	67	34	of	of	ADP
fcis-25103	67	35	outputs	outputs	PROPN
fcis-25103	67	36	s⊆r	s⊆r	PROPN
fcis-25103	67	37	,	,	PUNCT
fcis-25103	67	38	it	it	PRON
fcis-25103	67	39	holds	hold	VERB
fcis-25103	67	40	that	that	SCONJ
fcis-25103	67	41	pr[m(d1)∈s	pr[m(d1)∈s	NOUN
fcis-25103	67	42	]	]	PUNCT
fcis-25103	67	43	≤	≤	NUM
fcis-25103	67	44	eϵ	eϵ	X
fcis-25103	67	45	pr[m(d2)∈s	pr[m(d2)∈s	X
fcis-25103	67	46	]	]	PUNCT
fcis-25103	68	1	+	+	CCONJ
fcis-25103	68	2	δ	δ	X
fcis-25103	68	3	.	.	PUNCT
fcis-25103	69	1	(	(	PUNCT
fcis-25103	69	2	1	1	X
fcis-25103	69	3	)	)	PUNCT
fcis-25103	69	4	here	here	ADV
fcis-25103	69	5	,	,	PUNCT
fcis-25103	69	6	ϵ	ϵ	X
fcis-25103	69	7	>	>	X
fcis-25103	69	8	0	0	PUNCT
fcis-25103	69	9	and	and	CCONJ
fcis-25103	69	10	δ	δ	PROPN
fcis-25103	69	11	∈	∈	PROPN
fcis-25103	70	1	[	[	X
fcis-25103	70	2	0,1	0,1	NUM
fcis-25103	70	3	]	]	PUNCT
fcis-25103	70	4	control	control	NOUN
fcis-25103	70	5	the	the	DET
fcis-25103	70	6	strength	strength	NOUN
fcis-25103	70	7	of	of	ADP
fcis-25103	70	8	the	the	DET
fcis-25103	70	9	privacy	privacy	NOUN
fcis-25103	70	10	guarantee	guarantee	NOUN
fcis-25103	70	11	.	.	PUNCT
fcis-25103	71	1	the	the	DET
fcis-25103	71	2	privacy	privacy	NOUN
fcis-25103	71	3	budget	budget	NOUN
fcis-25103	71	4	ϵ	ϵ	ADP
fcis-25103	71	5	measures	measure	VERB
fcis-25103	71	6	privacy	privacy	NOUN
fcis-25103	71	7	loss	loss	NOUN
fcis-25103	71	8	,	,	PUNCT
fcis-25103	71	9	and	and	CCONJ
fcis-25103	71	10	a	a	DET
fcis-25103	71	11	small	small	ADJ
fcis-25103	71	12	ϵ	ϵ	NOUN
fcis-25103	71	13	indicates	indicate	VERB
fcis-25103	71	14	that	that	SCONJ
fcis-25103	71	15	deleting	delete	VERB
fcis-25103	71	16	any	any	DET
fcis-25103	71	17	record	record	NOUN
fcis-25103	71	18	from	from	ADP
fcis-25103	71	19	a	a	DET
fcis-25103	71	20	dataset	dataset	NOUN
fcis-25103	71	21	does	do	AUX
fcis-25103	71	22	not	not	PART
fcis-25103	71	23	change	change	VERB
fcis-25103	71	24	the	the	DET
fcis-25103	71	25	probability	probability	NOUN
fcis-25103	71	26	that	that	SCONJ
fcis-25103	71	27	the	the	DET
fcis-25103	71	28	algorithm	algorithm	NOUN
fcis-25103	71	29	outputs	output	VERB
fcis-25103	71	30	the	the	DET
fcis-25103	71	31	same	same	ADJ
fcis-25103	71	32	result	result	NOUN
fcis-25103	71	33	significantly	significantly	ADV
fcis-25103	71	34	.	.	PUNCT
fcis-25103	72	1	the	the	DET
fcis-25103	72	2	parameter	parameter	PROPN
fcis-25103	72	3	δ	δ	PROPN
fcis-25103	72	4	is	be	AUX
fcis-25103	72	5	the	the	DET
fcis-25103	72	6	probability	probability	NOUN
fcis-25103	72	7	that	that	PRON
fcis-25103	72	8	ϵdifferential	ϵdifferential	ADJ
fcis-25103	72	9	privacy	privacy	NOUN
fcis-25103	72	10	does	do	AUX
fcis-25103	72	11	not	not	PART
fcis-25103	72	12	hold	hold	VERB
fcis-25103	72	13	,	,	PUNCT
fcis-25103	72	14	which	which	PRON
fcis-25103	72	15	is	be	AUX
fcis-25103	72	16	a	a	DET
fcis-25103	72	17	small	small	ADJ
fcis-25103	72	18	number	number	NOUN
fcis-25103	72	19	.	.	PUNCT
fcis-25103	73	1	hence	hence	ADV
fcis-25103	73	2	,	,	PUNCT
fcis-25103	73	3	a	a	PRON
fcis-25103	73	4	lower	low	ADJ
fcis-25103	73	5	(	(	PUNCT
fcis-25103	73	6	ϵ,δ	ϵ,δ	NOUN
fcis-25103	73	7	)	)	PUNCT
fcis-25103	73	8	means	mean	VERB
fcis-25103	73	9	a	a	DET
fcis-25103	73	10	stronger	strong	ADJ
fcis-25103	73	11	privacy	privacy	NOUN
fcis-25103	73	12	guarantee	guarantee	NOUN
fcis-25103	73	13	.	.	PUNCT
fcis-25103	74	1	the	the	DET
fcis-25103	74	2	randomized	randomized	ADJ
fcis-25103	74	3	mechanism	mechanism	NOUN
fcis-25103	74	4	determines	determine	VERB
fcis-25103	74	5	the	the	DET
fcis-25103	74	6	amount	amount	NOUN
fcis-25103	74	7	of	of	ADP
fcis-25103	74	8	additive	additive	ADJ
fcis-25103	74	9	noise	noise	NOUN
fcis-25103	74	10	according	accord	VERB
fcis-25103	74	11	to	to	ADP
fcis-25103	74	12	the	the	DET
fcis-25103	74	13	sensitivity	sensitivity	NOUN
fcis-25103	74	14	of	of	ADP
fcis-25103	74	15	the	the	DET
fcis-25103	74	16	query	query	NOUN
fcis-25103	74	17	function	function	NOUN
fcis-25103	74	18	.	.	PUNCT
fcis-25103	75	1	theorem	theorem	ADJ
fcis-25103	75	2	1	1	NUM
fcis-25103	75	3	(	(	PUNCT
fcis-25103	75	4	sequential	sequential	ADJ
fcis-25103	75	5	composition	composition	NOUN
fcis-25103	75	6	[	[	X
fcis-25103	75	7	16	16	NUM
fcis-25103	75	8	]	]	PUNCT
fcis-25103	75	9	)	)	PUNCT
fcis-25103	75	10	.	.	PUNCT
fcis-25103	76	1	let	let	VERB
fcis-25103	76	2	randomized	randomized	ADJ
fcis-25103	76	3	mechanism	mechanism	NOUN
fcis-25103	76	4	m1	m1	NOUN
fcis-25103	76	5	:	:	PUNCT
fcis-25103	76	6	d	d	X
fcis-25103	76	7	→	→	SYM
fcis-25103	76	8	r1	r1	PROPN
fcis-25103	76	9	provides	provide	VERB
fcis-25103	76	10	(	(	PUNCT
fcis-25103	76	11	ϵ1,δ1)differential	ϵ1,δ1)differential	PROPN
fcis-25103	76	12	privacy	privacy	NOUN
fcis-25103	76	13	,	,	PUNCT
fcis-25103	76	14	and	and	CCONJ
fcis-25103	76	15	m2	m2	PROPN
fcis-25103	76	16	:	:	PUNCT
fcis-25103	77	1	d	d	X
fcis-25103	77	2	→	→	SYM
fcis-25103	77	3	r2	r2	PROPN
fcis-25103	77	4	provides	provide	VERB
fcis-25103	77	5	(	(	PUNCT
fcis-25103	77	6	ϵ2,δ2)differential	ϵ2,δ2)differential	PROPN
fcis-25103	77	7	privacy	privacy	NOUN
fcis-25103	77	8	.	.	PUNCT
fcis-25103	78	1	then	then	ADV
fcis-25103	78	2	their	their	PRON
fcis-25103	78	3	combination	combination	NOUN
fcis-25103	78	4	,	,	PUNCT
fcis-25103	78	5	defined	define	VERB
fcis-25103	78	6	to	to	PART
fcis-25103	78	7	be	be	AUX
fcis-25103	78	8	m1,2	m1,2	ADJ
fcis-25103	78	9	=	=	SYM
fcis-25103	78	10	(	(	PUNCT
fcis-25103	78	11	m1	m1	PROPN
fcis-25103	78	12	,	,	PUNCT
fcis-25103	78	13	m2	m2	PROPN
fcis-25103	78	14	)	)	PUNCT
fcis-25103	78	15	,	,	PUNCT
fcis-25103	78	16	provides	provide	VERB
fcis-25103	78	17	(	(	PUNCT
fcis-25103	78	18	ϵ1	ϵ1	ADJ
fcis-25103	78	19	+	+	CCONJ
fcis-25103	78	20	ϵ2	ϵ2	ADJ
fcis-25103	78	21	,	,	PUNCT
fcis-25103	78	22	δ1	δ1	NOUN
fcis-25103	78	23	+	+	CCONJ
fcis-25103	78	24	δ2)-differential	δ2)-differential	ADJ
fcis-25103	78	25	privacy	privacy	NOUN
fcis-25103	78	26	.	.	PUNCT
fcis-25103	79	1	sequential	sequential	ADJ
fcis-25103	79	2	composition	composition	NOUN
fcis-25103	79	3	theorem	theorem	NOUN
fcis-25103	79	4	gives	give	VERB
fcis-25103	79	5	a	a	DET
fcis-25103	79	6	way	way	NOUN
fcis-25103	79	7	to	to	PART
fcis-25103	79	8	calculate	calculate	VERB
fcis-25103	79	9	the	the	DET
fcis-25103	79	10	privacy	privacy	NOUN
fcis-25103	79	11	budget	budget	NOUN
fcis-25103	79	12	of	of	ADP
fcis-25103	79	13	multiple	multiple	ADJ
fcis-25103	79	14	queries	query	NOUN
fcis-25103	79	15	on	on	ADP
fcis-25103	79	16	the	the	DET
fcis-25103	79	17	same	same	ADJ
fcis-25103	79	18	dataset	dataset	NOUN
fcis-25103	79	19	.	.	PUNCT
fcis-25103	80	1	however	however	ADV
fcis-25103	80	2	,	,	PUNCT
fcis-25103	80	3	the	the	DET
fcis-25103	80	4	privacy	privacy	NOUN
fcis-25103	80	5	budget	budget	NOUN
fcis-25103	80	6	calculated	calculate	VERB
fcis-25103	80	7	by	by	ADP
fcis-25103	80	8	this	this	DET
fcis-25103	80	9	theorem	theorem	NOUN
fcis-25103	80	10	can	can	AUX
fcis-25103	80	11	be	be	AUX
fcis-25103	80	12	loose	loose	ADJ
fcis-25103	80	13	.	.	PUNCT
fcis-25103	81	1	a	a	DET
fcis-25103	81	2	tighter	tight	ADJ
fcis-25103	81	3	method	method	NOUN
fcis-25103	81	4	called	call	VERB
fcis-25103	81	5	moments	moment	NOUN
fcis-25103	81	6	accountant	accountant	NOUN
fcis-25103	81	7	was	be	AUX
fcis-25103	81	8	proposed	propose	VERB
fcis-25103	81	9	by	by	ADP
fcis-25103	81	10	abadi	abadi	PROPN
fcis-25103	82	1	[	[	X
fcis-25103	82	2	10	10	NUM
fcis-25103	82	3	]	]	PUNCT
fcis-25103	82	4	,	,	PUNCT
fcis-25103	82	5	which	which	PRON
fcis-25103	82	6	defines	define	VERB
fcis-25103	82	7	privacy	privacy	NOUN
fcis-25103	82	8	loss	loss	NOUN
fcis-25103	82	9	as	as	ADP
fcis-25103	82	10	a	a	DET
fcis-25103	82	11	random	random	ADJ
fcis-25103	82	12	variable	variable	NOUN
fcis-25103	82	13	dependent	dependent	ADJ
fcis-25103	82	14	on	on	ADP
fcis-25103	82	15	the	the	DET
fcis-25103	82	16	added	add	VERB
fcis-25103	82	17	noise	noise	NOUN
fcis-25103	82	18	,	,	PUNCT
fcis-25103	82	19	then	then	ADV
fcis-25103	82	20	bounds	bound	VERB
fcis-25103	82	21	the	the	DET
fcis-25103	82	22	moments	moment	NOUN
fcis-25103	82	23	of	of	ADP
fcis-25103	82	24	the	the	DET
fcis-25103	82	25	privacy	privacy	NOUN
fcis-25103	82	26	loss	loss	NOUN
fcis-25103	82	27	at	at	ADP
fcis-25103	82	28	each	each	DET
fcis-25103	82	29	step	step	NOUN
fcis-25103	82	30	,	,	PUNCT
fcis-25103	82	31	and	and	CCONJ
fcis-25103	82	32	computes	compute	VERB
fcis-25103	82	33	the	the	DET
fcis-25103	82	34	cumulative	cumulative	ADJ
fcis-25103	82	35	privacy	privacy	NOUN
fcis-25103	82	36	budget	budget	NOUN
fcis-25103	82	37	of	of	ADP
fcis-25103	82	38	the	the	DET
fcis-25103	82	39	algorithm	algorithm	NOUN
fcis-25103	82	40	.	.	PUNCT
fcis-25103	83	1	2.2	2.2	NUM
fcis-25103	83	2	.	.	PUNCT
fcis-25103	83	3	threat	threat	NOUN
fcis-25103	83	4	model	model	NOUN
fcis-25103	83	5	in	in	ADP
fcis-25103	83	6	our	our	PRON
fcis-25103	83	7	threat	threat	NOUN
fcis-25103	83	8	model	model	NOUN
fcis-25103	83	9	,	,	PUNCT
fcis-25103	83	10	an	an	DET
fcis-25103	83	11	adversary	adversary	NOUN
fcis-25103	83	12	controls	control	VERB
fcis-25103	83	13	a	a	DET
fcis-25103	83	14	subset	subset	NOUN
fcis-25103	83	15	of	of	ADP
fcis-25103	83	16	clients	client	NOUN
fcis-25103	83	17	,	,	PUNCT
fcis-25103	83	18	called	call	VERB
fcis-25103	83	19	malicious	malicious	ADJ
fcis-25103	83	20	clients	client	NOUN
fcis-25103	83	21	.	.	PUNCT
fcis-25103	84	1	we	we	PRON
fcis-25103	84	2	assume	assume	VERB
fcis-25103	84	3	the	the	DET
fcis-25103	84	4	aggregator	aggregator	NOUN
fcis-25103	84	5	is	be	AUX
fcis-25103	84	6	honest	honest	ADJ
fcis-25103	84	7	and	and	CCONJ
fcis-25103	84	8	the	the	DET
fcis-25103	84	9	threat	threat	NOUN
fcis-25103	84	10	model	model	NOUN
fcis-25103	84	11	of	of	ADP
fcis-25103	84	12	the	the	DET
fcis-25103	84	13	adversary	adversary	NOUN
fcis-25103	84	14	is	be	AUX
fcis-25103	84	15	as	as	SCONJ
fcis-25103	84	16	follows	follow	VERB
fcis-25103	84	17	:	:	PUNCT
fcis-25103	84	18	adversary	adversary	NOUN
fcis-25103	84	19	’s	’s	PART
fcis-25103	84	20	goal	goal	NOUN
fcis-25103	84	21	.	.	PUNCT
fcis-25103	85	1	the	the	DET
fcis-25103	85	2	adversary	adversary	NOUN
fcis-25103	85	3	attempts	attempt	VERB
fcis-25103	85	4	to	to	PART
fcis-25103	85	5	corrupt	corrupt	VERB
fcis-25103	85	6	the	the	DET
fcis-25103	85	7	global	global	ADJ
fcis-25103	85	8	model	model	NOUN
fcis-25103	85	9	,	,	PUNCT
fcis-25103	85	10	making	make	VERB
fcis-25103	85	11	the	the	DET
fcis-25103	85	12	model	model	NOUN
fcis-25103	85	13	misclassify	misclassify	VERB
fcis-25103	85	14	the	the	DET
fcis-25103	85	15	samples	sample	NOUN
fcis-25103	85	16	with	with	ADP
fcis-25103	85	17	particular	particular	ADJ
fcis-25103	85	18	features	feature	NOUN
fcis-25103	85	19	(	(	PUNCT
fcis-25103	85	20	backdoor	backdoor	NOUN
fcis-25103	85	21	features	feature	NOUN
fcis-25103	85	22	)	)	PUNCT
fcis-25103	85	23	into	into	ADP
fcis-25103	85	24	a	a	DET
fcis-25103	85	25	wrong	wrong	ADJ
fcis-25103	85	26	label	label	NOUN
fcis-25103	85	27	assigned	assign	VERB
fcis-25103	85	28	by	by	ADP
fcis-25103	85	29	itself	itself	PRON
fcis-25103	85	30	.	.	PUNCT
fcis-25103	86	1	in	in	ADP
fcis-25103	86	2	addition	addition	NOUN
fcis-25103	86	3	to	to	ADP
fcis-25103	86	4	achieving	achieve	VERB
fcis-25103	86	5	the	the	DET
fcis-25103	86	6	backdoor	backdoor	NOUN
fcis-25103	86	7	task	task	NOUN
fcis-25103	86	8	as	as	ADV
fcis-25103	86	9	accurately	accurately	ADV
fcis-25103	86	10	as	as	ADP
fcis-25103	86	11	possible	possible	ADJ
fcis-25103	86	12	,	,	PUNCT
fcis-25103	86	13	the	the	DET
fcis-25103	86	14	adversary	adversary	NOUN
fcis-25103	86	15	tries	try	VERB
fcis-25103	86	16	to	to	PART
fcis-25103	86	17	maintain	maintain	VERB
fcis-25103	86	18	a	a	DET
fcis-25103	86	19	high	high	ADJ
fcis-25103	86	20	accuracy	accuracy	NOUN
fcis-25103	86	21	on	on	ADP
fcis-25103	86	22	the	the	DET
fcis-25103	86	23	main	main	ADJ
fcis-25103	86	24	task	task	NOUN
fcis-25103	86	25	as	as	ADV
fcis-25103	86	26	well	well	ADV
fcis-25103	86	27	,	,	PUNCT
fcis-25103	86	28	because	because	SCONJ
fcis-25103	86	29	a	a	DET
fcis-25103	86	30	model	model	NOUN
fcis-25103	86	31	with	with	ADP
fcis-25103	86	32	a	a	DET
fcis-25103	86	33	high	high	ADJ
fcis-25103	86	34	accuracy	accuracy	NOUN
fcis-25103	86	35	on	on	ADP
fcis-25103	86	36	both	both	DET
fcis-25103	86	37	main	main	ADJ
fcis-25103	86	38	task	task	NOUN
fcis-25103	86	39	and	and	CCONJ
fcis-25103	86	40	backdoor	backdoor	NOUN
fcis-25103	86	41	task	task	NOUN
fcis-25103	86	42	can	can	AUX
fcis-25103	86	43	hardly	hardly	ADV
fcis-25103	86	44	be	be	AUX
fcis-25103	86	45	detected	detect	VERB
fcis-25103	86	46	as	as	ADP
fcis-25103	86	47	abnormal	abnormal	ADJ
fcis-25103	86	48	.	.	PUNCT
fcis-25103	87	1	adversary	adversary	NOUN
fcis-25103	87	2	’s	’s	PART
fcis-25103	87	3	knowledge	knowledge	NOUN
fcis-25103	87	4	and	and	CCONJ
fcis-25103	87	5	capability	capability	NOUN
fcis-25103	87	6	.	.	PUNCT
fcis-25103	88	1	since	since	SCONJ
fcis-25103	88	2	the	the	DET
fcis-25103	88	3	adversary	adversary	NOUN
fcis-25103	88	4	controls	control	VERB
fcis-25103	88	5	a	a	DET
fcis-25103	88	6	subset	subset	NOUN
fcis-25103	88	7	of	of	ADP
fcis-25103	88	8	clients	client	NOUN
fcis-25103	88	9	in	in	ADP
fcis-25103	88	10	fl	fl	PROPN
fcis-25103	88	11	,	,	PUNCT
fcis-25103	88	12	it	it	PRON
fcis-25103	88	13	knows	know	VERB
fcis-25103	88	14	the	the	DET
fcis-25103	88	15	model	model	NOUN
fcis-25103	88	16	architecture	architecture	NOUN
fcis-25103	88	17	and	and	CCONJ
fcis-25103	88	18	training	training	NOUN
fcis-25103	88	19	parameters	parameter	NOUN
fcis-25103	88	20	shared	share	VERB
fcis-25103	88	21	by	by	ADP
fcis-25103	88	22	all	all	DET
fcis-25103	88	23	clients	client	NOUN
fcis-25103	88	24	,	,	PUNCT
fcis-25103	88	25	e.g.	e.g.	ADV
fcis-25103	88	26	,	,	PUNCT
fcis-25103	88	27	learning	learn	VERB
fcis-25103	88	28	rate	rate	NOUN
fcis-25103	88	29	,	,	PUNCT
fcis-25103	88	30	batch	batch	NOUN
fcis-25103	88	31	size	size	NOUN
fcis-25103	88	32	,	,	PUNCT
fcis-25103	88	33	and	and	CCONJ
fcis-25103	88	34	the	the	DET
fcis-25103	88	35	number	number	NOUN
fcis-25103	88	36	of	of	ADP
fcis-25103	88	37	local	local	ADJ
fcis-25103	88	38	epochs	epoch	NOUN
fcis-25103	88	39	.	.	PUNCT
fcis-25103	89	1	this	this	DET
fcis-25103	89	2	assumption	assumption	NOUN
fcis-25103	89	3	is	be	AUX
fcis-25103	89	4	similar	similar	ADJ
fcis-25103	89	5	to	to	ADP
fcis-25103	89	6	the	the	DET
fcis-25103	89	7	white	white	ADJ
fcis-25103	89	8	-	-	PUNCT
fcis-25103	89	9	box	box	NOUN
fcis-25103	89	10	attacks	attack	NOUN
fcis-25103	89	11	.	.	PUNCT
fcis-25103	90	1	to	to	PART
fcis-25103	90	2	study	study	VERB
fcis-25103	90	3	the	the	DET
fcis-25103	90	4	factors	factor	NOUN
fcis-25103	90	5	associated	associate	VERB
fcis-25103	90	6	with	with	ADP
fcis-25103	90	7	traditional	traditional	ADJ
fcis-25103	90	8	backdoor	backdoor	NOUN
fcis-25103	90	9	attacks	attack	NOUN
fcis-25103	90	10	,	,	PUNCT
fcis-25103	90	11	in	in	ADP
fcis-25103	90	12	section	section	NOUN
fcis-25103	90	13	3	3	NUM
fcis-25103	90	14	,	,	PUNCT
fcis-25103	90	15	we	we	PRON
fcis-25103	90	16	assume	assume	VERB
fcis-25103	90	17	the	the	DET
fcis-25103	90	18	adversary	adversary	NOUN
fcis-25103	90	19	can	can	AUX
fcis-25103	90	20	only	only	ADV
fcis-25103	90	21	modify	modify	VERB
fcis-25103	90	22	the	the	DET
fcis-25103	90	23	training	training	NOUN
fcis-25103	90	24	data	datum	NOUN
fcis-25103	90	25	of	of	ADP
fcis-25103	90	26	poisoned	poison	VERB
fcis-25103	90	27	clients	client	NOUN
fcis-25103	90	28	,	,	PUNCT
fcis-25103	90	29	and	and	CCONJ
fcis-25103	90	30	can	can	AUX
fcis-25103	90	31	not	not	PART
fcis-25103	90	32	manipulate	manipulate	VERB
fcis-25103	90	33	the	the	DET
fcis-25103	90	34	training	training	NOUN
fcis-25103	90	35	process	process	NOUN
fcis-25103	90	36	,	,	PUNCT
fcis-25103	90	37	like	like	ADP
fcis-25103	90	38	data	data	NOUN
fcis-25103	90	39	poisoning	poisoning	NOUN
fcis-25103	90	40	attack	attack	NOUN
fcis-25103	90	41	[	[	X
fcis-25103	90	42	17	17	NUM
fcis-25103	90	43	]	]	PUNCT
fcis-25103	90	44	.	.	PUNCT
fcis-25103	91	1	in	in	ADP
fcis-25103	91	2	section	section	NOUN
fcis-25103	91	3	5	5	NUM
fcis-25103	91	4	,	,	PUNCT
fcis-25103	91	5	to	to	PART
fcis-25103	91	6	verify	verify	VERB
fcis-25103	91	7	the	the	DET
fcis-25103	91	8	effectiveness	effectiveness	NOUN
fcis-25103	91	9	of	of	ADP
fcis-25103	91	10	our	our	PRON
fcis-25103	91	11	defense	defense	NOUN
fcis-25103	91	12	method	method	NOUN
fcis-25103	91	13	against	against	ADP
fcis-25103	91	14	the	the	DET
fcis-25103	91	15	most	most	ADV
fcis-25103	91	16	advanced	advanced	ADJ
fcis-25103	91	17	backdoor	backdoor	NOUN
fcis-25103	91	18	attack	attack	NOUN
fcis-25103	91	19	,	,	PUNCT
fcis-25103	91	20	we	we	PRON
fcis-25103	91	21	assume	assume	VERB
fcis-25103	91	22	the	the	DET
fcis-25103	91	23	adversary	adversary	NOUN
fcis-25103	91	24	in	in	ADP
fcis-25103	91	25	the	the	DET
fcis-25103	91	26	semantic	semantic	ADJ
fcis-25103	91	27	backdoor	backdoor	NOUN
fcis-25103	91	28	attack	attack	NOUN
fcis-25103	91	29	can	can	AUX
fcis-25103	91	30	modify	modify	VERB
fcis-25103	91	31	the	the	DET
fcis-25103	91	32	training	training	NOUN
fcis-25103	91	33	data	datum	NOUN
fcis-25103	91	34	of	of	ADP
fcis-25103	91	35	poisoned	poison	VERB
fcis-25103	91	36	clients	client	NOUN
fcis-25103	91	37	,	,	PUNCT
fcis-25103	91	38	and	and	CCONJ
fcis-25103	91	39	manipulate	manipulate	VERB
fcis-25103	91	40	the	the	DET
fcis-25103	91	41	training	training	NOUN
fcis-25103	91	42	process	process	NOUN
fcis-25103	91	43	like	like	ADP
fcis-25103	91	44	model	model	NOUN
fcis-25103	91	45	poisoning	poisoning	NOUN
fcis-25103	91	46	attack	attack	NOUN
fcis-25103	91	47	[	[	X
fcis-25103	91	48	18	18	NUM
fcis-25103	91	49	]	]	PUNCT
fcis-25103	91	50	,	,	PUNCT
fcis-25103	91	51	which	which	PRON
fcis-25103	91	52	is	be	AUX
fcis-25103	91	53	a	a	DET
fcis-25103	91	54	strong	strong	ADJ
fcis-25103	91	55	assumption	assumption	NOUN
fcis-25103	91	56	of	of	ADP
fcis-25103	91	57	the	the	DET
fcis-25103	91	58	adversary	adversary	NOUN
fcis-25103	91	59	’s	’s	PART
fcis-25103	91	60	capability	capability	NOUN
fcis-25103	91	61	.	.	PUNCT
fcis-25103	92	1	3	3	X
fcis-25103	92	2	.	.	X
fcis-25103	92	3	backdoor	backdoor	NOUN
fcis-25103	92	4	attacks	attack	NOUN
fcis-25103	92	5	in	in	ADP
fcis-25103	92	6	fl	fl	NUM
fcis-25103	92	7	3.1	3.1	NUM
fcis-25103	92	8	.	.	PUNCT
fcis-25103	93	1	experimental	experimental	ADJ
fcis-25103	93	2	setup	setup	NOUN
fcis-25103	93	3	datasets	dataset	NOUN
fcis-25103	93	4	and	and	CCONJ
fcis-25103	93	5	dnn	dnn	PROPN
fcis-25103	93	6	architectures	architecture	NOUN
fcis-25103	93	7	.	.	PUNCT
fcis-25103	94	1	we	we	PRON
fcis-25103	94	2	use	use	VERB
fcis-25103	94	3	two	two	NUM
fcis-25103	94	4	datasets	dataset	NOUN
fcis-25103	94	5	in	in	ADP
fcis-25103	94	6	our	our	PRON
fcis-25103	94	7	experiments	experiment	NOUN
fcis-25103	94	8	:	:	PUNCT
fcis-25103	94	9	cifar-10	cifar-10	NOUN
fcis-25103	94	10	[	[	X
fcis-25103	94	11	19	19	NUM
fcis-25103	94	12	]	]	PUNCT
fcis-25103	94	13	and	and	CCONJ
fcis-25103	94	14	emnist	emnist	VERB
fcis-25103	94	15	[	[	X
fcis-25103	94	16	20	20	NUM
fcis-25103	94	17	]	]	PUNCT
fcis-25103	94	18	.	.	PUNCT
fcis-25103	95	1	cifar10	cifar10	PROPN
fcis-25103	95	2	consists	consist	VERB
fcis-25103	95	3	of	of	ADP
fcis-25103	95	4	60,000	60,000	NUM
fcis-25103	95	5	color	color	NOUN
fcis-25103	95	6	images	image	NOUN
fcis-25103	95	7	in	in	ADP
fcis-25103	95	8	10	10	NUM
fcis-25103	95	9	classes	class	NOUN
fcis-25103	95	10	,	,	PUNCT
fcis-25103	95	11	e.g.	e.g.	ADV
fcis-25103	95	12	,	,	PUNCT
fcis-25103	95	13	airplane	airplane	NOUN
fcis-25103	95	14	,	,	PUNCT
fcis-25103	95	15	automobile	automobile	NOUN
fcis-25103	95	16	,	,	PUNCT
fcis-25103	95	17	and	and	CCONJ
fcis-25103	95	18	bird	bird	NOUN
fcis-25103	95	19	,	,	PUNCT
fcis-25103	95	20	with	with	ADP
fcis-25103	95	21	6,000	6,000	NUM
fcis-25103	95	22	images	image	NOUN
fcis-25103	95	23	per	per	ADP
fcis-25103	95	24	class	class	NOUN
fcis-25103	95	25	.	.	PUNCT
fcis-25103	96	1	the	the	DET
fcis-25103	96	2	dataset	dataset	NOUN
fcis-25103	96	3	is	be	AUX
fcis-25103	96	4	divided	divide	VERB
fcis-25103	96	5	into	into	ADP
fcis-25103	96	6	50,000	50,000	NUM
fcis-25103	96	7	training	training	NOUN
fcis-25103	96	8	images	image	NOUN
fcis-25103	96	9	and	and	CCONJ
fcis-25103	96	10	10,000	10,000	NUM
fcis-25103	96	11	test	test	NOUN
fcis-25103	96	12	images	image	NOUN
fcis-25103	96	13	.	.	PUNCT
fcis-25103	97	1	we	we	PRON
fcis-25103	97	2	split	split	VERB
fcis-25103	97	3	the	the	DET
fcis-25103	97	4	training	training	NOUN
fcis-25103	97	5	images	image	NOUN
fcis-25103	97	6	using	use	VERB
fcis-25103	97	7	dirichlet	dirichlet	ADJ
fcis-25103	97	8	distribution	distribution	NOUN
fcis-25103	97	9	[	[	X
fcis-25103	97	10	21	21	NUM
fcis-25103	97	11	]	]	PUNCT
fcis-25103	97	12	to	to	PART
fcis-25103	97	13	simulate	simulate	VERB
fcis-25103	97	14	non	non	ADJ
fcis-25103	97	15	-	-	ADJ
fcis-25103	97	16	iid	iid	ADJ
fcis-25103	97	17	setting	setting	NOUN
fcis-25103	97	18	,	,	PUNCT
fcis-25103	97	19	which	which	PRON
fcis-25103	97	20	is	be	AUX
fcis-25103	97	21	realistic	realistic	ADJ
fcis-25103	97	22	in	in	ADP
fcis-25103	97	23	fl	fl	PROPN
fcis-25103	97	24	.	.	PUNCT
fcis-25103	98	1	we	we	PRON
fcis-25103	98	2	use	use	VERB
fcis-25103	98	3	the	the	DET
fcis-25103	98	4	lightweight	lightweight	ADJ
fcis-25103	98	5	resnet18	resnet18	NOUN
fcis-25103	99	1	[	[	X
fcis-25103	99	2	22	22	NUM
fcis-25103	99	3	]	]	PUNCT
fcis-25103	99	4	as	as	ADP
fcis-25103	99	5	the	the	DET
fcis-25103	99	6	training	training	NOUN
fcis-25103	99	7	model	model	NOUN
fcis-25103	99	8	.	.	PUNCT
fcis-25103	100	1	emnist	emnist	PROPN
fcis-25103	100	2	is	be	AUX
fcis-25103	100	3	a	a	DET
fcis-25103	100	4	set	set	NOUN
fcis-25103	100	5	of	of	ADP
fcis-25103	100	6	handwritten	handwritten	ADJ
fcis-25103	100	7	character	character	NOUN
fcis-25103	100	8	digits	digit	NOUN
fcis-25103	100	9	derived	derive	VERB
fcis-25103	100	10	from	from	ADP
fcis-25103	100	11	the	the	DET
fcis-25103	100	12	nist	nist	NOUN
fcis-25103	100	13	special	special	ADJ
fcis-25103	100	14	database	database	NOUN
fcis-25103	100	15	19	19	NUM
fcis-25103	100	16	,	,	PUNCT
fcis-25103	100	17	with	with	ADP
fcis-25103	100	18	the	the	DET
fcis-25103	100	19	same	same	ADJ
fcis-25103	100	20	image	image	NOUN
fcis-25103	100	21	size	size	NOUN
fcis-25103	100	22	and	and	CCONJ
fcis-25103	100	23	dataset	dataset	NOUN
fcis-25103	100	24	structure	structure	NOUN
fcis-25103	100	25	as	as	ADP
fcis-25103	100	26	mnist	mnist	NOUN
fcis-25103	100	27	.	.	PUNCT
fcis-25103	101	1	when	when	SCONJ
fcis-25103	101	2	split	split	VERB
fcis-25103	101	3	by	by	ADP
fcis-25103	101	4	‘	'	PUNCT
fcis-25103	101	5	digits	digit	NOUN
fcis-25103	101	6	’	'	PUNCT
fcis-25103	101	7	,	,	PUNCT
fcis-25103	101	8	there	there	PRON
fcis-25103	101	9	are	be	VERB
fcis-25103	101	10	240,000	240,000	NUM
fcis-25103	101	11	training	training	NOUN
fcis-25103	101	12	images	image	NOUN
fcis-25103	101	13	and	and	CCONJ
fcis-25103	101	14	40,000	40,000	NUM
fcis-25103	101	15	test	test	NOUN
fcis-25103	101	16	images	image	NOUN
fcis-25103	101	17	in	in	ADP
fcis-25103	101	18	10	10	NUM
fcis-25103	101	19	classes	class	NOUN
fcis-25103	101	20	.	.	PUNCT
fcis-25103	102	1	in	in	ADP
fcis-25103	102	2	the	the	DET
fcis-25103	102	3	case	case	NOUN
fcis-25103	102	4	of	of	ADP
fcis-25103	102	5	emnist	emnist	NOUN
fcis-25103	102	6	,	,	PUNCT
fcis-25103	102	7	we	we	PRON
fcis-25103	102	8	first	first	ADV
fcis-25103	102	9	access	access	VERB
fcis-25103	102	10	the	the	DET
fcis-25103	102	11	emnist	emnist	ADJ
fcis-25103	102	12	digits	digit	NOUN
fcis-25103	102	13	split	split	VERB
fcis-25103	102	14	and	and	CCONJ
fcis-25103	102	15	then	then	ADV
fcis-25103	102	16	distribute	distribute	VERB
fcis-25103	102	17	the	the	DET
fcis-25103	102	18	training	training	NOUN
fcis-25103	102	19	dataset	dataset	NOUN
fcis-25103	102	20	randomly	randomly	ADV
fcis-25103	102	21	to	to	ADP
fcis-25103	102	22	all	all	DET
fcis-25103	102	23	clients	client	NOUN
fcis-25103	102	24	.	.	PUNCT
fcis-25103	103	1	we	we	PRON
fcis-25103	103	2	use	use	VERB
fcis-25103	103	3	a	a	DET
fcis-25103	103	4	five	five	NUM
fcis-25103	103	5	-	-	PUNCT
fcis-25103	103	6	layer	layer	NOUN
fcis-25103	103	7	cnn	cnn	NOUN
fcis-25103	103	8	with	with	ADP
fcis-25103	103	9	two	two	NUM
fcis-25103	103	10	convolution	convolution	NOUN
fcis-25103	103	11	layers	layer	NOUN
fcis-25103	103	12	,	,	PUNCT
fcis-25103	103	13	one	one	NUM
fcis-25103	103	14	max	max	NOUN
fcis-25103	103	15	-	-	PUNCT
fcis-25103	103	16	pooling	pool	VERB
fcis-25103	103	17	layer	layer	NOUN
fcis-25103	103	18	,	,	PUNCT
fcis-25103	103	19	and	and	CCONJ
fcis-25103	103	20	two	two	NUM
fcis-25103	103	21	dense	dense	ADJ
fcis-25103	103	22	layers	layer	NOUN
fcis-25103	103	23	to	to	PART
fcis-25103	103	24	train	train	VERB
fcis-25103	103	25	on	on	ADP
fcis-25103	103	26	this	this	DET
fcis-25103	103	27	dataset	dataset	NOUN
fcis-25103	103	28	.	.	PUNCT
fcis-25103	104	1	in	in	ADP
fcis-25103	104	2	both	both	DET
fcis-25103	104	3	settings	setting	NOUN
fcis-25103	104	4	,	,	PUNCT
fcis-25103	104	5	all	all	DET
fcis-25103	104	6	clients	client	NOUN
fcis-25103	104	7	are	be	AUX
fcis-25103	104	8	allocated	allocate	VERB
fcis-25103	104	9	a	a	DET
fcis-25103	104	10	subset	subset	NOUN
fcis-25103	104	11	of	of	ADP
fcis-25103	104	12	33	33	NUM
fcis-25103	104	13	the	the	DET
fcis-25103	104	14	training	training	NOUN
fcis-25103	104	15	dataset	dataset	VERB
fcis-25103	104	16	without	without	ADP
fcis-25103	104	17	overlap	overlap	NOUN
fcis-25103	104	18	,	,	PUNCT
fcis-25103	104	19	and	and	CCONJ
fcis-25103	104	20	share	share	VERB
fcis-25103	104	21	the	the	DET
fcis-25103	104	22	whole	whole	ADJ
fcis-25103	104	23	test	test	NOUN
fcis-25103	104	24	dataset	dataset	VERB
fcis-25103	104	25	as	as	ADP
fcis-25103	104	26	their	their	PRON
fcis-25103	104	27	test	test	NOUN
fcis-25103	104	28	dataset	dataset	VERB
fcis-25103	104	29	.	.	PUNCT
fcis-25103	105	1	(	(	PUNCT
fcis-25103	105	2	a	a	X
fcis-25103	105	3	)	)	PUNCT
fcis-25103	105	4	emnist	emnist	NOUN
fcis-25103	105	5	(	(	PUNCT
fcis-25103	105	6	b	b	NOUN
fcis-25103	105	7	)	)	PUNCT
fcis-25103	105	8	cifar-10	cifar-10	PROPN
fcis-25103	105	9	fig	fig	NOUN
fcis-25103	105	10	1	1	NUM
fcis-25103	105	11	.	.	PUNCT
fcis-25103	106	1	examples	example	NOUN
fcis-25103	106	2	of	of	ADP
fcis-25103	106	3	backdoored	backdoore	VERB
fcis-25103	106	4	images	image	NOUN
fcis-25103	106	5	in	in	ADP
fcis-25103	106	6	single	single	ADJ
fcis-25103	106	7	-	-	PUNCT
fcis-25103	106	8	pixel	pixel	NOUN
fcis-25103	106	9	attack	attack	NOUN
fcis-25103	106	10	(	(	PUNCT
fcis-25103	106	11	a	a	NOUN
fcis-25103	106	12	)	)	PUNCT
fcis-25103	106	13	and	and	CCONJ
fcis-25103	106	14	semantic	semantic	ADJ
fcis-25103	106	15	backdoor	backdoor	NOUN
fcis-25103	106	16	attack	attack	NOUN
fcis-25103	106	17	(	(	PUNCT
fcis-25103	106	18	b	b	NOUN
fcis-25103	106	19	)	)	PUNCT
fcis-25103	106	20	backdoor	backdoor	NOUN
fcis-25103	106	21	tasks	task	NOUN
fcis-25103	106	22	.	.	PUNCT
fcis-25103	107	1	we	we	PRON
fcis-25103	107	2	conduct	conduct	VERB
fcis-25103	107	3	a	a	DET
fcis-25103	107	4	single	single	ADJ
fcis-25103	107	5	-	-	PUNCT
fcis-25103	107	6	pixel	pixel	NOUN
fcis-25103	107	7	attack	attack	NOUN
fcis-25103	107	8	on	on	ADP
fcis-25103	107	9	emnist	emnist	NOUN
fcis-25103	107	10	and	and	CCONJ
fcis-25103	107	11	a	a	DET
fcis-25103	107	12	semantic	semantic	ADJ
fcis-25103	107	13	backdoor	backdoor	NOUN
fcis-25103	107	14	attack	attack	NOUN
fcis-25103	107	15	on	on	ADP
fcis-25103	107	16	cifar-10	cifar-10	PROPN
fcis-25103	107	17	.	.	PROPN
fcis-25103	107	18	in	in	ADP
fcis-25103	107	19	the	the	DET
fcis-25103	107	20	single	single	ADJ
fcis-25103	107	21	-	-	PUNCT
fcis-25103	107	22	pixel	pixel	NOUN
fcis-25103	107	23	attack	attack	NOUN
fcis-25103	107	24	,	,	PUNCT
fcis-25103	107	25	the	the	DET
fcis-25103	107	26	attacker	attacker	NOUN
fcis-25103	107	27	changes	change	VERB
fcis-25103	107	28	the	the	DET
fcis-25103	107	29	bottom	bottom	ADJ
fcis-25103	107	30	-	-	PUNCT
fcis-25103	107	31	right	right	NOUN
fcis-25103	107	32	pixel	pixel	NOUN
fcis-25103	107	33	of	of	ADP
fcis-25103	107	34	all	all	DET
fcis-25103	107	35	its	its	PRON
fcis-25103	107	36	training	training	NOUN
fcis-25103	107	37	images	image	NOUN
fcis-25103	107	38	from	from	ADP
fcis-25103	107	39	black	black	ADJ
fcis-25103	107	40	to	to	ADP
fcis-25103	107	41	white	white	ADJ
fcis-25103	107	42	,	,	PUNCT
fcis-25103	107	43	and	and	CCONJ
fcis-25103	107	44	modifies	modify	VERB
fcis-25103	107	45	the	the	DET
fcis-25103	107	46	labels	label	NOUN
fcis-25103	107	47	of	of	ADP
fcis-25103	107	48	them	they	PRON
fcis-25103	107	49	to	to	ADP
fcis-25103	107	50	‘	'	PUNCT
fcis-25103	107	51	0	0	NUM
fcis-25103	107	52	’	'	PUNCT
fcis-25103	107	53	.	.	PUNCT
fcis-25103	108	1	we	we	PRON
fcis-25103	108	2	modify	modify	VERB
fcis-25103	108	3	a	a	DET
fcis-25103	108	4	fraction	fraction	NOUN
fcis-25103	108	5	of	of	ADP
fcis-25103	108	6	the	the	DET
fcis-25103	108	7	test	test	NOUN
fcis-25103	108	8	images	image	NOUN
fcis-25103	108	9	in	in	ADP
fcis-25103	108	10	the	the	DET
fcis-25103	108	11	same	same	ADJ
fcis-25103	108	12	way	way	NOUN
fcis-25103	108	13	to	to	PART
fcis-25103	108	14	measure	measure	VERB
fcis-25103	108	15	the	the	DET
fcis-25103	108	16	success	success	NOUN
fcis-25103	108	17	rate	rate	NOUN
fcis-25103	108	18	of	of	ADP
fcis-25103	108	19	the	the	DET
fcis-25103	108	20	singlepixel	singlepixel	NOUN
fcis-25103	108	21	attack	attack	NOUN
fcis-25103	108	22	,	,	PUNCT
fcis-25103	108	23	i.e.	i.e.	X
fcis-25103	108	24	,	,	PUNCT
fcis-25103	108	25	the	the	DET
fcis-25103	108	26	proportion	proportion	NOUN
fcis-25103	108	27	of	of	ADP
fcis-25103	108	28	backdoored	backdoore	VERB
fcis-25103	108	29	images	image	NOUN
fcis-25103	108	30	classified	classify	VERB
fcis-25103	108	31	as	as	ADP
fcis-25103	108	32	‘	'	PUNCT
fcis-25103	108	33	0	0	NUM
fcis-25103	108	34	’	'	PUNCT
fcis-25103	108	35	to	to	PART
fcis-25103	108	36	all	all	DET
fcis-25103	108	37	backdoored	backdoore	VERB
fcis-25103	108	38	images	image	NOUN
fcis-25103	108	39	whose	whose	DET
fcis-25103	108	40	true	true	ADJ
fcis-25103	108	41	labels	label	NOUN
fcis-25103	108	42	are	be	AUX
fcis-25103	108	43	not	not	PART
fcis-25103	108	44	‘	'	PUNCT
fcis-25103	108	45	0	0	NUM
fcis-25103	108	46	’	'	PUNCT
fcis-25103	108	47	,	,	PUNCT
fcis-25103	108	48	and	and	CCONJ
fcis-25103	108	49	use	use	VERB
fcis-25103	108	50	the	the	DET
fcis-25103	108	51	rest	rest	NOUN
fcis-25103	108	52	of	of	ADP
fcis-25103	108	53	the	the	DET
fcis-25103	108	54	test	test	NOUN
fcis-25103	108	55	data	datum	NOUN
fcis-25103	108	56	to	to	PART
fcis-25103	108	57	observe	observe	VERB
fcis-25103	108	58	the	the	DET
fcis-25103	108	59	main	main	ADJ
fcis-25103	108	60	task	task	NOUN
fcis-25103	108	61	accuracy	accuracy	NOUN
fcis-25103	108	62	.	.	PUNCT
fcis-25103	109	1	in	in	ADP
fcis-25103	109	2	the	the	DET
fcis-25103	109	3	semantic	semantic	ADJ
fcis-25103	109	4	backdoor	backdoor	NOUN
fcis-25103	109	5	attack	attack	NOUN
fcis-25103	109	6	,	,	PUNCT
fcis-25103	109	7	the	the	DET
fcis-25103	109	8	backdoor	backdoor	NOUN
fcis-25103	109	9	feature	feature	NOUN
fcis-25103	109	10	is	be	AUX
fcis-25103	109	11	cars	car	NOUN
fcis-25103	109	12	painted	paint	VERB
fcis-25103	109	13	in	in	ADP
fcis-25103	109	14	red	red	PROPN
fcis-25103	109	15	.	.	PUNCT
fcis-25103	110	1	this	this	DET
fcis-25103	110	2	kind	kind	NOUN
fcis-25103	110	3	of	of	ADP
fcis-25103	110	4	attack	attack	NOUN
fcis-25103	110	5	does	do	AUX
fcis-25103	110	6	not	not	PART
fcis-25103	110	7	need	need	VERB
fcis-25103	110	8	to	to	PART
fcis-25103	110	9	modify	modify	VERB
fcis-25103	110	10	images	image	NOUN
fcis-25103	110	11	.	.	PUNCT
fcis-25103	111	1	we	we	PRON
fcis-25103	111	2	first	first	ADV
fcis-25103	111	3	distribute	distribute	VERB
fcis-25103	111	4	images	image	NOUN
fcis-25103	111	5	without	without	ADP
fcis-25103	111	6	backdoor	backdoor	NOUN
fcis-25103	111	7	feature	feature	NOUN
fcis-25103	111	8	to	to	ADP
fcis-25103	111	9	all	all	DET
fcis-25103	111	10	clients	client	NOUN
fcis-25103	111	11	by	by	ADP
fcis-25103	111	12	dirichlet	dirichlet	ADJ
fcis-25103	111	13	distribution	distribution	NOUN
fcis-25103	111	14	.	.	PUNCT
fcis-25103	112	1	then	then	ADV
fcis-25103	112	2	we	we	PRON
fcis-25103	112	3	distribute	distribute	VERB
fcis-25103	112	4	images	image	NOUN
fcis-25103	112	5	with	with	ADP
fcis-25103	112	6	backdoor	backdoor	NOUN
fcis-25103	112	7	feature	feature	NOUN
fcis-25103	112	8	randomly	randomly	ADV
fcis-25103	112	9	to	to	ADP
fcis-25103	112	10	malicious	malicious	ADJ
fcis-25103	112	11	clients	client	NOUN
fcis-25103	112	12	and	and	CCONJ
fcis-25103	112	13	they	they	PRON
fcis-25103	112	14	will	will	AUX
fcis-25103	112	15	classify	classify	VERB
fcis-25103	112	16	these	these	DET
fcis-25103	112	17	images	image	NOUN
fcis-25103	112	18	as	as	ADP
fcis-25103	112	19	birds	bird	NOUN
fcis-25103	112	20	.	.	PUNCT
fcis-25103	113	1	in	in	ADP
fcis-25103	113	2	the	the	DET
fcis-25103	113	3	testing	testing	NOUN
fcis-25103	113	4	phase	phase	NOUN
fcis-25103	113	5	,	,	PUNCT
fcis-25103	113	6	we	we	PRON
fcis-25103	113	7	measure	measure	VERB
fcis-25103	113	8	the	the	DET
fcis-25103	113	9	success	success	NOUN
fcis-25103	113	10	rate	rate	NOUN
fcis-25103	113	11	of	of	ADP
fcis-25103	113	12	the	the	DET
fcis-25103	113	13	attack	attack	NOUN
fcis-25103	113	14	with	with	ADP
fcis-25103	113	15	backdoored	backdoore	VERB
fcis-25103	113	16	images	image	NOUN
fcis-25103	113	17	and	and	CCONJ
fcis-25103	113	18	record	record	VERB
fcis-25103	113	19	the	the	DET
fcis-25103	113	20	main	main	ADJ
fcis-25103	113	21	task	task	NOUN
fcis-25103	113	22	accuracy	accuracy	NOUN
fcis-25103	113	23	with	with	ADP
fcis-25103	113	24	the	the	DET
fcis-25103	113	25	other	other	ADJ
fcis-25103	113	26	images	image	NOUN
fcis-25103	113	27	.	.	PUNCT
fcis-25103	114	1	examples	example	NOUN
fcis-25103	114	2	of	of	ADP
fcis-25103	114	3	backdoored	backdoore	VERB
fcis-25103	114	4	images	image	NOUN
fcis-25103	114	5	are	be	AUX
fcis-25103	114	6	depicted	depict	VERB
fcis-25103	114	7	in	in	ADP
fcis-25103	114	8	fig	fig	NOUN
fcis-25103	114	9	.	.	PUNCT
fcis-25103	115	1	1	1	X
fcis-25103	115	2	.	.	X
fcis-25103	115	3	for	for	ADP
fcis-25103	115	4	emnist	emnist	NOUN
fcis-25103	115	5	,	,	PUNCT
fcis-25103	115	6	the	the	DET
fcis-25103	115	7	number	number	NOUN
fcis-25103	115	8	of	of	ADP
fcis-25103	115	9	test	test	NOUN
fcis-25103	115	10	samples	sample	NOUN
fcis-25103	115	11	used	use	VERB
fcis-25103	115	12	for	for	ADP
fcis-25103	115	13	success	success	NOUN
fcis-25103	115	14	rate	rate	NOUN
fcis-25103	115	15	measurement	measurement	NOUN
fcis-25103	115	16	is	be	AUX
fcis-25103	115	17	2000	2000	NUM
fcis-25103	115	18	,	,	PUNCT
fcis-25103	115	19	and	and	CCONJ
fcis-25103	115	20	for	for	ADP
fcis-25103	115	21	cifar10	cifar10	NOUN
fcis-25103	115	22	,	,	PUNCT
fcis-25103	115	23	it	it	PRON
fcis-25103	115	24	is	be	AUX
fcis-25103	115	25	132	132	NUM
fcis-25103	115	26	.	.	PUNCT
fcis-25103	116	1	federated	federated	ADJ
fcis-25103	116	2	learning	learning	NOUN
fcis-25103	116	3	setting	setting	NOUN
fcis-25103	116	4	.	.	PUNCT
fcis-25103	117	1	by	by	ADP
fcis-25103	117	2	default	default	NOUN
fcis-25103	117	3	,	,	PUNCT
fcis-25103	117	4	we	we	PRON
fcis-25103	117	5	have	have	VERB
fcis-25103	117	6	n	n	NOUN
fcis-25103	117	7	=	=	SYM
fcis-25103	117	8	100	100	NUM
fcis-25103	117	9	clients	client	NOUN
fcis-25103	117	10	,	,	PUNCT
fcis-25103	117	11	with	with	ADP
fcis-25103	117	12	p	p	NOUN
fcis-25103	117	13	=	=	SYM
fcis-25103	117	14	20	20	NUM
fcis-25103	117	15	malicious	malicious	ADJ
fcis-25103	117	16	clients	client	NOUN
fcis-25103	117	17	,	,	PUNCT
fcis-25103	117	18	or	or	CCONJ
fcis-25103	117	19	poisoned	poison	VERB
fcis-25103	117	20	clients	client	NOUN
fcis-25103	117	21	.	.	PUNCT
fcis-25103	118	1	in	in	ADP
fcis-25103	118	2	each	each	DET
fcis-25103	118	3	round	round	NOUN
fcis-25103	118	4	,	,	PUNCT
fcis-25103	118	5	we	we	PRON
fcis-25103	118	6	select	select	VERB
fcis-25103	118	7	m	m	VERB
fcis-25103	118	8	=	=	SYM
fcis-25103	118	9	20	20	NUM
fcis-25103	118	10	clients	client	NOUN
fcis-25103	118	11	,	,	PUNCT
fcis-25103	118	12	among	among	ADP
fcis-25103	118	13	which	which	PRON
fcis-25103	118	14	pm	pm	NOUN
fcis-25103	118	15	clients	client	NOUN
fcis-25103	118	16	are	be	AUX
fcis-25103	118	17	selected	select	VERB
fcis-25103	118	18	from	from	ADP
fcis-25103	118	19	poisoned	poison	VERB
fcis-25103	118	20	clients	client	NOUN
fcis-25103	118	21	,	,	PUNCT
fcis-25103	118	22	which	which	PRON
fcis-25103	118	23	is	be	AUX
fcis-25103	118	24	a	a	DET
fcis-25103	118	25	constant	constant	ADJ
fcis-25103	118	26	in	in	ADP
fcis-25103	118	27	a	a	DET
fcis-25103	118	28	single	single	ADJ
fcis-25103	118	29	experiment	experiment	NOUN
fcis-25103	118	30	,	,	PUNCT
fcis-25103	118	31	and	and	CCONJ
fcis-25103	118	32	the	the	DET
fcis-25103	118	33	rest	rest	NOUN
fcis-25103	118	34	are	be	AUX
fcis-25103	118	35	selected	select	VERB
fcis-25103	118	36	from	from	ADP
fcis-25103	118	37	honest	honest	ADJ
fcis-25103	118	38	clients	client	NOUN
fcis-25103	118	39	.	.	PUNCT
fcis-25103	119	1	both	both	DET
fcis-25103	119	2	poisoned	poison	VERB
fcis-25103	119	3	and	and	CCONJ
fcis-25103	119	4	honest	honest	ADJ
fcis-25103	119	5	clients	client	NOUN
fcis-25103	119	6	are	be	AUX
fcis-25103	119	7	selected	select	VERB
fcis-25103	119	8	randomly	randomly	ADV
fcis-25103	119	9	from	from	ADP
fcis-25103	119	10	two	two	NUM
fcis-25103	119	11	nonoverlapping	nonoverlapping	ADJ
fcis-25103	119	12	client	client	NOUN
fcis-25103	119	13	sets	set	NOUN
fcis-25103	119	14	.	.	PUNCT
fcis-25103	120	1	the	the	DET
fcis-25103	120	2	number	number	NOUN
fcis-25103	120	3	of	of	ADP
fcis-25103	120	4	local	local	ADJ
fcis-25103	120	5	epoch	epoch	NOUN
fcis-25103	120	6	(	(	PUNCT
fcis-25103	120	7	e	e	NOUN
fcis-25103	120	8	)	)	PUNCT
fcis-25103	120	9	is	be	AUX
fcis-25103	120	10	set	set	VERB
fcis-25103	120	11	to	to	ADP
fcis-25103	120	12	5	5	NUM
fcis-25103	120	13	for	for	ADP
fcis-25103	120	14	emnist	emnist	NOUN
fcis-25103	120	15	,	,	PUNCT
fcis-25103	120	16	while	while	SCONJ
fcis-25103	120	17	e	e	NOUN
fcis-25103	120	18	=	=	SYM
fcis-25103	120	19	2	2	NUM
fcis-25103	120	20	for	for	ADP
fcis-25103	120	21	cifar-10	cifar-10	PROPN
fcis-25103	120	22	.	.	PROPN
fcis-25103	120	23	for	for	ADP
fcis-25103	120	24	both	both	DET
fcis-25103	120	25	tasks	task	NOUN
fcis-25103	120	26	,	,	PUNCT
fcis-25103	120	27	the	the	DET
fcis-25103	120	28	batch	batch	NOUN
fcis-25103	120	29	size	size	NOUN
fcis-25103	120	30	is	be	AUX
fcis-25103	120	31	20	20	NUM
fcis-25103	120	32	,	,	PUNCT
fcis-25103	120	33	and	and	CCONJ
fcis-25103	120	34	the	the	DET
fcis-25103	120	35	learning	learning	NOUN
fcis-25103	120	36	rate	rate	NOUN
fcis-25103	120	37	is	be	AUX
fcis-25103	120	38	0.04	0.04	NUM
fcis-25103	120	39	.	.	PUNCT
fcis-25103	121	1	fl	fl	NOUN
fcis-25103	121	2	runs	run	VERB
fcis-25103	121	3	for	for	ADP
fcis-25103	121	4	300	300	NUM
fcis-25103	121	5	rounds	round	NOUN
fcis-25103	121	6	.	.	PUNCT
fcis-25103	122	1	all	all	DET
fcis-25103	122	2	results	result	NOUN
fcis-25103	122	3	are	be	AUX
fcis-25103	122	4	averaged	average	VERB
fcis-25103	122	5	over	over	ADP
fcis-25103	122	6	5	5	NUM
fcis-25103	122	7	runs	run	NOUN
fcis-25103	122	8	.	.	PUNCT
fcis-25103	123	1	3.2	3.2	NUM
fcis-25103	123	2	.	.	PUNCT
fcis-25103	124	1	analysis	analysis	NOUN
fcis-25103	124	2	of	of	ADP
fcis-25103	124	3	attack	attack	NOUN
fcis-25103	124	4	results	result	NOUN
fcis-25103	124	5	we	we	PRON
fcis-25103	124	6	first	first	ADV
fcis-25103	124	7	study	study	VERB
fcis-25103	124	8	the	the	DET
fcis-25103	124	9	variation	variation	NOUN
fcis-25103	124	10	trend	trend	NOUN
fcis-25103	124	11	of	of	ADP
fcis-25103	124	12	model	model	NOUN
fcis-25103	124	13	accuracy	accuracy	NOUN
fcis-25103	124	14	and	and	CCONJ
fcis-25103	124	15	backdoor	backdoor	NOUN
fcis-25103	124	16	success	success	NOUN
fcis-25103	124	17	rate	rate	NOUN
fcis-25103	124	18	with	with	ADP
fcis-25103	124	19	the	the	DET
fcis-25103	124	20	number	number	NOUN
fcis-25103	124	21	of	of	ADP
fcis-25103	124	22	poisoned	poison	VERB
fcis-25103	124	23	clients	client	NOUN
fcis-25103	124	24	.	.	PUNCT
fcis-25103	125	1	intuitively	intuitively	ADV
fcis-25103	125	2	,	,	PUNCT
fcis-25103	125	3	as	as	SCONJ
fcis-25103	125	4	the	the	DET
fcis-25103	125	5	number	number	NOUN
fcis-25103	125	6	of	of	ADP
fcis-25103	125	7	attackers	attacker	NOUN
fcis-25103	125	8	increases	increase	VERB
fcis-25103	125	9	,	,	PUNCT
fcis-25103	125	10	the	the	DET
fcis-25103	125	11	success	success	NOUN
fcis-25103	125	12	rate	rate	NOUN
fcis-25103	125	13	of	of	ADP
fcis-25103	125	14	the	the	DET
fcis-25103	125	15	backdoor	backdoor	NOUN
fcis-25103	125	16	attack	attack	NOUN
fcis-25103	125	17	will	will	AUX
fcis-25103	125	18	rise	rise	VERB
fcis-25103	125	19	dramatically	dramatically	ADV
fcis-25103	125	20	.	.	PUNCT
fcis-25103	126	1	the	the	DET
fcis-25103	126	2	experimental	experimental	ADJ
fcis-25103	126	3	results	result	NOUN
fcis-25103	126	4	on	on	ADP
fcis-25103	126	5	both	both	DET
fcis-25103	126	6	datasets	dataset	NOUN
fcis-25103	126	7	confirmed	confirm	VERB
fcis-25103	126	8	this	this	DET
fcis-25103	126	9	conjecture	conjecture	NOUN
fcis-25103	126	10	,	,	PUNCT
fcis-25103	126	11	as	as	ADP
fcis-25103	126	12	fig	fig	NOUN
fcis-25103	126	13	.	.	PUNCT
fcis-25103	127	1	2	2	NUM
fcis-25103	127	2	shows	show	NOUN
fcis-25103	127	3	.	.	PUNCT
fcis-25103	128	1	the	the	DET
fcis-25103	128	2	increasing	increase	VERB
fcis-25103	128	3	poisoned	poison	VERB
fcis-25103	128	4	samples	sample	NOUN
fcis-25103	128	5	facilitate	facilitate	VERB
fcis-25103	128	6	the	the	DET
fcis-25103	128	7	learning	learning	NOUN
fcis-25103	128	8	of	of	ADP
fcis-25103	128	9	backdoor	backdoor	NOUN
fcis-25103	128	10	tasks	task	NOUN
fcis-25103	128	11	,	,	PUNCT
fcis-25103	128	12	and	and	CCONJ
fcis-25103	128	13	the	the	DET
fcis-25103	128	14	success	success	NOUN
fcis-25103	128	15	rate	rate	NOUN
fcis-25103	128	16	exceeds	exceed	VERB
fcis-25103	128	17	80	80	NUM
fcis-25103	128	18	%	%	NOUN
fcis-25103	128	19	with	with	ADP
fcis-25103	128	20	less	less	ADJ
fcis-25103	128	21	than	than	ADP
fcis-25103	128	22	half	half	NOUN
fcis-25103	128	23	of	of	ADP
fcis-25103	128	24	the	the	DET
fcis-25103	128	25	poisoned	poison	VERB
fcis-25103	128	26	clients	client	NOUN
fcis-25103	128	27	.	.	PUNCT
fcis-25103	129	1	the	the	DET
fcis-25103	129	2	backdoor	backdoor	NOUN
fcis-25103	129	3	task	task	NOUN
fcis-25103	129	4	on	on	ADP
fcis-25103	129	5	emnist	emnist	NOUN
fcis-25103	129	6	needs	need	VERB
fcis-25103	129	7	fewer	few	ADJ
fcis-25103	129	8	poisoned	poison	VERB
fcis-25103	129	9	clients	client	NOUN
fcis-25103	129	10	to	to	PART
fcis-25103	129	11	achieve	achieve	VERB
fcis-25103	129	12	a	a	DET
fcis-25103	129	13	high	high	ADJ
fcis-25103	129	14	accuracy	accuracy	NOUN
fcis-25103	129	15	than	than	ADP
fcis-25103	129	16	that	that	PRON
fcis-25103	129	17	on	on	ADP
fcis-25103	129	18	cifar-10	cifar-10	PROPN
fcis-25103	129	19	,	,	PUNCT
fcis-25103	129	20	and	and	CCONJ
fcis-25103	129	21	part	part	NOUN
fcis-25103	129	22	of	of	ADP
fcis-25103	129	23	the	the	DET
fcis-25103	129	24	reason	reason	NOUN
fcis-25103	129	25	is	be	AUX
fcis-25103	129	26	that	that	SCONJ
fcis-25103	129	27	the	the	DET
fcis-25103	129	28	poisoned	poison	VERB
fcis-25103	129	29	clients	client	NOUN
fcis-25103	129	30	backdoor	backdoor	VERB
fcis-25103	129	31	all	all	DET
fcis-25103	129	32	their	their	PRON
fcis-25103	129	33	training	training	NOUN
fcis-25103	129	34	samples	sample	NOUN
fcis-25103	129	35	in	in	ADP
fcis-25103	129	36	the	the	DET
fcis-25103	129	37	single	single	ADJ
fcis-25103	129	38	-	-	PUNCT
fcis-25103	129	39	pixel	pixel	NOUN
fcis-25103	129	40	attack	attack	NOUN
fcis-25103	129	41	,	,	PUNCT
fcis-25103	129	42	while	while	SCONJ
fcis-25103	129	43	in	in	ADP
fcis-25103	129	44	the	the	DET
fcis-25103	129	45	semantic	semantic	ADJ
fcis-25103	129	46	backdoor	backdoor	NOUN
fcis-25103	129	47	attack	attack	NOUN
fcis-25103	129	48	,	,	PUNCT
fcis-25103	129	49	the	the	DET
fcis-25103	129	50	backdoored	backdoore	VERB
fcis-25103	129	51	samples	sample	NOUN
fcis-25103	129	52	only	only	ADV
fcis-25103	129	53	make	make	VERB
fcis-25103	129	54	up	up	ADP
fcis-25103	129	55	a	a	DET
fcis-25103	129	56	small	small	ADJ
fcis-25103	129	57	proportion	proportion	NOUN
fcis-25103	129	58	in	in	ADP
fcis-25103	129	59	their	their	PRON
fcis-25103	129	60	datasets	dataset	NOUN
fcis-25103	129	61	.	.	PUNCT
fcis-25103	130	1	besides	besides	SCONJ
fcis-25103	130	2	,	,	PUNCT
fcis-25103	130	3	the	the	DET
fcis-25103	130	4	accuracy	accuracy	NOUN
fcis-25103	130	5	of	of	ADP
fcis-25103	130	6	the	the	DET
fcis-25103	130	7	model	model	NOUN
fcis-25103	130	8	almost	almost	ADV
fcis-25103	130	9	does	do	AUX
fcis-25103	130	10	not	not	PART
fcis-25103	130	11	decline	decline	VERB
fcis-25103	130	12	as	as	ADP
fcis-25103	130	13	the	the	DET
fcis-25103	130	14	success	success	NOUN
fcis-25103	130	15	rate	rate	NOUN
fcis-25103	130	16	rises	rise	NOUN
fcis-25103	130	17	,	,	PUNCT
fcis-25103	130	18	which	which	PRON
fcis-25103	130	19	implies	imply	VERB
fcis-25103	130	20	that	that	SCONJ
fcis-25103	130	21	the	the	DET
fcis-25103	130	22	redundancy	redundancy	NOUN
fcis-25103	130	23	of	of	ADP
fcis-25103	130	24	model	model	NOUN
fcis-25103	130	25	feature	feature	NOUN
fcis-25103	130	26	space	space	NOUN
fcis-25103	130	27	allows	allow	VERB
fcis-25103	130	28	the	the	DET
fcis-25103	130	29	model	model	NOUN
fcis-25103	130	30	to	to	PART
fcis-25103	130	31	learn	learn	VERB
fcis-25103	130	32	backdoor	backdoor	NOUN
fcis-25103	130	33	features	feature	NOUN
fcis-25103	130	34	while	while	SCONJ
fcis-25103	130	35	maintaining	maintain	VERB
fcis-25103	130	36	the	the	DET
fcis-25103	130	37	knowledge	knowledge	NOUN
fcis-25103	130	38	about	about	ADP
fcis-25103	130	39	the	the	DET
fcis-25103	130	40	main	main	ADJ
fcis-25103	130	41	task	task	NOUN
fcis-25103	130	42	.	.	PUNCT
fcis-25103	131	1	(	(	PUNCT
fcis-25103	131	2	a)cifar-10	a)cifar-10	ADV
fcis-25103	131	3	(	(	PUNCT
fcis-25103	131	4	b	b	NOUN
fcis-25103	131	5	)	)	PUNCT
fcis-25103	131	6	emnist	emnist	NOUN
fcis-25103	131	7	fig	fig	NOUN
fcis-25103	131	8	2	2	NUM
fcis-25103	131	9	.	.	PUNCT
fcis-25103	131	10	model	model	NOUN
fcis-25103	131	11	accuracy	accuracy	NOUN
fcis-25103	131	12	and	and	CCONJ
fcis-25103	131	13	attack	attack	NOUN
fcis-25103	131	14	success	success	NOUN
fcis-25103	131	15	rate	rate	NOUN
fcis-25103	131	16	with	with	ADP
fcis-25103	131	17	the	the	DET
fcis-25103	131	18	number	number	NOUN
fcis-25103	131	19	of	of	ADP
fcis-25103	131	20	poisoned	poison	VERB
fcis-25103	131	21	clients	client	NOUN
fcis-25103	131	22	per	per	ADP
fcis-25103	131	23	round	round	NOUN
fcis-25103	131	24	(	(	PUNCT
fcis-25103	131	25	the	the	DET
fcis-25103	131	26	number	number	NOUN
fcis-25103	131	27	of	of	ADP
fcis-25103	131	28	selected	select	VERB
fcis-25103	131	29	clients	client	NOUN
fcis-25103	131	30	per	per	ADP
fcis-25103	131	31	round	round	NOUN
fcis-25103	131	32	is	be	AUX
fcis-25103	131	33	20	20	NUM
fcis-25103	131	34	for	for	ADP
fcis-25103	131	35	both	both	DET
fcis-25103	131	36	tasks	task	NOUN
fcis-25103	131	37	)	)	PUNCT
fcis-25103	131	38	table	table	NOUN
fcis-25103	132	1	1	1	NUM
fcis-25103	132	2	.	.	PUNCT
fcis-25103	132	3	model	model	NOUN
fcis-25103	132	4	accuracy	accuracy	NOUN
fcis-25103	132	5	and	and	CCONJ
fcis-25103	132	6	backdoor	backdoor	NOUN
fcis-25103	132	7	success	success	NOUN
fcis-25103	132	8	rate	rate	NOUN
fcis-25103	132	9	of	of	ADP
fcis-25103	132	10	two	two	NUM
fcis-25103	132	11	experiment	experiment	NOUN
fcis-25103	132	12	settings	setting	NOUN
fcis-25103	132	13	on	on	ADP
fcis-25103	132	14	cifar-10	cifar-10	PROPN
fcis-25103	132	15	setting	set	VERB
fcis-25103	132	16	pm	pm	NOUN
fcis-25103	132	17	poisoning	poisoning	NOUN
fcis-25103	132	18	rate	rate	NOUN
fcis-25103	132	19	acc	acc	PROPN
fcis-25103	132	20	.	.	PUNCT
fcis-25103	133	1	(	(	PUNCT
fcis-25103	133	2	%	%	INTJ
fcis-25103	133	3	)	)	PUNCT
fcis-25103	133	4	succ	succ	PROPN
fcis-25103	133	5	.	.	PUNCT
fcis-25103	134	1	(	(	PUNCT
fcis-25103	134	2	%	%	INTJ
fcis-25103	134	3	)	)	PUNCT
fcis-25103	134	4	1	1	NUM
fcis-25103	134	5	8	8	NUM
fcis-25103	134	6	0.5	0.5	NUM
fcis-25103	134	7	88.50	88.50	NUM
fcis-25103	134	8	54.24	54.24	NUM
fcis-25103	134	9	2	2	NUM
fcis-25103	134	10	4	4	NUM
fcis-25103	134	11	1.0	1.0	NUM
fcis-25103	134	12	88.13	88.13	NUM
fcis-25103	134	13	66.67	66.67	NUM
fcis-25103	134	14	next	next	ADV
fcis-25103	134	15	,	,	PUNCT
fcis-25103	134	16	we	we	PRON
fcis-25103	134	17	attempt	attempt	VERB
fcis-25103	134	18	to	to	PART
fcis-25103	134	19	figure	figure	VERB
fcis-25103	134	20	out	out	ADP
fcis-25103	134	21	under	under	ADP
fcis-25103	134	22	what	what	PRON
fcis-25103	134	23	setting	set	VERB
fcis-25103	134	24	the	the	DET
fcis-25103	134	25	success	success	NOUN
fcis-25103	134	26	rate	rate	NOUN
fcis-25103	134	27	is	be	AUX
fcis-25103	134	28	higher	high	ADJ
fcis-25103	134	29	when	when	SCONJ
fcis-25103	134	30	the	the	DET
fcis-25103	134	31	number	number	NOUN
fcis-25103	134	32	of	of	ADP
fcis-25103	134	33	poisoned	poison	VERB
fcis-25103	134	34	samples	sample	NOUN
fcis-25103	134	35	is	be	AUX
fcis-25103	134	36	fixed	fix	VERB
fcis-25103	134	37	.	.	PUNCT
fcis-25103	135	1	we	we	PRON
fcis-25103	135	2	define	define	VERB
fcis-25103	135	3	the	the	DET
fcis-25103	135	4	poisoning	poisoning	NOUN
fcis-25103	135	5	rate	rate	NOUN
fcis-25103	135	6	as	as	ADP
fcis-25103	135	7	the	the	DET
fcis-25103	135	8	proportion	proportion	NOUN
fcis-25103	135	9	of	of	ADP
fcis-25103	135	10	backdoor	backdoor	NOUN
fcis-25103	135	11	samples	sample	NOUN
fcis-25103	135	12	that	that	PRON
fcis-25103	135	13	participate	participate	VERB
fcis-25103	135	14	in	in	ADP
fcis-25103	135	15	the	the	DET
fcis-25103	135	16	training	training	NOUN
fcis-25103	135	17	.	.	PUNCT
fcis-25103	136	1	then	then	ADV
fcis-25103	136	2	,	,	PUNCT
fcis-25103	136	3	we	we	PRON
fcis-25103	136	4	design	design	VERB
fcis-25103	136	5	two	two	NUM
fcis-25103	136	6	settings	setting	NOUN
fcis-25103	136	7	:	:	PUNCT
fcis-25103	136	8	in	in	ADP
fcis-25103	136	9	setting-1	setting-1	NUM
fcis-25103	136	10	,	,	PUNCT
fcis-25103	136	11	pm	pm	NOUN
fcis-25103	136	12	is	be	AUX
fcis-25103	136	13	8	8	NUM
fcis-25103	136	14	and	and	CCONJ
fcis-25103	136	15	the	the	DET
fcis-25103	136	16	poisoning	poisoning	NOUN
fcis-25103	136	17	rate	rate	NOUN
fcis-25103	136	18	is	be	AUX
fcis-25103	136	19	0.5	0.5	NUM
fcis-25103	136	20	;	;	PUNCT
fcis-25103	136	21	in	in	ADP
fcis-25103	136	22	setting-2	setting-2	NUM
fcis-25103	136	23	,	,	PUNCT
fcis-25103	136	24	they	they	PRON
fcis-25103	136	25	are	be	AUX
fcis-25103	136	26	4	4	NUM
fcis-25103	136	27	and	and	CCONJ
fcis-25103	136	28	1.0	1.0	NUM
fcis-25103	136	29	,	,	PUNCT
fcis-25103	136	30	respectively	respectively	ADV
fcis-25103	136	31	.	.	PUNCT
fcis-25103	137	1	that	that	PRON
fcis-25103	137	2	is	be	AUX
fcis-25103	137	3	,	,	PUNCT
fcis-25103	137	4	the	the	DET
fcis-25103	137	5	density	density	NOUN
fcis-25103	137	6	of	of	ADP
fcis-25103	137	7	the	the	DET
fcis-25103	137	8	poisoned	poison	VERB
fcis-25103	137	9	samples	sample	NOUN
fcis-25103	137	10	in	in	ADP
fcis-25103	137	11	setting-2	setting-2	NUM
fcis-25103	137	12	is	be	AUX
fcis-25103	137	13	twice	twice	ADV
fcis-25103	137	14	as	as	ADV
fcis-25103	137	15	large	large	ADJ
fcis-25103	137	16	as	as	ADP
fcis-25103	137	17	setting-1	setting-1	NUM
fcis-25103	137	18	.	.	PUNCT
fcis-25103	137	19	results	result	NOUN
fcis-25103	137	20	in	in	ADP
fcis-25103	137	21	table	table	NOUN
fcis-25103	137	22	1	1	NUM
fcis-25103	137	23	show	show	VERB
fcis-25103	137	24	that	that	SCONJ
fcis-25103	137	25	,	,	PUNCT
fcis-25103	137	26	when	when	SCONJ
fcis-25103	137	27	the	the	DET
fcis-25103	137	28	number	number	NOUN
fcis-25103	137	29	of	of	ADP
fcis-25103	137	30	poisoned	poison	VERB
fcis-25103	137	31	samples	sample	NOUN
fcis-25103	137	32	trained	train	VERB
fcis-25103	137	33	per	per	ADP
fcis-25103	137	34	round	round	NOUN
fcis-25103	137	35	is	be	AUX
fcis-25103	137	36	fixed	fix	VERB
fcis-25103	137	37	,	,	PUNCT
fcis-25103	137	38	the	the	DET
fcis-25103	137	39	setting	setting	NOUN
fcis-25103	137	40	with	with	ADP
fcis-25103	137	41	denser	dense	ADJ
fcis-25103	137	42	backdoored	backdoore	VERB
fcis-25103	137	43	samples	sample	NOUN
fcis-25103	137	44	achieves	achieve	VERB
fcis-25103	137	45	a	a	DET
fcis-25103	137	46	higher	high	ADJ
fcis-25103	137	47	success	success	NOUN
fcis-25103	137	48	rate	rate	NOUN
fcis-25103	137	49	.	.	PUNCT
fcis-25103	138	1	fig	fig	NOUN
fcis-25103	138	2	3	3	NUM
fcis-25103	138	3	.	.	PUNCT
fcis-25103	138	4	average	average	ADJ
fcis-25103	138	5	norm	norm	NOUN
fcis-25103	138	6	of	of	ADP
fcis-25103	138	7	poisoned	poison	VERB
fcis-25103	138	8	clients	client	NOUN
fcis-25103	138	9	’	’	PART
fcis-25103	138	10	model	model	NOUN
fcis-25103	138	11	updates	update	NOUN
fcis-25103	138	12	on	on	ADP
fcis-25103	138	13	each	each	DET
fcis-25103	138	14	round	round	NOUN
fcis-25103	138	15	’s	’s	PART
fcis-25103	138	16	first	first	ADJ
fcis-25103	138	17	batch	batch	NOUN
fcis-25103	138	18	in	in	ADP
fcis-25103	138	19	semantic	semantic	ADJ
fcis-25103	138	20	backdoor	backdoor	NOUN
fcis-25103	138	21	attacks	attack	NOUN
fcis-25103	138	22	(	(	PUNCT
fcis-25103	138	23	the	the	DET
fcis-25103	138	24	total	total	ADJ
fcis-25103	138	25	numbers	number	NOUN
fcis-25103	138	26	of	of	ADP
fcis-25103	138	27	poisoned	poison	VERB
fcis-25103	138	28	samples	sample	NOUN
fcis-25103	138	29	in	in	ADP
fcis-25103	138	30	both	both	DET
fcis-25103	138	31	experiments	experiment	NOUN
fcis-25103	138	32	are	be	AUX
fcis-25103	138	33	the	the	DET
fcis-25103	138	34	same	same	ADJ
fcis-25103	138	35	)	)	PUNCT
fcis-25103	138	36	we	we	PRON
fcis-25103	138	37	calculate	calculate	VERB
fcis-25103	138	38	the	the	DET
fcis-25103	138	39	average	average	ADJ
fcis-25103	138	40	norm	norm	NOUN
fcis-25103	138	41	of	of	ADP
fcis-25103	138	42	the	the	DET
fcis-25103	138	43	model	model	NOUN
fcis-25103	138	44	updates	update	VERB
fcis-25103	138	45	on	on	ADP
fcis-25103	138	46	poisoned	poison	VERB
fcis-25103	138	47	clients	client	NOUN
fcis-25103	138	48	’	’	PART
fcis-25103	138	49	first	first	ADJ
fcis-25103	138	50	batch	batch	NOUN
fcis-25103	138	51	,	,	PUNCT
fcis-25103	138	52	as	as	SCONJ
fcis-25103	138	53	shown	show	VERB
fcis-25103	138	54	in	in	ADP
fcis-25103	138	55	fig	fig	NOUN
fcis-25103	138	56	.	.	PUNCT
fcis-25103	139	1	3	3	NUM
fcis-25103	139	2	,	,	PUNCT
fcis-25103	140	1	and	and	CCONJ
fcis-25103	140	2	find	find	VERB
fcis-25103	140	3	that	that	SCONJ
fcis-25103	140	4	the	the	DET
fcis-25103	140	5	clients	client	NOUN
fcis-25103	140	6	with	with	ADP
fcis-25103	140	7	denser	dense	ADJ
fcis-25103	140	8	backdoored	backdoore	VERB
fcis-25103	140	9	samples	sample	NOUN
fcis-25103	140	10	have	have	VERB
fcis-25103	140	11	larger	large	ADJ
fcis-25103	140	12	model	model	NOUN
fcis-25103	140	13	updates	update	NOUN
fcis-25103	140	14	through	through	ADP
fcis-25103	140	15	the	the	DET
fcis-25103	140	16	training	training	NOUN
fcis-25103	140	17	process	process	NOUN
fcis-25103	140	18	.	.	PUNCT
fcis-25103	141	1	it	it	PRON
fcis-25103	141	2	can	can	AUX
fcis-25103	141	3	be	be	AUX
fcis-25103	141	4	speculated	speculate	VERB
fcis-25103	141	5	that	that	SCONJ
fcis-25103	141	6	,	,	PUNCT
fcis-25103	141	7	the	the	DET
fcis-25103	141	8	model	model	NOUN
fcis-25103	141	9	update	update	NOUN
fcis-25103	141	10	trained	train	VERB
fcis-25103	141	11	with	with	ADP
fcis-25103	141	12	more	more	ADJ
fcis-25103	141	13	backdoored	backdoore	VERB
fcis-25103	141	14	samples	sample	NOUN
fcis-25103	141	15	has	have	VERB
fcis-25103	141	16	a	a	DET
fcis-25103	141	17	closer	close	ADJ
fcis-25103	141	18	orientation	orientation	NOUN
fcis-25103	141	19	to	to	ADP
fcis-25103	141	20	malicious	malicious	ADJ
fcis-25103	141	21	model	model	NOUN
fcis-25103	141	22	and	and	CCONJ
fcis-25103	141	23	larger	large	ADJ
fcis-25103	141	24	norm	norm	NOUN
fcis-25103	141	25	,	,	PUNCT
fcis-25103	141	26	hence	hence	ADV
fcis-25103	141	27	the	the	DET
fcis-25103	141	28	aggregated	aggregate	VERB
fcis-25103	141	29	model	model	NOUN
fcis-25103	141	30	update	update	NOUN
fcis-25103	141	31	is	be	AUX
fcis-25103	141	32	closer	close	ADJ
fcis-25103	141	33	to	to	ADP
fcis-25103	141	34	malicious	malicious	ADJ
fcis-25103	141	35	model	model	NOUN
fcis-25103	141	36	.	.	PUNCT
fcis-25103	142	1	in	in	ADP
fcis-25103	142	2	experiments	experiment	NOUN
fcis-25103	142	3	below	below	ADP
fcis-25103	142	4	,	,	PUNCT
fcis-25103	142	5	we	we	PRON
fcis-25103	142	6	keep	keep	VERB
fcis-25103	142	7	the	the	DET
fcis-25103	142	8	poisoning	poisoning	NOUN
fcis-25103	142	9	rate	rate	NOUN
fcis-25103	142	10	as	as	ADP
fcis-25103	142	11	1.0	1.0	NUM
fcis-25103	142	12	by	by	ADP
fcis-25103	142	13	default	default	NOUN
fcis-25103	142	14	.	.	PUNCT
fcis-25103	143	1	34	34	NUM
fcis-25103	143	2	3.3	3.3	NUM
fcis-25103	143	3	.	.	PUNCT
fcis-25103	144	1	effect	effect	NOUN
fcis-25103	144	2	of	of	ADP
fcis-25103	144	3	overfitting	overfitte	VERB
fcis-25103	144	4	during	during	ADP
fcis-25103	144	5	the	the	DET
fcis-25103	144	6	experiments	experiment	NOUN
fcis-25103	144	7	above	above	ADV
fcis-25103	144	8	,	,	PUNCT
fcis-25103	144	9	we	we	PRON
fcis-25103	144	10	discover	discover	VERB
fcis-25103	144	11	that	that	SCONJ
fcis-25103	144	12	there	there	PRON
fcis-25103	144	13	is	be	VERB
fcis-25103	144	14	some	some	DET
fcis-25103	144	15	relation	relation	NOUN
fcis-25103	144	16	between	between	ADP
fcis-25103	144	17	backdoor	backdoor	NOUN
fcis-25103	144	18	attack	attack	NOUN
fcis-25103	144	19	and	and	CCONJ
fcis-25103	144	20	model	model	NOUN
fcis-25103	144	21	overfitting	overfitting	NOUN
fcis-25103	144	22	.	.	PUNCT
fcis-25103	145	1	we	we	PRON
fcis-25103	145	2	draw	draw	VERB
fcis-25103	145	3	the	the	DET
fcis-25103	145	4	accuracy	accuracy	NOUN
fcis-25103	145	5	and	and	CCONJ
fcis-25103	145	6	the	the	DET
fcis-25103	145	7	success	success	NOUN
fcis-25103	145	8	rate	rate	NOUN
fcis-25103	145	9	of	of	ADP
fcis-25103	145	10	backdoor	backdoor	NOUN
fcis-25103	145	11	attack	attack	NOUN
fcis-25103	145	12	during	during	ADP
fcis-25103	145	13	200	200	NUM
fcis-25103	145	14	rounds	round	NOUN
fcis-25103	145	15	in	in	ADP
fcis-25103	145	16	the	the	DET
fcis-25103	145	17	single	single	ADJ
fcis-25103	145	18	-	-	PUNCT
fcis-25103	145	19	pixel	pixel	NOUN
fcis-25103	145	20	attack	attack	NOUN
fcis-25103	145	21	,	,	PUNCT
fcis-25103	145	22	as	as	SCONJ
fcis-25103	145	23	shown	show	VERB
fcis-25103	145	24	in	in	ADP
fcis-25103	145	25	fig	fig	NOUN
fcis-25103	145	26	.	.	PUNCT
fcis-25103	146	1	4	4	X
fcis-25103	146	2	.	.	X
fcis-25103	146	3	the	the	DET
fcis-25103	146	4	increase	increase	NOUN
fcis-25103	146	5	of	of	ADP
fcis-25103	146	6	the	the	DET
fcis-25103	146	7	success	success	NOUN
fcis-25103	146	8	rate	rate	NOUN
fcis-25103	146	9	is	be	AUX
fcis-25103	146	10	obviously	obviously	ADV
fcis-25103	146	11	behind	behind	ADP
fcis-25103	146	12	the	the	DET
fcis-25103	146	13	increase	increase	NOUN
fcis-25103	146	14	of	of	ADP
fcis-25103	146	15	accuracy	accuracy	NOUN
fcis-25103	146	16	.	.	PUNCT
fcis-25103	147	1	after	after	SCONJ
fcis-25103	147	2	the	the	DET
fcis-25103	147	3	accuracy	accuracy	NOUN
fcis-25103	147	4	has	have	AUX
fcis-25103	147	5	converged	converge	VERB
fcis-25103	147	6	,	,	PUNCT
fcis-25103	147	7	the	the	DET
fcis-25103	147	8	success	success	NOUN
fcis-25103	147	9	rate	rate	NOUN
fcis-25103	147	10	begins	begin	VERB
fcis-25103	147	11	to	to	PART
fcis-25103	147	12	rise	rise	VERB
fcis-25103	147	13	gradually	gradually	ADV
fcis-25103	147	14	.	.	PUNCT
fcis-25103	148	1	the	the	DET
fcis-25103	148	2	possible	possible	ADJ
fcis-25103	148	3	reason	reason	NOUN
fcis-25103	148	4	is	be	AUX
fcis-25103	148	5	that	that	SCONJ
fcis-25103	148	6	in	in	ADP
fcis-25103	148	7	early	early	ADJ
fcis-25103	148	8	rounds	round	NOUN
fcis-25103	148	9	,	,	PUNCT
fcis-25103	148	10	attacker	attacker	PROPN
fcis-25103	148	11	’s	’s	PART
fcis-25103	148	12	updates	update	NOUN
fcis-25103	148	13	are	be	AUX
fcis-25103	148	14	hidden	hide	VERB
fcis-25103	148	15	among	among	ADP
fcis-25103	148	16	those	those	PRON
fcis-25103	148	17	of	of	ADP
fcis-25103	148	18	other	other	ADJ
fcis-25103	148	19	clients	client	NOUN
fcis-25103	148	20	,	,	PUNCT
fcis-25103	148	21	and	and	CCONJ
fcis-25103	148	22	the	the	DET
fcis-25103	148	23	global	global	ADJ
fcis-25103	148	24	model	model	NOUN
fcis-25103	148	25	mainly	mainly	ADV
fcis-25103	148	26	learns	learn	VERB
fcis-25103	148	27	features	feature	NOUN
fcis-25103	148	28	of	of	ADP
fcis-25103	148	29	the	the	DET
fcis-25103	148	30	main	main	ADJ
fcis-25103	148	31	task	task	NOUN
fcis-25103	148	32	.	.	PUNCT
fcis-25103	149	1	after	after	SCONJ
fcis-25103	149	2	the	the	DET
fcis-25103	149	3	learning	learning	NOUN
fcis-25103	149	4	of	of	ADP
fcis-25103	149	5	the	the	DET
fcis-25103	149	6	main	main	ADJ
fcis-25103	149	7	task	task	NOUN
fcis-25103	149	8	is	be	AUX
fcis-25103	149	9	finished	finish	VERB
fcis-25103	149	10	,	,	PUNCT
fcis-25103	149	11	honest	honest	ADJ
fcis-25103	149	12	clients	client	NOUN
fcis-25103	149	13	’	'	PUNCT
fcis-25103	149	14	updates	update	NOUN
fcis-25103	149	15	become	become	VERB
fcis-25103	149	16	small	small	ADJ
fcis-25103	149	17	,	,	PUNCT
fcis-25103	149	18	and	and	CCONJ
fcis-25103	149	19	the	the	DET
fcis-25103	149	20	global	global	ADJ
fcis-25103	149	21	model	model	NOUN
fcis-25103	149	22	begins	begin	VERB
fcis-25103	149	23	to	to	PART
fcis-25103	149	24	learn	learn	VERB
fcis-25103	149	25	the	the	DET
fcis-25103	149	26	feature	feature	NOUN
fcis-25103	149	27	of	of	ADP
fcis-25103	149	28	the	the	DET
fcis-25103	149	29	backdoor	backdoor	NOUN
fcis-25103	149	30	task	task	NOUN
fcis-25103	149	31	.	.	PUNCT
fcis-25103	150	1	this	this	PRON
fcis-25103	150	2	means	mean	VERB
fcis-25103	150	3	that	that	SCONJ
fcis-25103	150	4	the	the	DET
fcis-25103	150	5	global	global	ADJ
fcis-25103	150	6	model	model	NOUN
fcis-25103	150	7	has	have	AUX
fcis-25103	150	8	overfitted	overfitte	VERB
fcis-25103	150	9	.	.	PUNCT
fcis-25103	151	1	fig	fig	NOUN
fcis-25103	151	2	4	4	NUM
fcis-25103	151	3	.	.	PUNCT
fcis-25103	151	4	trends	trend	NOUN
fcis-25103	151	5	of	of	ADP
fcis-25103	151	6	model	model	NOUN
fcis-25103	151	7	accuracy	accuracy	NOUN
fcis-25103	151	8	and	and	CCONJ
fcis-25103	151	9	attack	attack	NOUN
fcis-25103	151	10	success	success	NOUN
fcis-25103	151	11	rate	rate	NOUN
fcis-25103	151	12	during	during	ADP
fcis-25103	151	13	200	200	NUM
fcis-25103	151	14	rounds	round	NOUN
fcis-25103	151	15	in	in	ADP
fcis-25103	151	16	the	the	DET
fcis-25103	151	17	single	single	ADJ
fcis-25103	151	18	-	-	PUNCT
fcis-25103	151	19	pixel	pixel	NOUN
fcis-25103	151	20	attack	attack	NOUN
fcis-25103	151	21	(	(	PUNCT
fcis-25103	151	22	20	20	NUM
fcis-25103	151	23	clients	client	NOUN
fcis-25103	151	24	selected	select	VERB
fcis-25103	151	25	per	per	ADP
fcis-25103	151	26	round	round	NOUN
fcis-25103	151	27	and	and	CCONJ
fcis-25103	151	28	4	4	NUM
fcis-25103	151	29	of	of	ADP
fcis-25103	151	30	them	they	PRON
fcis-25103	151	31	are	be	AUX
fcis-25103	151	32	poisoned	poison	VERB
fcis-25103	151	33	)	)	PUNCT
fcis-25103	151	34	(	(	PUNCT
fcis-25103	151	35	a	a	X
fcis-25103	151	36	)	)	PUNCT
fcis-25103	151	37	cifar-10	cifar-10	PROPN
fcis-25103	151	38	(	(	PUNCT
fcis-25103	151	39	b	b	NOUN
fcis-25103	151	40	)	)	PUNCT
fcis-25103	151	41	emnist	emnist	NOUN
fcis-25103	151	42	fig	fig	NOUN
fcis-25103	151	43	5	5	NUM
fcis-25103	151	44	.	.	PUNCT
fcis-25103	151	45	variation	variation	NOUN
fcis-25103	151	46	of	of	ADP
fcis-25103	151	47	model	model	NOUN
fcis-25103	151	48	accuracy	accuracy	NOUN
fcis-25103	151	49	and	and	CCONJ
fcis-25103	151	50	attack	attack	NOUN
fcis-25103	151	51	success	success	NOUN
fcis-25103	151	52	rate	rate	NOUN
fcis-25103	151	53	when	when	SCONJ
fcis-25103	151	54	changing	change	VERB
fcis-25103	151	55	the	the	DET
fcis-25103	151	56	number	number	NOUN
fcis-25103	151	57	of	of	ADP
fcis-25103	151	58	local	local	ADJ
fcis-25103	151	59	epochs	epoch	NOUN
fcis-25103	151	60	(	(	PUNCT
fcis-25103	151	61	for	for	ADP
fcis-25103	151	62	cifar-10	cifar-10	PROPN
fcis-25103	151	63	,	,	PUNCT
fcis-25103	151	64	8	8	NUM
fcis-25103	151	65	poisoned	poison	VERB
fcis-25103	151	66	clients	client	NOUN
fcis-25103	151	67	are	be	AUX
fcis-25103	151	68	selected	select	VERB
fcis-25103	151	69	per	per	ADP
fcis-25103	151	70	round	round	NOUN
fcis-25103	151	71	and	and	CCONJ
fcis-25103	151	72	for	for	ADP
fcis-25103	151	73	emnist	emnist	NOUN
fcis-25103	151	74	,	,	PUNCT
fcis-25103	151	75	the	the	DET
fcis-25103	151	76	number	number	NOUN
fcis-25103	151	77	is	be	AUX
fcis-25103	151	78	4	4	NUM
fcis-25103	151	79	)	)	PUNCT
fcis-25103	151	80	in	in	ADP
fcis-25103	151	81	order	order	NOUN
fcis-25103	151	82	to	to	PART
fcis-25103	151	83	verify	verify	VERB
fcis-25103	151	84	our	our	PRON
fcis-25103	151	85	speculation	speculation	NOUN
fcis-25103	151	86	,	,	PUNCT
fcis-25103	151	87	we	we	PRON
fcis-25103	151	88	change	change	VERB
fcis-25103	151	89	the	the	DET
fcis-25103	151	90	parameters	parameter	NOUN
fcis-25103	151	91	of	of	ADP
fcis-25103	151	92	the	the	DET
fcis-25103	151	93	training	training	NOUN
fcis-25103	151	94	process	process	NOUN
fcis-25103	151	95	to	to	PART
fcis-25103	151	96	alleviate	alleviate	VERB
fcis-25103	151	97	overfitting	overfitting	NOUN
fcis-25103	151	98	,	,	PUNCT
fcis-25103	151	99	and	and	CCONJ
fcis-25103	151	100	compare	compare	VERB
fcis-25103	151	101	the	the	DET
fcis-25103	151	102	accuracy	accuracy	NOUN
fcis-25103	151	103	as	as	ADV
fcis-25103	151	104	well	well	ADV
fcis-25103	151	105	as	as	ADP
fcis-25103	151	106	the	the	DET
fcis-25103	151	107	success	success	NOUN
fcis-25103	151	108	rate	rate	NOUN
fcis-25103	151	109	.	.	PUNCT
fcis-25103	152	1	first	first	ADV
fcis-25103	152	2	,	,	PUNCT
fcis-25103	152	3	we	we	PRON
fcis-25103	152	4	change	change	VERB
fcis-25103	152	5	the	the	DET
fcis-25103	152	6	number	number	NOUN
fcis-25103	152	7	of	of	ADP
fcis-25103	152	8	local	local	ADJ
fcis-25103	152	9	epochs	epoch	NOUN
fcis-25103	152	10	from	from	ADP
fcis-25103	152	11	5	5	NUM
fcis-25103	152	12	to	to	PART
fcis-25103	152	13	2	2	NUM
fcis-25103	152	14	and	and	CCONJ
fcis-25103	152	15	1	1	NUM
fcis-25103	152	16	,	,	PUNCT
fcis-25103	152	17	which	which	PRON
fcis-25103	152	18	reduces	reduce	VERB
fcis-25103	152	19	the	the	DET
fcis-25103	152	20	training	training	NOUN
fcis-25103	152	21	times	time	NOUN
fcis-25103	152	22	of	of	ADP
fcis-25103	152	23	every	every	DET
fcis-25103	152	24	client	client	NOUN
fcis-25103	152	25	.	.	PUNCT
fcis-25103	153	1	fig	fig	NOUN
fcis-25103	153	2	.	.	PUNCT
fcis-25103	154	1	5	5	NUM
fcis-25103	154	2	indicates	indicate	VERB
fcis-25103	154	3	that	that	SCONJ
fcis-25103	154	4	in	in	ADP
fcis-25103	154	5	both	both	DET
fcis-25103	154	6	backdoor	backdoor	NOUN
fcis-25103	154	7	attacks	attack	NOUN
fcis-25103	154	8	,	,	PUNCT
fcis-25103	154	9	the	the	DET
fcis-25103	154	10	success	success	NOUN
fcis-25103	154	11	rate	rate	NOUN
fcis-25103	154	12	decreases	decrease	VERB
fcis-25103	154	13	to	to	ADP
fcis-25103	154	14	some	some	DET
fcis-25103	154	15	extent	extent	NOUN
fcis-25103	154	16	(	(	PUNCT
fcis-25103	154	17	attacks	attack	NOUN
fcis-25103	154	18	on	on	ADP
fcis-25103	154	19	emnist	emnist	ADJ
fcis-25103	154	20	decrease	decrease	NOUN
fcis-25103	154	21	more	more	ADJ
fcis-25103	154	22	)	)	PUNCT
fcis-25103	154	23	and	and	CCONJ
fcis-25103	154	24	the	the	DET
fcis-25103	154	25	accuracy	accuracy	NOUN
fcis-25103	154	26	almost	almost	ADV
fcis-25103	154	27	remains	remain	VERB
fcis-25103	154	28	the	the	DET
fcis-25103	154	29	same	same	ADJ
fcis-25103	154	30	.	.	PUNCT
fcis-25103	155	1	next	next	ADV
fcis-25103	155	2	,	,	PUNCT
fcis-25103	155	3	we	we	PRON
fcis-25103	155	4	introduce	introduce	VERB
fcis-25103	155	5	l2	l2	NOUN
fcis-25103	155	6	-	-	PUNCT
fcis-25103	155	7	regularization	regularization	NOUN
fcis-25103	155	8	,	,	PUNCT
fcis-25103	155	9	setting	set	VERB
fcis-25103	155	10	a	a	DET
fcis-25103	155	11	series	series	NOUN
fcis-25103	155	12	of	of	ADP
fcis-25103	155	13	weight	weight	NOUN
fcis-25103	155	14	decays	decay	NOUN
fcis-25103	155	15	,	,	PUNCT
fcis-25103	155	16	as	as	SCONJ
fcis-25103	155	17	listed	list	VERB
fcis-25103	155	18	in	in	ADP
fcis-25103	155	19	table	table	NOUN
fcis-25103	155	20	2	2	NUM
fcis-25103	155	21	.	.	PUNCT
fcis-25103	156	1	in	in	ADP
fcis-25103	156	2	the	the	DET
fcis-25103	156	3	single	single	ADJ
fcis-25103	156	4	-	-	PUNCT
fcis-25103	156	5	pixel	pixel	NOUN
fcis-25103	156	6	attack	attack	NOUN
fcis-25103	156	7	,	,	PUNCT
fcis-25103	156	8	the	the	DET
fcis-25103	156	9	success	success	NOUN
fcis-25103	156	10	rate	rate	NOUN
fcis-25103	156	11	drops	drop	VERB
fcis-25103	156	12	sharply	sharply	ADV
fcis-25103	156	13	to	to	ADP
fcis-25103	156	14	almost	almost	ADV
fcis-25103	156	15	zero	zero	NUM
fcis-25103	156	16	when	when	SCONJ
fcis-25103	156	17	increasing	increase	VERB
fcis-25103	156	18	the	the	DET
fcis-25103	156	19	weight	weight	NOUN
fcis-25103	156	20	decay	decay	NOUN
fcis-25103	156	21	.	.	PUNCT
fcis-25103	157	1	however	however	ADV
fcis-25103	157	2	,	,	PUNCT
fcis-25103	157	3	in	in	ADP
fcis-25103	157	4	the	the	DET
fcis-25103	157	5	semantic	semantic	ADJ
fcis-25103	157	6	backdoor	backdoor	NOUN
fcis-25103	157	7	attack	attack	NOUN
fcis-25103	157	8	,	,	PUNCT
fcis-25103	157	9	the	the	DET
fcis-25103	157	10	success	success	NOUN
fcis-25103	157	11	rate	rate	NOUN
fcis-25103	157	12	rises	rise	VERB
fcis-25103	157	13	slightly	slightly	ADV
fcis-25103	157	14	,	,	PUNCT
fcis-25103	157	15	rather	rather	ADV
fcis-25103	157	16	than	than	ADP
fcis-25103	157	17	going	go	VERB
fcis-25103	157	18	down	down	ADV
fcis-25103	157	19	.	.	PUNCT
fcis-25103	158	1	these	these	DET
fcis-25103	158	2	distinct	distinct	ADJ
fcis-25103	158	3	results	result	NOUN
fcis-25103	158	4	are	be	AUX
fcis-25103	158	5	due	due	ADJ
fcis-25103	158	6	to	to	ADP
fcis-25103	158	7	the	the	DET
fcis-25103	158	8	different	different	ADJ
fcis-25103	158	9	degrees	degree	NOUN
fcis-25103	158	10	of	of	ADP
fcis-25103	158	11	overfitting	overfitting	NOUN
fcis-25103	158	12	in	in	ADP
fcis-25103	158	13	the	the	DET
fcis-25103	158	14	two	two	NUM
fcis-25103	158	15	tasks	task	NOUN
fcis-25103	158	16	.	.	PUNCT
fcis-25103	159	1	in	in	ADP
fcis-25103	159	2	the	the	DET
fcis-25103	159	3	single	single	ADJ
fcis-25103	159	4	-	-	PUNCT
fcis-25103	159	5	pixel	pixel	NOUN
fcis-25103	159	6	attack	attack	NOUN
fcis-25103	159	7	,	,	PUNCT
fcis-25103	159	8	the	the	DET
fcis-25103	159	9	backdoor	backdoor	NOUN
fcis-25103	159	10	feature	feature	NOUN
fcis-25103	159	11	is	be	AUX
fcis-25103	159	12	a	a	DET
fcis-25103	159	13	white	white	ADJ
fcis-25103	159	14	pixel	pixel	NOUN
fcis-25103	159	15	and	and	CCONJ
fcis-25103	159	16	all	all	DET
fcis-25103	159	17	training	training	NOUN
fcis-25103	159	18	samples	sample	NOUN
fcis-25103	159	19	of	of	ADP
fcis-25103	159	20	poisoned	poison	VERB
fcis-25103	159	21	clients	client	NOUN
fcis-25103	159	22	are	be	AUX
fcis-25103	159	23	labeled	label	VERB
fcis-25103	159	24	the	the	DET
fcis-25103	159	25	same	same	ADJ
fcis-25103	159	26	,	,	PUNCT
fcis-25103	159	27	causing	cause	VERB
fcis-25103	159	28	their	their	PRON
fcis-25103	159	29	local	local	ADJ
fcis-25103	159	30	models	model	NOUN
fcis-25103	159	31	to	to	PART
fcis-25103	159	32	learn	learn	VERB
fcis-25103	159	33	a	a	DET
fcis-25103	159	34	single	single	ADJ
fcis-25103	159	35	feature	feature	NOUN
fcis-25103	159	36	.	.	PUNCT
fcis-25103	160	1	however	however	ADV
fcis-25103	160	2	,	,	PUNCT
fcis-25103	160	3	the	the	DET
fcis-25103	160	4	backdoor	backdoor	NOUN
fcis-25103	160	5	feature	feature	NOUN
fcis-25103	160	6	in	in	ADP
fcis-25103	160	7	the	the	DET
fcis-25103	160	8	semantic	semantic	ADJ
fcis-25103	160	9	backdoor	backdoor	NOUN
fcis-25103	160	10	attack	attack	NOUN
fcis-25103	160	11	is	be	AUX
fcis-25103	160	12	the	the	DET
fcis-25103	160	13	existence	existence	NOUN
fcis-25103	160	14	of	of	ADP
fcis-25103	160	15	any	any	DET
fcis-25103	160	16	kinds	kind	NOUN
fcis-25103	160	17	of	of	ADP
fcis-25103	160	18	red	red	ADJ
fcis-25103	160	19	cars	car	NOUN
fcis-25103	160	20	,	,	PUNCT
fcis-25103	160	21	and	and	CCONJ
fcis-25103	160	22	the	the	DET
fcis-25103	160	23	training	training	NOUN
fcis-25103	160	24	data	datum	NOUN
fcis-25103	160	25	are	be	AUX
fcis-25103	160	26	divided	divide	VERB
fcis-25103	160	27	into	into	ADP
fcis-25103	160	28	ten	ten	NUM
fcis-25103	160	29	classes	class	NOUN
fcis-25103	160	30	even	even	ADV
fcis-25103	160	31	in	in	ADP
fcis-25103	160	32	poisoned	poison	VERB
fcis-25103	160	33	clients	client	NOUN
fcis-25103	160	34	.	.	PUNCT
fcis-25103	161	1	a	a	DET
fcis-25103	161	2	more	more	ADV
fcis-25103	161	3	balanced	balanced	ADJ
fcis-25103	161	4	data	datum	NOUN
fcis-25103	161	5	distribution	distribution	NOUN
fcis-25103	161	6	and	and	CCONJ
fcis-25103	161	7	a	a	DET
fcis-25103	161	8	more	more	ADV
fcis-25103	161	9	complicated	complicated	ADJ
fcis-25103	161	10	backdoor	backdoor	NOUN
fcis-25103	161	11	task	task	NOUN
fcis-25103	161	12	make	make	VERB
fcis-25103	161	13	the	the	DET
fcis-25103	161	14	model	model	NOUN
fcis-25103	161	15	less	less	ADV
fcis-25103	161	16	prone	prone	ADJ
fcis-25103	161	17	to	to	ADP
fcis-25103	161	18	overfitting	overfitte	VERB
fcis-25103	161	19	in	in	ADP
fcis-25103	161	20	the	the	DET
fcis-25103	161	21	semantic	semantic	ADJ
fcis-25103	161	22	backdoor	backdoor	NOUN
fcis-25103	161	23	attack	attack	NOUN
fcis-25103	161	24	,	,	PUNCT
fcis-25103	161	25	so	so	SCONJ
fcis-25103	161	26	the	the	DET
fcis-25103	161	27	success	success	NOUN
fcis-25103	161	28	rate	rate	NOUN
fcis-25103	161	29	is	be	AUX
fcis-25103	161	30	less	less	ADV
fcis-25103	161	31	affected	affect	VERB
fcis-25103	161	32	by	by	ADP
fcis-25103	161	33	methods	method	NOUN
fcis-25103	161	34	alleviating	alleviate	VERB
fcis-25103	161	35	overfitting	overfitte	VERB
fcis-25103	161	36	.	.	PUNCT
fcis-25103	162	1	table	table	NOUN
fcis-25103	162	2	2	2	NUM
fcis-25103	162	3	.	.	X
fcis-25103	162	4	variation	variation	NOUN
fcis-25103	162	5	of	of	ADP
fcis-25103	162	6	model	model	NOUN
fcis-25103	162	7	accuracy	accuracy	NOUN
fcis-25103	162	8	and	and	CCONJ
fcis-25103	162	9	attack	attack	NOUN
fcis-25103	162	10	success	success	NOUN
fcis-25103	162	11	rate	rate	NOUN
fcis-25103	162	12	with	with	ADP
fcis-25103	162	13	respect	respect	NOUN
fcis-25103	162	14	to	to	ADP
fcis-25103	162	15	weight	weight	NOUN
fcis-25103	162	16	decay	decay	NOUN
fcis-25103	162	17	(	(	PUNCT
fcis-25103	162	18	the	the	DET
fcis-25103	162	19	number	number	NOUN
fcis-25103	162	20	of	of	ADP
fcis-25103	162	21	local	local	ADJ
fcis-25103	162	22	epochs	epoch	NOUN
fcis-25103	162	23	is	be	AUX
fcis-25103	162	24	5	5	NUM
fcis-25103	162	25	for	for	ADP
fcis-25103	162	26	emnist	emnist	NOUN
fcis-25103	162	27	and	and	CCONJ
fcis-25103	162	28	2	2	NUM
fcis-25103	162	29	for	for	ADP
fcis-25103	162	30	cifar-10	cifar-10	PROPN
fcis-25103	162	31	;	;	PUNCT
fcis-25103	162	32	the	the	DET
fcis-25103	162	33	numbers	number	NOUN
fcis-25103	162	34	of	of	ADP
fcis-25103	162	35	poisoned	poison	VERB
fcis-25103	162	36	clients	client	NOUN
fcis-25103	162	37	selected	select	VERB
fcis-25103	162	38	per	per	ADP
fcis-25103	162	39	round	round	NOUN
fcis-25103	162	40	are	be	AUX
fcis-25103	162	41	4	4	NUM
fcis-25103	162	42	and	and	CCONJ
fcis-25103	162	43	8	8	NUM
fcis-25103	162	44	respectively	respectively	ADV
fcis-25103	162	45	)	)	PUNCT
fcis-25103	162	46	weight	weight	NOUN
fcis-25103	162	47	decay	decay	NOUN
fcis-25103	162	48	0	0	NUM
fcis-25103	162	49	1e-4	1e-4	NUM
fcis-25103	162	50	5e-4	5e-4	NUM
fcis-25103	162	51	1e-3	1e-3	NUM
fcis-25103	162	52	5e-3	5e-3	NUM
fcis-25103	162	53	emnist	emnist	NOUN
fcis-25103	162	54	acc	acc	PROPN
fcis-25103	162	55	.	.	PUNCT
fcis-25103	163	1	(	(	PUNCT
fcis-25103	163	2	%	%	INTJ
fcis-25103	163	3	)	)	PUNCT
fcis-25103	163	4	99.28	99.28	NUM
fcis-25103	163	5	99.32	99.32	NUM
fcis-25103	163	6	99.10	99.10	NUM
fcis-25103	163	7	98.31	98.31	NUM
fcis-25103	163	8	97.02	97.02	NUM
fcis-25103	163	9	succ	succ	X
fcis-25103	163	10	.	.	PUNCT
fcis-25103	164	1	(	(	PUNCT
fcis-25103	164	2	%	%	INTJ
fcis-25103	164	3	)	)	PUNCT
fcis-25103	164	4	99.96	99.96	NUM
fcis-25103	164	5	99.85	99.85	NUM
fcis-25103	164	6	67.87	67.87	NUM
fcis-25103	164	7	8.17	8.17	NUM
fcis-25103	164	8	2.63	2.63	NUM
fcis-25103	164	9	cifar-10	cifar-10	PROPN
fcis-25103	164	10	acc	acc	PROPN
fcis-25103	164	11	.	.	PUNCT
fcis-25103	165	1	(	(	PUNCT
fcis-25103	165	2	%	%	INTJ
fcis-25103	165	3	)	)	PUNCT
fcis-25103	165	4	88.02	88.02	NUM
fcis-25103	165	5	88.13	88.13	NUM
fcis-25103	165	6	88.15	88.15	NUM
fcis-25103	165	7	88.27	88.27	NUM
fcis-25103	165	8	87.44	87.44	NUM
fcis-25103	165	9	succ	succ	X
fcis-25103	165	10	.	.	PUNCT
fcis-25103	166	1	(	(	PUNCT
fcis-25103	166	2	%	%	INTJ
fcis-25103	166	3	)	)	PUNCT
fcis-25103	166	4	80.05	80.05	NUM
fcis-25103	166	5	80.00	80.00	NUM
fcis-25103	166	6	81.06	81.06	NUM
fcis-25103	166	7	81.36	81.36	NUM
fcis-25103	166	8	84.24	84.24	NUM
fcis-25103	166	9	to	to	PART
fcis-25103	166	10	sum	sum	VERB
fcis-25103	166	11	up	up	ADP
fcis-25103	166	12	,	,	PUNCT
fcis-25103	166	13	the	the	DET
fcis-25103	166	14	redundancy	redundancy	NOUN
fcis-25103	166	15	of	of	ADP
fcis-25103	166	16	model	model	NOUN
fcis-25103	166	17	feature	feature	NOUN
fcis-25103	166	18	space	space	NOUN
fcis-25103	166	19	is	be	AUX
fcis-25103	166	20	a	a	DET
fcis-25103	166	21	basic	basic	ADJ
fcis-25103	166	22	condition	condition	NOUN
fcis-25103	166	23	for	for	ADP
fcis-25103	166	24	backdoor	backdoor	NOUN
fcis-25103	166	25	attacks	attack	NOUN
fcis-25103	166	26	,	,	PUNCT
fcis-25103	166	27	which	which	PRON
fcis-25103	166	28	allows	allow	VERB
fcis-25103	166	29	the	the	DET
fcis-25103	166	30	model	model	NOUN
fcis-25103	166	31	to	to	PART
fcis-25103	166	32	learn	learn	VERB
fcis-25103	166	33	backdoor	backdoor	NOUN
fcis-25103	166	34	features	feature	NOUN
fcis-25103	166	35	and	and	CCONJ
fcis-25103	166	36	maintain	maintain	VERB
fcis-25103	166	37	the	the	DET
fcis-25103	166	38	accuracy	accuracy	NOUN
fcis-25103	166	39	of	of	ADP
fcis-25103	166	40	the	the	DET
fcis-25103	166	41	main	main	ADJ
fcis-25103	166	42	task	task	NOUN
fcis-25103	166	43	simultaneously	simultaneously	ADV
fcis-25103	166	44	.	.	PUNCT
fcis-25103	167	1	in	in	ADP
fcis-25103	167	2	addition	addition	NOUN
fcis-25103	167	3	,	,	PUNCT
fcis-25103	167	4	backdoor	backdoor	NOUN
fcis-25103	167	5	attacks	attack	NOUN
fcis-25103	167	6	are	be	AUX
fcis-25103	167	7	related	relate	VERB
fcis-25103	167	8	to	to	ADP
fcis-25103	167	9	overfitting	overfitte	VERB
fcis-25103	167	10	.	.	PUNCT
fcis-25103	168	1	more	more	ADV
fcis-25103	168	2	specifically	specifically	ADV
fcis-25103	168	3	,	,	PUNCT
fcis-25103	168	4	it	it	PRON
fcis-25103	168	5	can	can	AUX
fcis-25103	168	6	be	be	AUX
fcis-25103	168	7	considered	consider	VERB
fcis-25103	168	8	that	that	SCONJ
fcis-25103	168	9	overfitting	overfitting	NOUN
fcis-25103	168	10	occurs	occur	VERB
fcis-25103	168	11	in	in	ADP
fcis-25103	168	12	the	the	DET
fcis-25103	168	13	process	process	NOUN
fcis-25103	168	14	of	of	ADP
fcis-25103	168	15	learning	learn	VERB
fcis-25103	168	16	backdoor	backdoor	NOUN
fcis-25103	168	17	features	feature	NOUN
fcis-25103	168	18	when	when	SCONJ
fcis-25103	168	19	poisoned	poison	VERB
fcis-25103	168	20	clients	client	NOUN
fcis-25103	168	21	training	train	VERB
fcis-25103	168	22	their	their	PRON
fcis-25103	168	23	local	local	ADJ
fcis-25103	168	24	models	model	NOUN
fcis-25103	168	25	.	.	PUNCT
fcis-25103	169	1	the	the	DET
fcis-25103	169	2	strength	strength	NOUN
fcis-25103	169	3	of	of	ADP
fcis-25103	169	4	the	the	DET
fcis-25103	169	5	relation	relation	NOUN
fcis-25103	169	6	depends	depend	VERB
fcis-25103	169	7	on	on	ADP
fcis-25103	169	8	the	the	DET
fcis-25103	169	9	degree	degree	NOUN
fcis-25103	169	10	of	of	ADP
fcis-25103	169	11	overfitting	overfitting	NOUN
fcis-25103	169	12	.	.	PUNCT
fcis-25103	170	1	the	the	PRON
fcis-25103	170	2	higher	high	ADJ
fcis-25103	170	3	the	the	DET
fcis-25103	170	4	degree	degree	NOUN
fcis-25103	170	5	of	of	ADP
fcis-25103	170	6	overfitting	overfitting	NOUN
fcis-25103	170	7	,	,	PUNCT
fcis-25103	170	8	the	the	PRON
fcis-25103	170	9	stronger	strong	ADJ
fcis-25103	170	10	the	the	DET
fcis-25103	170	11	relation	relation	NOUN
fcis-25103	170	12	becomes	become	VERB
fcis-25103	170	13	,	,	PUNCT
fcis-25103	170	14	and	and	CCONJ
fcis-25103	170	15	the	the	DET
fcis-25103	170	16	more	more	ADV
fcis-25103	170	17	effective	effective	ADJ
fcis-25103	170	18	the	the	DET
fcis-25103	170	19	mitigation	mitigation	NOUN
fcis-25103	170	20	of	of	ADP
fcis-25103	170	21	overfitting	overfitting	NOUN
fcis-25103	170	22	is	be	AUX
fcis-25103	170	23	against	against	ADP
fcis-25103	170	24	the	the	DET
fcis-25103	170	25	backdoor	backdoor	NOUN
fcis-25103	170	26	attack	attack	NOUN
fcis-25103	170	27	.	.	PUNCT
fcis-25103	171	1	35	35	NUM
fcis-25103	171	2	4	4	NUM
fcis-25103	171	3	.	.	PUNCT
fcis-25103	171	4	differential	differential	ADJ
fcis-25103	171	5	privacy	privacy	NOUN
fcis-25103	171	6	with	with	ADP
fcis-25103	171	7	clip	clip	NOUN
fcis-25103	171	8	norm	norm	NOUN
fcis-25103	171	9	decay	decay	VERB
fcis-25103	171	10	4.1	4.1	NUM
fcis-25103	171	11	.	.	PUNCT
fcis-25103	172	1	algorithm	algorithm	NOUN
fcis-25103	172	2	description	description	NOUN
fcis-25103	172	3	we	we	PRON
fcis-25103	172	4	have	have	AUX
fcis-25103	172	5	discussed	discuss	VERB
fcis-25103	172	6	the	the	DET
fcis-25103	172	7	effect	effect	NOUN
fcis-25103	172	8	of	of	ADP
fcis-25103	172	9	overfitting	overfitte	VERB
fcis-25103	172	10	on	on	ADP
fcis-25103	172	11	backdoor	backdoor	NOUN
fcis-25103	172	12	attacks	attack	NOUN
fcis-25103	172	13	in	in	ADP
fcis-25103	172	14	subsec	subsec	PROPN
fcis-25103	172	15	.	.	PUNCT
fcis-25103	173	1	3.3	3.3	NUM
fcis-25103	174	1	and	and	CCONJ
fcis-25103	174	2	found	find	VERB
fcis-25103	174	3	that	that	SCONJ
fcis-25103	174	4	mitigating	mitigate	VERB
fcis-25103	174	5	overfitting	overfitting	NOUN
fcis-25103	174	6	can	can	AUX
fcis-25103	174	7	reduce	reduce	VERB
fcis-25103	174	8	the	the	DET
fcis-25103	174	9	success	success	NOUN
fcis-25103	174	10	rate	rate	NOUN
fcis-25103	174	11	of	of	ADP
fcis-25103	174	12	backdoor	backdoor	NOUN
fcis-25103	174	13	attacks	attack	NOUN
fcis-25103	174	14	,	,	PUNCT
fcis-25103	174	15	to	to	ADP
fcis-25103	174	16	some	some	DET
fcis-25103	174	17	extent	extent	NOUN
fcis-25103	174	18	.	.	PUNCT
fcis-25103	175	1	however	however	ADV
fcis-25103	175	2	,	,	PUNCT
fcis-25103	175	3	it	it	PRON
fcis-25103	175	4	is	be	AUX
fcis-25103	175	5	unrealistic	unrealistic	ADJ
fcis-25103	175	6	to	to	PART
fcis-25103	175	7	rely	rely	VERB
fcis-25103	175	8	solely	solely	ADV
fcis-25103	175	9	on	on	ADP
fcis-25103	175	10	mitigating	mitigate	VERB
fcis-25103	175	11	overfitting	overfitte	VERB
fcis-25103	175	12	to	to	PART
fcis-25103	175	13	defend	defend	VERB
fcis-25103	175	14	against	against	ADP
fcis-25103	175	15	backdoor	backdoor	NOUN
fcis-25103	175	16	attacks	attack	NOUN
fcis-25103	175	17	.	.	PUNCT
fcis-25103	176	1	for	for	ADP
fcis-25103	176	2	one	one	NUM
fcis-25103	176	3	thing	thing	NOUN
fcis-25103	176	4	,	,	PUNCT
fcis-25103	176	5	the	the	DET
fcis-25103	176	6	degree	degree	NOUN
fcis-25103	176	7	of	of	ADP
fcis-25103	176	8	defense	defense	NOUN
fcis-25103	176	9	achieved	achieve	VERB
fcis-25103	176	10	by	by	ADP
fcis-25103	176	11	reducing	reduce	VERB
fcis-25103	176	12	local	local	ADJ
fcis-25103	176	13	epochs	epoch	NOUN
fcis-25103	176	14	is	be	AUX
fcis-25103	176	15	limited	limited	ADJ
fcis-25103	176	16	.	.	PUNCT
fcis-25103	177	1	even	even	ADV
fcis-25103	177	2	training	train	VERB
fcis-25103	177	3	only	only	ADV
fcis-25103	177	4	one	one	NUM
fcis-25103	177	5	local	local	ADJ
fcis-25103	177	6	epoch	epoch	NOUN
fcis-25103	177	7	in	in	ADP
fcis-25103	177	8	a	a	DET
fcis-25103	177	9	round	round	NOUN
fcis-25103	177	10	,	,	PUNCT
fcis-25103	177	11	backdoor	backdoor	NOUN
fcis-25103	177	12	attacks	attack	NOUN
fcis-25103	177	13	can	can	AUX
fcis-25103	177	14	still	still	ADV
fcis-25103	177	15	have	have	VERB
fcis-25103	177	16	a	a	DET
fcis-25103	177	17	high	high	ADJ
fcis-25103	177	18	success	success	NOUN
fcis-25103	177	19	rate	rate	NOUN
fcis-25103	177	20	.	.	PUNCT
fcis-25103	178	1	for	for	ADP
fcis-25103	178	2	another	another	PRON
fcis-25103	178	3	,	,	PUNCT
fcis-25103	178	4	the	the	DET
fcis-25103	178	5	effect	effect	NOUN
fcis-25103	178	6	of	of	ADP
fcis-25103	178	7	regularization	regularization	NOUN
fcis-25103	178	8	on	on	ADP
fcis-25103	178	9	backdoor	backdoor	NOUN
fcis-25103	178	10	attacks	attack	NOUN
fcis-25103	178	11	is	be	AUX
fcis-25103	178	12	uncertain	uncertain	ADJ
fcis-25103	178	13	.	.	PUNCT
fcis-25103	179	1	in	in	ADP
fcis-25103	179	2	the	the	DET
fcis-25103	179	3	case	case	NOUN
fcis-25103	179	4	of	of	ADP
fcis-25103	179	5	extreme	extreme	ADJ
fcis-25103	179	6	overfitting	overfitting	NOUN
fcis-25103	179	7	,	,	PUNCT
fcis-25103	179	8	regularization	regularization	NOUN
fcis-25103	179	9	could	could	AUX
fcis-25103	179	10	greatly	greatly	ADV
fcis-25103	179	11	reduce	reduce	VERB
fcis-25103	179	12	the	the	DET
fcis-25103	179	13	success	success	NOUN
fcis-25103	179	14	rate	rate	NOUN
fcis-25103	179	15	of	of	ADP
fcis-25103	179	16	the	the	DET
fcis-25103	179	17	attack	attack	NOUN
fcis-25103	179	18	,	,	PUNCT
fcis-25103	179	19	but	but	CCONJ
fcis-25103	179	20	in	in	ADP
fcis-25103	179	21	other	other	ADJ
fcis-25103	179	22	circumstances	circumstance	NOUN
fcis-25103	179	23	it	it	PRON
fcis-25103	179	24	might	might	AUX
fcis-25103	179	25	be	be	AUX
fcis-25103	179	26	ineffective	ineffective	ADJ
fcis-25103	179	27	.	.	PUNCT
fcis-25103	180	1	in	in	ADP
fcis-25103	180	2	reality	reality	NOUN
fcis-25103	180	3	,	,	PUNCT
fcis-25103	180	4	the	the	DET
fcis-25103	180	5	defender	defender	NOUN
fcis-25103	180	6	can	can	AUX
fcis-25103	180	7	not	not	PART
fcis-25103	180	8	assume	assume	VERB
fcis-25103	180	9	the	the	DET
fcis-25103	180	10	specific	specific	ADJ
fcis-25103	180	11	way	way	NOUN
fcis-25103	180	12	of	of	ADP
fcis-25103	180	13	the	the	DET
fcis-25103	180	14	attack	attack	NOUN
fcis-25103	180	15	and	and	CCONJ
fcis-25103	180	16	therefore	therefore	ADV
fcis-25103	180	17	can	can	AUX
fcis-25103	180	18	not	not	PART
fcis-25103	180	19	set	set	VERB
fcis-25103	180	20	the	the	DET
fcis-25103	180	21	optimal	optimal	ADJ
fcis-25103	180	22	training	training	NOUN
fcis-25103	180	23	parameters	parameter	NOUN
fcis-25103	180	24	.	.	PUNCT
fcis-25103	181	1	next	next	ADV
fcis-25103	181	2	,	,	PUNCT
fcis-25103	181	3	we	we	PRON
fcis-25103	181	4	study	study	VERB
fcis-25103	181	5	defenses	defense	NOUN
fcis-25103	181	6	against	against	ADP
fcis-25103	181	7	backdoor	backdoor	NOUN
fcis-25103	181	8	attacks	attack	NOUN
fcis-25103	181	9	with	with	ADP
fcis-25103	181	10	dp	dp	PROPN
fcis-25103	181	11	.	.	PUNCT
fcis-25103	182	1	our	our	PRON
fcis-25103	182	2	algorithm	algorithm	NOUN
fcis-25103	182	3	is	be	AUX
fcis-25103	182	4	based	base	VERB
fcis-25103	182	5	on	on	ADP
fcis-25103	182	6	user	user	NOUN
fcis-25103	182	7	-	-	PUNCT
fcis-25103	182	8	level	level	NOUN
fcis-25103	182	9	dp	dp	NOUN
fcis-25103	182	10	proposed	propose	VERB
fcis-25103	182	11	by	by	ADP
fcis-25103	182	12	mcmahan	mcmahan	PROPN
fcis-25103	183	1	[	[	X
fcis-25103	183	2	13	13	NUM
fcis-25103	183	3	]	]	PUNCT
fcis-25103	183	4	,	,	PUNCT
fcis-25103	183	5	which	which	PRON
fcis-25103	183	6	clips	clip	VERB
fcis-25103	183	7	the	the	DET
fcis-25103	183	8	model	model	NOUN
fcis-25103	183	9	update	update	NOUN
fcis-25103	183	10	computed	compute	VERB
fcis-25103	183	11	at	at	ADP
fcis-25103	183	12	each	each	DET
fcis-25103	183	13	batch	batch	NOUN
fcis-25103	183	14	of	of	ADP
fcis-25103	183	15	the	the	DET
fcis-25103	183	16	data	datum	NOUN
fcis-25103	183	17	,	,	PUNCT
fcis-25103	183	18	and	and	CCONJ
fcis-25103	183	19	then	then	ADV
fcis-25103	183	20	perturbs	perturb	VERB
fcis-25103	183	21	the	the	DET
fcis-25103	183	22	aggregated	aggregate	VERB
fcis-25103	183	23	update	update	NOUN
fcis-25103	183	24	at	at	ADP
fcis-25103	183	25	the	the	DET
fcis-25103	183	26	server	server	NOUN
fcis-25103	183	27	.	.	PUNCT
fcis-25103	184	1	the	the	DET
fcis-25103	184	2	result	result	NOUN
fcis-25103	184	3	of	of	ADP
fcis-25103	184	4	clipping	clip	VERB
fcis-25103	184	5	at	at	ADP
fcis-25103	184	6	each	each	DET
fcis-25103	184	7	batch	batch	NOUN
fcis-25103	184	8	is	be	AUX
fcis-25103	184	9	better	well	ADJ
fcis-25103	184	10	than	than	ADP
fcis-25103	184	11	that	that	PRON
fcis-25103	184	12	of	of	ADP
fcis-25103	184	13	clipping	clip	VERB
fcis-25103	184	14	at	at	ADP
fcis-25103	184	15	each	each	DET
fcis-25103	184	16	round	round	NOUN
fcis-25103	185	1	[	[	X
fcis-25103	185	2	12	12	NUM
fcis-25103	185	3	]	]	PUNCT
fcis-25103	185	4	.	.	PUNCT
fcis-25103	186	1	because	because	SCONJ
fcis-25103	186	2	a	a	DET
fcis-25103	186	3	round	round	NOUN
fcis-25103	186	4	contains	contain	VERB
fcis-25103	186	5	multiple	multiple	ADJ
fcis-25103	186	6	epochs	epoch	NOUN
fcis-25103	186	7	and	and	CCONJ
fcis-25103	186	8	an	an	DET
fcis-25103	186	9	epoch	epoch	NOUN
fcis-25103	186	10	contains	contain	VERB
fcis-25103	186	11	multiple	multiple	ADJ
fcis-25103	186	12	batches	batch	NOUN
fcis-25103	186	13	,	,	PUNCT
fcis-25103	186	14	the	the	DET
fcis-25103	186	15	cumulative	cumulative	ADJ
fcis-25103	186	16	update	update	NOUN
fcis-25103	186	17	in	in	ADP
fcis-25103	186	18	a	a	DET
fcis-25103	186	19	round	round	NOUN
fcis-25103	186	20	will	will	AUX
fcis-25103	186	21	be	be	AUX
fcis-25103	186	22	very	very	ADV
fcis-25103	186	23	large	large	ADJ
fcis-25103	186	24	,	,	PUNCT
fcis-25103	186	25	and	and	CCONJ
fcis-25103	186	26	the	the	DET
fcis-25103	186	27	clipping	clip	VERB
fcis-25103	186	28	threshold	threshold	NOUN
fcis-25103	186	29	should	should	AUX
fcis-25103	186	30	also	also	ADV
fcis-25103	186	31	be	be	AUX
fcis-25103	186	32	set	set	VERB
fcis-25103	186	33	very	very	ADV
fcis-25103	186	34	large	large	ADJ
fcis-25103	186	35	in	in	ADP
fcis-25103	186	36	order	order	NOUN
fcis-25103	186	37	not	not	PART
fcis-25103	186	38	to	to	PART
fcis-25103	186	39	affect	affect	VERB
fcis-25103	186	40	the	the	DET
fcis-25103	186	41	model	model	NOUN
fcis-25103	186	42	accuracy	accuracy	NOUN
fcis-25103	186	43	.	.	PUNCT
fcis-25103	187	1	if	if	SCONJ
fcis-25103	187	2	clipping	clip	VERB
fcis-25103	187	3	at	at	ADP
fcis-25103	187	4	each	each	DET
fcis-25103	187	5	batch	batch	NOUN
fcis-25103	187	6	,	,	PUNCT
fcis-25103	187	7	the	the	DET
fcis-25103	187	8	threshold	threshold	NOUN
fcis-25103	187	9	could	could	AUX
fcis-25103	187	10	be	be	AUX
fcis-25103	187	11	a	a	DET
fcis-25103	187	12	small	small	ADJ
fcis-25103	187	13	value	value	NOUN
fcis-25103	187	14	,	,	PUNCT
fcis-25103	187	15	hence	hence	ADV
fcis-25103	187	16	injecting	inject	VERB
fcis-25103	187	17	less	less	ADJ
fcis-25103	187	18	noise	noise	NOUN
fcis-25103	187	19	.	.	PUNCT
fcis-25103	188	1	previous	previous	ADJ
fcis-25103	188	2	work	work	NOUN
fcis-25103	188	3	[	[	X
fcis-25103	188	4	15	15	NUM
fcis-25103	188	5	]	]	PUNCT
fcis-25103	188	6	showed	show	VERB
fcis-25103	188	7	that	that	SCONJ
fcis-25103	188	8	userlevel	userlevel	ADJ
fcis-25103	188	9	dp	dp	NOUN
fcis-25103	188	10	could	could	AUX
fcis-25103	188	11	defend	defend	VERB
fcis-25103	188	12	against	against	ADP
fcis-25103	188	13	backdoor	backdoor	NOUN
fcis-25103	188	14	attacks	attack	NOUN
fcis-25103	188	15	.	.	PUNCT
fcis-25103	189	1	however	however	ADV
fcis-25103	189	2	,	,	PUNCT
fcis-25103	189	3	this	this	DET
fcis-25103	189	4	method	method	NOUN
fcis-25103	189	5	still	still	ADV
fcis-25103	189	6	leads	lead	VERB
fcis-25103	189	7	to	to	ADP
fcis-25103	189	8	a	a	DET
fcis-25103	189	9	great	great	ADJ
fcis-25103	189	10	loss	loss	NOUN
fcis-25103	189	11	of	of	ADP
fcis-25103	189	12	the	the	DET
fcis-25103	189	13	main	main	ADJ
fcis-25103	189	14	task	task	NOUN
fcis-25103	189	15	accuracy	accuracy	NOUN
fcis-25103	189	16	.	.	PUNCT
fcis-25103	190	1	algorithm	algorithm	NOUN
fcis-25103	190	2	1	1	NUM
fcis-25103	190	3	differential	differential	NOUN
fcis-25103	190	4	privacy	privacy	NOUN
fcis-25103	190	5	with	with	ADP
fcis-25103	190	6	cnd	cnd	PROPN
fcis-25103	190	7	in	in	ADP
fcis-25103	190	8	federated	federated	ADJ
fcis-25103	190	9	learning	learning	NOUN
fcis-25103	190	10	.	.	PUNCT
fcis-25103	191	1	input	input	NOUN
fcis-25103	191	2	:	:	PUNCT
fcis-25103	191	3	z	z	X
fcis-25103	191	4	:	:	PUNCT
fcis-25103	191	5	noise	noise	NOUN
fcis-25103	191	6	scale	scale	NOUN
fcis-25103	191	7	,	,	PUNCT
fcis-25103	191	8	ϵ	ϵ	X
fcis-25103	191	9	:	:	PUNCT
fcis-25103	191	10	target	target	VERB
fcis-25103	191	11	privacy	privacy	NOUN
fcis-25103	191	12	budget	budget	NOUN
fcis-25103	191	13	,	,	PUNCT
fcis-25103	191	14	δ	δ	PROPN
fcis-25103	191	15	:	:	PUNCT
fcis-25103	191	16	target	target	NOUN
fcis-25103	191	17	delta	delta	NOUN
fcis-25103	191	18	,	,	PUNCT
fcis-25103	191	19	γ	γ	X
fcis-25103	191	20	:	:	PUNCT
fcis-25103	191	21	decay	decay	NOUN
fcis-25103	191	22	coefficient	coefficient	NOUN
fcis-25103	191	23	,	,	PUNCT
fcis-25103	191	24	m	m	PRON
fcis-25103	191	25	:	:	PUNCT
fcis-25103	191	26	number	number	NOUN
fcis-25103	191	27	of	of	ADP
fcis-25103	191	28	clients	client	NOUN
fcis-25103	191	29	per	per	ADP
fcis-25103	191	30	round	round	NOUN
fcis-25103	191	31	,	,	PUNCT
fcis-25103	191	32	n	n	CCONJ
fcis-25103	191	33	:	:	PUNCT
fcis-25103	191	34	number	number	NOUN
fcis-25103	191	35	of	of	ADP
fcis-25103	191	36	total	total	ADJ
fcis-25103	191	37	clients	client	NOUN
fcis-25103	191	38	;	;	PUNCT
fcis-25103	191	39	output	output	NOUN
fcis-25103	191	40	:	:	PUNCT
fcis-25103	191	41	global	global	ADJ
fcis-25103	191	42	model	model	PROPN
fcis-25103	191	43	θ	θ	PROPN
fcis-25103	191	44	;	;	PUNCT
fcis-25103	191	45	1	1	NUM
fcis-25103	191	46	:	:	PUNCT
fcis-25103	191	47	procedure	procedure	NOUN
fcis-25103	191	48	sever	sever	VERB
fcis-25103	191	49	execution	execution	NOUN
fcis-25103	191	50	2	2	NUM
fcis-25103	191	51	:	:	PUNCT
fcis-25103	191	52	initialize	initialize	VERB
fcis-25103	191	53	:	:	PUNCT
fcis-25103	191	54	model	model	NOUN
fcis-25103	191	55	θ0	θ0	PROPN
fcis-25103	191	56	,	,	PUNCT
fcis-25103	191	57	clip	clip	PROPN
fcis-25103	191	58	norm	norm	PROPN
fcis-25103	191	59	c0	c0	PROPN
fcis-25103	191	60	,	,	PUNCT
fcis-25103	191	61	moments	moment	NOUN
fcis-25103	191	62	account	account	VERB
fcis-25103	191	63	ma(δ	ma(δ	PROPN
fcis-25103	191	64	,	,	PUNCT
fcis-25103	191	65	m	m	PROPN
fcis-25103	191	66	,	,	PUNCT
fcis-25103	191	67	n	n	CCONJ
fcis-25103	191	68	)	)	PUNCT
fcis-25103	191	69	;	;	PUNCT
fcis-25103	192	1	3	3	X
fcis-25103	192	2	:	:	PUNCT
fcis-25103	192	3	for	for	ADP
fcis-25103	192	4	each	each	DET
fcis-25103	192	5	round	round	NOUN
fcis-25103	192	6	t	t	PROPN
fcis-25103	192	7	=	=	SYM
fcis-25103	192	8	0	0	NUM
fcis-25103	192	9	,	,	PUNCT
fcis-25103	192	10	1	1	NUM
fcis-25103	192	11	,	,	PUNCT
fcis-25103	192	12	2	2	NUM
fcis-25103	192	13	,	,	PUNCT
fcis-25103	192	14	...	...	PUNCT
fcis-25103	192	15	do	do	VERB
fcis-25103	192	16	4	4	NUM
fcis-25103	192	17	:	:	PUNCT
fcis-25103	192	18	if	if	SCONJ
fcis-25103	192	19	ϵ	ϵ	X
fcis-25103	192	20	<	<	X
fcis-25103	192	21	ma.get_privacy_spent	ma.get_privacy_spent	PROPN
fcis-25103	192	22	(	(	PUNCT
fcis-25103	192	23	)	)	PUNCT
fcis-25103	192	24	then	then	ADV
fcis-25103	192	25	5	5	NUM
fcis-25103	192	26	:	:	PUNCT
fcis-25103	192	27	return	return	VERB
fcis-25103	192	28	θt	θt	PRON
fcis-25103	192	29	6	6	NUM
fcis-25103	192	30	:	:	PUNCT
fcis-25103	192	31	zt	zt	PROPN
fcis-25103	192	32	←	←	PROPN
fcis-25103	192	33	random	random	ADJ
fcis-25103	192	34	set	set	NOUN
fcis-25103	192	35	of	of	ADP
fcis-25103	192	36	m	m	PROPN
fcis-25103	192	37	clients	client	NOUN
fcis-25103	192	38	;	;	PUNCT
fcis-25103	192	39	7	7	NUM
fcis-25103	192	40	:	:	PUNCT
fcis-25103	192	41	for	for	SCONJ
fcis-25103	192	42	each	each	DET
fcis-25103	192	43	client	client	NOUN
fcis-25103	192	44	k	k	PROPN
fcis-25103	192	45	∈	∈	PROPN
fcis-25103	192	46	zt	zt	PROPN
fcis-25103	192	47	in	in	ADP
fcis-25103	192	48	parallel	parallel	ADJ
fcis-25103	192	49	do	do	VERB
fcis-25103	192	50	8	8	NUM
fcis-25103	192	51	:	:	PUNCT
fcis-25103	192	52	∆k	∆k	PROPN
fcis-25103	192	53	t+1	t+1	PROPN
fcis-25103	192	54	←	←	PROPN
fcis-25103	192	55	client	client	PROPN
fcis-25103	192	56	update(k	update(k	PROPN
fcis-25103	192	57	,	,	PUNCT
fcis-25103	192	58	θt	θt	PROPN
fcis-25103	192	59	,	,	PUNCT
fcis-25103	192	60	ct	ct	PROPN
fcis-25103	192	61	)	)	PUNCT
fcis-25103	192	62	9	9	NUM
fcis-25103	192	63	:	:	PUNCT
fcis-25103	192	64	σ	σ	NOUN
fcis-25103	192	65	=	=	PUNCT
fcis-25103	193	1	z	z	PROPN
fcis-25103	193	2	/	/	SYM
fcis-25103	193	3	m	m	VERB
fcis-25103	193	4	10	10	NUM
fcis-25103	193	5	:	:	PUNCT
fcis-25103	193	6	θt+1	θt+1	NUM
fcis-25103	193	7	←	←	PROPN
fcis-25103	193	8	θt	θt	PROPN
fcis-25103	194	1	+	+	CCONJ
fcis-25103	194	2	∑i∆i	∑i∆i	PROPN
fcis-25103	194	3	t+1	t+1	PROPN
fcis-25103	194	4	/	/	SYM
fcis-25103	194	5	m	m	PROPN
fcis-25103	194	6	+	+	NUM
fcis-25103	194	7	n	n	CCONJ
fcis-25103	194	8	(	(	PUNCT
fcis-25103	194	9	0	0	NUM
fcis-25103	194	10	,	,	PUNCT
fcis-25103	194	11	(	(	PUNCT
fcis-25103	194	12	ct	ct	NOUN
fcis-25103	194	13	·	·	PUNCT
fcis-25103	194	14	σ)2	σ)2	NOUN
fcis-25103	194	15	)	)	PUNCT
fcis-25103	194	16	11	11	NUM
fcis-25103	194	17	:	:	PUNCT
fcis-25103	194	18	ma.accumulate_spent_privacy(z	ma.accumulate_spent_privacy(z	NOUN
fcis-25103	194	19	)	)	PUNCT
fcis-25103	194	20	12	12	NUM
fcis-25103	194	21	:	:	PUNCT
fcis-25103	194	22	ct+1	ct+1	NUM
fcis-25103	194	23	←	←	PROPN
fcis-25103	194	24	new	new	PROPN
fcis-25103	194	25	threshold(ct	threshold(ct	PROPN
fcis-25103	194	26	,	,	PUNCT
fcis-25103	194	27	γ	γ	PROPN
fcis-25103	194	28	,	,	PUNCT
fcis-25103	194	29	t	t	PROPN
fcis-25103	194	30	)	)	PUNCT
fcis-25103	194	31	13	13	NUM
fcis-25103	194	32	:	:	PUNCT
fcis-25103	194	33	function	function	NOUN
fcis-25103	194	34	client	client	NOUN
fcis-25103	194	35	update(k	update(k	PROPN
fcis-25103	194	36	,	,	PUNCT
fcis-25103	194	37	θt	θt	PROPN
fcis-25103	194	38	,	,	PUNCT
fcis-25103	194	39	ct	ct	PROPN
fcis-25103	194	40	)	)	PUNCT
fcis-25103	194	41	14	14	NUM
fcis-25103	194	42	:	:	PUNCT
fcis-25103	194	43	θ	θ	PROPN
fcis-25103	194	44	←	←	PROPN
fcis-25103	194	45	θt	θt	PROPN
fcis-25103	194	46	15	15	NUM
fcis-25103	194	47	:	:	PUNCT
fcis-25103	194	48	for	for	ADP
fcis-25103	194	49	each	each	DET
fcis-25103	194	50	local	local	ADJ
fcis-25103	194	51	epoch	epoch	NOUN
fcis-25103	195	1	i	i	NOUN
fcis-25103	195	2	=	=	NOUN
fcis-25103	195	3	1	1	NUM
fcis-25103	195	4	,	,	PUNCT
fcis-25103	195	5	2	2	NUM
fcis-25103	195	6	,	,	PUNCT
fcis-25103	195	7	...	...	PUNCT
fcis-25103	195	8	,	,	PUNCT
fcis-25103	195	9	e	e	PRON
fcis-25103	195	10	do	do	VERB
fcis-25103	195	11	16	16	NUM
fcis-25103	195	12	:	:	PUNCT
fcis-25103	195	13	for	for	ADP
fcis-25103	195	14	batch	batch	NOUN
fcis-25103	195	15	b	b	PROPN
fcis-25103	195	16	∈	∈	PROPN
fcis-25103	195	17	b	b	NOUN
fcis-25103	195	18	do	do	AUX
fcis-25103	195	19	17	17	NUM
fcis-25103	195	20	:	:	PUNCT
fcis-25103	196	1	θ	θ	PROPN
fcis-25103	196	2	←	←	PROPN
fcis-25103	196	3	θ	θ	X
fcis-25103	196	4	-η	-η	SYM
fcis-25103	196	5	l(θ	l(θ	PROPN
fcis-25103	196	6	,	,	PUNCT
fcis-25103	196	7	b	b	NOUN
fcis-25103	196	8	)	)	PUNCT
fcis-25103	196	9	18	18	NUM
fcis-25103	196	10	:	:	PUNCT
fcis-25103	196	11	∆	∆	PROPN
fcis-25103	196	12	←	←	PROPN
fcis-25103	196	13	θ	θ	PROPN
fcis-25103	196	14	θt	θt	PROPN
fcis-25103	196	15	19	19	NUM
fcis-25103	196	16	:	:	PUNCT
fcis-25103	197	1	θ	θ	PROPN
fcis-25103	197	2	←	←	PROPN
fcis-25103	197	3	θt	θt	PROPN
fcis-25103	197	4	+	+	PROPN
fcis-25103	197	5	∆·min(1	∆·min(1	PROPN
fcis-25103	197	6	,	,	PUNCT
fcis-25103	197	7	ct	ct	PROPN
fcis-25103	197	8	/	/	SYM
fcis-25103	197	9	||∆||2	||∆||2	NOUN
fcis-25103	197	10	)	)	PUNCT
fcis-25103	197	11	20	20	NUM
fcis-25103	197	12	:	:	PUNCT
fcis-25103	197	13	return	return	VERB
fcis-25103	197	14	θ	θ	PROPN
fcis-25103	197	15	θt	θt	ADJ
fcis-25103	197	16	in	in	ADP
fcis-25103	197	17	order	order	NOUN
fcis-25103	197	18	to	to	PART
fcis-25103	197	19	further	far	ADV
fcis-25103	197	20	improve	improve	VERB
fcis-25103	197	21	the	the	DET
fcis-25103	197	22	accuracy	accuracy	NOUN
fcis-25103	197	23	of	of	ADP
fcis-25103	197	24	the	the	DET
fcis-25103	197	25	model	model	NOUN
fcis-25103	197	26	while	while	SCONJ
fcis-25103	197	27	defending	defend	VERB
fcis-25103	197	28	against	against	ADP
fcis-25103	197	29	backdoor	backdoor	NOUN
fcis-25103	197	30	attacks	attack	NOUN
fcis-25103	197	31	,	,	PUNCT
fcis-25103	197	32	we	we	PRON
fcis-25103	197	33	propose	propose	VERB
fcis-25103	197	34	a	a	DET
fcis-25103	197	35	method	method	NOUN
fcis-25103	197	36	,	,	PUNCT
fcis-25103	197	37	termed	term	VERB
fcis-25103	197	38	clip	clip	NOUN
fcis-25103	197	39	norm	norm	NOUN
fcis-25103	197	40	decay	decay	NOUN
fcis-25103	197	41	(	(	PUNCT
fcis-25103	197	42	cnd	cnd	PROPN
fcis-25103	197	43	)	)	PUNCT
fcis-25103	197	44	,	,	PUNCT
fcis-25103	197	45	to	to	PART
fcis-25103	197	46	decrease	decrease	VERB
fcis-25103	197	47	the	the	DET
fcis-25103	197	48	clipping	clip	VERB
fcis-25103	197	49	threshold	threshold	NOUN
fcis-25103	197	50	of	of	ADP
fcis-25103	197	51	model	model	NOUN
fcis-25103	197	52	updates	update	NOUN
fcis-25103	197	53	in	in	ADP
fcis-25103	197	54	dp	dp	NOUN
fcis-25103	197	55	as	as	SCONJ
fcis-25103	197	56	the	the	DET
fcis-25103	197	57	training	training	NOUN
fcis-25103	197	58	goes	go	VERB
fcis-25103	197	59	on	on	ADP
fcis-25103	197	60	.	.	PUNCT
fcis-25103	198	1	concretely	concretely	ADV
fcis-25103	198	2	,	,	PUNCT
fcis-25103	198	3	we	we	PRON
fcis-25103	198	4	initialize	initialize	VERB
fcis-25103	198	5	a	a	DET
fcis-25103	198	6	clip	clip	NOUN
fcis-25103	198	7	norm	norm	NOUN
fcis-25103	198	8	threshold	threshold	NOUN
fcis-25103	198	9	c0	c0	PROPN
fcis-25103	198	10	before	before	ADP
fcis-25103	198	11	the	the	DET
fcis-25103	198	12	training	training	NOUN
fcis-25103	198	13	starts	start	NOUN
fcis-25103	198	14	and	and	CCONJ
fcis-25103	198	15	send	send	VERB
fcis-25103	198	16	the	the	DET
fcis-25103	198	17	threshold	threshold	NOUN
fcis-25103	198	18	along	along	ADP
fcis-25103	198	19	with	with	ADP
fcis-25103	198	20	the	the	DET
fcis-25103	198	21	global	global	ADJ
fcis-25103	198	22	model	model	NOUN
fcis-25103	198	23	to	to	ADP
fcis-25103	198	24	selected	select	VERB
fcis-25103	198	25	clients	client	NOUN
fcis-25103	198	26	at	at	ADP
fcis-25103	198	27	each	each	DET
fcis-25103	198	28	round	round	NOUN
fcis-25103	198	29	.	.	PUNCT
fcis-25103	199	1	the	the	DET
fcis-25103	199	2	clients	client	NOUN
fcis-25103	199	3	will	will	AUX
fcis-25103	199	4	compute	compute	VERB
fcis-25103	199	5	their	their	PRON
fcis-25103	199	6	local	local	ADJ
fcis-25103	199	7	model	model	NOUN
fcis-25103	199	8	update	update	NOUN
fcis-25103	199	9	at	at	ADP
fcis-25103	199	10	each	each	DET
fcis-25103	199	11	batch	batch	NOUN
fcis-25103	199	12	and	and	CCONJ
fcis-25103	199	13	clip	clip	VERB
fcis-25103	199	14	the	the	DET
fcis-25103	199	15	update	update	NOUN
fcis-25103	199	16	using	use	VERB
fcis-25103	199	17	the	the	DET
fcis-25103	199	18	threshold	threshold	NOUN
fcis-25103	199	19	c0	c0	NOUN
fcis-25103	199	20	if	if	SCONJ
fcis-25103	199	21	the	the	DET
fcis-25103	199	22	norm	norm	NOUN
fcis-25103	199	23	of	of	ADP
fcis-25103	199	24	update	update	NOUN
fcis-25103	199	25	exceeds	exceed	VERB
fcis-25103	199	26	it	it	PRON
fcis-25103	199	27	.	.	PUNCT
fcis-25103	200	1	as	as	ADP
fcis-25103	200	2	the	the	DET
fcis-25103	200	3	number	number	NOUN
fcis-25103	200	4	of	of	ADP
fcis-25103	200	5	rounds	round	NOUN
fcis-25103	200	6	increases	increase	NOUN
fcis-25103	200	7	,	,	PUNCT
fcis-25103	200	8	the	the	DET
fcis-25103	200	9	server	server	NOUN
fcis-25103	200	10	will	will	AUX
fcis-25103	200	11	decrease	decrease	VERB
fcis-25103	200	12	the	the	DET
fcis-25103	200	13	threshold	threshold	NOUN
fcis-25103	200	14	to	to	ADP
fcis-25103	200	15	a	a	DET
fcis-25103	200	16	new	new	ADJ
fcis-25103	200	17	value	value	NOUN
fcis-25103	200	18	ct	ct	PROPN
fcis-25103	200	19	,	,	PUNCT
fcis-25103	200	20	and	and	CCONJ
fcis-25103	200	21	send	send	VERB
fcis-25103	200	22	it	it	PRON
fcis-25103	200	23	to	to	ADP
fcis-25103	200	24	selected	select	VERB
fcis-25103	200	25	clients	client	NOUN
fcis-25103	200	26	in	in	ADP
fcis-25103	200	27	the	the	DET
fcis-25103	200	28	later	later	ADJ
fcis-25103	200	29	rounds	round	NOUN
fcis-25103	200	30	.	.	PUNCT
fcis-25103	201	1	the	the	DET
fcis-25103	201	2	whole	whole	ADJ
fcis-25103	201	3	algorithm	algorithm	NOUN
fcis-25103	201	4	is	be	AUX
fcis-25103	201	5	illustrated	illustrate	VERB
fcis-25103	201	6	in	in	ADP
fcis-25103	201	7	alg	alg	PROPN
fcis-25103	201	8	.	.	PROPN
fcis-25103	202	1	1	1	NUM
fcis-25103	202	2	,	,	PUNCT
fcis-25103	202	3	where	where	SCONJ
fcis-25103	202	4	we	we	PRON
fcis-25103	202	5	use	use	VERB
fcis-25103	202	6	moments	moment	NOUN
fcis-25103	202	7	account	account	NOUN
fcis-25103	203	1	[	[	X
fcis-25103	203	2	10	10	NUM
fcis-25103	203	3	]	]	PUNCT
fcis-25103	203	4	to	to	PART
fcis-25103	203	5	compute	compute	VERB
fcis-25103	203	6	the	the	DET
fcis-25103	203	7	privacy	privacy	NOUN
fcis-25103	203	8	budget	budget	NOUN
fcis-25103	203	9	spent	spend	VERB
fcis-25103	203	10	at	at	ADP
fcis-25103	203	11	the	the	DET
fcis-25103	203	12	beginning	beginning	NOUN
fcis-25103	203	13	of	of	ADP
fcis-25103	203	14	each	each	DET
fcis-25103	203	15	round	round	NOUN
fcis-25103	203	16	,	,	PUNCT
fcis-25103	203	17	and	and	CCONJ
fcis-25103	203	18	accumulate	accumulate	VERB
fcis-25103	203	19	the	the	DET
fcis-25103	203	20	privacy	privacy	NOUN
fcis-25103	203	21	loss	loss	NOUN
fcis-25103	203	22	after	after	ADP
fcis-25103	203	23	each	each	DET
fcis-25103	203	24	round	round	NOUN
fcis-25103	203	25	.	.	PUNCT
fcis-25103	204	1	algorithm	algorithm	NOUN
fcis-25103	204	2	2	2	NUM
fcis-25103	204	3	computing	compute	VERB
fcis-25103	204	4	new	new	ADJ
fcis-25103	204	5	threshold	threshold	NOUN
fcis-25103	204	6	by	by	ADP
fcis-25103	204	7	cnd	cnd	PROPN
fcis-25103	204	8	.	.	PROPN
fcis-25103	205	1	1	1	NUM
fcis-25103	205	2	:	:	PUNCT
fcis-25103	205	3	function	function	VERB
fcis-25103	205	4	new	new	PROPN
fcis-25103	205	5	threshold(ct	threshold(ct	PROPN
fcis-25103	205	6	,	,	PUNCT
fcis-25103	205	7	γ	γ	PROPN
fcis-25103	205	8	,	,	PUNCT
fcis-25103	205	9	t	t	PROPN
fcis-25103	205	10	)	)	PUNCT
fcis-25103	205	11	2	2	NUM
fcis-25103	205	12	:	:	PUNCT
fcis-25103	205	13	ct+1	ct+1	NUM
fcis-25103	205	14	←	←	PROPN
fcis-25103	205	15	γ	γ	PROPN
fcis-25103	205	16	·	·	SYM
fcis-25103	205	17	ct	ct	PROPN
fcis-25103	205	18	3	3	NUM
fcis-25103	205	19	:	:	PUNCT
fcis-25103	205	20	if	if	SCONJ
fcis-25103	205	21	t	t	PROPN
fcis-25103	205	22	<	<	X
fcis-25103	205	23	10	10	NUM
fcis-25103	205	24	or	or	CCONJ
fcis-25103	205	25	t	t	NOUN
fcis-25103	205	26	=	=	SYM
fcis-25103	205	27	50	50	NUM
fcis-25103	205	28	,	,	PUNCT
fcis-25103	205	29	100	100	NUM
fcis-25103	205	30	,	,	PUNCT
fcis-25103	205	31	...	...	PUNCT
fcis-25103	206	1	then	then	ADV
fcis-25103	206	2	4	4	X
fcis-25103	206	3	:	:	PUNCT
fcis-25103	206	4	c	c	PROPN
fcis-25103	206	5	←	←	PROPN
fcis-25103	207	1	∑i||∆i	∑i||∆i	PROPN
fcis-25103	207	2	t+1||2	t+1||2	PROPN
fcis-25103	207	3	/	/	SYM
fcis-25103	207	4	m	m	PROPN
fcis-25103	207	5	+	+	NUM
fcis-25103	207	6	n	n	CCONJ
fcis-25103	207	7	(	(	PUNCT
fcis-25103	207	8	0	0	NUM
fcis-25103	207	9	,	,	PUNCT
fcis-25103	207	10	(	(	PUNCT
fcis-25103	207	11	ct	ct	NOUN
fcis-25103	207	12	·	·	PUNCT
fcis-25103	207	13	σ)2	σ)2	NOUN
fcis-25103	207	14	)	)	PUNCT
fcis-25103	207	15	5	5	NUM
fcis-25103	207	16	:	:	PUNCT
fcis-25103	207	17	ma.accumulate_spent_privacy(z	ma.accumulate_spent_privacy(z	NOUN
fcis-25103	207	18	)	)	PUNCT
fcis-25103	207	19	6	6	NUM
fcis-25103	207	20	:	:	PUNCT
fcis-25103	207	21	if	if	SCONJ
fcis-25103	207	22	c	c	PROPN
fcis-25103	207	23	<	<	X
fcis-25103	207	24	ct+1	ct+1	PROPN
fcis-25103	207	25	then	then	ADV
fcis-25103	207	26	7	7	NUM
fcis-25103	207	27	:	:	PUNCT
fcis-25103	207	28	ct+1	ct+1	NUM
fcis-25103	207	29	←	←	PROPN
fcis-25103	207	30	c	c	PROPN
fcis-25103	207	31	8	8	NUM
fcis-25103	207	32	:	:	PUNCT
fcis-25103	207	33	return	return	VERB
fcis-25103	207	34	ct+1	ct+1	PRON
fcis-25103	207	35	our	our	PRON
fcis-25103	207	36	intuition	intuition	NOUN
fcis-25103	207	37	is	be	AUX
fcis-25103	207	38	based	base	VERB
fcis-25103	207	39	on	on	ADP
fcis-25103	207	40	the	the	DET
fcis-25103	207	41	fact	fact	NOUN
fcis-25103	207	42	that	that	SCONJ
fcis-25103	207	43	,	,	PUNCT
fcis-25103	207	44	as	as	ADP
fcis-25103	207	45	the	the	DET
fcis-25103	207	46	number	number	NOUN
fcis-25103	207	47	of	of	ADP
fcis-25103	207	48	rounds	round	NOUN
fcis-25103	207	49	increases	increase	NOUN
fcis-25103	207	50	,	,	PUNCT
fcis-25103	207	51	the	the	DET
fcis-25103	207	52	norm	norm	NOUN
fcis-25103	207	53	of	of	ADP
fcis-25103	207	54	model	model	NOUN
fcis-25103	207	55	update	update	NOUN
fcis-25103	207	56	gradually	gradually	ADV
fcis-25103	207	57	decreases	decrease	VERB
fcis-25103	207	58	,	,	PUNCT
fcis-25103	207	59	as	as	SCONJ
fcis-25103	207	60	shown	show	VERB
fcis-25103	207	61	in	in	ADP
fcis-25103	207	62	fig	fig	NOUN
fcis-25103	207	63	.	.	PUNCT
fcis-25103	208	1	3	3	X
fcis-25103	208	2	.	.	PUNCT
fcis-25103	208	3	the	the	DET
fcis-25103	208	4	reasons	reason	NOUN
fcis-25103	208	5	are	be	AUX
fcis-25103	208	6	as	as	SCONJ
fcis-25103	208	7	follows	follow	VERB
fcis-25103	208	8	:	:	PUNCT
fcis-25103	208	9	i	i	X
fcis-25103	208	10	)	)	PUNCT
fcis-25103	208	11	the	the	DET
fcis-25103	208	12	decrease	decrease	NOUN
fcis-25103	208	13	of	of	ADP
fcis-25103	208	14	the	the	DET
fcis-25103	208	15	loss	loss	NOUN
fcis-25103	208	16	leads	lead	VERB
fcis-25103	208	17	to	to	ADP
fcis-25103	208	18	the	the	DET
fcis-25103	208	19	reduction	reduction	NOUN
fcis-25103	208	20	of	of	ADP
fcis-25103	208	21	the	the	DET
fcis-25103	208	22	gradient	gradient	NOUN
fcis-25103	208	23	;	;	PUNCT
fcis-25103	208	24	ii	ii	X
fcis-25103	208	25	)	)	PUNCT
fcis-25103	208	26	the	the	DET
fcis-25103	208	27	learning	learn	VERB
fcis-25103	208	28	rate	rate	NOUN
fcis-25103	208	29	decays	decay	VERB
fcis-25103	208	30	gradually	gradually	ADV
fcis-25103	208	31	.	.	PUNCT
fcis-25103	209	1	a	a	DET
fcis-25103	209	2	smaller	small	ADJ
fcis-25103	209	3	clipping	clip	VERB
fcis-25103	209	4	threshold	threshold	NOUN
fcis-25103	209	5	means	mean	VERB
fcis-25103	209	6	less	less	ADJ
fcis-25103	209	7	noise	noise	NOUN
fcis-25103	209	8	injected	inject	VERB
fcis-25103	209	9	and	and	CCONJ
fcis-25103	209	10	a	a	DET
fcis-25103	209	11	higher	high	ADJ
fcis-25103	209	12	model	model	NOUN
fcis-25103	209	13	accuracy	accuracy	NOUN
fcis-25103	209	14	.	.	PUNCT
fcis-25103	210	1	therefore	therefore	ADV
fcis-25103	210	2	,	,	PUNCT
fcis-25103	210	3	we	we	PRON
fcis-25103	210	4	propose	propose	VERB
fcis-25103	210	5	to	to	PART
fcis-25103	210	6	decrease	decrease	VERB
fcis-25103	210	7	the	the	DET
fcis-25103	210	8	clipping	clipping	NOUN
fcis-25103	210	9	threshold	threshold	NOUN
fcis-25103	210	10	as	as	SCONJ
fcis-25103	210	11	the	the	DET
fcis-25103	210	12	training	training	NOUN
fcis-25103	210	13	goes	go	VERB
fcis-25103	210	14	on	on	ADP
fcis-25103	210	15	.	.	PUNCT
fcis-25103	211	1	since	since	SCONJ
fcis-25103	211	2	we	we	PRON
fcis-25103	211	3	do	do	AUX
fcis-25103	211	4	not	not	PART
fcis-25103	211	5	change	change	VERB
fcis-25103	211	6	σ	σ	NOUN
fcis-25103	211	7	in	in	ADP
fcis-25103	211	8	gaussian	gaussian	ADJ
fcis-25103	211	9	mechanism	mechanism	NOUN
fcis-25103	211	10	,	,	PUNCT
fcis-25103	211	11	our	our	PRON
fcis-25103	211	12	algorithm	algorithm	NOUN
fcis-25103	211	13	can	can	AUX
fcis-25103	211	14	obtain	obtain	VERB
fcis-25103	211	15	the	the	DET
fcis-25103	211	16	same	same	ADJ
fcis-25103	211	17	privacy	privacy	NOUN
fcis-25103	211	18	guarantee	guarantee	NOUN
fcis-25103	211	19	as	as	ADP
fcis-25103	211	20	the	the	DET
fcis-25103	211	21	original	original	ADJ
fcis-25103	211	22	dp	dp	NOUN
fcis-25103	211	23	.	.	PROPN
fcis-25103	211	24	alg	alg	PROPN
fcis-25103	211	25	.	.	PROPN
fcis-25103	212	1	2	2	NUM
fcis-25103	212	2	describes	describe	VERB
fcis-25103	212	3	the	the	DET
fcis-25103	212	4	process	process	NOUN
fcis-25103	212	5	of	of	ADP
fcis-25103	212	6	computing	compute	VERB
fcis-25103	212	7	a	a	DET
fcis-25103	212	8	new	new	ADJ
fcis-25103	212	9	threshold	threshold	NOUN
fcis-25103	212	10	after	after	ADP
fcis-25103	212	11	each	each	DET
fcis-25103	212	12	round	round	NOUN
fcis-25103	212	13	.	.	PUNCT
fcis-25103	213	1	the	the	DET
fcis-25103	213	2	server	server	NOUN
fcis-25103	213	3	first	first	ADV
fcis-25103	213	4	multiplies	multiplie	NOUN
fcis-25103	213	5	the	the	DET
fcis-25103	213	6	threshold	threshold	NOUN
fcis-25103	213	7	by	by	ADP
fcis-25103	213	8	the	the	DET
fcis-25103	213	9	decay	decay	NOUN
fcis-25103	213	10	coefficient	coefficient	NOUN
fcis-25103	213	11	as	as	ADP
fcis-25103	213	12	a	a	DET
fcis-25103	213	13	default	default	NOUN
fcis-25103	213	14	value	value	NOUN
fcis-25103	213	15	,	,	PUNCT
fcis-25103	213	16	and	and	CCONJ
fcis-25103	213	17	then	then	ADV
fcis-25103	213	18	calculates	calculate	VERB
fcis-25103	213	19	the	the	DET
fcis-25103	213	20	average	average	ADJ
fcis-25103	213	21	norm	norm	NOUN
fcis-25103	213	22	of	of	ADP
fcis-25103	213	23	each	each	DET
fcis-25103	213	24	client	client	NOUN
fcis-25103	213	25	’s	’s	PART
fcis-25103	213	26	update	update	NOUN
fcis-25103	213	27	.	.	PUNCT
fcis-25103	214	1	if	if	SCONJ
fcis-25103	214	2	the	the	DET
fcis-25103	214	3	average	average	ADJ
fcis-25103	214	4	norm	norm	NOUN
fcis-25103	214	5	is	be	AUX
fcis-25103	214	6	smaller	small	ADJ
fcis-25103	214	7	than	than	ADP
fcis-25103	214	8	the	the	DET
fcis-25103	214	9	default	default	NOUN
fcis-25103	214	10	value	value	NOUN
fcis-25103	214	11	,	,	PUNCT
fcis-25103	214	12	the	the	DET
fcis-25103	214	13	server	server	NOUN
fcis-25103	214	14	will	will	AUX
fcis-25103	214	15	set	set	VERB
fcis-25103	214	16	it	it	PRON
fcis-25103	214	17	as	as	ADP
fcis-25103	214	18	the	the	DET
fcis-25103	214	19	new	new	ADJ
fcis-25103	214	20	threshold	threshold	NOUN
fcis-25103	214	21	.	.	PUNCT
fcis-25103	215	1	since	since	SCONJ
fcis-25103	215	2	the	the	DET
fcis-25103	215	3	model	model	NOUN
fcis-25103	215	4	updates	update	NOUN
fcis-25103	215	5	are	be	AUX
fcis-25103	215	6	clipped	clip	VERB
fcis-25103	215	7	before	before	ADP
fcis-25103	215	8	uploading	uploading	NOUN
fcis-25103	215	9	,	,	PUNCT
fcis-25103	215	10	the	the	DET
fcis-25103	215	11	average	average	ADJ
fcis-25103	215	12	norm	norm	NOUN
fcis-25103	215	13	will	will	AUX
fcis-25103	215	14	be	be	AUX
fcis-25103	215	15	no	no	ADV
fcis-25103	215	16	greater	great	ADJ
fcis-25103	215	17	than	than	ADP
fcis-25103	215	18	the	the	DET
fcis-25103	215	19	current	current	ADJ
fcis-25103	215	20	threshold	threshold	NOUN
fcis-25103	215	21	.	.	PUNCT
fcis-25103	216	1	the	the	DET
fcis-25103	216	2	purpose	purpose	NOUN
fcis-25103	216	3	of	of	ADP
fcis-25103	216	4	this	this	DET
fcis-25103	216	5	step	step	NOUN
fcis-25103	216	6	is	be	AUX
fcis-25103	216	7	to	to	PART
fcis-25103	216	8	make	make	VERB
fcis-25103	216	9	the	the	DET
fcis-25103	216	10	threshold	threshold	NOUN
fcis-25103	216	11	adaptively	adaptively	ADV
fcis-25103	216	12	drop	drop	VERB
fcis-25103	216	13	.	.	PUNCT
fcis-25103	217	1	if	if	SCONJ
fcis-25103	217	2	the	the	DET
fcis-25103	217	3	initial	initial	ADJ
fcis-25103	217	4	threshold	threshold	NOUN
fcis-25103	217	5	is	be	AUX
fcis-25103	217	6	too	too	ADV
fcis-25103	217	7	large	large	ADJ
fcis-25103	217	8	,	,	PUNCT
fcis-25103	217	9	the	the	DET
fcis-25103	217	10	average	average	ADJ
fcis-25103	217	11	norm	norm	NOUN
fcis-25103	217	12	will	will	AUX
fcis-25103	217	13	be	be	AUX
fcis-25103	217	14	much	much	ADV
fcis-25103	217	15	lower	low	ADJ
fcis-25103	217	16	than	than	ADP
fcis-25103	217	17	the	the	DET
fcis-25103	217	18	default	default	NOUN
fcis-25103	217	19	value	value	NOUN
fcis-25103	217	20	,	,	PUNCT
fcis-25103	217	21	so	so	CCONJ
fcis-25103	217	22	the	the	DET
fcis-25103	217	23	threshold	threshold	NOUN
fcis-25103	217	24	will	will	AUX
fcis-25103	217	25	decrease	decrease	VERB
fcis-25103	217	26	rapidly	rapidly	ADV
fcis-25103	217	27	.	.	PUNCT
fcis-25103	218	1	accordingly	accordingly	ADV
fcis-25103	218	2	,	,	PUNCT
fcis-25103	218	3	if	if	SCONJ
fcis-25103	218	4	the	the	DET
fcis-25103	218	5	initial	initial	ADJ
fcis-25103	218	6	threshold	threshold	NOUN
fcis-25103	218	7	is	be	AUX
fcis-25103	218	8	small	small	ADJ
fcis-25103	218	9	,	,	PUNCT
fcis-25103	218	10	most	most	ADJ
fcis-25103	218	11	updates	update	NOUN
fcis-25103	218	12	will	will	AUX
fcis-25103	218	13	be	be	AUX
fcis-25103	218	14	clipped	clip	VERB
fcis-25103	218	15	and	and	CCONJ
fcis-25103	218	16	the	the	DET
fcis-25103	218	17	clipping	clip	VERB
fcis-25103	218	18	threshold	threshold	NOUN
fcis-25103	218	19	will	will	AUX
fcis-25103	218	20	drop	drop	VERB
fcis-25103	218	21	slowly	slowly	ADV
fcis-25103	218	22	.	.	PUNCT
fcis-25103	219	1	the	the	DET
fcis-25103	219	2	clipping	clip	VERB
fcis-25103	219	3	threshold	threshold	NOUN
fcis-25103	219	4	falls	fall	VERB
fcis-25103	219	5	in	in	ADP
fcis-25103	219	6	a	a	DET
fcis-25103	219	7	reasonable	reasonable	ADJ
fcis-25103	219	8	range	range	NOUN
fcis-25103	219	9	after	after	ADP
fcis-25103	219	10	the	the	DET
fcis-25103	219	11	first	first	ADJ
fcis-25103	219	12	few	few	ADJ
fcis-25103	219	13	rounds	round	NOUN
fcis-25103	219	14	,	,	PUNCT
fcis-25103	219	15	and	and	CCONJ
fcis-25103	219	16	then	then	ADV
fcis-25103	219	17	only	only	ADV
fcis-25103	219	18	needs	need	VERB
fcis-25103	219	19	to	to	PART
fcis-25103	219	20	be	be	AUX
fcis-25103	219	21	adjusted	adjust	VERB
fcis-25103	219	22	at	at	ADP
fcis-25103	219	23	certain	certain	ADJ
fcis-25103	219	24	intervals	interval	NOUN
fcis-25103	219	25	.	.	PUNCT
fcis-25103	220	1	the	the	DET
fcis-25103	220	2	average	average	ADJ
fcis-25103	220	3	norm	norm	NOUN
fcis-25103	220	4	is	be	AUX
fcis-25103	220	5	also	also	ADV
fcis-25103	220	6	perturbed	perturb	VERB
fcis-25103	220	7	so	so	ADV
fcis-25103	220	8	as	as	SCONJ
fcis-25103	220	9	not	not	PART
fcis-25103	220	10	to	to	PART
fcis-25103	220	11	reveal	reveal	VERB
fcis-25103	220	12	privacy	privacy	NOUN
fcis-25103	220	13	,	,	PUNCT
fcis-25103	220	14	but	but	CCONJ
fcis-25103	220	15	the	the	DET
fcis-25103	220	16	scale	scale	NOUN
fcis-25103	220	17	of	of	ADP
fcis-25103	220	18	noise	noise	NOUN
fcis-25103	220	19	can	can	AUX
fcis-25103	220	20	be	be	AUX
fcis-25103	220	21	different	different	ADJ
fcis-25103	220	22	from	from	ADP
fcis-25103	220	23	alg	alg	PROPN
fcis-25103	220	24	.	.	PUNCT
fcis-25103	221	1	1	1	NUM
fcis-25103	221	2	.	.	X
fcis-25103	221	3	4.2	4.2	NUM
fcis-25103	221	4	.	.	PUNCT
fcis-25103	222	1	theoretical	theoretical	ADJ
fcis-25103	222	2	analysis	analysis	NOUN
fcis-25103	222	3	in	in	ADP
fcis-25103	222	4	our	our	PRON
fcis-25103	222	5	method	method	NOUN
fcis-25103	222	6	,	,	PUNCT
fcis-25103	222	7	the	the	DET
fcis-25103	222	8	perturbing	perturbing	NOUN
fcis-25103	222	9	process	process	NOUN
fcis-25103	222	10	is	be	AUX
fcis-25103	222	11	conducted	conduct	VERB
fcis-25103	222	12	at	at	ADP
fcis-25103	222	13	the	the	DET
fcis-25103	222	14	server	server	NOUN
fcis-25103	222	15	and	and	CCONJ
fcis-25103	222	16	does	do	AUX
fcis-25103	222	17	not	not	PART
fcis-25103	222	18	rely	rely	VERB
fcis-25103	222	19	on	on	ADP
fcis-25103	222	20	clients	client	NOUN
fcis-25103	222	21	.	.	PUNCT
fcis-25103	223	1	besides	besides	SCONJ
fcis-25103	223	2	,	,	PUNCT
fcis-25103	223	3	if	if	SCONJ
fcis-25103	223	4	the	the	DET
fcis-25103	223	5	attacker	attacker	NOUN
fcis-25103	223	6	refuses	refuse	VERB
fcis-25103	223	7	to	to	PART
fcis-25103	223	8	clip	clip	VERB
fcis-25103	223	9	its	its	PRON
fcis-25103	223	10	update	update	NOUN
fcis-25103	223	11	with	with	ADP
fcis-25103	223	12	the	the	DET
fcis-25103	223	13	given	give	VERB
fcis-25103	223	14	threshold	threshold	NOUN
fcis-25103	223	15	,	,	PUNCT
fcis-25103	223	16	it	it	PRON
fcis-25103	223	17	will	will	AUX
fcis-25103	223	18	be	be	AUX
fcis-25103	223	19	detected	detect	VERB
fcis-25103	223	20	immediately	immediately	ADV
fcis-25103	223	21	.	.	PUNCT
fcis-25103	224	1	hence	hence	ADV
fcis-25103	224	2	,	,	PUNCT
fcis-25103	224	3	the	the	DET
fcis-25103	224	4	malicious	malicious	ADJ
fcis-25103	224	5	clients	client	NOUN
fcis-25103	224	6	can	can	AUX
fcis-25103	224	7	not	not	PART
fcis-25103	224	8	quit	quit	VERB
fcis-25103	224	9	dp	dp	NOUN
fcis-25103	224	10	by	by	ADP
fcis-25103	224	11	skipping	skip	VERB
fcis-25103	224	12	the	the	DET
fcis-25103	224	13	process	process	NOUN
fcis-25103	224	14	of	of	ADP
fcis-25103	224	15	clipping	clip	VERB
fcis-25103	224	16	and	and	CCONJ
fcis-25103	224	17	perturbing	perturb	VERB
fcis-25103	224	18	their	their	PRON
fcis-25103	224	19	updates	update	NOUN
fcis-25103	224	20	.	.	PUNCT
fcis-25103	225	1	next	next	ADV
fcis-25103	225	2	,	,	PUNCT
fcis-25103	225	3	we	we	PRON
fcis-25103	225	4	show	show	VERB
fcis-25103	225	5	that	that	SCONJ
fcis-25103	225	6	our	our	PRON
fcis-25103	225	7	algorithm	algorithm	NOUN
fcis-25103	225	8	satisfy	satisfy	NOUN
fcis-25103	225	9	dp	dp	PROPN
fcis-25103	225	10	.	.	PUNCT
fcis-25103	225	11	theorem	theorem	PROPN
fcis-25103	225	12	2	2	NUM
fcis-25103	225	13	.	.	PUNCT
fcis-25103	225	14	dp	dp	NOUN
fcis-25103	225	15	with	with	ADP
fcis-25103	225	16	cnd	cnd	PROPN
fcis-25103	225	17	satisfies	satisfie	NOUN
fcis-25103	225	18	(	(	PUNCT
fcis-25103	225	19	ϵ,δ)-differential	ϵ,δ)-differential	PROPN
fcis-25103	225	20	privacy	privacy	NOUN
fcis-25103	225	21	.	.	PUNCT
fcis-25103	226	1	proof	proof	NOUN
fcis-25103	226	2	.	.	PUNCT
fcis-25103	227	1	in	in	ADP
fcis-25103	227	2	gaussian	gaussian	ADJ
fcis-25103	227	3	mechanism	mechanism	NOUN
fcis-25103	227	4	,	,	PUNCT
fcis-25103	227	5	noise	noise	NOUN
fcis-25103	227	6	with	with	ADP
fcis-25103	227	7	the	the	DET
fcis-25103	227	8	normal	normal	ADJ
fcis-25103	227	9	36	36	NUM
fcis-25103	227	10	distribution	distribution	NOUN
fcis-25103	227	11	n	n	CCONJ
fcis-25103	227	12	(	(	PUNCT
fcis-25103	227	13	0	0	NUM
fcis-25103	227	14	,	,	PUNCT
fcis-25103	227	15	sf	sf	PROPN
fcis-25103	227	16	2·σ2	2·σ2	NUM
fcis-25103	227	17	)	)	PUNCT
fcis-25103	227	18	is	be	AUX
fcis-25103	227	19	added	add	VERB
fcis-25103	227	20	into	into	ADP
fcis-25103	227	21	the	the	DET
fcis-25103	227	22	query	query	NOUN
fcis-25103	227	23	function	function	NOUN
fcis-25103	227	24	f	f	PROPN
fcis-25103	227	25	to	to	PART
fcis-25103	227	26	satisfy	satisfy	VERB
fcis-25103	227	27	(	(	PUNCT
fcis-25103	227	28	ϵ,δ)-dp	ϵ,δ)-dp	PROPN
fcis-25103	227	29	,	,	PUNCT
fcis-25103	227	30	where	where	SCONJ
fcis-25103	227	31	the	the	DET
fcis-25103	227	32	sensitivity	sensitivity	NOUN
fcis-25103	227	33	sf	sf	PROPN
fcis-25103	227	34	is	be	AUX
fcis-25103	227	35	the	the	DET
fcis-25103	227	36	maximum	maximum	ADJ
fcis-25103	227	37	distance	distance	NOUN
fcis-25103	227	38	of	of	ADP
fcis-25103	227	39	two	two	NUM
fcis-25103	227	40	adjacent	adjacent	ADJ
fcis-25103	227	41	datasets	dataset	NOUN
fcis-25103	227	42	’	'	PUNCT
fcis-25103	227	43	outputs	output	NOUN
fcis-25103	227	44	|f(d1	|f(d1	NUM
fcis-25103	227	45	)	)	PUNCT
fcis-25103	228	1	−	−	PROPN
fcis-25103	229	1	f(d2)|	f(d2)|	PROPN
fcis-25103	229	2	.	.	PUNCT
fcis-25103	230	1	no	no	DET
fcis-25103	230	2	matter	matter	NOUN
fcis-25103	230	3	for	for	ADP
fcis-25103	230	4	averaging	average	VERB
fcis-25103	230	5	the	the	DET
fcis-25103	230	6	model	model	NOUN
fcis-25103	230	7	updates	update	NOUN
fcis-25103	230	8	in	in	ADP
fcis-25103	230	9	alg	alg	PROPN
fcis-25103	230	10	.	.	PROPN
fcis-25103	230	11	1	1	NUM
fcis-25103	230	12	or	or	CCONJ
fcis-25103	230	13	averaging	average	VERB
fcis-25103	230	14	their	their	PRON
fcis-25103	230	15	norms	norm	NOUN
fcis-25103	230	16	in	in	ADP
fcis-25103	230	17	alg	alg	PROPN
fcis-25103	230	18	.	.	PROPN
fcis-25103	231	1	2	2	NUM
fcis-25103	231	2	,	,	PUNCT
fcis-25103	231	3	the	the	DET
fcis-25103	231	4	sensitivity	sensitivity	NOUN
fcis-25103	231	5	is	be	AUX
fcis-25103	231	6	ct	ct	PROPN
fcis-25103	231	7	/	/	SYM
fcis-25103	231	8	m.	m.	NOUN
fcis-25103	231	9	according	accord	VERB
fcis-25103	231	10	to	to	ADP
fcis-25103	231	11	the	the	DET
fcis-25103	231	12	sequential	sequential	ADJ
fcis-25103	231	13	composition	composition	NOUN
fcis-25103	231	14	theorem	theorem	NOUN
fcis-25103	231	15	of	of	ADP
fcis-25103	231	16	dp	dp	PROPN
fcis-25103	231	17	,	,	PUNCT
fcis-25103	231	18	multiple	multiple	ADJ
fcis-25103	231	19	applications	application	NOUN
fcis-25103	231	20	of	of	ADP
fcis-25103	231	21	a	a	DET
fcis-25103	231	22	dp	dp	NOUN
fcis-25103	231	23	algorithm	algorithm	NOUN
fcis-25103	231	24	still	still	ADV
fcis-25103	231	25	satisfy	satisfy	VERB
fcis-25103	231	26	dp	dp	PROPN
fcis-25103	231	27	,	,	PUNCT
fcis-25103	231	28	and	and	CCONJ
fcis-25103	231	29	the	the	DET
fcis-25103	231	30	overall	overall	ADJ
fcis-25103	231	31	algorithm	algorithm	PROPN
fcis-25103	231	32	’s	’s	PART
fcis-25103	231	33	privacy	privacy	NOUN
fcis-25103	231	34	budget	budget	NOUN
fcis-25103	231	35	is	be	AUX
fcis-25103	231	36	the	the	DET
fcis-25103	231	37	sum	sum	NOUN
fcis-25103	231	38	of	of	ADP
fcis-25103	231	39	that	that	PRON
fcis-25103	231	40	of	of	ADP
fcis-25103	231	41	every	every	DET
fcis-25103	231	42	single	single	ADJ
fcis-25103	231	43	algorithm	algorithm	NOUN
fcis-25103	231	44	.	.	PUNCT
fcis-25103	232	1	our	our	PRON
fcis-25103	232	2	algorithm	algorithm	NOUN
fcis-25103	232	3	can	can	AUX
fcis-25103	232	4	be	be	AUX
fcis-25103	232	5	divided	divide	VERB
fcis-25103	232	6	into	into	ADP
fcis-25103	232	7	two	two	NUM
fcis-25103	232	8	parts	part	NOUN
fcis-25103	232	9	,	,	PUNCT
fcis-25103	232	10	and	and	CCONJ
fcis-25103	232	11	each	each	DET
fcis-25103	232	12	part	part	NOUN
fcis-25103	232	13	uses	use	VERB
fcis-25103	232	14	moments	moment	NOUN
fcis-25103	232	15	account	account	NOUN
fcis-25103	232	16	to	to	PART
fcis-25103	232	17	accumulate	accumulate	VERB
fcis-25103	232	18	the	the	DET
fcis-25103	232	19	privacy	privacy	NOUN
fcis-25103	232	20	budget	budget	NOUN
fcis-25103	232	21	.	.	PUNCT
fcis-25103	233	1	since	since	SCONJ
fcis-25103	233	2	both	both	DET
fcis-25103	233	3	parts	part	NOUN
fcis-25103	233	4	satisfy	satisfy	VERB
fcis-25103	233	5	dp	dp	NOUN
fcis-25103	233	6	and	and	CCONJ
fcis-25103	233	7	the	the	DET
fcis-25103	233	8	privacy	privacy	NOUN
fcis-25103	233	9	budget	budget	NOUN
fcis-25103	233	10	is	be	AUX
fcis-25103	233	11	ϵ1	ϵ1	ADJ
fcis-25103	233	12	and	and	CCONJ
fcis-25103	233	13	ϵ2	ϵ2	VERB
fcis-25103	233	14	respectively	respectively	ADV
fcis-25103	233	15	,	,	PUNCT
fcis-25103	233	16	the	the	DET
fcis-25103	233	17	overall	overall	ADJ
fcis-25103	233	18	algorithm	algorithm	NOUN
fcis-25103	233	19	satisfies	satisfy	VERB
fcis-25103	233	20	dp	dp	PROPN
fcis-25103	233	21	and	and	CCONJ
fcis-25103	233	22	the	the	DET
fcis-25103	233	23	privacy	privacy	NOUN
fcis-25103	233	24	budget	budget	NOUN
fcis-25103	233	25	is	be	AUX
fcis-25103	233	26	ϵ	ϵ	X
fcis-25103	233	27	=	=	PUNCT
fcis-25103	233	28	ϵ1	ϵ1	PROPN
fcis-25103	233	29	+	+	CCONJ
fcis-25103	233	30	ϵ2	ϵ2	ADJ
fcis-25103	233	31	.	.	PUNCT
fcis-25103	234	1	similarly	similarly	ADV
fcis-25103	234	2	,	,	PUNCT
fcis-25103	234	3	the	the	DET
fcis-25103	234	4	overall	overall	ADJ
fcis-25103	234	5	δ	δ	PROPN
fcis-25103	234	6	=	=	PROPN
fcis-25103	234	7	δ1	δ1	NOUN
fcis-25103	234	8	+	+	CCONJ
fcis-25103	234	9	δ2	δ2	VERB
fcis-25103	234	10	.	.	PUNCT
fcis-25103	235	1	5	5	X
fcis-25103	235	2	.	.	X
fcis-25103	235	3	experiments	experiment	NOUN
fcis-25103	235	4	5.1	5.1	NUM
fcis-25103	235	5	.	.	PUNCT
fcis-25103	236	1	performance	performance	NOUN
fcis-25103	236	2	evaluation	evaluation	NOUN
fcis-25103	236	3	of	of	ADP
fcis-25103	236	4	cnd	cnd	PROPN
fcis-25103	236	5	in	in	ADP
fcis-25103	236	6	the	the	DET
fcis-25103	236	7	following	follow	VERB
fcis-25103	236	8	semantic	semantic	ADJ
fcis-25103	236	9	backdoor	backdoor	NOUN
fcis-25103	236	10	attack	attack	NOUN
fcis-25103	236	11	,	,	PUNCT
fcis-25103	236	12	we	we	PRON
fcis-25103	236	13	enhance	enhance	VERB
fcis-25103	236	14	the	the	DET
fcis-25103	236	15	capability	capability	NOUN
fcis-25103	236	16	of	of	ADP
fcis-25103	236	17	the	the	DET
fcis-25103	236	18	adversary	adversary	NOUN
fcis-25103	236	19	by	by	ADP
fcis-25103	236	20	assuming	assume	VERB
fcis-25103	236	21	that	that	SCONJ
fcis-25103	236	22	it	it	PRON
fcis-25103	236	23	can	can	AUX
fcis-25103	236	24	modify	modify	VERB
fcis-25103	236	25	the	the	DET
fcis-25103	236	26	training	training	NOUN
fcis-25103	236	27	data	datum	NOUN
fcis-25103	236	28	of	of	ADP
fcis-25103	236	29	the	the	DET
fcis-25103	236	30	poisoned	poison	VERB
fcis-25103	236	31	clients	client	NOUN
fcis-25103	236	32	and	and	CCONJ
fcis-25103	236	33	manipulate	manipulate	VERB
fcis-25103	236	34	the	the	DET
fcis-25103	236	35	local	local	ADJ
fcis-25103	236	36	training	training	NOUN
fcis-25103	236	37	process	process	NOUN
fcis-25103	236	38	and	and	CCONJ
fcis-25103	236	39	training	training	NOUN
fcis-25103	236	40	parameters	parameter	NOUN
fcis-25103	236	41	to	to	PART
fcis-25103	236	42	improve	improve	VERB
fcis-25103	236	43	the	the	DET
fcis-25103	236	44	learning	learning	NOUN
fcis-25103	236	45	of	of	ADP
fcis-25103	236	46	the	the	DET
fcis-25103	236	47	backdoor	backdoor	NOUN
fcis-25103	236	48	feature	feature	NOUN
fcis-25103	236	49	.	.	PUNCT
fcis-25103	237	1	the	the	DET
fcis-25103	237	2	attacker	attacker	NOUN
fcis-25103	237	3	adopts	adopt	VERB
fcis-25103	237	4	the	the	DET
fcis-25103	237	5	model	model	NOUN
fcis-25103	237	6	replacement	replacement	NOUN
fcis-25103	237	7	method	method	NOUN
fcis-25103	237	8	[	[	X
fcis-25103	237	9	18	18	NUM
fcis-25103	237	10	]	]	PUNCT
fcis-25103	237	11	,	,	PUNCT
fcis-25103	237	12	launching	launch	VERB
fcis-25103	237	13	model	model	NOUN
fcis-25103	237	14	poisoning	poisoning	NOUN
fcis-25103	237	15	attacks	attack	NOUN
fcis-25103	237	16	in	in	ADP
fcis-25103	237	17	rounds	round	NOUN
fcis-25103	237	18	250	250	NUM
fcis-25103	237	19	,	,	PUNCT
fcis-25103	237	20	270	270	NUM
fcis-25103	237	21	and	and	CCONJ
fcis-25103	237	22	290	290	NUM
fcis-25103	237	23	,	,	PUNCT
fcis-25103	237	24	and	and	CCONJ
fcis-25103	237	25	set	set	VERB
fcis-25103	237	26	the	the	DET
fcis-25103	237	27	learning	learning	NOUN
fcis-25103	237	28	rate	rate	NOUN
fcis-25103	237	29	as	as	ADP
fcis-25103	237	30	0.04	0.04	NUM
fcis-25103	237	31	and	and	CCONJ
fcis-25103	237	32	the	the	DET
fcis-25103	237	33	number	number	NOUN
fcis-25103	237	34	of	of	ADP
fcis-25103	237	35	local	local	ADJ
fcis-25103	237	36	epochs	epoch	NOUN
fcis-25103	237	37	as	as	ADP
fcis-25103	237	38	50	50	NUM
fcis-25103	237	39	.	.	PUNCT
fcis-25103	238	1	fig	fig	NOUN
fcis-25103	238	2	.	.	PUNCT
fcis-25103	239	1	6	6	NUM
fcis-25103	239	2	shows	show	VERB
fcis-25103	239	3	the	the	DET
fcis-25103	239	4	experimental	experimental	ADJ
fcis-25103	239	5	results	result	NOUN
fcis-25103	239	6	with	with	ADP
fcis-25103	239	7	different	different	ADJ
fcis-25103	239	8	numbers	number	NOUN
fcis-25103	239	9	of	of	ADP
fcis-25103	239	10	poisoned	poison	VERB
fcis-25103	239	11	clients	client	NOUN
fcis-25103	239	12	.	.	PUNCT
fcis-25103	240	1	by	by	ADP
fcis-25103	240	2	comparing	compare	VERB
fcis-25103	240	3	with	with	ADP
fcis-25103	240	4	the	the	DET
fcis-25103	240	5	result	result	NOUN
fcis-25103	240	6	of	of	ADP
fcis-25103	240	7	data	data	NOUN
fcis-25103	240	8	poisoning	poisoning	NOUN
fcis-25103	240	9	attacks	attack	NOUN
fcis-25103	240	10	(	(	PUNCT
fcis-25103	240	11	fig	fig	NOUN
fcis-25103	240	12	.	.	PUNCT
fcis-25103	240	13	2	2	NUM
fcis-25103	240	14	)	)	PUNCT
fcis-25103	240	15	,	,	PUNCT
fcis-25103	240	16	it	it	PRON
fcis-25103	240	17	can	can	AUX
fcis-25103	240	18	be	be	AUX
fcis-25103	240	19	seen	see	VERB
fcis-25103	240	20	that	that	SCONJ
fcis-25103	240	21	the	the	DET
fcis-25103	240	22	model	model	NOUN
fcis-25103	240	23	poisoning	poisoning	NOUN
fcis-25103	240	24	attack	attack	NOUN
fcis-25103	240	25	has	have	VERB
fcis-25103	240	26	stronger	strong	ADJ
fcis-25103	240	27	power	power	NOUN
fcis-25103	240	28	.	.	PUNCT
fcis-25103	241	1	for	for	ADP
fcis-25103	241	2	example	example	NOUN
fcis-25103	241	3	,	,	PUNCT
fcis-25103	241	4	when	when	SCONJ
fcis-25103	241	5	the	the	DET
fcis-25103	241	6	number	number	NOUN
fcis-25103	241	7	of	of	ADP
fcis-25103	241	8	poisoned	poison	VERB
fcis-25103	241	9	clients	client	NOUN
fcis-25103	241	10	selected	select	VERB
fcis-25103	241	11	in	in	ADP
fcis-25103	241	12	each	each	DET
fcis-25103	241	13	round	round	NOUN
fcis-25103	241	14	is	be	AUX
fcis-25103	241	15	2	2	NUM
fcis-25103	241	16	,	,	PUNCT
fcis-25103	241	17	the	the	DET
fcis-25103	241	18	success	success	NOUN
fcis-25103	241	19	rate	rate	NOUN
fcis-25103	241	20	of	of	ADP
fcis-25103	241	21	data	datum	NOUN
fcis-25103	241	22	poisoning	poisoning	NOUN
fcis-25103	241	23	attack	attack	NOUN
fcis-25103	241	24	is	be	AUX
fcis-25103	241	25	48.99	48.99	NUM
fcis-25103	241	26	%	%	NOUN
fcis-25103	241	27	.	.	PUNCT
fcis-25103	242	1	while	while	SCONJ
fcis-25103	242	2	,	,	PUNCT
fcis-25103	242	3	the	the	DET
fcis-25103	242	4	success	success	NOUN
fcis-25103	242	5	rate	rate	NOUN
fcis-25103	242	6	of	of	ADP
fcis-25103	242	7	the	the	DET
fcis-25103	242	8	model	model	NOUN
fcis-25103	242	9	poisoning	poisoning	NOUN
fcis-25103	242	10	attack	attack	NOUN
fcis-25103	242	11	can	can	AUX
fcis-25103	242	12	reach	reach	VERB
fcis-25103	242	13	60.6	60.6	NUM
fcis-25103	242	14	%	%	NOUN
fcis-25103	242	15	even	even	ADV
fcis-25103	242	16	if	if	SCONJ
fcis-25103	242	17	only	only	ADV
fcis-25103	242	18	two	two	NUM
fcis-25103	242	19	poisoned	poison	VERB
fcis-25103	242	20	clients	client	NOUN
fcis-25103	242	21	launch	launch	VERB
fcis-25103	242	22	attacks	attack	NOUN
fcis-25103	242	23	in	in	ADP
fcis-25103	242	24	three	three	NUM
fcis-25103	242	25	rounds	round	NOUN
fcis-25103	242	26	.	.	PUNCT
fcis-25103	243	1	fig	fig	NOUN
fcis-25103	243	2	6	6	NUM
fcis-25103	243	3	.	.	PUNCT
fcis-25103	243	4	model	model	NOUN
fcis-25103	243	5	accuracy	accuracy	NOUN
fcis-25103	243	6	and	and	CCONJ
fcis-25103	243	7	attack	attack	NOUN
fcis-25103	243	8	success	success	NOUN
fcis-25103	243	9	rate	rate	NOUN
fcis-25103	243	10	in	in	ADP
fcis-25103	243	11	the	the	DET
fcis-25103	243	12	model	model	NOUN
fcis-25103	243	13	poisoning	poisoning	NOUN
fcis-25103	243	14	attack	attack	NOUN
fcis-25103	243	15	on	on	ADP
fcis-25103	243	16	cifar-10	cifar-10	PROPN
fcis-25103	243	17	without	without	ADP
fcis-25103	243	18	defense	defense	NOUN
fcis-25103	243	19	we	we	PRON
fcis-25103	243	20	implement	implement	VERB
fcis-25103	243	21	dp	dp	NOUN
fcis-25103	243	22	with	with	ADP
fcis-25103	243	23	cnd	cnd	PROPN
fcis-25103	243	24	and	and	CCONJ
fcis-25103	243	25	the	the	DET
fcis-25103	243	26	original	original	ADJ
fcis-25103	243	27	dp	dp	NOUN
fcis-25103	243	28	(	(	PUNCT
fcis-25103	243	29	cdp	cdp	NOUN
fcis-25103	243	30	)	)	PUNCT
fcis-25103	243	31	to	to	PART
fcis-25103	243	32	defend	defend	VERB
fcis-25103	243	33	against	against	ADP
fcis-25103	243	34	model	model	NOUN
fcis-25103	243	35	poisoning	poisoning	NOUN
fcis-25103	243	36	attack	attack	NOUN
fcis-25103	243	37	on	on	ADP
fcis-25103	243	38	cifar-10	cifar-10	PROPN
fcis-25103	243	39	dataset	dataset	NOUN
fcis-25103	243	40	(	(	PUNCT
fcis-25103	243	41	δ	δ	NOUN
fcis-25103	243	42	=	=	SYM
fcis-25103	243	43	10−5	10−5	NUM
fcis-25103	243	44	)	)	PUNCT
fcis-25103	243	45	,	,	PUNCT
fcis-25103	243	46	in	in	ADP
fcis-25103	243	47	which	which	PRON
fcis-25103	243	48	8	8	NUM
fcis-25103	243	49	poisoned	poison	VERB
fcis-25103	243	50	clients	client	NOUN
fcis-25103	243	51	are	be	AUX
fcis-25103	243	52	selected	select	VERB
fcis-25103	243	53	in	in	ADP
fcis-25103	243	54	rounds	round	NOUN
fcis-25103	243	55	250	250	NUM
fcis-25103	243	56	,	,	PUNCT
fcis-25103	243	57	270	270	NUM
fcis-25103	243	58	and	and	CCONJ
fcis-25103	243	59	290	290	NUM
fcis-25103	243	60	,	,	PUNCT
fcis-25103	243	61	respectively	respectively	ADV
fcis-25103	243	62	.	.	PUNCT
fcis-25103	244	1	the	the	DET
fcis-25103	244	2	poisoned	poison	VERB
fcis-25103	244	3	clients	client	NOUN
fcis-25103	244	4	take	take	VERB
fcis-25103	244	5	‘	'	PUNCT
fcis-25103	244	6	trainand	trainand	NOUN
fcis-25103	244	7	scale	scale	NOUN
fcis-25103	244	8	’	'	PUNCT
fcis-25103	244	9	method	method	NOUN
fcis-25103	244	10	[	[	X
fcis-25103	244	11	18	18	NUM
fcis-25103	244	12	]	]	PUNCT
fcis-25103	244	13	during	during	ADP
fcis-25103	244	14	their	their	PRON
fcis-25103	244	15	rounds	round	NOUN
fcis-25103	244	16	and	and	CCONJ
fcis-25103	244	17	the	the	DET
fcis-25103	244	18	experimental	experimental	ADJ
fcis-25103	244	19	results	result	NOUN
fcis-25103	244	20	are	be	AUX
fcis-25103	244	21	depicted	depict	VERB
fcis-25103	244	22	in	in	ADP
fcis-25103	244	23	fig	fig	NOUN
fcis-25103	244	24	.	.	PUNCT
fcis-25103	245	1	7	7	X
fcis-25103	245	2	.	.	PUNCT
fcis-25103	245	3	(	(	PUNCT
fcis-25103	245	4	a)cdp	a)cdp	X
fcis-25103	245	5	(	(	PUNCT
fcis-25103	245	6	b)dp	b)dp	NOUN
fcis-25103	245	7	with	with	ADP
fcis-25103	245	8	cnd	cnd	PROPN
fcis-25103	245	9	fig	fig	PROPN
fcis-25103	245	10	7	7	NUM
fcis-25103	245	11	.	.	PUNCT
fcis-25103	245	12	model	model	NOUN
fcis-25103	245	13	accuracy	accuracy	NOUN
fcis-25103	245	14	and	and	CCONJ
fcis-25103	245	15	attack	attack	NOUN
fcis-25103	245	16	success	success	NOUN
fcis-25103	245	17	rate	rate	NOUN
fcis-25103	245	18	of	of	ADP
fcis-25103	245	19	cdp	cdp	NOUN
fcis-25103	245	20	and	and	CCONJ
fcis-25103	245	21	dp	dp	NOUN
fcis-25103	245	22	with	with	ADP
fcis-25103	245	23	cnd	cnd	PROPN
fcis-25103	245	24	on	on	ADP
fcis-25103	245	25	cifar-10	cifar-10	PROPN
fcis-25103	245	26	(	(	PUNCT
fcis-25103	245	27	c0	c0	NOUN
fcis-25103	245	28	=	=	PROPN
fcis-25103	245	29	0.05	0.05	NUM
fcis-25103	245	30	.	.	PUNCT
fcis-25103	246	1	ϵ	ϵ	X
fcis-25103	246	2	=	=	SYM
fcis-25103	246	3	4.13	4.13	NUM
fcis-25103	246	4	,	,	PUNCT
fcis-25103	246	5	4.72	4.72	NUM
fcis-25103	246	6	,	,	PUNCT
fcis-25103	246	7	5.50	5.50	NUM
fcis-25103	246	8	,	,	PUNCT
fcis-25103	246	9	6.35	6.35	NUM
fcis-25103	246	10	,	,	PUNCT
fcis-25103	246	11	7.17	7.17	NUM
fcis-25103	246	12	in	in	ADP
fcis-25103	246	13	cdp	cdp	NOUN
fcis-25103	246	14	)	)	PUNCT
fcis-25103	246	15	as	as	ADP
fcis-25103	246	16	fig	fig	NOUN
fcis-25103	246	17	.	.	PUNCT
fcis-25103	247	1	7	7	NUM
fcis-25103	247	2	shows	show	NOUN
fcis-25103	247	3	,	,	PUNCT
fcis-25103	247	4	there	there	PRON
fcis-25103	247	5	is	be	VERB
fcis-25103	247	6	a	a	DET
fcis-25103	247	7	trade	trade	NOUN
fcis-25103	247	8	-	-	PUNCT
fcis-25103	247	9	off	off	NOUN
fcis-25103	247	10	between	between	ADP
fcis-25103	247	11	defense	defense	NOUN
fcis-25103	247	12	efficiency	efficiency	NOUN
fcis-25103	247	13	and	and	CCONJ
fcis-25103	247	14	data	datum	NOUN
fcis-25103	247	15	utility	utility	NOUN
fcis-25103	247	16	,	,	PUNCT
fcis-25103	247	17	with	with	ADP
fcis-25103	247	18	respect	respect	NOUN
fcis-25103	247	19	to	to	ADP
fcis-25103	247	20	the	the	DET
fcis-25103	247	21	magnitude	magnitude	NOUN
fcis-25103	247	22	of	of	ADP
fcis-25103	247	23	the	the	DET
fcis-25103	247	24	noise	noise	NOUN
fcis-25103	247	25	added	add	VERB
fcis-25103	247	26	through	through	ADP
fcis-25103	247	27	dp	dp	PROPN
fcis-25103	247	28	.	.	PROPN
fcis-25103	248	1	for	for	ADP
fcis-25103	248	2	cdp	cdp	NOUN
fcis-25103	248	3	,	,	PUNCT
fcis-25103	248	4	adding	add	VERB
fcis-25103	248	5	more	more	ADJ
fcis-25103	248	6	noise	noise	NOUN
fcis-25103	248	7	helps	help	VERB
fcis-25103	248	8	to	to	PART
fcis-25103	248	9	reduce	reduce	VERB
fcis-25103	248	10	the	the	DET
fcis-25103	248	11	success	success	NOUN
fcis-25103	248	12	rate	rate	NOUN
fcis-25103	248	13	of	of	ADP
fcis-25103	248	14	backdoor	backdoor	NOUN
fcis-25103	248	15	attacks	attack	NOUN
fcis-25103	248	16	,	,	PUNCT
fcis-25103	248	17	but	but	CCONJ
fcis-25103	248	18	it	it	PRON
fcis-25103	248	19	also	also	ADV
fcis-25103	248	20	greatly	greatly	ADV
fcis-25103	248	21	brings	bring	VERB
fcis-25103	248	22	down	down	ADP
fcis-25103	248	23	the	the	DET
fcis-25103	248	24	model	model	NOUN
fcis-25103	248	25	accuracy	accuracy	NOUN
fcis-25103	248	26	.	.	PUNCT
fcis-25103	249	1	in	in	ADP
fcis-25103	249	2	the	the	DET
fcis-25103	249	3	case	case	NOUN
fcis-25103	249	4	of	of	ADP
fcis-25103	249	5	dp	dp	PROPN
fcis-25103	249	6	with	with	ADP
fcis-25103	249	7	cnd	cnd	PROPN
fcis-25103	249	8	,	,	PUNCT
fcis-25103	249	9	the	the	DET
fcis-25103	249	10	increase	increase	NOUN
fcis-25103	249	11	of	of	ADP
fcis-25103	249	12	perturbation	perturbation	NOUN
fcis-25103	249	13	does	do	AUX
fcis-25103	249	14	not	not	PART
fcis-25103	249	15	lead	lead	VERB
fcis-25103	249	16	to	to	ADP
fcis-25103	249	17	an	an	DET
fcis-25103	249	18	obvious	obvious	ADJ
fcis-25103	249	19	decrease	decrease	NOUN
fcis-25103	249	20	in	in	ADP
fcis-25103	249	21	the	the	DET
fcis-25103	249	22	model	model	NOUN
fcis-25103	249	23	accuracy	accuracy	NOUN
fcis-25103	249	24	.	.	PUNCT
fcis-25103	250	1	although	although	SCONJ
fcis-25103	250	2	cnd	cnd	PROPN
fcis-25103	250	3	spends	spend	VERB
fcis-25103	250	4	a	a	DET
fcis-25103	250	5	small	small	ADJ
fcis-25103	250	6	extra	extra	ADJ
fcis-25103	250	7	privacy	privacy	NOUN
fcis-25103	250	8	budget	budget	NOUN
fcis-25103	250	9	(	(	PUNCT
fcis-25103	250	10	1.27	1.27	NUM
fcis-25103	250	11	)	)	PUNCT
fcis-25103	250	12	,	,	PUNCT
fcis-25103	250	13	it	it	PRON
fcis-25103	250	14	achieves	achieve	VERB
fcis-25103	250	15	at	at	ADV
fcis-25103	250	16	least	least	ADV
fcis-25103	250	17	20	20	NUM
fcis-25103	250	18	%	%	NOUN
fcis-25103	250	19	higher	high	ADJ
fcis-25103	250	20	accuracy	accuracy	NOUN
fcis-25103	250	21	than	than	ADP
fcis-25103	250	22	cdp	cdp	NOUN
fcis-25103	250	23	,	,	PUNCT
fcis-25103	250	24	under	under	ADP
fcis-25103	250	25	the	the	DET
fcis-25103	250	26	same	same	ADJ
fcis-25103	250	27	privacy	privacy	NOUN
fcis-25103	250	28	budget	budget	NOUN
fcis-25103	250	29	.	.	PUNCT
fcis-25103	251	1	moreover	moreover	ADV
fcis-25103	251	2	,	,	PUNCT
fcis-25103	251	3	cnd	cnd	PROPN
fcis-25103	251	4	significantly	significantly	ADV
fcis-25103	251	5	reduces	reduce	VERB
fcis-25103	251	6	the	the	DET
fcis-25103	251	7	attack	attack	NOUN
fcis-25103	251	8	success	success	NOUN
fcis-25103	251	9	rate	rate	NOUN
fcis-25103	251	10	.	.	PUNCT
fcis-25103	252	1	from	from	ADP
fcis-25103	252	2	fig	fig	NOUN
fcis-25103	252	3	.	.	PUNCT
fcis-25103	253	1	3	3	NUM
fcis-25103	253	2	,	,	PUNCT
fcis-25103	253	3	we	we	PRON
fcis-25103	253	4	can	can	AUX
fcis-25103	253	5	learn	learn	VERB
fcis-25103	253	6	that	that	SCONJ
fcis-25103	253	7	,	,	PUNCT
fcis-25103	253	8	if	if	SCONJ
fcis-25103	253	9	the	the	DET
fcis-25103	253	10	clipping	clip	VERB
fcis-25103	253	11	threshold	threshold	NOUN
fcis-25103	253	12	in	in	ADP
fcis-25103	253	13	alg	alg	PROPN
fcis-25103	253	14	.	.	PROPN
fcis-25103	254	1	1	1	NUM
fcis-25103	254	2	is	be	AUX
fcis-25103	254	3	a	a	DET
fcis-25103	254	4	constant	constant	ADJ
fcis-25103	254	5	,	,	PUNCT
fcis-25103	254	6	the	the	DET
fcis-25103	254	7	norm	norm	NOUN
fcis-25103	254	8	of	of	ADP
fcis-25103	254	9	model	model	NOUN
fcis-25103	254	10	update	update	NOUN
fcis-25103	254	11	will	will	AUX
fcis-25103	254	12	always	always	ADV
fcis-25103	254	13	be	be	AUX
fcis-25103	254	14	smaller	small	ADJ
fcis-25103	254	15	than	than	ADP
fcis-25103	254	16	the	the	DET
fcis-25103	254	17	threshold	threshold	NOUN
fcis-25103	254	18	from	from	ADP
fcis-25103	254	19	a	a	DET
fcis-25103	254	20	specific	specific	ADJ
fcis-25103	254	21	round	round	NOUN
fcis-25103	254	22	,	,	PUNCT
fcis-25103	254	23	which	which	PRON
fcis-25103	254	24	means	mean	VERB
fcis-25103	254	25	the	the	DET
fcis-25103	254	26	update	update	NOUN
fcis-25103	254	27	will	will	AUX
fcis-25103	254	28	no	no	ADV
fcis-25103	254	29	longer	long	ADV
fcis-25103	254	30	be	be	AUX
fcis-25103	254	31	clipped	clip	VERB
fcis-25103	254	32	.	.	PUNCT
fcis-25103	255	1	however	however	ADV
fcis-25103	255	2	,	,	PUNCT
fcis-25103	255	3	in	in	ADP
fcis-25103	255	4	the	the	DET
fcis-25103	255	5	later	later	ADJ
fcis-25103	255	6	stage	stage	NOUN
fcis-25103	255	7	of	of	ADP
fcis-25103	255	8	the	the	DET
fcis-25103	255	9	training	training	NOUN
fcis-25103	255	10	,	,	PUNCT
fcis-25103	255	11	the	the	DET
fcis-25103	255	12	accuracy	accuracy	NOUN
fcis-25103	255	13	of	of	ADP
fcis-25103	255	14	the	the	DET
fcis-25103	255	15	main	main	ADJ
fcis-25103	255	16	task	task	NOUN
fcis-25103	255	17	tends	tend	VERB
fcis-25103	255	18	to	to	PART
fcis-25103	255	19	converge	converge	VERB
fcis-25103	255	20	and	and	CCONJ
fcis-25103	255	21	the	the	DET
fcis-25103	255	22	backdoor	backdoor	NOUN
fcis-25103	255	23	task	task	NOUN
fcis-25103	255	24	is	be	AUX
fcis-25103	255	25	mainly	mainly	ADV
fcis-25103	255	26	learned	learn	VERB
fcis-25103	255	27	(	(	PUNCT
fcis-25103	255	28	fig	fig	NOUN
fcis-25103	255	29	.	.	PUNCT
fcis-25103	256	1	4	4	NUM
fcis-25103	256	2	)	)	PUNCT
fcis-25103	256	3	.	.	PUNCT
fcis-25103	257	1	therefore	therefore	ADV
fcis-25103	257	2	,	,	PUNCT
fcis-25103	257	3	the	the	DET
fcis-25103	257	4	update	update	NOUN
fcis-25103	257	5	of	of	ADP
fcis-25103	257	6	poisoned	poison	VERB
fcis-25103	257	7	clients	client	NOUN
fcis-25103	257	8	is	be	AUX
fcis-25103	257	9	generally	generally	ADV
fcis-25103	257	10	greater	great	ADJ
fcis-25103	257	11	than	than	ADP
fcis-25103	257	12	that	that	PRON
fcis-25103	257	13	of	of	ADP
fcis-25103	257	14	honest	honest	ADJ
fcis-25103	257	15	clients	client	NOUN
fcis-25103	257	16	.	.	PUNCT
fcis-25103	258	1	if	if	SCONJ
fcis-25103	258	2	not	not	PART
fcis-25103	258	3	clipped	clip	VERB
fcis-25103	258	4	,	,	PUNCT
fcis-25103	258	5	the	the	DET
fcis-25103	258	6	malicious	malicious	ADJ
fcis-25103	258	7	gradient	gradient	NOUN
fcis-25103	258	8	is	be	AUX
fcis-25103	258	9	uploaded	upload	VERB
fcis-25103	258	10	to	to	ADP
fcis-25103	258	11	the	the	DET
fcis-25103	258	12	server	server	NOUN
fcis-25103	258	13	in	in	ADP
fcis-25103	258	14	its	its	PRON
fcis-25103	258	15	entirety	entirety	NOUN
fcis-25103	258	16	,	,	PUNCT
fcis-25103	258	17	playing	play	VERB
fcis-25103	258	18	a	a	DET
fcis-25103	258	19	dominant	dominant	ADJ
fcis-25103	258	20	role	role	NOUN
fcis-25103	258	21	in	in	ADP
fcis-25103	258	22	the	the	DET
fcis-25103	258	23	aggregated	aggregate	VERB
fcis-25103	258	24	gradient	gradient	NOUN
fcis-25103	258	25	.	.	PUNCT
fcis-25103	259	1	by	by	ADP
fcis-25103	259	2	contrast	contrast	NOUN
fcis-25103	259	3	,	,	PUNCT
fcis-25103	259	4	cnd	cnd	PROPN
fcis-25103	259	5	enables	enable	VERB
fcis-25103	259	6	the	the	DET
fcis-25103	259	7	model	model	NOUN
fcis-25103	259	8	update	update	NOUN
fcis-25103	259	9	to	to	PART
fcis-25103	259	10	be	be	AUX
fcis-25103	259	11	continuously	continuously	ADV
fcis-25103	259	12	clipped	clip	VERB
fcis-25103	259	13	and	and	CCONJ
fcis-25103	259	14	limits	limit	VERB
fcis-25103	259	15	the	the	DET
fcis-25103	259	16	influence	influence	NOUN
fcis-25103	259	17	of	of	ADP
fcis-25103	259	18	the	the	DET
fcis-25103	259	19	malicious	malicious	ADJ
fcis-25103	259	20	gradient	gradient	NOUN
fcis-25103	259	21	.	.	PUNCT
fcis-25103	260	1	this	this	PRON
fcis-25103	260	2	explains	explain	VERB
fcis-25103	260	3	why	why	SCONJ
fcis-25103	260	4	cnd	cnd	PROPN
fcis-25103	260	5	can	can	AUX
fcis-25103	260	6	reduce	reduce	VERB
fcis-25103	260	7	the	the	DET
fcis-25103	260	8	attack	attack	NOUN
fcis-25103	260	9	success	success	NOUN
fcis-25103	260	10	rate	rate	NOUN
fcis-25103	260	11	.	.	PUNCT
fcis-25103	261	1	5.2	5.2	NUM
fcis-25103	261	2	.	.	PUNCT
fcis-25103	261	3	comparison	comparison	NOUN
fcis-25103	261	4	in	in	ADP
fcis-25103	261	5	this	this	DET
fcis-25103	261	6	subsection	subsection	NOUN
fcis-25103	261	7	,	,	PUNCT
fcis-25103	261	8	we	we	PRON
fcis-25103	261	9	compare	compare	VERB
fcis-25103	261	10	our	our	PRON
fcis-25103	261	11	method	method	NOUN
fcis-25103	261	12	with	with	ADP
fcis-25103	261	13	state	state	NOUN
fcis-25103	261	14	-	-	PUNCT
fcis-25103	261	15	ofthe	ofthe	NOUN
fcis-25103	261	16	-	-	PUNCT
fcis-25103	261	17	art	art	NOUN
fcis-25103	261	18	defensive	defensive	ADJ
fcis-25103	261	19	mechanisms	mechanism	NOUN
fcis-25103	261	20	against	against	ADP
fcis-25103	261	21	backdoor	backdoor	NOUN
fcis-25103	261	22	attacks	attack	NOUN
fcis-25103	261	23	.	.	PUNCT
fcis-25103	262	1	we	we	PRON
fcis-25103	262	2	have	have	AUX
fcis-25103	262	3	shown	show	VERB
fcis-25103	262	4	that	that	SCONJ
fcis-25103	262	5	our	our	PRON
fcis-25103	262	6	method	method	NOUN
fcis-25103	262	7	outperforms	outperform	NOUN
fcis-25103	262	8	cdp	cdp	VERB
fcis-25103	262	9	.	.	PUNCT
fcis-25103	263	1	ldp	ldp	PROPN
fcis-25103	263	2	solution	solution	NOUN
fcis-25103	263	3	[	[	X
fcis-25103	263	4	15	15	NUM
fcis-25103	263	5	]	]	X
fcis-25103	263	6	,	,	PUNCT
fcis-25103	263	7	which	which	PRON
fcis-25103	263	8	is	be	AUX
fcis-25103	263	9	based	base	VERB
fcis-25103	263	10	on	on	ADP
fcis-25103	263	11	dp	dp	PROPN
fcis-25103	263	12	-	-	PUNCT
fcis-25103	263	13	sgd	sgd	ADJ
fcis-25103	263	14	,	,	PUNCT
fcis-25103	263	15	achieves	achieve	VERB
fcis-25103	263	16	similar	similar	ADJ
fcis-25103	263	17	results	result	NOUN
fcis-25103	263	18	as	as	SCONJ
fcis-25103	263	19	cdp	cdp	NOUN
fcis-25103	263	20	does	do	VERB
fcis-25103	263	21	,	,	PUNCT
fcis-25103	263	22	losing	lose	VERB
fcis-25103	263	23	much	much	ADJ
fcis-25103	263	24	model	model	NOUN
fcis-25103	263	25	utility	utility	NOUN
fcis-25103	263	26	.	.	PUNCT
fcis-25103	264	1	and	and	CCONJ
fcis-25103	264	2	the	the	DET
fcis-25103	264	3	poisoned	poison	VERB
fcis-25103	264	4	clients	client	NOUN
fcis-25103	264	5	can	can	AUX
fcis-25103	264	6	quit	quit	VERB
fcis-25103	264	7	ldp	ldp	PROPN
fcis-25103	264	8	,	,	PUNCT
fcis-25103	264	9	by	by	ADP
fcis-25103	264	10	skipping	skip	VERB
fcis-25103	264	11	the	the	DET
fcis-25103	264	12	process	process	NOUN
fcis-25103	264	13	of	of	ADP
fcis-25103	264	14	clipping	clip	VERB
fcis-25103	264	15	and	and	CCONJ
fcis-25103	264	16	perturbing	perturb	VERB
fcis-25103	264	17	their	their	PRON
fcis-25103	264	18	updates	update	NOUN
fcis-25103	264	19	.	.	PUNCT
fcis-25103	265	1	next	next	ADV
fcis-25103	265	2	,	,	PUNCT
fcis-25103	265	3	we	we	PRON
fcis-25103	265	4	conduct	conduct	VERB
fcis-25103	265	5	the	the	DET
fcis-25103	265	6	comparison	comparison	NOUN
fcis-25103	265	7	with	with	ADP
fcis-25103	265	8	other	other	ADJ
fcis-25103	265	9	defenses	defense	NOUN
fcis-25103	265	10	:	:	PUNCT
fcis-25103	265	11	norm	norm	NOUN
fcis-25103	265	12	bounding	bound	VERB
fcis-25103	265	13	[	[	X
fcis-25103	265	14	14	14	NUM
fcis-25103	265	15	]	]	PUNCT
fcis-25103	265	16	,	,	PUNCT
fcis-25103	265	17	weak	weak	ADJ
fcis-25103	265	18	dp	dp	NOUN
fcis-25103	266	1	[	[	X
fcis-25103	266	2	14	14	NUM
fcis-25103	266	3	]	]	PUNCT
fcis-25103	266	4	,	,	PUNCT
fcis-25103	266	5	krum	krum	PROPN
fcis-25103	267	1	[	[	X
fcis-25103	267	2	23	23	NUM
fcis-25103	267	3	]	]	PUNCT
fcis-25103	267	4	,	,	PUNCT
fcis-25103	267	5	and	and	CCONJ
fcis-25103	267	6	median	median	NOUN
fcis-25103	268	1	[	[	X
fcis-25103	268	2	24	24	NUM
fcis-25103	268	3	]	]	PUNCT
fcis-25103	268	4	.	.	PUNCT
fcis-25103	269	1	norm	norm	NOUN
fcis-25103	269	2	bounding	bound	VERB
fcis-25103	269	3	[	[	X
fcis-25103	269	4	14	14	NUM
fcis-25103	269	5	]	]	PUNCT
fcis-25103	269	6	.	.	PUNCT
fcis-25103	270	1	the	the	DET
fcis-25103	270	2	server	server	NOUN
fcis-25103	270	3	clips	clip	NOUN
fcis-25103	270	4	clients	client	NOUN
fcis-25103	270	5	’	'	PUNCT
fcis-25103	270	6	model	model	NOUN
fcis-25103	270	7	updates	update	NOUN
fcis-25103	270	8	that	that	PRON
fcis-25103	270	9	exceed	exceed	VERB
fcis-25103	270	10	a	a	DET
fcis-25103	270	11	threshold	threshold	NOUN
fcis-25103	270	12	.	.	PUNCT
fcis-25103	271	1	after	after	ADP
fcis-25103	271	2	attempting	attempt	VERB
fcis-25103	271	3	a	a	DET
fcis-25103	271	4	wide	wide	ADJ
fcis-25103	271	5	range	range	NOUN
fcis-25103	271	6	of	of	ADP
fcis-25103	271	7	values	value	NOUN
fcis-25103	271	8	,	,	PUNCT
fcis-25103	271	9	we	we	PRON
fcis-25103	271	10	set	set	VERB
fcis-25103	271	11	the	the	DET
fcis-25103	271	12	thresholds	threshold	NOUN
fcis-25103	271	13	to	to	ADP
fcis-25103	271	14	0.1	0.1	NUM
fcis-25103	271	15	and	and	CCONJ
fcis-25103	271	16	0.2	0.2	NUM
fcis-25103	271	17	for	for	ADP
fcis-25103	271	18	tasks	task	NOUN
fcis-25103	271	19	on	on	ADP
fcis-25103	271	20	cifar-10	cifar-10	PROPN
fcis-25103	271	21	and	and	CCONJ
fcis-25103	271	22	emnist	emnist	ADJ
fcis-25103	271	23	,	,	PUNCT
fcis-25103	271	24	respectively	respectively	ADV
fcis-25103	271	25	.	.	PUNCT
fcis-25103	272	1	weak	weak	ADJ
fcis-25103	272	2	dp	dp	NOUN
fcis-25103	273	1	[	[	X
fcis-25103	273	2	14	14	NUM
fcis-25103	273	3	]	]	PUNCT
fcis-25103	273	4	.	.	PUNCT
fcis-25103	274	1	the	the	DET
fcis-25103	274	2	server	server	NOUN
fcis-25103	274	3	clips	clip	NOUN
fcis-25103	274	4	the	the	DET
fcis-25103	274	5	updates	update	NOUN
fcis-25103	274	6	and	and	CCONJ
fcis-25103	274	7	adds	add	VERB
fcis-25103	274	8	slight	slight	ADJ
fcis-25103	274	9	gaussian	gaussian	ADJ
fcis-25103	274	10	noise	noise	NOUN
fcis-25103	274	11	to	to	ADP
fcis-25103	274	12	the	the	DET
fcis-25103	274	13	aggregated	aggregate	VERB
fcis-25103	274	14	update	update	NOUN
fcis-25103	274	15	.	.	PUNCT
fcis-25103	275	1	based	base	VERB
fcis-25103	275	2	on	on	ADP
fcis-25103	275	3	norm	norm	NOUN
fcis-25103	275	4	bounding	bounding	NOUN
fcis-25103	275	5	,	,	PUNCT
fcis-25103	275	6	we	we	PRON
fcis-25103	275	7	explore	explore	VERB
fcis-25103	275	8	several	several	ADJ
fcis-25103	275	9	values	value	NOUN
fcis-25103	275	10	of	of	ADP
fcis-25103	275	11	σ	σ	NOUN
fcis-25103	275	12	of	of	ADP
fcis-25103	275	13	gaussian	gaussian	ADJ
fcis-25103	275	14	noise	noise	NOUN
fcis-25103	275	15	,	,	PUNCT
fcis-25103	275	16	and	and	CCONJ
fcis-25103	275	17	set	set	VERB
fcis-25103	275	18	it	it	PRON
fcis-25103	275	19	to	to	ADP
fcis-25103	275	20	0.005	0.005	NUM
fcis-25103	275	21	for	for	ADP
fcis-25103	275	22	cifar-10	cifar-10	PROPN
fcis-25103	275	23	and	and	CCONJ
fcis-25103	275	24	0.001	0.001	NUM
fcis-25103	275	25	for	for	ADP
fcis-25103	275	26	emnist	emnist	NOUN
fcis-25103	275	27	.	.	PUNCT
fcis-25103	276	1	krum	krum	PROPN
fcis-25103	277	1	[	[	X
fcis-25103	277	2	23	23	NUM
fcis-25103	277	3	]	]	PUNCT
fcis-25103	277	4	.	.	PUNCT
fcis-25103	278	1	for	for	ADP
fcis-25103	278	2	each	each	DET
fcis-25103	278	3	client	client	NOUN
fcis-25103	278	4	’s	’s	PART
fcis-25103	278	5	update	update	NOUN
fcis-25103	278	6	∆i	∆i	PROPN
fcis-25103	278	7	,	,	PUNCT
fcis-25103	278	8	the	the	DET
fcis-25103	278	9	server	server	NOUN
fcis-25103	278	10	computes	compute	VERB
fcis-25103	278	11	the	the	DET
fcis-25103	278	12	euclidean	euclidean	ADJ
fcis-25103	278	13	distances	distance	NOUN
fcis-25103	278	14	between	between	ADP
fcis-25103	278	15	it	it	PRON
fcis-25103	278	16	and	and	CCONJ
fcis-25103	278	17	k	k	PROPN
fcis-25103	278	18	closest	close	ADJ
fcis-25103	278	19	clients	client	NOUN
fcis-25103	278	20	’	'	PUNCT
fcis-25103	278	21	updates	update	VERB
fcis-25103	278	22	to	to	ADP
fcis-25103	278	23	it	it	PRON
fcis-25103	278	24	,	,	PUNCT
fcis-25103	278	25	and	and	CCONJ
fcis-25103	278	26	then	then	ADV
fcis-25103	278	27	selects	select	VERB
fcis-25103	278	28	the	the	DET
fcis-25103	278	29	update	update	NOUN
fcis-25103	278	30	with	with	ADP
fcis-25103	278	31	the	the	DET
fcis-25103	278	32	smallest	small	ADJ
fcis-25103	278	33	sum	sum	NOUN
fcis-25103	278	34	of	of	ADP
fcis-25103	278	35	distances	distance	NOUN
fcis-25103	278	36	as	as	ADP
fcis-25103	278	37	the	the	DET
fcis-25103	278	38	global	global	ADJ
fcis-25103	278	39	update	update	NOUN
fcis-25103	278	40	.	.	PUNCT
fcis-25103	279	1	supposing	suppose	VERB
fcis-25103	279	2	at	at	ADP
fcis-25103	279	3	most	most	ADJ
fcis-25103	279	4	c	c	NOUN
fcis-25103	279	5	=	=	SYM
fcis-25103	279	6	8	8	NUM
fcis-25103	279	7	poisoned	poison	VERB
fcis-25103	279	8	clients	client	NOUN
fcis-25103	279	9	are	be	AUX
fcis-25103	279	10	selected	select	VERB
fcis-25103	279	11	,	,	PUNCT
fcis-25103	279	12	then	then	ADV
fcis-25103	279	13	k	k	PROPN
fcis-25103	279	14	is	be	AUX
fcis-25103	279	15	m	m	PROPN
fcis-25103	279	16	c	c	NOUN
fcis-25103	279	17	2	2	NUM
fcis-25103	279	18	=	=	SYM
fcis-25103	279	19	10	10	NUM
fcis-25103	279	20	.	.	PUNCT
fcis-25103	280	1	37	37	NUM
fcis-25103	280	2	(	(	PUNCT
fcis-25103	280	3	a	a	NOUN
fcis-25103	280	4	)	)	PUNCT
fcis-25103	280	5	(	(	PUNCT
fcis-25103	280	6	b	b	X
fcis-25103	280	7	)	)	PUNCT
fcis-25103	280	8	(	(	PUNCT
fcis-25103	280	9	c	c	X
fcis-25103	280	10	)	)	PUNCT
fcis-25103	280	11	(	(	PUNCT
fcis-25103	280	12	d	d	X
fcis-25103	280	13	)	)	PUNCT
fcis-25103	280	14	fig	fig	NOUN
fcis-25103	280	15	8	8	NUM
fcis-25103	280	16	.	.	PUNCT
fcis-25103	281	1	results	result	NOUN
fcis-25103	281	2	of	of	ADP
fcis-25103	281	3	different	different	ADJ
fcis-25103	281	4	defense	defense	NOUN
fcis-25103	281	5	mechanisms	mechanism	NOUN
fcis-25103	281	6	against	against	ADP
fcis-25103	281	7	semantic	semantic	ADJ
fcis-25103	281	8	backdoor	backdoor	NOUN
fcis-25103	281	9	attacks	attack	NOUN
fcis-25103	281	10	,	,	PUNCT
fcis-25103	281	11	(	(	PUNCT
fcis-25103	281	12	a	a	X
fcis-25103	281	13	)	)	PUNCT
fcis-25103	281	14	(	(	PUNCT
fcis-25103	281	15	c	c	X
fcis-25103	281	16	):	):	PUNCT
fcis-25103	281	17	model	model	NOUN
fcis-25103	281	18	accuracy	accuracy	NOUN
fcis-25103	281	19	,	,	PUNCT
fcis-25103	281	20	(	(	PUNCT
fcis-25103	281	21	b	b	X
fcis-25103	281	22	)	)	PUNCT
fcis-25103	281	23	(	(	PUNCT
fcis-25103	281	24	d	d	NOUN
fcis-25103	281	25	):	):	PUNCT
fcis-25103	281	26	attack	attack	NOUN
fcis-25103	281	27	success	success	NOUN
fcis-25103	281	28	rate	rate	NOUN
fcis-25103	281	29	(	(	PUNCT
fcis-25103	281	30	c0	c0	NOUN
fcis-25103	281	31	=	=	PROPN
fcis-25103	281	32	0.05	0.05	NUM
fcis-25103	281	33	.	.	PUNCT
fcis-25103	282	1	ϵ	ϵ	X
fcis-25103	282	2	=	=	PUNCT
fcis-25103	282	3	4.72	4.72	NUM
fcis-25103	282	4	+	+	NUM
fcis-25103	282	5	1.27	1.27	NUM
fcis-25103	282	6	=	=	NUM
fcis-25103	282	7	5.99	5.99	NUM
fcis-25103	282	8	,	,	PUNCT
fcis-25103	282	9	δ	δ	PROPN
fcis-25103	282	10	=	=	SYM
fcis-25103	282	11	10−5	10−5	NUM
fcis-25103	282	12	)	)	PUNCT
fcis-25103	282	13	median	median	NOUN
fcis-25103	283	1	[	[	X
fcis-25103	283	2	24	24	NUM
fcis-25103	283	3	]	]	PUNCT
fcis-25103	283	4	.	.	PUNCT
fcis-25103	284	1	for	for	ADP
fcis-25103	284	2	each	each	DET
fcis-25103	284	3	model	model	NOUN
fcis-25103	284	4	update	update	NOUN
fcis-25103	284	5	’s	’s	PART
fcis-25103	284	6	parameter	parameter	PROPN
fcis-25103	284	7	∆i	∆i	PROPN
fcis-25103	284	8	,	,	PUNCT
fcis-25103	284	9	j	j	PROPN
fcis-25103	284	10	,	,	PUNCT
fcis-25103	284	11	the	the	DET
fcis-25103	284	12	server	server	NOUN
fcis-25103	284	13	sorts	sort	VERB
fcis-25103	284	14	the	the	DET
fcis-25103	284	15	parameter	parameter	NOUN
fcis-25103	284	16	∆i	∆i	PROPN
fcis-25103	284	17	,	,	PUNCT
fcis-25103	284	18	j	j	PROPN
fcis-25103	284	19	of	of	ADP
fcis-25103	284	20	all	all	DET
fcis-25103	284	21	selected	select	VERB
fcis-25103	284	22	clients	client	NOUN
fcis-25103	284	23	’	'	PUNCT
fcis-25103	284	24	updates	update	NOUN
fcis-25103	284	25	and	and	CCONJ
fcis-25103	284	26	takes	take	VERB
fcis-25103	284	27	the	the	DET
fcis-25103	284	28	median	median	NOUN
fcis-25103	284	29	of	of	ADP
fcis-25103	284	30	them	they	PRON
fcis-25103	284	31	as	as	ADP
fcis-25103	284	32	the	the	DET
fcis-25103	284	33	global	global	ADJ
fcis-25103	284	34	update	update	NOUN
fcis-25103	284	35	’s	’s	PART
fcis-25103	284	36	parameter	parameter	NOUN
fcis-25103	284	37	.	.	PUNCT
fcis-25103	285	1	when	when	SCONJ
fcis-25103	285	2	there	there	PRON
fcis-25103	285	3	is	be	VERB
fcis-25103	285	4	an	an	DET
fcis-25103	285	5	even	even	ADJ
fcis-25103	285	6	number	number	NOUN
fcis-25103	285	7	of	of	ADP
fcis-25103	285	8	updates	update	NOUN
fcis-25103	285	9	,	,	PUNCT
fcis-25103	285	10	it	it	PRON
fcis-25103	285	11	takes	take	VERB
fcis-25103	285	12	the	the	DET
fcis-25103	285	13	mean	mean	NOUN
fcis-25103	285	14	of	of	ADP
fcis-25103	285	15	the	the	DET
fcis-25103	285	16	middle	middle	ADJ
fcis-25103	285	17	two	two	NUM
fcis-25103	285	18	parameters	parameter	NOUN
fcis-25103	285	19	.	.	PUNCT
fcis-25103	286	1	including	include	VERB
fcis-25103	286	2	dp	dp	PROPN
fcis-25103	286	3	with	with	ADP
fcis-25103	286	4	cnd	cnd	PROPN
fcis-25103	286	5	,	,	PUNCT
fcis-25103	286	6	we	we	PRON
fcis-25103	286	7	draw	draw	VERB
fcis-25103	286	8	the	the	DET
fcis-25103	286	9	experimental	experimental	ADJ
fcis-25103	286	10	results	result	NOUN
fcis-25103	286	11	of	of	ADP
fcis-25103	286	12	the	the	DET
fcis-25103	286	13	five	five	NUM
fcis-25103	286	14	defense	defense	NOUN
fcis-25103	286	15	mechanisms	mechanism	NOUN
fcis-25103	286	16	in	in	ADP
fcis-25103	286	17	figs	fig	NOUN
fcis-25103	286	18	.	.	PUNCT
fcis-25103	286	19	8	8	NUM
fcis-25103	286	20	and	and	CCONJ
fcis-25103	286	21	9	9	NUM
fcis-25103	286	22	,	,	PUNCT
fcis-25103	286	23	with	with	ADP
fcis-25103	286	24	different	different	ADJ
fcis-25103	286	25	numbers	number	NOUN
fcis-25103	286	26	of	of	ADP
fcis-25103	286	27	poisoned	poison	VERB
fcis-25103	286	28	clients	client	NOUN
fcis-25103	286	29	selected	select	VERB
fcis-25103	286	30	per	per	ADP
fcis-25103	286	31	round	round	NOUN
fcis-25103	286	32	.	.	PUNCT
fcis-25103	287	1	norm	norm	NOUN
fcis-25103	287	2	bounding	bounding	NOUN
fcis-25103	287	3	provides	provide	VERB
fcis-25103	287	4	a	a	DET
fcis-25103	287	5	poor	poor	ADJ
fcis-25103	287	6	defense	defense	NOUN
fcis-25103	287	7	against	against	ADP
fcis-25103	287	8	two	two	NUM
fcis-25103	287	9	kinds	kind	NOUN
fcis-25103	287	10	of	of	ADP
fcis-25103	287	11	attacks	attack	NOUN
fcis-25103	287	12	.	.	PUNCT
fcis-25103	288	1	on	on	ADP
fcis-25103	288	2	this	this	DET
fcis-25103	288	3	basis	basis	NOUN
fcis-25103	288	4	,	,	PUNCT
fcis-25103	288	5	weak	weak	ADJ
fcis-25103	288	6	dp	dp	NOUN
fcis-25103	288	7	can	can	AUX
fcis-25103	288	8	lower	lower	VERB
fcis-25103	288	9	the	the	DET
fcis-25103	288	10	success	success	NOUN
fcis-25103	288	11	rate	rate	NOUN
fcis-25103	288	12	only	only	ADV
fcis-25103	288	13	by	by	ADP
fcis-25103	288	14	a	a	DET
fcis-25103	288	15	tiny	tiny	ADJ
fcis-25103	288	16	amount	amount	NOUN
fcis-25103	288	17	.	.	PUNCT
fcis-25103	289	1	(	(	PUNCT
fcis-25103	289	2	a	a	X
fcis-25103	289	3	)	)	PUNCT
fcis-25103	289	4	(	(	PUNCT
fcis-25103	289	5	b	b	X
fcis-25103	289	6	)	)	PUNCT
fcis-25103	289	7	(	(	PUNCT
fcis-25103	289	8	c	c	X
fcis-25103	289	9	)	)	PUNCT
fcis-25103	289	10	(	(	PUNCT
fcis-25103	289	11	d	d	X
fcis-25103	289	12	)	)	PUNCT
fcis-25103	289	13	fig	fig	NOUN
fcis-25103	289	14	9	9	NUM
fcis-25103	289	15	.	.	PUNCT
fcis-25103	290	1	results	result	NOUN
fcis-25103	290	2	of	of	ADP
fcis-25103	290	3	different	different	ADJ
fcis-25103	290	4	defense	defense	NOUN
fcis-25103	290	5	mechanisms	mechanism	NOUN
fcis-25103	290	6	against	against	ADP
fcis-25103	290	7	single	single	ADJ
fcis-25103	290	8	-	-	PUNCT
fcis-25103	290	9	pixel	pixel	NOUN
fcis-25103	290	10	attacks	attack	NOUN
fcis-25103	290	11	,	,	PUNCT
fcis-25103	290	12	(	(	PUNCT
fcis-25103	290	13	a	a	X
fcis-25103	290	14	)	)	PUNCT
fcis-25103	290	15	(	(	PUNCT
fcis-25103	290	16	c	c	X
fcis-25103	290	17	):	):	PUNCT
fcis-25103	290	18	model	model	NOUN
fcis-25103	290	19	accuracy	accuracy	NOUN
fcis-25103	290	20	,	,	PUNCT
fcis-25103	290	21	(	(	PUNCT
fcis-25103	290	22	b	b	X
fcis-25103	290	23	)	)	PUNCT
fcis-25103	290	24	(	(	PUNCT
fcis-25103	290	25	d	d	NOUN
fcis-25103	290	26	):	):	PUNCT
fcis-25103	290	27	attack	attack	NOUN
fcis-25103	290	28	success	success	NOUN
fcis-25103	290	29	rate	rate	NOUN
fcis-25103	290	30	(	(	PUNCT
fcis-25103	290	31	c0	c0	NOUN
fcis-25103	290	32	=	=	NOUN
fcis-25103	290	33	0.1	0.1	NUM
fcis-25103	290	34	.	.	PUNCT
fcis-25103	291	1	ϵ	ϵ	X
fcis-25103	291	2	=	=	PUNCT
fcis-25103	291	3	4.72	4.72	NUM
fcis-25103	291	4	+	+	NUM
fcis-25103	291	5	1.27	1.27	NUM
fcis-25103	291	6	=	=	NUM
fcis-25103	291	7	5.99	5.99	NUM
fcis-25103	291	8	,	,	PUNCT
fcis-25103	291	9	δ	δ	PROPN
fcis-25103	291	10	=	=	SYM
fcis-25103	291	11	10	10	NUM
fcis-25103	291	12	-	-	SYM
fcis-25103	291	13	5	5	NUM
fcis-25103	291	14	)	)	PUNCT
fcis-25103	291	15	krum	krum	PROPN
fcis-25103	291	16	picks	pick	VERB
fcis-25103	291	17	the	the	DET
fcis-25103	291	18	gradient	gradient	NOUN
fcis-25103	291	19	with	with	ADP
fcis-25103	291	20	the	the	DET
fcis-25103	291	21	most	most	ADJ
fcis-25103	291	22	‘	'	PUNCT
fcis-25103	291	23	partners	partner	NOUN
fcis-25103	291	24	’	'	PUNCT
fcis-25103	291	25	and	and	CCONJ
fcis-25103	291	26	is	be	AUX
fcis-25103	291	27	therefore	therefore	ADV
fcis-25103	291	28	vulnerable	vulnerable	ADJ
fcis-25103	291	29	to	to	ADP
fcis-25103	291	30	collusion	collusion	NOUN
fcis-25103	291	31	.	.	PUNCT
fcis-25103	292	1	hence	hence	ADV
fcis-25103	292	2	,	,	PUNCT
fcis-25103	292	3	it	it	PRON
fcis-25103	292	4	fails	fail	VERB
fcis-25103	292	5	against	against	ADP
fcis-25103	292	6	single	single	ADJ
fcis-25103	292	7	-	-	PUNCT
fcis-25103	292	8	pixel	pixel	NOUN
fcis-25103	292	9	attacks	attack	NOUN
fcis-25103	292	10	,	,	PUNCT
fcis-25103	292	11	where	where	SCONJ
fcis-25103	292	12	attackers	attacker	NOUN
fcis-25103	292	13	modify	modify	VERB
fcis-25103	292	14	all	all	DET
fcis-25103	292	15	their	their	PRON
fcis-25103	292	16	training	training	NOUN
fcis-25103	292	17	samples	sample	NOUN
fcis-25103	292	18	in	in	ADP
fcis-25103	292	19	the	the	DET
fcis-25103	292	20	same	same	ADJ
fcis-25103	292	21	way	way	NOUN
fcis-25103	292	22	and	and	CCONJ
fcis-25103	292	23	consequently	consequently	ADV
fcis-25103	292	24	have	have	VERB
fcis-25103	292	25	similar	similar	ADJ
fcis-25103	292	26	update	update	NOUN
fcis-25103	292	27	direction	direction	NOUN
fcis-25103	292	28	.	.	PUNCT
fcis-25103	293	1	on	on	ADP
fcis-25103	293	2	the	the	DET
fcis-25103	293	3	contrary	contrary	NOUN
fcis-25103	293	4	,	,	PUNCT
fcis-25103	293	5	selecting	select	VERB
fcis-25103	293	6	the	the	DET
fcis-25103	293	7	median	median	NOUN
fcis-25103	293	8	is	be	AUX
fcis-25103	293	9	not	not	PART
fcis-25103	293	10	affected	affect	VERB
fcis-25103	293	11	by	by	ADP
fcis-25103	293	12	malicious	malicious	ADJ
fcis-25103	293	13	parameters	parameter	NOUN
fcis-25103	293	14	that	that	PRON
fcis-25103	293	15	appear	appear	VERB
fcis-25103	293	16	at	at	ADP
fcis-25103	293	17	one	one	NUM
fcis-25103	293	18	end	end	NOUN
fcis-25103	293	19	of	of	ADP
fcis-25103	293	20	the	the	DET
fcis-25103	293	21	normal	normal	ADJ
fcis-25103	293	22	range	range	NOUN
fcis-25103	293	23	,	,	PUNCT
fcis-25103	293	24	but	but	CCONJ
fcis-25103	293	25	it	it	PRON
fcis-25103	293	26	fails	fail	VERB
fcis-25103	293	27	when	when	SCONJ
fcis-25103	293	28	the	the	DET
fcis-25103	293	29	malicious	malicious	ADJ
fcis-25103	293	30	parameters	parameter	NOUN
fcis-25103	293	31	are	be	AUX
fcis-25103	293	32	scattered	scatter	VERB
fcis-25103	293	33	over	over	ADP
fcis-25103	293	34	the	the	DET
fcis-25103	293	35	whole	whole	ADJ
fcis-25103	293	36	interval	interval	NOUN
fcis-25103	293	37	.	.	PUNCT
fcis-25103	294	1	hence	hence	ADV
fcis-25103	294	2	,	,	PUNCT
fcis-25103	294	3	median	median	NOUN
fcis-25103	294	4	is	be	AUX
fcis-25103	294	5	disabled	disabled	ADJ
fcis-25103	294	6	in	in	ADP
fcis-25103	294	7	semantic	semantic	ADJ
fcis-25103	294	8	backdoor	backdoor	NOUN
fcis-25103	294	9	attacks	attack	NOUN
fcis-25103	294	10	,	,	PUNCT
fcis-25103	294	11	where	where	SCONJ
fcis-25103	294	12	attackers	attacker	NOUN
fcis-25103	294	13	are	be	AUX
fcis-25103	294	14	assigned	assign	VERB
fcis-25103	294	15	backdoored	backdoore	VERB
fcis-25103	294	16	images	image	NOUN
fcis-25103	294	17	randomly	randomly	ADV
fcis-25103	294	18	and	and	CCONJ
fcis-25103	294	19	generate	generate	VERB
fcis-25103	294	20	more	more	ADJ
fcis-25103	294	21	diverge	diverge	NOUN
fcis-25103	294	22	updates	update	NOUN
fcis-25103	294	23	.	.	PUNCT
fcis-25103	295	1	importantly	importantly	ADV
fcis-25103	295	2	,	,	PUNCT
fcis-25103	295	3	the	the	DET
fcis-25103	295	4	defender	defender	NOUN
fcis-25103	295	5	can	can	AUX
fcis-25103	295	6	not	not	PART
fcis-25103	295	7	assume	assume	VERB
fcis-25103	295	8	the	the	DET
fcis-25103	295	9	attack	attack	NOUN
fcis-25103	295	10	strategy	strategy	NOUN
fcis-25103	295	11	employed	employ	VERB
fcis-25103	295	12	by	by	ADP
fcis-25103	295	13	an	an	DET
fcis-25103	295	14	adversary	adversary	NOUN
fcis-25103	295	15	in	in	ADP
fcis-25103	295	16	real	real	ADJ
fcis-25103	295	17	life	life	NOUN
fcis-25103	295	18	,	,	PUNCT
fcis-25103	295	19	so	so	CCONJ
fcis-25103	295	20	neither	neither	DET
fcis-25103	295	21	approach	approach	NOUN
fcis-25103	295	22	can	can	AUX
fcis-25103	295	23	be	be	AUX
fcis-25103	295	24	applied	apply	VERB
fcis-25103	295	25	.	.	PUNCT
fcis-25103	296	1	different	different	ADJ
fcis-25103	296	2	from	from	ADP
fcis-25103	296	3	krum	krum	PROPN
fcis-25103	296	4	and	and	CCONJ
fcis-25103	296	5	median	median	PROPN
fcis-25103	296	6	that	that	PRON
fcis-25103	296	7	are	be	AUX
fcis-25103	296	8	designed	design	VERB
fcis-25103	296	9	for	for	ADP
fcis-25103	296	10	byzantine	byzantine	ADJ
fcis-25103	296	11	attacks	attack	NOUN
fcis-25103	296	12	,	,	PUNCT
fcis-25103	296	13	our	our	PRON
fcis-25103	296	14	method	method	NOUN
fcis-25103	296	15	is	be	AUX
fcis-25103	296	16	not	not	PART
fcis-25103	296	17	restricted	restrict	VERB
fcis-25103	296	18	to	to	ADP
fcis-25103	296	19	some	some	DET
fcis-25103	296	20	specific	specific	ADJ
fcis-25103	296	21	attack	attack	NOUN
fcis-25103	296	22	and	and	CCONJ
fcis-25103	296	23	provides	provide	VERB
fcis-25103	296	24	a	a	DET
fcis-25103	296	25	general	general	ADJ
fcis-25103	296	26	defense	defense	NOUN
fcis-25103	296	27	against	against	ADP
fcis-25103	296	28	both	both	DET
fcis-25103	296	29	backdoor	backdoor	NOUN
fcis-25103	296	30	attacks	attack	NOUN
fcis-25103	296	31	,	,	PUNCT
fcis-25103	296	32	dropping	drop	VERB
fcis-25103	296	33	the	the	DET
fcis-25103	296	34	success	success	NOUN
fcis-25103	296	35	rate	rate	NOUN
fcis-25103	296	36	close	close	ADV
fcis-25103	296	37	to	to	ADP
fcis-25103	296	38	zero	zero	NUM
fcis-25103	296	39	.	.	PUNCT
fcis-25103	297	1	although	although	SCONJ
fcis-25103	297	2	dp	dp	NOUN
fcis-25103	297	3	has	have	AUX
fcis-25103	297	4	been	be	AUX
fcis-25103	297	5	applied	apply	VERB
fcis-25103	297	6	to	to	PART
fcis-25103	297	7	defend	defend	VERB
fcis-25103	297	8	against	against	ADP
fcis-25103	297	9	backdoor	backdoor	NOUN
fcis-25103	297	10	attacks	attack	NOUN
fcis-25103	297	11	in	in	ADP
fcis-25103	297	12	early	early	ADJ
fcis-25103	297	13	works	work	NOUN
fcis-25103	297	14	,	,	PUNCT
fcis-25103	297	15	they	they	PRON
fcis-25103	297	16	either	either	CCONJ
fcis-25103	297	17	lost	lose	VERB
fcis-25103	297	18	great	great	ADJ
fcis-25103	297	19	data	datum	NOUN
fcis-25103	297	20	utility	utility	NOUN
fcis-25103	297	21	,	,	PUNCT
fcis-25103	297	22	or	or	CCONJ
fcis-25103	297	23	set	set	VERB
fcis-25103	297	24	a	a	DET
fcis-25103	297	25	tiny	tiny	ADJ
fcis-25103	297	26	noise	noise	NOUN
fcis-25103	297	27	multiplier	multiplier	ADV
fcis-25103	297	28	and	and	CCONJ
fcis-25103	297	29	obtained	obtain	VERB
fcis-25103	297	30	a	a	DET
fcis-25103	297	31	limited	limited	ADJ
fcis-25103	297	32	defensive	defensive	ADJ
fcis-25103	297	33	effect	effect	NOUN
fcis-25103	297	34	.	.	PUNCT
fcis-25103	298	1	as	as	SCONJ
fcis-25103	298	2	compared	compare	VERB
fcis-25103	298	3	above	above	ADV
fcis-25103	298	4	,	,	PUNCT
fcis-25103	298	5	due	due	ADP
fcis-25103	298	6	to	to	ADP
fcis-25103	298	7	our	our	PRON
fcis-25103	298	8	unique	unique	ADJ
fcis-25103	298	9	design	design	NOUN
fcis-25103	298	10	of	of	ADP
fcis-25103	298	11	cnd	cnd	PROPN
fcis-25103	298	12	,	,	PUNCT
fcis-25103	298	13	we	we	PRON
fcis-25103	298	14	solve	solve	VERB
fcis-25103	298	15	the	the	DET
fcis-25103	298	16	dilemma	dilemma	NOUN
fcis-25103	298	17	of	of	ADP
fcis-25103	298	18	choosing	choose	VERB
fcis-25103	298	19	perturbation	perturbation	NOUN
fcis-25103	298	20	level	level	NOUN
fcis-25103	298	21	,	,	PUNCT
fcis-25103	298	22	and	and	CCONJ
fcis-25103	298	23	achieve	achieve	VERB
fcis-25103	298	24	promising	promising	ADJ
fcis-25103	298	25	results	result	NOUN
fcis-25103	298	26	.	.	PUNCT
fcis-25103	299	1	5.3	5.3	NUM
fcis-25103	299	2	.	.	PUNCT
fcis-25103	300	1	defending	defend	VERB
fcis-25103	300	2	against	against	ADP
fcis-25103	300	3	property	property	NOUN
fcis-25103	300	4	inference	inference	NOUN
fcis-25103	300	5	attack	attack	NOUN
fcis-25103	300	6	we	we	PRON
fcis-25103	300	7	have	have	AUX
fcis-25103	300	8	demonstrated	demonstrate	VERB
fcis-25103	300	9	that	that	SCONJ
fcis-25103	300	10	cnd	cnd	PROPN
fcis-25103	300	11	has	have	VERB
fcis-25103	300	12	better	well	ADJ
fcis-25103	300	13	performance	performance	NOUN
fcis-25103	300	14	than	than	ADP
fcis-25103	300	15	the	the	DET
fcis-25103	300	16	original	original	ADJ
fcis-25103	300	17	dp	dp	NOUN
fcis-25103	300	18	when	when	SCONJ
fcis-25103	300	19	defending	defend	VERB
fcis-25103	300	20	against	against	ADP
fcis-25103	300	21	backdoor	backdoor	NOUN
fcis-25103	300	22	attacks	attack	NOUN
fcis-25103	300	23	.	.	PUNCT
fcis-25103	301	1	in	in	ADP
fcis-25103	301	2	what	what	PRON
fcis-25103	301	3	follows	follow	VERB
fcis-25103	301	4	,	,	PUNCT
fcis-25103	301	5	we	we	PRON
fcis-25103	301	6	are	be	AUX
fcis-25103	301	7	concerned	concerned	ADJ
fcis-25103	301	8	about	about	ADP
fcis-25103	301	9	whether	whether	SCONJ
fcis-25103	301	10	cnd	cnd	PROPN
fcis-25103	301	11	would	would	AUX
fcis-25103	301	12	expand	expand	VERB
fcis-25103	301	13	the	the	DET
fcis-25103	301	14	privacy	privacy	NOUN
fcis-25103	301	15	loss	loss	NOUN
fcis-25103	301	16	and	and	CCONJ
fcis-25103	301	17	damage	damage	VERB
fcis-25103	301	18	the	the	DET
fcis-25103	301	19	privacy	privacy	NOUN
fcis-25103	301	20	preservation	preservation	NOUN
fcis-25103	301	21	of	of	ADP
fcis-25103	301	22	dp	dp	PROPN
fcis-25103	301	23	.	.	PUNCT
fcis-25103	302	1	in	in	ADP
fcis-25103	302	2	theory	theory	NOUN
fcis-25103	302	3	,	,	PUNCT
fcis-25103	302	4	reducing	reduce	VERB
fcis-25103	302	5	the	the	DET
fcis-25103	302	6	clipping	clip	VERB
fcis-25103	302	7	threshold	threshold	NOUN
fcis-25103	302	8	does	do	AUX
fcis-25103	302	9	not	not	PART
fcis-25103	302	10	change	change	VERB
fcis-25103	302	11	the	the	DET
fcis-25103	302	12	privacy	privacy	NOUN
fcis-25103	302	13	guarantee	guarantee	NOUN
fcis-25103	302	14	,	,	PUNCT
fcis-25103	302	15	and	and	CCONJ
fcis-25103	302	16	our	our	PRON
fcis-25103	302	17	method	method	NOUN
fcis-25103	302	18	provides	provide	VERB
fcis-25103	302	19	an	an	DET
fcis-25103	302	20	equivalent	equivalent	ADJ
fcis-25103	302	21	capability	capability	NOUN
fcis-25103	302	22	of	of	ADP
fcis-25103	302	23	the	the	DET
fcis-25103	302	24	privacy	privacy	NOUN
fcis-25103	302	25	preservation	preservation	NOUN
fcis-25103	302	26	as	as	ADP
fcis-25103	302	27	the	the	DET
fcis-25103	302	28	original	original	ADJ
fcis-25103	302	29	dp	dp	NOUN
fcis-25103	302	30	.	.	PUNCT
fcis-25103	303	1	we	we	PRON
fcis-25103	303	2	herein	herein	VERB
fcis-25103	303	3	verify	verify	VERB
fcis-25103	303	4	this	this	DET
fcis-25103	303	5	conclusion	conclusion	NOUN
fcis-25103	303	6	through	through	ADP
fcis-25103	303	7	experiments	experiment	NOUN
fcis-25103	303	8	about	about	ADP
fcis-25103	303	9	property	property	NOUN
fcis-25103	303	10	inference	inference	NOUN
fcis-25103	303	11	attack	attack	NOUN
fcis-25103	303	12	[	[	X
fcis-25103	303	13	25	25	NUM
fcis-25103	303	14	]	]	PUNCT
fcis-25103	303	15	.	.	PUNCT
fcis-25103	304	1	property	property	NOUN
fcis-25103	304	2	inference	inference	NOUN
fcis-25103	304	3	attack	attack	NOUN
fcis-25103	304	4	is	be	AUX
fcis-25103	304	5	a	a	DET
fcis-25103	304	6	kind	kind	NOUN
fcis-25103	304	7	of	of	ADP
fcis-25103	304	8	privacy	privacy	NOUN
fcis-25103	304	9	attack	attack	NOUN
fcis-25103	304	10	whose	whose	DET
fcis-25103	304	11	goal	goal	NOUN
fcis-25103	304	12	is	be	AUX
fcis-25103	304	13	to	to	PART
fcis-25103	304	14	reveal	reveal	VERB
fcis-25103	304	15	the	the	DET
fcis-25103	304	16	properties	property	NOUN
fcis-25103	304	17	of	of	ADP
fcis-25103	304	18	data	datum	NOUN
fcis-25103	304	19	owners	owner	NOUN
fcis-25103	304	20	.	.	PUNCT
fcis-25103	305	1	the	the	DET
fcis-25103	305	2	attacker	attacker	NOUN
fcis-25103	305	3	in	in	ADP
fcis-25103	305	4	property	property	NOUN
fcis-25103	305	5	inference	inference	NOUN
fcis-25103	305	6	attack	attack	NOUN
fcis-25103	305	7	[	[	X
fcis-25103	305	8	25	25	NUM
fcis-25103	305	9	]	]	PUNCT
fcis-25103	305	10	is	be	AUX
fcis-25103	305	11	a	a	DET
fcis-25103	305	12	malicious	malicious	ADJ
fcis-25103	305	13	client	client	NOUN
fcis-25103	305	14	who	who	PRON
fcis-25103	305	15	aims	aim	VERB
fcis-25103	305	16	to	to	PART
fcis-25103	305	17	calculate	calculate	VERB
fcis-25103	305	18	the	the	DET
fcis-25103	305	19	probability	probability	NOUN
fcis-25103	305	20	that	that	SCONJ
fcis-25103	305	21	a	a	DET
fcis-25103	305	22	sample	sample	NOUN
fcis-25103	305	23	with	with	ADP
fcis-25103	305	24	a	a	DET
fcis-25103	305	25	certain	certain	ADJ
fcis-25103	305	26	property	property	NOUN
fcis-25103	305	27	is	be	AUX
fcis-25103	305	28	used	use	VERB
fcis-25103	305	29	in	in	ADP
fcis-25103	305	30	the	the	DET
fcis-25103	305	31	global	global	ADJ
fcis-25103	305	32	update	update	NOUN
fcis-25103	305	33	.	.	PUNCT
fcis-25103	306	1	it	it	PRON
fcis-25103	306	2	calculates	calculate	VERB
fcis-25103	306	3	the	the	DET
fcis-25103	306	4	aggregated	aggregated	ADJ
fcis-25103	306	5	update	update	NOUN
fcis-25103	306	6	of	of	ADP
fcis-25103	306	7	clients	client	NOUN
fcis-25103	306	8	other	other	ADJ
fcis-25103	306	9	than	than	ADP
fcis-25103	306	10	itself	itself	PRON
fcis-25103	306	11	as	as	ADP
fcis-25103	306	12	the	the	DET
fcis-25103	306	13	test	test	NOUN
fcis-25103	306	14	sample	sample	NOUN
fcis-25103	306	15	.	.	PUNCT
fcis-25103	307	1	table	table	NOUN
fcis-25103	307	2	3	3	NUM
fcis-25103	307	3	.	.	PUNCT
fcis-25103	307	4	main	main	ADJ
fcis-25103	307	5	task	task	NOUN
fcis-25103	307	6	accuracy	accuracy	NOUN
fcis-25103	307	7	and	and	CCONJ
fcis-25103	307	8	auc	auc	NOUN
fcis-25103	307	9	of	of	ADP
fcis-25103	307	10	the	the	DET
fcis-25103	307	11	property	property	NOUN
fcis-25103	307	12	inference	inference	NOUN
fcis-25103	307	13	attack	attack	NOUN
fcis-25103	307	14	in	in	ADP
fcis-25103	307	15	cases	case	NOUN
fcis-25103	307	16	of	of	ADP
fcis-25103	307	17	different	different	ADJ
fcis-25103	307	18	numbers	number	NOUN
fcis-25103	307	19	of	of	ADP
fcis-25103	307	20	clients	client	NOUN
fcis-25103	307	21	,	,	PUNCT
fcis-25103	307	22	averaged	average	VERB
fcis-25103	307	23	on	on	ADP
fcis-25103	307	24	3	3	NUM
fcis-25103	307	25	runs	run	NOUN
fcis-25103	307	26	(	(	PUNCT
fcis-25103	307	27	c0	c0	NOUN
fcis-25103	307	28	=	=	SYM
fcis-25103	307	29	0.03	0.03	NUM
fcis-25103	307	30	,	,	PUNCT
fcis-25103	307	31	δ	δ	PROPN
fcis-25103	307	32	=	=	SYM
fcis-25103	307	33	10	10	NUM
fcis-25103	307	34	-	-	SYM
fcis-25103	307	35	5	5	NUM
fcis-25103	307	36	,	,	PUNCT
fcis-25103	307	37	ϵ	ϵ	PROPN
fcis-25103	307	38	of	of	ADP
fcis-25103	307	39	cnd	cnd	PROPN
fcis-25103	307	40	=	=	PROPN
fcis-25103	307	41	6.35	6.35	NUM
fcis-25103	307	42	+	+	NUM
fcis-25103	307	43	1.27	1.27	NUM
fcis-25103	307	44	=	=	SYM
fcis-25103	307	45	7.62	7.62	NUM
fcis-25103	307	46	)	)	PUNCT
fcis-25103	307	47	clients	client	NOUN
fcis-25103	307	48	no	no	DET
fcis-25103	307	49	defense	defense	NOUN
fcis-25103	307	50	dp	dp	NOUN
fcis-25103	307	51	(	(	PUNCT
fcis-25103	307	52	ϵ	ϵ	X
fcis-25103	307	53	=	=	SYM
fcis-25103	307	54	8.0	8.0	NUM
fcis-25103	307	55	)	)	PUNCT
fcis-25103	307	56	cnd(ϵ	cnd(ϵ	PROPN
fcis-25103	307	57	=	=	NOUN
fcis-25103	307	58	7.62	7.62	NUM
fcis-25103	307	59	)	)	PUNCT
fcis-25103	307	60	acc.(%	acc.(%	ADJ
fcis-25103	307	61	)	)	PUNCT
fcis-25103	307	62	auc	auc	NOUN
fcis-25103	307	63	acc.(%	acc.(%	NOUN
fcis-25103	307	64	)	)	PUNCT
fcis-25103	307	65	auc	auc	NOUN
fcis-25103	307	66	acc.(%	acc.(%	NOUN
fcis-25103	307	67	)	)	PUNCT
fcis-25103	307	68	auc	auc	VERB
fcis-25103	307	69	2	2	NUM
fcis-25103	307	70	91.67	91.67	NUM
fcis-25103	307	71	0.81	0.81	NUM
fcis-25103	307	72	34.04	34.04	NUM
fcis-25103	307	73	0.53	0.53	NUM
fcis-25103	307	74	52.30	52.30	NUM
fcis-25103	307	75	0.50	0.50	NUM
fcis-25103	307	76	3	3	NUM
fcis-25103	307	77	92.30	92.30	NUM
fcis-25103	307	78	0.78	0.78	NUM
fcis-25103	307	79	41.40	41.40	NUM
fcis-25103	307	80	0.49	0.49	NUM
fcis-25103	307	81	65.76	65.76	NUM
fcis-25103	307	82	0.49	0.49	NUM
fcis-25103	307	83	4	4	NUM
fcis-25103	307	84	92.40	92.40	NUM
fcis-25103	307	85	0.74	0.74	NUM
fcis-25103	307	86	58.32	58.32	NUM
fcis-25103	307	87	0.53	0.53	NUM
fcis-25103	307	88	65.72	65.72	NUM
fcis-25103	307	89	0.50	0.50	NUM
fcis-25103	307	90	5	5	NUM
fcis-25103	307	91	92.03	92.03	NUM
fcis-25103	307	92	0.71	0.71	NUM
fcis-25103	307	93	62.11	62.11	NUM
fcis-25103	307	94	0.50	0.50	NUM
fcis-25103	307	95	69.44	69.44	NUM
fcis-25103	307	96	0.51	0.51	NUM
fcis-25103	307	97	we	we	PRON
fcis-25103	307	98	use	use	VERB
fcis-25103	307	99	the	the	DET
fcis-25103	307	100	labeled	label	VERB
fcis-25103	307	101	faces	face	NOUN
fcis-25103	307	102	in	in	ADP
fcis-25103	307	103	the	the	DET
fcis-25103	307	104	wild	wild	ADJ
fcis-25103	307	105	(	(	PUNCT
fcis-25103	307	106	lfw	lfw	NOUN
fcis-25103	307	107	)	)	PUNCT
fcis-25103	307	108	dataset	dataset	NOUN
fcis-25103	307	109	which	which	PRON
fcis-25103	307	110	contains	contain	VERB
fcis-25103	307	111	more	more	ADJ
fcis-25103	307	112	than	than	ADP
fcis-25103	307	113	13,000	13,000	NUM
fcis-25103	307	114	images	image	NOUN
fcis-25103	307	115	of	of	ADP
fcis-25103	307	116	faces	face	NOUN
fcis-25103	307	117	for	for	ADP
fcis-25103	307	118	around	around	ADV
fcis-25103	307	119	5,800	5,800	NUM
fcis-25103	307	120	individuals	individual	NOUN
fcis-25103	307	121	with	with	ADP
fcis-25103	307	122	property	property	NOUN
fcis-25103	307	123	labels	label	NOUN
fcis-25103	307	124	(	(	PUNCT
fcis-25103	307	125	e.g.	e.g.	ADV
fcis-25103	307	126	,	,	PUNCT
fcis-25103	307	127	gender	gender	NOUN
fcis-25103	307	128	,	,	PUNCT
fcis-25103	307	129	race	race	NOUN
fcis-25103	307	130	,	,	PUNCT
fcis-25103	307	131	age	age	NOUN
fcis-25103	307	132	,	,	PUNCT
fcis-25103	307	133	and	and	CCONJ
fcis-25103	307	134	hair	hair	NOUN
fcis-25103	307	135	color	color	NOUN
fcis-25103	307	136	)	)	PUNCT
fcis-25103	307	137	,	,	PUNCT
fcis-25103	307	138	collected	collect	VERB
fcis-25103	307	139	from	from	ADP
fcis-25103	307	140	the	the	DET
fcis-25103	307	141	web	web	NOUN
fcis-25103	307	142	.	.	PUNCT
fcis-25103	308	1	we	we	PRON
fcis-25103	308	2	use	use	VERB
fcis-25103	308	3	the	the	DET
fcis-25103	308	4	same	same	ADJ
fcis-25103	308	5	cnn	cnn	NOUN
fcis-25103	308	6	architecture	architecture	NOUN
fcis-25103	308	7	as	as	ADP
fcis-25103	308	8	[	[	X
fcis-25103	308	9	25	25	NUM
fcis-25103	308	10	]	]	PUNCT
fcis-25103	308	11	,	,	PUNCT
fcis-25103	308	12	including	include	VERB
fcis-25103	308	13	three	three	NUM
fcis-25103	308	14	spatial	spatial	ADJ
fcis-25103	308	15	convolution	convolution	NOUN
fcis-25103	308	16	layers	layer	NOUN
fcis-25103	308	17	with	with	ADP
fcis-25103	308	18	32	32	NUM
fcis-25103	308	19	,	,	PUNCT
fcis-25103	308	20	64	64	NUM
fcis-25103	308	21	,	,	PUNCT
fcis-25103	308	22	and	and	CCONJ
fcis-25103	308	23	128	128	NUM
fcis-25103	308	24	filters	filter	NOUN
fcis-25103	308	25	and	and	CCONJ
fcis-25103	308	26	maxpooling	maxpoole	VERB
fcis-25103	308	27	layers	layer	NOUN
fcis-25103	308	28	,	,	PUNCT
fcis-25103	308	29	followed	follow	VERB
fcis-25103	308	30	by	by	ADP
fcis-25103	308	31	two	two	NUM
fcis-25103	308	32	dense	dense	ADJ
fcis-25103	308	33	layers	layer	NOUN
fcis-25103	308	34	of	of	ADP
fcis-25103	308	35	size	size	NOUN
fcis-25103	308	36	256	256	NUM
fcis-25103	308	37	and	and	CCONJ
fcis-25103	308	38	2	2	NUM
fcis-25103	308	39	,	,	PUNCT
fcis-25103	308	40	respectively	respectively	ADV
fcis-25103	308	41	.	.	PUNCT
fcis-25103	309	1	the	the	DET
fcis-25103	309	2	main	main	ADJ
fcis-25103	309	3	task	task	NOUN
fcis-25103	309	4	is	be	AUX
fcis-25103	309	5	gender	gender	NOUN
fcis-25103	309	6	classification	classification	NOUN
fcis-25103	309	7	and	and	CCONJ
fcis-25103	309	8	the	the	DET
fcis-25103	309	9	inference	inference	NOUN
fcis-25103	309	10	task	task	NOUN
fcis-25103	309	11	is	be	AUX
fcis-25103	309	12	over	over	ADP
fcis-25103	309	13	race	race	NOUN
fcis-25103	309	14	.	.	PUNCT
fcis-25103	310	1	the	the	DET
fcis-25103	310	2	performance	performance	NOUN
fcis-25103	310	3	of	of	ADP
fcis-25103	310	4	the	the	DET
fcis-25103	310	5	attack	attack	NOUN
fcis-25103	310	6	is	be	AUX
fcis-25103	310	7	evaluated	evaluate	VERB
fcis-25103	310	8	by	by	ADP
fcis-25103	310	9	area	area	NOUN
fcis-25103	310	10	under	under	ADP
fcis-25103	310	11	the	the	DET
fcis-25103	310	12	curve	curve	NOUN
fcis-25103	310	13	(	(	PUNCT
fcis-25103	310	14	auc	auc	NOUN
fcis-25103	310	15	)	)	PUNCT
fcis-25103	310	16	.	.	PUNCT
fcis-25103	311	1	all	all	DET
fcis-25103	311	2	clients	client	NOUN
fcis-25103	311	3	are	be	AUX
fcis-25103	311	4	selected	select	VERB
fcis-25103	311	5	per	per	ADP
fcis-25103	311	6	round	round	NOUN
fcis-25103	311	7	(	(	PUNCT
fcis-25103	311	8	i.e.	i.e.	X
fcis-25103	311	9	,	,	PUNCT
fcis-25103	311	10	n	n	PROPN
fcis-25103	311	11	=	=	SYM
fcis-25103	311	12	m	m	NOUN
fcis-25103	311	13	)	)	PUNCT
fcis-25103	311	14	and	and	CCONJ
fcis-25103	311	15	fl	fl	NUM
fcis-25103	311	16	runs	run	NOUN
fcis-25103	311	17	for	for	ADP
fcis-25103	311	18	300	300	NUM
fcis-25103	311	19	rounds	round	NOUN
fcis-25103	311	20	.	.	PUNCT
fcis-25103	312	1	the	the	DET
fcis-25103	312	2	number	number	NOUN
fcis-25103	312	3	of	of	ADP
fcis-25103	312	4	local	local	ADJ
fcis-25103	312	5	epochs	epoch	NOUN
fcis-25103	312	6	is	be	AUX
fcis-25103	312	7	10	10	NUM
fcis-25103	312	8	.	.	PUNCT
fcis-25103	313	1	the	the	DET
fcis-25103	313	2	data	datum	NOUN
fcis-25103	313	3	are	be	AUX
fcis-25103	313	4	equally	equally	ADV
fcis-25103	313	5	distributed	distribute	VERB
fcis-25103	313	6	to	to	ADP
fcis-25103	313	7	clients	client	NOUN
fcis-25103	313	8	and	and	CCONJ
fcis-25103	313	9	only	only	ADV
fcis-25103	313	10	the	the	DET
fcis-25103	313	11	38	38	NUM
fcis-25103	313	12	attacker	attacker	NOUN
fcis-25103	313	13	and	and	CCONJ
fcis-25103	313	14	the	the	DET
fcis-25103	313	15	victim	victim	NOUN
fcis-25103	313	16	have	have	VERB
fcis-25103	313	17	data	datum	NOUN
fcis-25103	313	18	with	with	ADP
fcis-25103	313	19	the	the	DET
fcis-25103	313	20	property	property	NOUN
fcis-25103	313	21	.	.	PUNCT
fcis-25103	314	1	in	in	ADP
fcis-25103	314	2	our	our	PRON
fcis-25103	314	3	experiments	experiment	NOUN
fcis-25103	314	4	,	,	PUNCT
fcis-25103	314	5	we	we	PRON
fcis-25103	314	6	use	use	VERB
fcis-25103	314	7	alg	alg	PROPN
fcis-25103	314	8	.	.	PROPN
fcis-25103	314	9	1	1	NUM
fcis-25103	314	10	to	to	PART
fcis-25103	314	11	defend	defend	VERB
fcis-25103	314	12	against	against	ADP
fcis-25103	314	13	the	the	DET
fcis-25103	314	14	attack	attack	NOUN
fcis-25103	314	15	and	and	CCONJ
fcis-25103	314	16	compare	compare	VERB
fcis-25103	314	17	the	the	DET
fcis-25103	314	18	results	result	NOUN
fcis-25103	314	19	of	of	ADP
fcis-25103	314	20	dp	dp	NOUN
fcis-25103	314	21	with	with	ADP
fcis-25103	314	22	cnd	cnd	PROPN
fcis-25103	314	23	and	and	CCONJ
fcis-25103	314	24	the	the	DET
fcis-25103	314	25	original	original	ADJ
fcis-25103	314	26	dp	dp	NOUN
fcis-25103	314	27	.	.	PUNCT
fcis-25103	315	1	we	we	PRON
fcis-25103	315	2	also	also	ADV
fcis-25103	315	3	record	record	VERB
fcis-25103	315	4	the	the	DET
fcis-25103	315	5	results	result	NOUN
fcis-25103	315	6	of	of	ADP
fcis-25103	315	7	no	no	DET
fcis-25103	315	8	defense	defense	NOUN
fcis-25103	315	9	(	(	PUNCT
fcis-25103	315	10	without	without	ADP
fcis-25103	315	11	clipping	clip	VERB
fcis-25103	315	12	and	and	CCONJ
fcis-25103	315	13	perturbing	perturb	VERB
fcis-25103	315	14	)	)	PUNCT
fcis-25103	315	15	.	.	PUNCT
fcis-25103	316	1	experimental	experimental	ADJ
fcis-25103	316	2	results	result	NOUN
fcis-25103	316	3	are	be	AUX
fcis-25103	316	4	listed	list	VERB
fcis-25103	316	5	in	in	ADP
fcis-25103	316	6	table	table	NOUN
fcis-25103	316	7	3	3	NUM
fcis-25103	316	8	.	.	PUNCT
fcis-25103	316	9	from	from	ADP
fcis-25103	316	10	the	the	DET
fcis-25103	316	11	table	table	NOUN
fcis-25103	316	12	,	,	PUNCT
fcis-25103	316	13	we	we	PRON
fcis-25103	316	14	can	can	AUX
fcis-25103	316	15	see	see	VERB
fcis-25103	316	16	that	that	SCONJ
fcis-25103	316	17	,	,	PUNCT
fcis-25103	316	18	the	the	DET
fcis-25103	316	19	auc	auc	NOUN
fcis-25103	316	20	of	of	ADP
fcis-25103	316	21	the	the	DET
fcis-25103	316	22	attack	attack	NOUN
fcis-25103	316	23	goes	go	VERB
fcis-25103	316	24	down	down	ADP
fcis-25103	316	25	with	with	ADP
fcis-25103	316	26	the	the	DET
fcis-25103	316	27	increase	increase	NOUN
fcis-25103	316	28	of	of	ADP
fcis-25103	316	29	the	the	DET
fcis-25103	316	30	number	number	NOUN
fcis-25103	316	31	of	of	ADP
fcis-25103	316	32	clients	client	NOUN
fcis-25103	316	33	when	when	SCONJ
fcis-25103	316	34	no	no	DET
fcis-25103	316	35	defense	defense	NOUN
fcis-25103	316	36	is	be	AUX
fcis-25103	316	37	applied	apply	VERB
fcis-25103	316	38	.	.	PUNCT
fcis-25103	317	1	this	this	PRON
fcis-25103	317	2	is	be	AUX
fcis-25103	317	3	because	because	SCONJ
fcis-25103	317	4	,	,	PUNCT
fcis-25103	317	5	as	as	SCONJ
fcis-25103	317	6	the	the	DET
fcis-25103	317	7	number	number	NOUN
fcis-25103	317	8	of	of	ADP
fcis-25103	317	9	clients	client	NOUN
fcis-25103	317	10	increases	increase	NOUN
fcis-25103	317	11	,	,	PUNCT
fcis-25103	317	12	the	the	DET
fcis-25103	317	13	victim	victim	NOUN
fcis-25103	317	14	’s	’s	PART
fcis-25103	317	15	update	update	NOUN
fcis-25103	317	16	is	be	AUX
fcis-25103	317	17	aggregated	aggregate	VERB
fcis-25103	317	18	with	with	ADP
fcis-25103	317	19	more	more	ADJ
fcis-25103	317	20	updates	update	NOUN
fcis-25103	317	21	,	,	PUNCT
fcis-25103	317	22	and	and	CCONJ
fcis-25103	317	23	inferring	infer	VERB
fcis-25103	317	24	the	the	DET
fcis-25103	317	25	property	property	NOUN
fcis-25103	317	26	of	of	ADP
fcis-25103	317	27	victim	victim	NOUN
fcis-25103	317	28	’s	’s	PART
fcis-25103	317	29	samples	sample	NOUN
fcis-25103	317	30	becomes	become	VERB
fcis-25103	317	31	harder	hard	ADJ
fcis-25103	317	32	.	.	PUNCT
fcis-25103	318	1	thus	thus	ADV
fcis-25103	318	2	,	,	PUNCT
fcis-25103	318	3	it	it	PRON
fcis-25103	318	4	can	can	AUX
fcis-25103	318	5	be	be	AUX
fcis-25103	318	6	speculated	speculate	VERB
fcis-25103	318	7	that	that	SCONJ
fcis-25103	318	8	federated	federated	ADJ
fcis-25103	318	9	learning	learning	NOUN
fcis-25103	318	10	with	with	ADP
fcis-25103	318	11	a	a	DET
fcis-25103	318	12	large	large	ADJ
fcis-25103	318	13	number	number	NOUN
fcis-25103	318	14	of	of	ADP
fcis-25103	318	15	clients	client	NOUN
fcis-25103	318	16	is	be	AUX
fcis-25103	318	17	not	not	PART
fcis-25103	318	18	vulnerable	vulnerable	ADJ
fcis-25103	318	19	to	to	ADP
fcis-25103	318	20	the	the	DET
fcis-25103	318	21	property	property	NOUN
fcis-25103	318	22	inference	inference	NOUN
fcis-25103	318	23	attack	attack	NOUN
fcis-25103	318	24	.	.	PUNCT
fcis-25103	319	1	moreover	moreover	ADV
fcis-25103	319	2	,	,	PUNCT
fcis-25103	319	3	user	user	NOUN
fcis-25103	319	4	-	-	PUNCT
fcis-25103	319	5	level	level	NOUN
fcis-25103	319	6	dp	dp	NOUN
fcis-25103	319	7	effectively	effectively	ADV
fcis-25103	319	8	defends	defend	VERB
fcis-25103	319	9	against	against	ADP
fcis-25103	319	10	the	the	DET
fcis-25103	319	11	attack	attack	NOUN
fcis-25103	319	12	,	,	PUNCT
fcis-25103	319	13	reducing	reduce	VERB
fcis-25103	319	14	the	the	DET
fcis-25103	319	15	auc	auc	NOUN
fcis-25103	319	16	to	to	ADP
fcis-25103	319	17	around	around	ADP
fcis-25103	319	18	0.5	0.5	NUM
fcis-25103	319	19	.	.	PUNCT
fcis-25103	320	1	the	the	DET
fcis-25103	320	2	reason	reason	NOUN
fcis-25103	320	3	is	be	AUX
fcis-25103	320	4	that	that	SCONJ
fcis-25103	320	5	user	user	NOUN
fcis-25103	320	6	-	-	PUNCT
fcis-25103	320	7	level	level	NOUN
fcis-25103	320	8	dp	dp	NOUN
fcis-25103	320	9	perturbs	perturb	VERB
fcis-25103	320	10	clients	client	NOUN
fcis-25103	320	11	’	'	PUNCT
fcis-25103	320	12	updates	update	NOUN
fcis-25103	320	13	at	at	ADP
fcis-25103	320	14	each	each	DET
fcis-25103	320	15	round	round	NOUN
fcis-25103	320	16	so	so	SCONJ
fcis-25103	320	17	that	that	SCONJ
fcis-25103	320	18	the	the	DET
fcis-25103	320	19	adversary	adversary	NOUN
fcis-25103	320	20	can	can	AUX
fcis-25103	320	21	not	not	PART
fcis-25103	320	22	tell	tell	VERB
fcis-25103	320	23	whether	whether	SCONJ
fcis-25103	320	24	a	a	DET
fcis-25103	320	25	specific	specific	ADJ
fcis-25103	320	26	client	client	NOUN
fcis-25103	320	27	has	have	AUX
fcis-25103	320	28	joined	join	VERB
fcis-25103	320	29	in	in	ADP
fcis-25103	320	30	training	training	NOUN
fcis-25103	320	31	,	,	PUNCT
fcis-25103	320	32	which	which	PRON
fcis-25103	320	33	is	be	AUX
fcis-25103	320	34	consistent	consistent	ADJ
fcis-25103	320	35	with	with	ADP
fcis-25103	320	36	the	the	DET
fcis-25103	320	37	definition	definition	NOUN
fcis-25103	320	38	of	of	ADP
fcis-25103	320	39	dp	dp	PROPN
fcis-25103	320	40	.	.	PUNCT
fcis-25103	321	1	nevertheless	nevertheless	ADV
fcis-25103	321	2	,	,	PUNCT
fcis-25103	321	3	the	the	DET
fcis-25103	321	4	noise	noise	NOUN
fcis-25103	321	5	introduced	introduce	VERB
fcis-25103	321	6	into	into	ADP
fcis-25103	321	7	the	the	DET
fcis-25103	321	8	global	global	ADJ
fcis-25103	321	9	update	update	NOUN
fcis-25103	321	10	by	by	ADP
fcis-25103	321	11	dp	dp	NOUN
fcis-25103	321	12	makes	make	VERB
fcis-25103	321	13	the	the	DET
fcis-25103	321	14	update	update	NOUN
fcis-25103	321	15	deviate	deviate	NOUN
fcis-25103	321	16	from	from	ADP
fcis-25103	321	17	correct	correct	ADJ
fcis-25103	321	18	direction	direction	NOUN
fcis-25103	321	19	,	,	PUNCT
fcis-25103	321	20	resulting	result	VERB
fcis-25103	321	21	in	in	ADP
fcis-25103	321	22	a	a	DET
fcis-25103	321	23	drastic	drastic	ADJ
fcis-25103	321	24	decline	decline	NOUN
fcis-25103	321	25	on	on	ADP
fcis-25103	321	26	the	the	DET
fcis-25103	321	27	main	main	ADJ
fcis-25103	321	28	task	task	NOUN
fcis-25103	321	29	accuracy	accuracy	NOUN
fcis-25103	321	30	.	.	PUNCT
fcis-25103	322	1	we	we	PRON
fcis-25103	322	2	also	also	ADV
fcis-25103	322	3	observe	observe	VERB
fcis-25103	322	4	that	that	SCONJ
fcis-25103	322	5	federated	federated	ADJ
fcis-25103	322	6	learning	learning	NOUN
fcis-25103	322	7	with	with	ADP
fcis-25103	322	8	more	more	ADJ
fcis-25103	322	9	clients	client	NOUN
fcis-25103	322	10	is	be	AUX
fcis-25103	322	11	less	less	ADV
fcis-25103	322	12	affected	affect	VERB
fcis-25103	322	13	by	by	ADP
fcis-25103	322	14	noise	noise	NOUN
fcis-25103	322	15	perturbation	perturbation	NOUN
fcis-25103	322	16	of	of	ADP
fcis-25103	322	17	dp	dp	NOUN
fcis-25103	322	18	(	(	PUNCT
fcis-25103	322	19	62.11	62.11	NUM
fcis-25103	322	20	%	%	NOUN
fcis-25103	322	21	vs.	vs.	ADP
fcis-25103	322	22	34.04	34.04	NUM
fcis-25103	322	23	%	%	NOUN
fcis-25103	322	24	)	)	PUNCT
fcis-25103	322	25	.	.	PUNCT
fcis-25103	323	1	for	for	ADP
fcis-25103	323	2	a	a	DET
fcis-25103	323	3	binary	binary	ADJ
fcis-25103	323	4	classifier	classifier	NOUN
fcis-25103	323	5	,	,	PUNCT
fcis-25103	323	6	an	an	DET
fcis-25103	323	7	accuracy	accuracy	NOUN
fcis-25103	323	8	less	less	ADJ
fcis-25103	323	9	than	than	ADP
fcis-25103	323	10	50	50	NUM
fcis-25103	323	11	%	%	NOUN
fcis-25103	323	12	does	do	AUX
fcis-25103	323	13	not	not	PART
fcis-25103	323	14	make	make	VERB
fcis-25103	323	15	sense	sense	NOUN
fcis-25103	323	16	.	.	PUNCT
fcis-25103	324	1	in	in	ADP
fcis-25103	324	2	contrast	contrast	NOUN
fcis-25103	324	3	,	,	PUNCT
fcis-25103	324	4	cnd	cnd	PROPN
fcis-25103	324	5	significantly	significantly	ADV
fcis-25103	324	6	improves	improve	VERB
fcis-25103	324	7	the	the	DET
fcis-25103	324	8	accuracy	accuracy	NOUN
fcis-25103	324	9	of	of	ADP
fcis-25103	324	10	the	the	DET
fcis-25103	324	11	model	model	NOUN
fcis-25103	324	12	to	to	ADP
fcis-25103	324	13	an	an	DET
fcis-25103	324	14	acceptable	acceptable	ADJ
fcis-25103	324	15	level	level	NOUN
fcis-25103	324	16	(	(	PUNCT
fcis-25103	324	17	e.g.	e.g.	ADV
fcis-25103	324	18	,	,	PUNCT
fcis-25103	324	19	from	from	ADP
fcis-25103	324	20	41.40	41.40	NUM
fcis-25103	324	21	%	%	NOUN
fcis-25103	324	22	to	to	ADP
fcis-25103	324	23	65.76	65.76	NUM
fcis-25103	324	24	%	%	NOUN
fcis-25103	324	25	)	)	PUNCT
fcis-25103	324	26	,	,	PUNCT
fcis-25103	324	27	which	which	PRON
fcis-25103	324	28	is	be	AUX
fcis-25103	324	29	similar	similar	ADJ
fcis-25103	324	30	to	to	ADP
fcis-25103	324	31	the	the	DET
fcis-25103	324	32	results	result	NOUN
fcis-25103	324	33	of	of	ADP
fcis-25103	324	34	defending	defend	VERB
fcis-25103	324	35	against	against	ADP
fcis-25103	324	36	backdoor	backdoor	NOUN
fcis-25103	324	37	attacks	attack	NOUN
fcis-25103	324	38	.	.	PUNCT
fcis-25103	325	1	in	in	ADP
fcis-25103	325	2	all	all	DET
fcis-25103	325	3	cases	case	NOUN
fcis-25103	325	4	,	,	PUNCT
fcis-25103	325	5	our	our	PRON
fcis-25103	325	6	method	method	NOUN
fcis-25103	325	7	achieves	achieve	VERB
fcis-25103	325	8	an	an	DET
fcis-25103	325	9	equivalent	equivalent	ADJ
fcis-25103	325	10	auc	auc	NOUN
fcis-25103	325	11	as	as	ADP
fcis-25103	325	12	dp	dp	NOUN
fcis-25103	325	13	does	do	AUX
fcis-25103	325	14	,	,	PUNCT
fcis-25103	325	15	which	which	PRON
fcis-25103	325	16	implies	imply	VERB
fcis-25103	325	17	that	that	SCONJ
fcis-25103	325	18	cnd	cnd	PROPN
fcis-25103	325	19	does	do	AUX
fcis-25103	325	20	not	not	PART
fcis-25103	325	21	introduce	introduce	VERB
fcis-25103	325	22	privacy	privacy	NOUN
fcis-25103	325	23	risk	risk	NOUN
fcis-25103	325	24	,	,	PUNCT
fcis-25103	325	25	and	and	CCONJ
fcis-25103	325	26	our	our	PRON
fcis-25103	325	27	method	method	NOUN
fcis-25103	325	28	provides	provide	VERB
fcis-25103	325	29	the	the	DET
fcis-25103	325	30	same	same	ADJ
fcis-25103	325	31	level	level	NOUN
fcis-25103	325	32	of	of	ADP
fcis-25103	325	33	privacy	privacy	NOUN
fcis-25103	325	34	preservation	preservation	NOUN
fcis-25103	325	35	as	as	ADP
fcis-25103	325	36	the	the	DET
fcis-25103	325	37	original	original	ADJ
fcis-25103	325	38	dp	dp	NOUN
fcis-25103	325	39	.	.	PROPN
fcis-25103	326	1	6	6	NUM
fcis-25103	326	2	.	.	X
fcis-25103	326	3	conclusion	conclusion	NOUN
fcis-25103	326	4	in	in	ADP
fcis-25103	326	5	this	this	DET
fcis-25103	326	6	paper	paper	NOUN
fcis-25103	326	7	,	,	PUNCT
fcis-25103	326	8	we	we	PRON
fcis-25103	326	9	studied	study	VERB
fcis-25103	326	10	backdoor	backdoor	NOUN
fcis-25103	326	11	attacks	attack	NOUN
fcis-25103	326	12	in	in	ADP
fcis-25103	326	13	fl	fl	NUM
fcis-25103	326	14	and	and	CCONJ
fcis-25103	326	15	proposed	propose	VERB
fcis-25103	326	16	a	a	DET
fcis-25103	326	17	new	new	ADJ
fcis-25103	326	18	defense	defense	NOUN
fcis-25103	326	19	based	base	VERB
fcis-25103	326	20	on	on	ADP
fcis-25103	326	21	dp	dp	PROPN
fcis-25103	326	22	.	.	PUNCT
fcis-25103	327	1	we	we	PRON
fcis-25103	327	2	found	find	VERB
fcis-25103	327	3	several	several	ADJ
fcis-25103	327	4	factors	factor	NOUN
fcis-25103	327	5	that	that	PRON
fcis-25103	327	6	promote	promote	VERB
fcis-25103	327	7	the	the	DET
fcis-25103	327	8	success	success	NOUN
fcis-25103	327	9	rate	rate	NOUN
fcis-25103	327	10	of	of	ADP
fcis-25103	327	11	the	the	DET
fcis-25103	327	12	attack	attack	NOUN
fcis-25103	327	13	,	,	PUNCT
fcis-25103	327	14	e.g.	e.g.	ADV
fcis-25103	327	15	,	,	PUNCT
fcis-25103	327	16	the	the	DET
fcis-25103	327	17	increase	increase	NOUN
fcis-25103	327	18	and	and	CCONJ
fcis-25103	327	19	the	the	DET
fcis-25103	327	20	concentration	concentration	NOUN
fcis-25103	327	21	of	of	ADP
fcis-25103	327	22	backdoored	backdoore	VERB
fcis-25103	327	23	samples	sample	NOUN
fcis-25103	327	24	in	in	ADP
fcis-25103	327	25	poisoned	poison	VERB
fcis-25103	327	26	clients	client	NOUN
fcis-25103	327	27	’	’	PART
fcis-25103	327	28	datasets	dataset	NOUN
fcis-25103	327	29	.	.	PUNCT
fcis-25103	328	1	we	we	PRON
fcis-25103	328	2	also	also	ADV
fcis-25103	328	3	discovered	discover	VERB
fcis-25103	328	4	the	the	DET
fcis-25103	328	5	relation	relation	NOUN
fcis-25103	328	6	between	between	ADP
fcis-25103	328	7	backdoor	backdoor	NOUN
fcis-25103	328	8	attacks	attack	NOUN
fcis-25103	328	9	and	and	CCONJ
fcis-25103	328	10	model	model	NOUN
fcis-25103	328	11	overfitting	overfitting	NOUN
fcis-25103	328	12	,	,	PUNCT
fcis-25103	328	13	and	and	CCONJ
fcis-25103	328	14	empirically	empirically	ADV
fcis-25103	328	15	verified	verify	VERB
fcis-25103	328	16	that	that	SCONJ
fcis-25103	328	17	suppressing	suppress	VERB
fcis-25103	328	18	overfitting	overfitting	NOUN
fcis-25103	328	19	helps	help	VERB
fcis-25103	328	20	to	to	PART
fcis-25103	328	21	defend	defend	VERB
fcis-25103	328	22	against	against	ADP
fcis-25103	328	23	backdoor	backdoor	NOUN
fcis-25103	328	24	attacks	attack	NOUN
fcis-25103	328	25	.	.	PUNCT
fcis-25103	329	1	in	in	ADP
fcis-25103	329	2	particular	particular	ADJ
fcis-25103	329	3	,	,	PUNCT
fcis-25103	329	4	we	we	PRON
fcis-25103	329	5	proposed	propose	VERB
fcis-25103	329	6	cnd	cnd	PROPN
fcis-25103	329	7	to	to	PART
fcis-25103	329	8	solve	solve	VERB
fcis-25103	329	9	the	the	DET
fcis-25103	329	10	problem	problem	NOUN
fcis-25103	329	11	of	of	ADP
fcis-25103	329	12	losing	lose	VERB
fcis-25103	329	13	model	model	NOUN
fcis-25103	329	14	utility	utility	NOUN
fcis-25103	329	15	when	when	SCONJ
fcis-25103	329	16	defending	defend	VERB
fcis-25103	329	17	against	against	ADP
fcis-25103	329	18	backdoor	backdoor	NOUN
fcis-25103	329	19	attacks	attack	NOUN
fcis-25103	329	20	with	with	ADP
fcis-25103	329	21	dp	dp	PROPN
fcis-25103	329	22	,	,	PUNCT
fcis-25103	329	23	which	which	PRON
fcis-25103	329	24	decreases	decrease	VERB
fcis-25103	329	25	the	the	DET
fcis-25103	329	26	clipping	clip	VERB
fcis-25103	329	27	threshold	threshold	NOUN
fcis-25103	329	28	of	of	ADP
fcis-25103	329	29	model	model	NOUN
fcis-25103	329	30	updates	update	NOUN
fcis-25103	329	31	in	in	ADP
fcis-25103	329	32	training	training	NOUN
fcis-25103	329	33	process	process	NOUN
fcis-25103	329	34	.	.	PUNCT
fcis-25103	330	1	by	by	ADP
fcis-25103	330	2	adaptively	adaptively	ADV
fcis-25103	330	3	setting	set	VERB
fcis-25103	330	4	the	the	DET
fcis-25103	330	5	appropriate	appropriate	ADJ
fcis-25103	330	6	thresholds	threshold	NOUN
fcis-25103	330	7	,	,	PUNCT
fcis-25103	330	8	our	our	PRON
fcis-25103	330	9	algorithm	algorithm	NOUN
fcis-25103	330	10	reduced	reduce	VERB
fcis-25103	330	11	the	the	DET
fcis-25103	330	12	noise	noise	NOUN
fcis-25103	330	13	injection	injection	NOUN
fcis-25103	330	14	and	and	CCONJ
fcis-25103	330	15	eliminated	eliminate	VERB
fcis-25103	330	16	the	the	DET
fcis-25103	330	17	impact	impact	NOUN
fcis-25103	330	18	of	of	ADP
fcis-25103	330	19	malicious	malicious	ADJ
fcis-25103	330	20	updates	update	NOUN
fcis-25103	330	21	.	.	PUNCT
fcis-25103	331	1	experiments	experiment	NOUN
fcis-25103	331	2	of	of	ADP
fcis-25103	331	3	cnd	cnd	PROPN
fcis-25103	331	4	showed	show	VERB
fcis-25103	331	5	that	that	SCONJ
fcis-25103	331	6	our	our	PRON
fcis-25103	331	7	method	method	NOUN
fcis-25103	331	8	could	could	AUX
fcis-25103	331	9	not	not	PART
fcis-25103	331	10	only	only	ADV
fcis-25103	331	11	improve	improve	VERB
fcis-25103	331	12	the	the	DET
fcis-25103	331	13	accuracy	accuracy	NOUN
fcis-25103	331	14	of	of	ADP
fcis-25103	331	15	the	the	DET
fcis-25103	331	16	main	main	ADJ
fcis-25103	331	17	task	task	NOUN
fcis-25103	331	18	,	,	PUNCT
fcis-25103	331	19	but	but	CCONJ
fcis-25103	331	20	also	also	ADV
fcis-25103	331	21	further	far	ADV
fcis-25103	331	22	reduce	reduce	VERB
fcis-25103	331	23	the	the	DET
fcis-25103	331	24	success	success	NOUN
fcis-25103	331	25	rate	rate	NOUN
fcis-25103	331	26	of	of	ADP
fcis-25103	331	27	backdoor	backdoor	NOUN
fcis-25103	331	28	attacks	attack	NOUN
fcis-25103	331	29	compared	compare	VERB
fcis-25103	331	30	to	to	ADP
fcis-25103	331	31	the	the	DET
fcis-25103	331	32	original	original	ADJ
fcis-25103	331	33	dp	dp	NOUN
fcis-25103	331	34	.	.	PUNCT
fcis-25103	332	1	in	in	ADP
fcis-25103	332	2	comparison	comparison	NOUN
fcis-25103	332	3	with	with	ADP
fcis-25103	332	4	the	the	DET
fcis-25103	332	5	state	state	NOUN
fcis-25103	332	6	-	-	PUNCT
fcis-25103	332	7	of	of	ADP
fcis-25103	332	8	-	-	PUNCT
fcis-25103	332	9	the	the	DET
fcis-25103	332	10	-	-	PUNCT
fcis-25103	332	11	art	art	NOUN
fcis-25103	332	12	defensive	defensive	ADJ
fcis-25103	332	13	mechanisms	mechanism	NOUN
fcis-25103	332	14	on	on	ADP
fcis-25103	332	15	two	two	NUM
fcis-25103	332	16	datasets	dataset	NOUN
fcis-25103	332	17	,	,	PUNCT
fcis-25103	332	18	cnd	cnd	PROPN
fcis-25103	332	19	outperforms	outperform	VERB
fcis-25103	332	20	them	they	PRON
fcis-25103	332	21	by	by	ADP
fcis-25103	332	22	a	a	DET
fcis-25103	332	23	large	large	ADJ
fcis-25103	332	24	margin	margin	NOUN
fcis-25103	332	25	.	.	PUNCT
fcis-25103	333	1	moreover	moreover	ADV
fcis-25103	333	2	,	,	PUNCT
fcis-25103	333	3	we	we	PRON
fcis-25103	333	4	implemented	implement	VERB
fcis-25103	333	5	cnd	cnd	PROPN
fcis-25103	333	6	to	to	PART
fcis-25103	333	7	defend	defend	VERB
fcis-25103	333	8	against	against	ADP
fcis-25103	333	9	property	property	NOUN
fcis-25103	333	10	inference	inference	NOUN
fcis-25103	333	11	attack	attack	NOUN
fcis-25103	333	12	and	and	CCONJ
fcis-25103	333	13	validated	validate	VERB
fcis-25103	333	14	that	that	SCONJ
fcis-25103	333	15	our	our	PRON
fcis-25103	333	16	method	method	NOUN
fcis-25103	333	17	also	also	ADV
fcis-25103	333	18	improves	improve	VERB
fcis-25103	333	19	the	the	DET
fcis-25103	333	20	main	main	ADJ
fcis-25103	333	21	task	task	NOUN
fcis-25103	333	22	accuracy	accuracy	NOUN
fcis-25103	333	23	in	in	ADP
fcis-25103	333	24	the	the	DET
fcis-25103	333	25	defense	defense	NOUN
fcis-25103	333	26	against	against	ADP
fcis-25103	333	27	privacy	privacy	NOUN
fcis-25103	333	28	attack	attack	NOUN
fcis-25103	333	29	and	and	CCONJ
fcis-25103	333	30	does	do	AUX
fcis-25103	333	31	not	not	PART
fcis-25103	333	32	risk	risk	VERB
fcis-25103	333	33	the	the	DET
fcis-25103	333	34	privacy	privacy	NOUN
fcis-25103	333	35	preservation	preservation	NOUN
fcis-25103	333	36	of	of	ADP
fcis-25103	333	37	dp	dp	PROPN
fcis-25103	333	38	.	.	PUNCT
fcis-25103	334	1	for	for	ADP
fcis-25103	334	2	future	future	ADJ
fcis-25103	334	3	work	work	NOUN
fcis-25103	334	4	,	,	PUNCT
fcis-25103	334	5	we	we	PRON
fcis-25103	334	6	plan	plan	VERB
fcis-25103	334	7	to	to	PART
fcis-25103	334	8	apply	apply	VERB
fcis-25103	334	9	dp	dp	NOUN
fcis-25103	334	10	with	with	ADP
fcis-25103	334	11	cnd	cnd	PROPN
fcis-25103	334	12	to	to	ADP
fcis-25103	334	13	more	more	ADJ
fcis-25103	334	14	privacy	privacy	NOUN
fcis-25103	334	15	threats	threat	NOUN
fcis-25103	334	16	to	to	PART
fcis-25103	334	17	obtain	obtain	VERB
fcis-25103	334	18	extensive	extensive	ADJ
fcis-25103	334	19	results	result	NOUN
fcis-25103	334	20	about	about	ADP
fcis-25103	334	21	the	the	DET
fcis-25103	334	22	method	method	NOUN
fcis-25103	334	23	.	.	PUNCT
fcis-25103	335	1	after	after	ADP
fcis-25103	335	2	that	that	PRON
fcis-25103	335	3	,	,	PUNCT
fcis-25103	335	4	we	we	PRON
fcis-25103	335	5	will	will	AUX
fcis-25103	335	6	evaluate	evaluate	VERB
fcis-25103	335	7	the	the	DET
fcis-25103	335	8	prospect	prospect	NOUN
fcis-25103	335	9	of	of	ADP
fcis-25103	335	10	using	use	VERB
fcis-25103	335	11	this	this	DET
fcis-25103	335	12	approach	approach	NOUN
fcis-25103	335	13	to	to	PART
fcis-25103	335	14	protect	protect	VERB
fcis-25103	335	15	federated	federated	ADJ
fcis-25103	335	16	learning	learning	NOUN
fcis-25103	335	17	from	from	ADP
fcis-25103	335	18	security	security	NOUN
fcis-25103	335	19	and	and	CCONJ
fcis-25103	335	20	privacy	privacy	NOUN
fcis-25103	335	21	attacks	attack	NOUN
fcis-25103	335	22	simultaneously	simultaneously	ADV
fcis-25103	335	23	.	.	PUNCT
fcis-25103	336	1	references	reference	NOUN
fcis-25103	336	2	[	[	X
fcis-25103	336	3	1	1	NUM
fcis-25103	336	4	]	]	X
fcis-25103	336	5	hard	hard	ADV
fcis-25103	336	6	,	,	PUNCT
fcis-25103	336	7	a.	a.	NOUN
fcis-25103	336	8	,	,	PUNCT
fcis-25103	336	9	rao	rao	PROPN
fcis-25103	336	10	,	,	PUNCT
fcis-25103	336	11	k.	k.	PROPN
fcis-25103	336	12	,	,	PUNCT
fcis-25103	336	13	mathews	mathews	PROPN
fcis-25103	336	14	,	,	PUNCT
fcis-25103	336	15	r.	r.	PROPN
fcis-25103	336	16	,	,	PUNCT
fcis-25103	336	17	beaufays	beaufay	NOUN
fcis-25103	336	18	,	,	PUNCT
fcis-25103	336	19	f.	f.	PROPN
fcis-25103	336	20	,	,	PUNCT
fcis-25103	336	21	augenstein	augenstein	ADV
fcis-25103	336	22	,	,	PUNCT
fcis-25103	336	23	s.	s.	PROPN
fcis-25103	336	24	,	,	PUNCT
fcis-25103	336	25	eichner	eichner	PROPN
fcis-25103	336	26	,	,	PUNCT
fcis-25103	336	27	h.	h.	PROPN
fcis-25103	336	28	,	,	PUNCT
fcis-25103	336	29	kiddon	kiddon	PROPN
fcis-25103	336	30	,	,	PUNCT
fcis-25103	336	31	c.	c.	PROPN
fcis-25103	336	32	,	,	PUNCT
fcis-25103	336	33	ramage	ramage	NOUN
fcis-25103	336	34	,	,	PUNCT
fcis-25103	336	35	d.	d.	PROPN
fcis-25103	336	36	:	:	PUNCT
fcis-25103	336	37	federated	federate	VERB
fcis-25103	336	38	learning	learning	NOUN
fcis-25103	336	39	for	for	ADP
fcis-25103	336	40	mobile	mobile	ADJ
fcis-25103	336	41	keyboard	keyboard	NOUN
fcis-25103	336	42	prediction	prediction	NOUN
fcis-25103	336	43	.	.	PUNCT
fcis-25103	337	1	corr	corr	PROPN
fcis-25103	337	2	abs/1811.03604	abs/1811.03604	PROPN
fcis-25103	337	3	(	(	PUNCT
fcis-25103	337	4	2018	2018	NUM
fcis-25103	337	5	)	)	PUNCT
fcis-25103	337	6	.	.	PUNCT
fcis-25103	338	1	[	[	X
fcis-25103	338	2	2	2	NUM
fcis-25103	338	3	]	]	PUNCT
fcis-25103	338	4	schlesinger	schlesinger	NOUN
fcis-25103	338	5	,	,	PUNCT
fcis-25103	338	6	a.	a.	NOUN
fcis-25103	338	7	,	,	PUNCT
fcis-25103	338	8	o’hara	o’hara	NOUN
fcis-25103	338	9	,	,	PUNCT
fcis-25103	338	10	k.p	k.p	PROPN
fcis-25103	338	11	.	.	PROPN
fcis-25103	338	12	,	,	PUNCT
fcis-25103	338	13	taylor	taylor	PROPN
fcis-25103	338	14	,	,	PUNCT
fcis-25103	338	15	a.s	a.s	PROPN
fcis-25103	338	16	.	.	PROPN
fcis-25103	338	17	:	:	PUNCT
fcis-25103	338	18	let	let	VERB
fcis-25103	338	19	’s	’s	PRON
fcis-25103	338	20	talk	talk	VERB
fcis-25103	338	21	about	about	ADP
fcis-25103	338	22	race	race	NOUN
fcis-25103	338	23	:	:	PUNCT
fcis-25103	338	24	identity	identity	NOUN
fcis-25103	338	25	,	,	PUNCT
fcis-25103	338	26	chat	chat	VERB
fcis-25103	338	27	bots	bot	NOUN
fcis-25103	338	28	,	,	PUNCT
fcis-25103	338	29	and	and	CCONJ
fcis-25103	338	30	ai	ai	VERB
fcis-25103	338	31	.	.	PUNCT
fcis-25103	339	1	in	in	ADP
fcis-25103	339	2	:	:	PUNCT
fcis-25103	339	3	proceedings	proceeding	NOUN
fcis-25103	339	4	of	of	ADP
fcis-25103	339	5	the	the	DET
fcis-25103	339	6	2018	2018	NUM
fcis-25103	339	7	chi	chi	PROPN
fcis-25103	339	8	conference	conference	NOUN
fcis-25103	339	9	on	on	ADP
fcis-25103	339	10	human	human	ADJ
fcis-25103	339	11	factors	factor	NOUN
fcis-25103	339	12	in	in	ADP
fcis-25103	339	13	computing	computing	NOUN
fcis-25103	339	14	systems	system	NOUN
fcis-25103	339	15	,	,	PUNCT
fcis-25103	339	16	chi	chi	NOUN
fcis-25103	339	17	2018	2018	NUM
fcis-25103	339	18	.	.	PUNCT
fcis-25103	340	1	[	[	X
fcis-25103	340	2	3	3	NUM
fcis-25103	340	3	]	]	X
fcis-25103	340	4	konecný	konecný	PROPN
fcis-25103	340	5	,	,	PUNCT
fcis-25103	340	6	j.	j.	PROPN
fcis-25103	340	7	,	,	PUNCT
fcis-25103	340	8	mcmahan	mcmahan	PROPN
fcis-25103	340	9	,	,	PUNCT
fcis-25103	340	10	h.b	h.b	PROPN
fcis-25103	340	11	.	.	PROPN
fcis-25103	340	12	,	,	PUNCT
fcis-25103	340	13	yu	yu	PROPN
fcis-25103	340	14	,	,	PUNCT
fcis-25103	340	15	f.x	f.x	PROPN
fcis-25103	340	16	.	.	PROPN
fcis-25103	340	17	,	,	PUNCT
fcis-25103	340	18	richtárik	richtárik	PROPN
fcis-25103	340	19	,	,	PUNCT
fcis-25103	340	20	p.	p.	PROPN
fcis-25103	340	21	,	,	PUNCT
fcis-25103	340	22	suresh	suresh	PROPN
fcis-25103	340	23	,	,	PUNCT
fcis-25103	340	24	a.t	a.t	PROPN
fcis-25103	340	25	.	.	PROPN
fcis-25103	340	26	,	,	PUNCT
fcis-25103	340	27	bacon	bacon	NOUN
fcis-25103	340	28	,	,	PUNCT
fcis-25103	340	29	d.	d.	PROPN
fcis-25103	340	30	:	:	PUNCT
fcis-25103	340	31	federated	federate	VERB
fcis-25103	340	32	learning	learning	NOUN
fcis-25103	340	33	:	:	PUNCT
fcis-25103	340	34	strategies	strategy	NOUN
fcis-25103	340	35	for	for	ADP
fcis-25103	340	36	improving	improve	VERB
fcis-25103	340	37	communication	communication	NOUN
fcis-25103	340	38	efficiency	efficiency	NOUN
fcis-25103	340	39	.	.	PUNCT
fcis-25103	341	1	corr	corr	PROPN
fcis-25103	341	2	abs/1610.05492	abs/1610.05492	PROPN
fcis-25103	341	3	(	(	PUNCT
fcis-25103	341	4	2016	2016	NUM
fcis-25103	341	5	)	)	PUNCT
fcis-25103	341	6	.	.	PUNCT
fcis-25103	342	1	[	[	X
fcis-25103	342	2	4	4	NUM
fcis-25103	342	3	]	]	X
fcis-25103	342	4	mcmahan	mcmahan	PROPN
fcis-25103	342	5	,	,	PUNCT
fcis-25103	342	6	b.	b.	PROPN
fcis-25103	342	7	,	,	PUNCT
fcis-25103	342	8	moore	moore	PROPN
fcis-25103	342	9	,	,	PUNCT
fcis-25103	342	10	e.	e.	PROPN
fcis-25103	342	11	,	,	PUNCT
fcis-25103	342	12	ramage	ramage	NOUN
fcis-25103	342	13	,	,	PUNCT
fcis-25103	342	14	d.	d.	PROPN
fcis-25103	342	15	,	,	PUNCT
fcis-25103	342	16	hampson	hampson	PROPN
fcis-25103	342	17	,	,	PUNCT
fcis-25103	342	18	s.	s.	PROPN
fcis-25103	342	19	,	,	PUNCT
fcis-25103	342	20	arcas	arcas	PROPN
fcis-25103	342	21	,	,	PUNCT
fcis-25103	342	22	b.a	b.a	PROPN
fcis-25103	342	23	.	.	PUNCT
fcis-25103	342	24	:	:	PUNCT
fcis-25103	342	25	communication	communication	NOUN
fcis-25103	342	26	-	-	PUNCT
fcis-25103	342	27	efficient	efficient	ADJ
fcis-25103	342	28	learning	learning	NOUN
fcis-25103	342	29	of	of	ADP
fcis-25103	342	30	deep	deep	ADJ
fcis-25103	342	31	networks	network	NOUN
fcis-25103	342	32	from	from	ADP
fcis-25103	342	33	decentralized	decentralized	ADJ
fcis-25103	342	34	data	datum	NOUN
fcis-25103	342	35	.	.	PUNCT
fcis-25103	343	1	in	in	ADP
fcis-25103	343	2	:	:	PUNCT
fcis-25103	343	3	proceedings	proceeding	NOUN
fcis-25103	343	4	of	of	ADP
fcis-25103	343	5	the	the	DET
fcis-25103	343	6	20th	20th	ADJ
fcis-25103	343	7	international	international	ADJ
fcis-25103	343	8	conference	conference	NOUN
fcis-25103	343	9	on	on	ADP
fcis-25103	343	10	artificial	artificial	ADJ
fcis-25103	343	11	intelligence	intelligence	NOUN
fcis-25103	343	12	and	and	CCONJ
fcis-25103	343	13	statistics	statistic	NOUN
fcis-25103	343	14	,	,	PUNCT
fcis-25103	343	15	aistats	aistat	VERB
fcis-25103	343	16	2017	2017	NUM
fcis-25103	343	17	.	.	PUNCT
fcis-25103	344	1	[	[	X
fcis-25103	344	2	5	5	NUM
fcis-25103	344	3	]	]	X
fcis-25103	344	4	wang	wang	PROPN
fcis-25103	344	5	,	,	PUNCT
fcis-25103	344	6	b.	b.	PROPN
fcis-25103	344	7	,	,	PUNCT
fcis-25103	344	8	yao	yao	PROPN
fcis-25103	344	9	,	,	PUNCT
fcis-25103	344	10	y.	y.	PROPN
fcis-25103	344	11	,	,	PUNCT
fcis-25103	344	12	shan	shan	PROPN
fcis-25103	344	13	,	,	PUNCT
fcis-25103	344	14	s.	s.	PROPN
fcis-25103	344	15	,	,	PUNCT
fcis-25103	344	16	li	li	PROPN
fcis-25103	344	17	,	,	PUNCT
fcis-25103	344	18	h.	h.	PROPN
fcis-25103	344	19	,	,	PUNCT
fcis-25103	344	20	viswanath	viswanath	PROPN
fcis-25103	344	21	,	,	PUNCT
fcis-25103	344	22	b.	b.	PROPN
fcis-25103	344	23	,	,	PUNCT
fcis-25103	344	24	zheng	zheng	PROPN
fcis-25103	344	25	,	,	PUNCT
fcis-25103	344	26	h.	h.	PROPN
fcis-25103	344	27	,	,	PUNCT
fcis-25103	344	28	zhao	zhao	PROPN
fcis-25103	344	29	,	,	PUNCT
fcis-25103	344	30	b.y	b.y	PROPN
fcis-25103	344	31	.	.	PROPN
fcis-25103	344	32	:	:	PUNCT
fcis-25103	344	33	neural	neural	ADJ
fcis-25103	344	34	cleanse	cleanse	NOUN
fcis-25103	344	35	:	:	PUNCT
fcis-25103	344	36	identifying	identify	VERB
fcis-25103	344	37	and	and	CCONJ
fcis-25103	344	38	mitigating	mitigate	VERB
fcis-25103	344	39	backdoor	backdoor	NOUN
fcis-25103	344	40	attacks	attack	NOUN
fcis-25103	344	41	in	in	ADP
fcis-25103	344	42	neural	neural	ADJ
fcis-25103	344	43	networks	network	NOUN
fcis-25103	344	44	.	.	PUNCT
fcis-25103	345	1	in	in	ADP
fcis-25103	345	2	:	:	PUNCT
fcis-25103	345	3	2019	2019	NUM
fcis-25103	345	4	ieee	ieee	NOUN
fcis-25103	345	5	symposium	symposium	NOUN
fcis-25103	345	6	on	on	ADP
fcis-25103	345	7	security	security	NOUN
fcis-25103	345	8	and	and	CCONJ
fcis-25103	345	9	privacy	privacy	NOUN
fcis-25103	345	10	,	,	PUNCT
fcis-25103	345	11	sp	sp	ADP
fcis-25103	345	12	2019	2019	NUM
fcis-25103	345	13	.	.	PUNCT
fcis-25103	346	1	[	[	X
fcis-25103	346	2	6	6	NUM
fcis-25103	346	3	]	]	PUNCT
fcis-25103	346	4	steinhardt	steinhardt	PROPN
fcis-25103	346	5	,	,	PUNCT
fcis-25103	346	6	j.	j.	PROPN
fcis-25103	346	7	,	,	PUNCT
fcis-25103	346	8	koh	koh	PROPN
fcis-25103	346	9	,	,	PUNCT
fcis-25103	346	10	p.w	p.w	PROPN
fcis-25103	346	11	.	.	PROPN
fcis-25103	346	12	,	,	PUNCT
fcis-25103	346	13	liang	liang	PROPN
fcis-25103	346	14	,	,	PUNCT
fcis-25103	346	15	p.	p.	NOUN
fcis-25103	346	16	:	:	PUNCT
fcis-25103	346	17	certified	certify	VERB
fcis-25103	346	18	defenses	defense	NOUN
fcis-25103	346	19	for	for	ADP
fcis-25103	346	20	data	data	NOUN
fcis-25103	346	21	poisoning	poisoning	NOUN
fcis-25103	346	22	attacks	attack	NOUN
fcis-25103	346	23	.	.	PUNCT
fcis-25103	347	1	in	in	ADP
fcis-25103	347	2	:	:	PUNCT
fcis-25103	347	3	advances	advance	NOUN
fcis-25103	347	4	in	in	ADP
fcis-25103	347	5	neural	neural	ADJ
fcis-25103	347	6	information	information	NOUN
fcis-25103	347	7	processing	processing	NOUN
fcis-25103	347	8	systems	system	NOUN
fcis-25103	347	9	30	30	NUM
fcis-25103	347	10	:	:	PUNCT
fcis-25103	347	11	annual	annual	ADJ
fcis-25103	347	12	conference	conference	NOUN
fcis-25103	347	13	on	on	ADP
fcis-25103	347	14	neural	neural	ADJ
fcis-25103	347	15	information	information	NOUN
fcis-25103	347	16	processing	processing	NOUN
fcis-25103	347	17	systems	system	NOUN
fcis-25103	347	18	2017	2017	NUM
fcis-25103	347	19	.	.	PUNCT
fcis-25103	348	1	[	[	X
fcis-25103	348	2	7	7	NUM
fcis-25103	348	3	]	]	X
fcis-25103	348	4	shen	shen	NOUN
fcis-25103	348	5	,	,	PUNCT
fcis-25103	348	6	s.	s.	PROPN
fcis-25103	348	7	,	,	PUNCT
fcis-25103	348	8	tople	tople	PROPN
fcis-25103	348	9	,	,	PUNCT
fcis-25103	348	10	s.	s.	PROPN
fcis-25103	348	11	,	,	PUNCT
fcis-25103	348	12	saxena	saxena	PROPN
fcis-25103	348	13	,	,	PUNCT
fcis-25103	348	14	p.	p.	NOUN
fcis-25103	348	15	:	:	PUNCT
fcis-25103	348	16	auror	auror	NOUN
fcis-25103	348	17	:	:	PUNCT
fcis-25103	348	18	defending	defend	VERB
fcis-25103	348	19	against	against	ADP
fcis-25103	348	20	poisoning	poisoning	NOUN
fcis-25103	348	21	attacks	attack	NOUN
fcis-25103	348	22	in	in	ADP
fcis-25103	348	23	collaborative	collaborative	ADJ
fcis-25103	348	24	deep	deep	ADJ
fcis-25103	348	25	learning	learning	NOUN
fcis-25103	348	26	systems	system	NOUN
fcis-25103	348	27	.	.	PUNCT
fcis-25103	349	1	in	in	ADP
fcis-25103	349	2	:	:	PUNCT
fcis-25103	349	3	proceedings	proceeding	NOUN
fcis-25103	349	4	of	of	ADP
fcis-25103	349	5	the	the	DET
fcis-25103	349	6	32nd	32nd	ADJ
fcis-25103	349	7	annual	annual	ADJ
fcis-25103	349	8	conference	conference	NOUN
fcis-25103	349	9	on	on	ADP
fcis-25103	349	10	computer	computer	NOUN
fcis-25103	349	11	security	security	NOUN
fcis-25103	349	12	applications	application	NOUN
fcis-25103	349	13	,	,	PUNCT
fcis-25103	349	14	acsac	acsac	NOUN
fcis-25103	349	15	2016	2016	NUM
fcis-25103	349	16	.	.	PUNCT
fcis-25103	350	1	[	[	X
fcis-25103	350	2	8	8	NUM
fcis-25103	350	3	]	]	X
fcis-25103	350	4	liu	liu	PROPN
fcis-25103	350	5	,	,	PUNCT
fcis-25103	350	6	k.	k.	PROPN
fcis-25103	350	7	,	,	PUNCT
fcis-25103	350	8	dolan	dolan	PROPN
fcis-25103	350	9	-	-	PUNCT
fcis-25103	350	10	gavitt	gavitt	VERB
fcis-25103	350	11	,	,	PUNCT
fcis-25103	350	12	b.	b.	PROPN
fcis-25103	350	13	,	,	PUNCT
fcis-25103	350	14	garg	garg	PROPN
fcis-25103	350	15	,	,	PUNCT
fcis-25103	350	16	s.	s.	PROPN
fcis-25103	350	17	:	:	PUNCT
fcis-25103	350	18	fine	fine	ADV
fcis-25103	350	19	-	-	PUNCT
fcis-25103	350	20	pruning	pruning	NOUN
fcis-25103	350	21	:	:	PUNCT
fcis-25103	350	22	defending	defend	VERB
fcis-25103	350	23	against	against	ADP
fcis-25103	350	24	backdooring	backdoore	VERB
fcis-25103	350	25	attacks	attack	NOUN
fcis-25103	350	26	on	on	ADP
fcis-25103	350	27	deep	deep	ADJ
fcis-25103	350	28	neural	neural	ADJ
fcis-25103	350	29	networks	network	NOUN
fcis-25103	350	30	.	.	PUNCT
fcis-25103	351	1	in	in	ADP
fcis-25103	351	2	:	:	PUNCT
fcis-25103	351	3	research	research	NOUN
fcis-25103	351	4	in	in	ADP
fcis-25103	351	5	attacks	attack	NOUN
fcis-25103	351	6	,	,	PUNCT
fcis-25103	351	7	intrusions	intrusion	NOUN
fcis-25103	351	8	,	,	PUNCT
fcis-25103	351	9	and	and	CCONJ
fcis-25103	351	10	defenses	defense	VERB
fcis-25103	351	11	21st	21st	ADJ
fcis-25103	351	12	international	international	ADJ
fcis-25103	351	13	symposium	symposium	NOUN
fcis-25103	351	14	,	,	PUNCT
fcis-25103	351	15	raid	raid	NOUN
fcis-25103	351	16	2018	2018	NUM
fcis-25103	351	17	.	.	PUNCT
fcis-25103	352	1	[	[	X
fcis-25103	352	2	9	9	NUM
fcis-25103	352	3	]	]	SYM
fcis-25103	352	4	dwork	dwork	NOUN
fcis-25103	352	5	,	,	PUNCT
fcis-25103	352	6	c.	c.	NOUN
fcis-25103	352	7	:	:	PUNCT
fcis-25103	352	8	differential	differential	NOUN
fcis-25103	352	9	privacy	privacy	NOUN
fcis-25103	352	10	.	.	PUNCT
fcis-25103	353	1	in	in	ADP
fcis-25103	353	2	:	:	PUNCT
fcis-25103	353	3	automata	automata	NOUN
fcis-25103	353	4	,	,	PUNCT
fcis-25103	353	5	languages	language	NOUN
fcis-25103	353	6	and	and	CCONJ
fcis-25103	353	7	programming	programming	NOUN
fcis-25103	353	8	,	,	PUNCT
fcis-25103	353	9	33rd	33rd	ADJ
fcis-25103	353	10	international	international	ADJ
fcis-25103	353	11	colloquium	colloquium	NOUN
fcis-25103	353	12	,	,	PUNCT
fcis-25103	353	13	icalp	icalp	NOUN
fcis-25103	353	14	2006	2006	NUM
fcis-25103	353	15	.	.	PUNCT
fcis-25103	354	1	[	[	X
fcis-25103	354	2	10	10	NUM
fcis-25103	354	3	]	]	X
fcis-25103	354	4	abadi	abadi	PROPN
fcis-25103	354	5	,	,	PUNCT
fcis-25103	354	6	m.	m.	NOUN
fcis-25103	354	7	,	,	PUNCT
fcis-25103	354	8	chu	chu	PROPN
fcis-25103	354	9	,	,	PUNCT
fcis-25103	354	10	a.	a.	NOUN
fcis-25103	354	11	,	,	PUNCT
fcis-25103	354	12	goodfellow	goodfellow	PROPN
fcis-25103	354	13	,	,	PUNCT
fcis-25103	354	14	i.j	i.j	PROPN
fcis-25103	354	15	.	.	PROPN
fcis-25103	354	16	,	,	PUNCT
fcis-25103	354	17	mcmahan	mcmahan	PROPN
fcis-25103	354	18	,	,	PUNCT
fcis-25103	354	19	h.b	h.b	PROPN
fcis-25103	354	20	.	.	PROPN
fcis-25103	354	21	,	,	PUNCT
fcis-25103	354	22	mironov	mironov	PROPN
fcis-25103	354	23	,	,	PUNCT
fcis-25103	354	24	i.	i.	PROPN
fcis-25103	354	25	,	,	PUNCT
fcis-25103	354	26	talwar	talwar	PROPN
fcis-25103	354	27	,	,	PUNCT
fcis-25103	354	28	k.	k.	PROPN
fcis-25103	354	29	,	,	PUNCT
fcis-25103	354	30	zhang	zhang	PROPN
fcis-25103	354	31	,	,	PUNCT
fcis-25103	354	32	l.	l.	PROPN
fcis-25103	354	33	:	:	PUNCT
fcis-25103	354	34	deep	deep	ADJ
fcis-25103	354	35	learning	learn	VERB
fcis-25103	354	36	with	with	ADP
fcis-25103	354	37	differential	differential	ADJ
fcis-25103	354	38	privacy	privacy	NOUN
fcis-25103	354	39	.	.	PUNCT
fcis-25103	355	1	in	in	ADP
fcis-25103	355	2	:	:	PUNCT
fcis-25103	355	3	proceedings	proceeding	NOUN
fcis-25103	355	4	of	of	ADP
fcis-25103	355	5	the	the	DET
fcis-25103	355	6	2016	2016	NUM
fcis-25103	355	7	acm	acm	PROPN
fcis-25103	355	8	sigsac	sigsac	NOUN
fcis-25103	355	9	conference	conference	NOUN
fcis-25103	355	10	on	on	ADP
fcis-25103	355	11	computer	computer	NOUN
fcis-25103	355	12	and	and	CCONJ
fcis-25103	355	13	communications	communication	NOUN
fcis-25103	355	14	security	security	NOUN
fcis-25103	355	15	,	,	PUNCT
fcis-25103	355	16	2016	2016	NUM
fcis-25103	355	17	.	.	PUNCT
fcis-25103	356	1	[	[	X
fcis-25103	356	2	11	11	NUM
fcis-25103	356	3	]	]	PUNCT
fcis-25103	356	4	papernot	papernot	ADV
fcis-25103	356	5	,	,	PUNCT
fcis-25103	356	6	n.	n.	NOUN
fcis-25103	356	7	,	,	PUNCT
fcis-25103	356	8	abadi	abadi	PROPN
fcis-25103	356	9	,	,	PUNCT
fcis-25103	356	10	m.	m.	NOUN
fcis-25103	356	11	,	,	PUNCT
fcis-25103	356	12	erlingsson	erlingsson	PROPN
fcis-25103	356	13	,	,	PUNCT
fcis-25103	356	14	ú	ú	PROPN
fcis-25103	356	15	.	.	PROPN
fcis-25103	356	16	,	,	PUNCT
fcis-25103	356	17	goodfellow	goodfellow	PROPN
fcis-25103	356	18	,	,	PUNCT
fcis-25103	356	19	i.j	i.j	PROPN
fcis-25103	356	20	.	.	PROPN
fcis-25103	356	21	,	,	PUNCT
fcis-25103	356	22	talwar	talwar	PROPN
fcis-25103	356	23	,	,	PUNCT
fcis-25103	356	24	k.	k.	PROPN
fcis-25103	356	25	:	:	PUNCT
fcis-25103	356	26	semisupervised	semisupervise	VERB
fcis-25103	356	27	knowledge	knowledge	NOUN
fcis-25103	356	28	transfer	transfer	NOUN
fcis-25103	356	29	for	for	ADP
fcis-25103	356	30	deep	deep	ADJ
fcis-25103	356	31	learning	learning	NOUN
fcis-25103	356	32	from	from	ADP
fcis-25103	356	33	private	private	ADJ
fcis-25103	356	34	training	training	NOUN
fcis-25103	356	35	data	datum	NOUN
fcis-25103	356	36	.	.	PUNCT
fcis-25103	357	1	in	in	ADP
fcis-25103	357	2	:	:	PUNCT
fcis-25103	357	3	5th	5th	ADJ
fcis-25103	357	4	international	international	ADJ
fcis-25103	357	5	conference	conference	NOUN
fcis-25103	357	6	on	on	ADP
fcis-25103	357	7	learning	learn	VERB
fcis-25103	357	8	representations	representation	NOUN
fcis-25103	357	9	,	,	PUNCT
fcis-25103	357	10	iclr	iclr	ADJ
fcis-25103	357	11	2017	2017	NUM
fcis-25103	357	12	.	.	PUNCT
fcis-25103	358	1	[	[	X
fcis-25103	358	2	12	12	NUM
fcis-25103	358	3	]	]	X
fcis-25103	358	4	geyer	geyer	PROPN
fcis-25103	358	5	,	,	PUNCT
fcis-25103	358	6	r.c	r.c	PROPN
fcis-25103	358	7	.	.	PROPN
fcis-25103	358	8	,	,	PUNCT
fcis-25103	358	9	klein	klein	PROPN
fcis-25103	358	10	,	,	PUNCT
fcis-25103	358	11	t.	t.	PROPN
fcis-25103	358	12	,	,	PUNCT
fcis-25103	358	13	nabi	nabi	PROPN
fcis-25103	358	14	,	,	PUNCT
fcis-25103	358	15	m.	m.	NOUN
fcis-25103	358	16	:	:	PUNCT
fcis-25103	358	17	differentially	differentially	ADV
fcis-25103	358	18	private	private	ADJ
fcis-25103	358	19	federated	federated	ADJ
fcis-25103	358	20	learning	learning	NOUN
fcis-25103	358	21	:	:	PUNCT
fcis-25103	358	22	a	a	DET
fcis-25103	358	23	client	client	NOUN
fcis-25103	358	24	level	level	NOUN
fcis-25103	358	25	perspective	perspective	NOUN
fcis-25103	358	26	.	.	PUNCT
fcis-25103	359	1	corr	corr	PROPN
fcis-25103	359	2	abs/1712.07557	abs/1712.07557	PROPN
fcis-25103	359	3	(	(	PUNCT
fcis-25103	359	4	2017	2017	NUM
fcis-25103	359	5	)	)	PUNCT
fcis-25103	359	6	.	.	PUNCT
fcis-25103	360	1	[	[	X
fcis-25103	360	2	13	13	NUM
fcis-25103	360	3	]	]	SYM
fcis-25103	360	4	mcmahan	mcmahan	PROPN
fcis-25103	360	5	,	,	PUNCT
fcis-25103	360	6	h.b	h.b	PROPN
fcis-25103	360	7	.	.	PROPN
fcis-25103	360	8	,	,	PUNCT
fcis-25103	360	9	ramage	ramage	NOUN
fcis-25103	360	10	,	,	PUNCT
fcis-25103	360	11	d.	d.	PROPN
fcis-25103	360	12	,	,	PUNCT
fcis-25103	360	13	talwar	talwar	PROPN
fcis-25103	360	14	,	,	PUNCT
fcis-25103	360	15	k.	k.	PROPN
fcis-25103	360	16	,	,	PUNCT
fcis-25103	360	17	zhang	zhang	PROPN
fcis-25103	360	18	,	,	PUNCT
fcis-25103	360	19	l.	l.	PROPN
fcis-25103	360	20	:	:	PUNCT
fcis-25103	360	21	learning	learn	VERB
fcis-25103	360	22	differentially	differentially	ADV
fcis-25103	360	23	private	private	ADJ
fcis-25103	360	24	recurrent	recurrent	ADJ
fcis-25103	360	25	language	language	NOUN
fcis-25103	360	26	models	model	NOUN
fcis-25103	360	27	.	.	PUNCT
fcis-25103	361	1	in	in	ADP
fcis-25103	361	2	:	:	PUNCT
fcis-25103	361	3	6th	6th	ADJ
fcis-25103	361	4	international	international	ADJ
fcis-25103	361	5	conference	conference	NOUN
fcis-25103	361	6	on	on	ADP
fcis-25103	361	7	learning	learn	VERB
fcis-25103	361	8	representations	representation	NOUN
fcis-25103	361	9	,	,	PUNCT
fcis-25103	361	10	iclr	iclr	ADJ
fcis-25103	361	11	2018	2018	NUM
fcis-25103	361	12	.	.	PUNCT
fcis-25103	362	1	[	[	X
fcis-25103	362	2	14	14	NUM
fcis-25103	362	3	]	]	X
fcis-25103	362	4	sun	sun	PROPN
fcis-25103	362	5	,	,	PUNCT
fcis-25103	362	6	z.	z.	PROPN
fcis-25103	362	7	,	,	PUNCT
fcis-25103	362	8	kairouz	kairouz	PROPN
fcis-25103	362	9	,	,	PUNCT
fcis-25103	362	10	p.	p.	PROPN
fcis-25103	362	11	,	,	PUNCT
fcis-25103	362	12	suresh	suresh	PROPN
fcis-25103	362	13	,	,	PUNCT
fcis-25103	362	14	a.t	a.t	PROPN
fcis-25103	362	15	.	.	PROPN
fcis-25103	362	16	,	,	PUNCT
fcis-25103	362	17	mcmahan	mcmahan	PROPN
fcis-25103	362	18	,	,	PUNCT
fcis-25103	362	19	h.b	h.b	PROPN
fcis-25103	362	20	.	.	PROPN
fcis-25103	362	21	:	:	PUNCT
fcis-25103	362	22	can	can	AUX
fcis-25103	362	23	you	you	PRON
fcis-25103	362	24	really	really	ADV
fcis-25103	362	25	backdoor	backdoor	VERB
fcis-25103	362	26	federated	federated	ADJ
fcis-25103	362	27	learning	learning	NOUN
fcis-25103	362	28	?	?	PUNCT
fcis-25103	363	1	corr	corr	PROPN
fcis-25103	363	2	abs/1911.07963	abs/1911.07963	PROPN
fcis-25103	363	3	(	(	PUNCT
fcis-25103	363	4	2019	2019	NUM
fcis-25103	363	5	)	)	PUNCT
fcis-25103	363	6	.	.	PUNCT
fcis-25103	364	1	[	[	X
fcis-25103	364	2	15	15	NUM
fcis-25103	364	3	]	]	X
fcis-25103	364	4	naseri	naseri	NOUN
fcis-25103	364	5	,	,	PUNCT
fcis-25103	364	6	m.	m.	NOUN
fcis-25103	364	7	,	,	PUNCT
fcis-25103	364	8	hayes	hayes	PROPN
fcis-25103	364	9	,	,	PUNCT
fcis-25103	364	10	j.	j.	PROPN
fcis-25103	364	11	,	,	PUNCT
fcis-25103	364	12	cristofaro	cristofaro	NOUN
fcis-25103	364	13	,	,	PUNCT
fcis-25103	364	14	e.d	e.d	PROPN
fcis-25103	364	15	.	.	PUNCT
fcis-25103	364	16	:	:	PUNCT
fcis-25103	364	17	toward	toward	ADP
fcis-25103	364	18	robustness	robustness	NOUN
fcis-25103	364	19	and	and	CCONJ
fcis-25103	364	20	privacy	privacy	NOUN
fcis-25103	364	21	in	in	ADP
fcis-25103	364	22	federated	federated	ADJ
fcis-25103	364	23	learning	learning	NOUN
fcis-25103	364	24	:	:	PUNCT
fcis-25103	364	25	experimenting	experiment	VERB
fcis-25103	364	26	with	with	ADP
fcis-25103	364	27	local	local	ADJ
fcis-25103	364	28	and	and	CCONJ
fcis-25103	364	29	central	central	ADJ
fcis-25103	364	30	differential	differential	NOUN
fcis-25103	364	31	privacy	privacy	NOUN
fcis-25103	364	32	.	.	PUNCT
fcis-25103	365	1	corr	corr	PROPN
fcis-25103	365	2	abs/2009.03561	abs/2009.03561	PROPN
fcis-25103	365	3	(	(	PUNCT
fcis-25103	365	4	2020	2020	NUM
fcis-25103	365	5	)	)	PUNCT
fcis-25103	365	6	.	.	PUNCT
fcis-25103	366	1	[	[	X
fcis-25103	366	2	16	16	NUM
fcis-25103	366	3	]	]	PUNCT
fcis-25103	366	4	vadhan	vadhan	PROPN
fcis-25103	366	5	,	,	PUNCT
fcis-25103	366	6	s.	s.	PROPN
fcis-25103	366	7	:	:	PUNCT
fcis-25103	366	8	the	the	DET
fcis-25103	366	9	complexity	complexity	NOUN
fcis-25103	366	10	of	of	ADP
fcis-25103	366	11	differential	differential	ADJ
fcis-25103	366	12	privacy	privacy	NOUN
fcis-25103	366	13	,	,	PUNCT
fcis-25103	366	14	pp	pp	PROPN
fcis-25103	366	15	.	.	PUNCT
fcis-25103	367	1	347	347	NUM
fcis-25103	367	2	–	–	PUNCT
fcis-25103	367	3	450	450	NUM
fcis-25103	367	4	.	.	PUNCT
fcis-25103	367	5	springer	springer	NOUN
fcis-25103	367	6	,	,	PUNCT
fcis-25103	367	7	cham	cham	PROPN
fcis-25103	367	8	(	(	PUNCT
fcis-25103	367	9	2017	2017	NUM
fcis-25103	367	10	)	)	PUNCT
fcis-25103	367	11	.	.	PUNCT
fcis-25103	368	1	[	[	X
fcis-25103	368	2	17	17	NUM
fcis-25103	368	3	]	]	X
fcis-25103	368	4	liu	liu	PROPN
fcis-25103	368	5	,	,	PUNCT
fcis-25103	368	6	y.	y.	PROPN
fcis-25103	368	7	,	,	PUNCT
fcis-25103	368	8	ma	ma	PROPN
fcis-25103	368	9	,	,	PUNCT
fcis-25103	368	10	s.	s.	PROPN
fcis-25103	368	11	,	,	PUNCT
fcis-25103	368	12	aafer	aafer	VERB
fcis-25103	368	13	,	,	PUNCT
fcis-25103	368	14	y.	y.	PROPN
fcis-25103	368	15	,	,	PUNCT
fcis-25103	368	16	lee	lee	PROPN
fcis-25103	368	17	,	,	PUNCT
fcis-25103	368	18	w.	w.	PROPN
fcis-25103	368	19	,	,	PUNCT
fcis-25103	368	20	zhai	zhai	PROPN
fcis-25103	368	21	,	,	PUNCT
fcis-25103	368	22	j.	j.	PROPN
fcis-25103	368	23	,	,	PUNCT
fcis-25103	368	24	wang	wang	PROPN
fcis-25103	368	25	,	,	PUNCT
fcis-25103	368	26	w.	w.	PROPN
fcis-25103	368	27	,	,	PUNCT
fcis-25103	368	28	zhang	zhang	PROPN
fcis-25103	368	29	,	,	PUNCT
fcis-25103	368	30	x.	x.	NOUN
fcis-25103	368	31	:	:	PUNCT
fcis-25103	368	32	trojaning	trojane	VERB
fcis-25103	368	33	attack	attack	NOUN
fcis-25103	368	34	on	on	ADP
fcis-25103	368	35	neural	neural	ADJ
fcis-25103	368	36	networks	network	NOUN
fcis-25103	368	37	.	.	PUNCT
fcis-25103	369	1	in	in	ADP
fcis-25103	369	2	:	:	PUNCT
fcis-25103	369	3	25th	25th	ADJ
fcis-25103	369	4	annual	annual	ADJ
fcis-25103	369	5	network	network	NOUN
fcis-25103	369	6	and	and	CCONJ
fcis-25103	369	7	distributed	distribute	VERB
fcis-25103	369	8	system	system	NOUN
fcis-25103	369	9	security	security	NOUN
fcis-25103	369	10	symposium	symposium	NOUN
fcis-25103	369	11	,	,	PUNCT
fcis-25103	369	12	ndss	ndss	NOUN
fcis-25103	369	13	2018	2018	NUM
fcis-25103	369	14	.	.	PUNCT
fcis-25103	369	15	39	39	NUM
fcis-25103	370	1	[	[	SYM
fcis-25103	370	2	18	18	NUM
fcis-25103	370	3	]	]	X
fcis-25103	370	4	bagdasaryan	bagdasaryan	ADJ
fcis-25103	370	5	,	,	PUNCT
fcis-25103	370	6	e.	e.	PROPN
fcis-25103	370	7	,	,	PUNCT
fcis-25103	370	8	veit	veit	PROPN
fcis-25103	370	9	,	,	PUNCT
fcis-25103	370	10	a.	a.	PROPN
fcis-25103	370	11	,	,	PUNCT
fcis-25103	370	12	hua	hua	PROPN
fcis-25103	370	13	,	,	PUNCT
fcis-25103	370	14	y.	y.	PROPN
fcis-25103	370	15	,	,	PUNCT
fcis-25103	370	16	estrin	estrin	NOUN
fcis-25103	370	17	,	,	PUNCT
fcis-25103	370	18	d.	d.	PROPN
fcis-25103	370	19	,	,	PUNCT
fcis-25103	370	20	shmatikov	shmatikov	PROPN
fcis-25103	370	21	,	,	PUNCT
fcis-25103	370	22	v.	v.	ADP
fcis-25103	370	23	:	:	PUNCT
fcis-25103	370	24	how	how	SCONJ
fcis-25103	370	25	to	to	PART
fcis-25103	370	26	backdoor	backdoor	VERB
fcis-25103	370	27	federated	federated	ADJ
fcis-25103	370	28	learning	learning	NOUN
fcis-25103	370	29	.	.	PUNCT
fcis-25103	371	1	in	in	ADP
fcis-25103	371	2	:	:	PUNCT
fcis-25103	371	3	the	the	DET
fcis-25103	371	4	23rd	23rd	ADJ
fcis-25103	371	5	international	international	ADJ
fcis-25103	371	6	conference	conference	NOUN
fcis-25103	371	7	on	on	ADP
fcis-25103	371	8	artificial	artificial	ADJ
fcis-25103	371	9	intelligence	intelligence	NOUN
fcis-25103	371	10	and	and	CCONJ
fcis-25103	371	11	statistics	statistic	NOUN
fcis-25103	371	12	,	,	PUNCT
fcis-25103	371	13	aistats	aistat	NOUN
fcis-25103	371	14	2020	2020	NUM
fcis-25103	371	15	.	.	PUNCT
fcis-25103	372	1	[	[	X
fcis-25103	372	2	19	19	NUM
fcis-25103	372	3	]	]	X
fcis-25103	372	4	krizhevsky	krizhevsky	NOUN
fcis-25103	372	5	,	,	PUNCT
fcis-25103	372	6	a.	a.	NOUN
fcis-25103	372	7	:	:	PUNCT
fcis-25103	372	8	learning	learn	VERB
fcis-25103	372	9	multiple	multiple	ADJ
fcis-25103	372	10	layers	layer	NOUN
fcis-25103	372	11	of	of	ADP
fcis-25103	372	12	features	feature	NOUN
fcis-25103	372	13	from	from	ADP
fcis-25103	372	14	tiny	tiny	ADJ
fcis-25103	372	15	images	image	NOUN
fcis-25103	372	16	.	.	PUNCT
fcis-25103	373	1	technical	technical	ADJ
fcis-25103	373	2	report	report	NOUN
fcis-25103	373	3	(	(	PUNCT
fcis-25103	373	4	2009	2009	NUM
fcis-25103	373	5	)	)	PUNCT
fcis-25103	373	6	.	.	PUNCT
fcis-25103	374	1	[	[	X
fcis-25103	374	2	20	20	NUM
fcis-25103	374	3	]	]	X
fcis-25103	374	4	cohen	cohen	PROPN
fcis-25103	374	5	,	,	PUNCT
fcis-25103	374	6	g.	g.	PROPN
fcis-25103	374	7	,	,	PUNCT
fcis-25103	374	8	afshar	afshar	PRON
fcis-25103	374	9	,	,	PUNCT
fcis-25103	374	10	s.	s.	PROPN
fcis-25103	374	11	,	,	PUNCT
fcis-25103	374	12	tapson	tapson	PROPN
fcis-25103	374	13	,	,	PUNCT
fcis-25103	374	14	j.	j.	PROPN
fcis-25103	374	15	,	,	PUNCT
fcis-25103	374	16	schaik	schaik	NOUN
fcis-25103	374	17	,	,	PUNCT
fcis-25103	374	18	a.	a.	NOUN
fcis-25103	374	19	:	:	PUNCT
fcis-25103	374	20	emnist	emnist	NOUN
fcis-25103	374	21	:	:	PUNCT
fcis-25103	374	22	extending	extend	VERB
fcis-25103	374	23	mnist	mnist	NOUN
fcis-25103	374	24	to	to	ADP
fcis-25103	374	25	handwritten	handwritten	ADJ
fcis-25103	374	26	letters	letter	NOUN
fcis-25103	374	27	.	.	PUNCT
fcis-25103	375	1	in	in	ADP
fcis-25103	375	2	:	:	PUNCT
fcis-25103	375	3	2017	2017	NUM
fcis-25103	375	4	international	international	ADJ
fcis-25103	375	5	joint	joint	ADJ
fcis-25103	375	6	conference	conference	NOUN
fcis-25103	375	7	on	on	ADP
fcis-25103	375	8	neural	neural	ADJ
fcis-25103	375	9	networks	network	NOUN
fcis-25103	375	10	,	,	PUNCT
fcis-25103	375	11	ijcnn	ijcnn	PROPN
fcis-25103	375	12	2017	2017	NUM
fcis-25103	375	13	.	.	PUNCT
fcis-25103	376	1	[	[	X
fcis-25103	376	2	21	21	NUM
fcis-25103	376	3	]	]	PUNCT
fcis-25103	376	4	minka	minka	PROPN
fcis-25103	376	5	,	,	PUNCT
fcis-25103	376	6	t.	t.	PROPN
fcis-25103	376	7	:	:	PUNCT
fcis-25103	376	8	estimating	estimate	VERB
fcis-25103	376	9	a	a	DET
fcis-25103	376	10	dirichlet	dirichlet	NOUN
fcis-25103	376	11	distribution	distribution	NOUN
fcis-25103	376	12	.	.	PUNCT
fcis-25103	377	1	in	in	ADP
fcis-25103	377	2	:	:	PUNCT
fcis-25103	377	3	technical	technical	ADJ
fcis-25103	377	4	report	report	NOUN
fcis-25103	377	5	.	.	PUNCT
fcis-25103	378	1	mit	mit	NOUN
fcis-25103	378	2	,	,	PUNCT
fcis-25103	378	3	(	(	PUNCT
fcis-25103	378	4	2000	2000	NUM
fcis-25103	378	5	)	)	PUNCT
fcis-25103	378	6	.	.	PUNCT
fcis-25103	379	1	[	[	X
fcis-25103	379	2	22	22	NUM
fcis-25103	379	3	]	]	PUNCT
fcis-25103	379	4	he	he	PRON
fcis-25103	379	5	,	,	PUNCT
fcis-25103	379	6	k.	k.	PROPN
fcis-25103	379	7	,	,	PUNCT
fcis-25103	379	8	zhang	zhang	PROPN
fcis-25103	379	9	,	,	PUNCT
fcis-25103	379	10	x.	x.	PROPN
fcis-25103	379	11	,	,	PUNCT
fcis-25103	379	12	ren	ren	PROPN
fcis-25103	379	13	,	,	PUNCT
fcis-25103	379	14	s.	s.	PROPN
fcis-25103	379	15	,	,	PUNCT
fcis-25103	379	16	sun	sun	PROPN
fcis-25103	379	17	,	,	PUNCT
fcis-25103	379	18	j.	j.	PROPN
fcis-25103	379	19	:	:	PUNCT
fcis-25103	379	20	deep	deep	ADJ
fcis-25103	379	21	residual	residual	ADJ
fcis-25103	379	22	learning	learning	NOUN
fcis-25103	379	23	for	for	ADP
fcis-25103	379	24	image	image	NOUN
fcis-25103	379	25	recognition	recognition	NOUN
fcis-25103	379	26	.	.	PUNCT
fcis-25103	380	1	in	in	ADP
fcis-25103	380	2	:	:	PUNCT
fcis-25103	380	3	2016	2016	NUM
fcis-25103	380	4	ieee	ieee	NOUN
fcis-25103	380	5	conference	conference	NOUN
fcis-25103	380	6	on	on	ADP
fcis-25103	380	7	computer	computer	NOUN
fcis-25103	380	8	vision	vision	NOUN
fcis-25103	380	9	and	and	CCONJ
fcis-25103	380	10	pattern	pattern	NOUN
fcis-25103	380	11	recognition	recognition	NOUN
fcis-25103	380	12	,	,	PUNCT
fcis-25103	380	13	cvpr	cvpr	NOUN
fcis-25103	380	14	2016	2016	NUM
fcis-25103	380	15	.	.	PUNCT
fcis-25103	381	1	[	[	X
fcis-25103	381	2	23	23	NUM
fcis-25103	381	3	]	]	X
fcis-25103	381	4	blanchard	blanchard	NOUN
fcis-25103	381	5	,	,	PUNCT
fcis-25103	381	6	p.	p.	NOUN
fcis-25103	381	7	,	,	PUNCT
fcis-25103	381	8	mhamdi	mhamdi	NOUN
fcis-25103	381	9	,	,	PUNCT
fcis-25103	381	10	e.m.e	e.m.e	NOUN
fcis-25103	381	11	.	.	PUNCT
fcis-25103	381	12	,	,	PUNCT
fcis-25103	381	13	guerraoui	guerraoui	PROPN
fcis-25103	381	14	,	,	PUNCT
fcis-25103	381	15	r.	r.	PROPN
fcis-25103	381	16	,	,	PUNCT
fcis-25103	381	17	stainer	stainer	NOUN
fcis-25103	381	18	,	,	PUNCT
fcis-25103	381	19	j.	j.	PROPN
fcis-25103	381	20	:	:	PUNCT
fcis-25103	381	21	machine	machine	NOUN
fcis-25103	381	22	learning	learn	VERB
fcis-25103	381	23	with	with	ADP
fcis-25103	381	24	adversaries	adversary	NOUN
fcis-25103	381	25	:	:	PUNCT
fcis-25103	381	26	byzantine	byzantine	ADJ
fcis-25103	381	27	tolerant	tolerant	ADJ
fcis-25103	381	28	gradient	gradient	ADJ
fcis-25103	381	29	descent	descent	NOUN
fcis-25103	381	30	.	.	PUNCT
fcis-25103	382	1	in	in	ADP
fcis-25103	382	2	:	:	PUNCT
fcis-25103	382	3	advances	advance	NOUN
fcis-25103	382	4	in	in	ADP
fcis-25103	382	5	neural	neural	ADJ
fcis-25103	382	6	information	information	NOUN
fcis-25103	382	7	processing	processing	NOUN
fcis-25103	382	8	systems	system	NOUN
fcis-25103	382	9	30	30	NUM
fcis-25103	382	10	:	:	PUNCT
fcis-25103	382	11	annual	annual	ADJ
fcis-25103	382	12	conference	conference	NOUN
fcis-25103	382	13	on	on	ADP
fcis-25103	382	14	neural	neural	ADJ
fcis-25103	382	15	information	information	NOUN
fcis-25103	382	16	processing	processing	NOUN
fcis-25103	382	17	systems	system	NOUN
fcis-25103	382	18	2017	2017	NUM
fcis-25103	382	19	.	.	PUNCT
fcis-25103	383	1	[	[	X
fcis-25103	383	2	24	24	NUM
fcis-25103	383	3	]	]	SYM
fcis-25103	383	4	yin	yin	PROPN
fcis-25103	383	5	,	,	PUNCT
fcis-25103	383	6	d.	d.	PROPN
fcis-25103	383	7	,	,	PUNCT
fcis-25103	383	8	chen	chen	PROPN
fcis-25103	383	9	,	,	PUNCT
fcis-25103	383	10	y.	y.	PROPN
fcis-25103	383	11	,	,	PUNCT
fcis-25103	383	12	ramchandran	ramchandran	NOUN
fcis-25103	383	13	,	,	PUNCT
fcis-25103	383	14	k.	k.	PROPN
fcis-25103	383	15	,	,	PUNCT
fcis-25103	383	16	bartlett	bartlett	PROPN
fcis-25103	383	17	,	,	PUNCT
fcis-25103	383	18	p.l	p.l	PROPN
fcis-25103	383	19	.	.	PROPN
fcis-25103	383	20	:	:	PUNCT
fcis-25103	384	1	byzantinerobust	byzantinerobust	PROPN
fcis-25103	384	2	distributed	distributed	ADJ
fcis-25103	384	3	learning	learning	NOUN
fcis-25103	384	4	:	:	PUNCT
fcis-25103	384	5	towards	towards	ADP
fcis-25103	384	6	optimal	optimal	ADJ
fcis-25103	384	7	statistical	statistical	ADJ
fcis-25103	384	8	rates	rate	NOUN
fcis-25103	384	9	.	.	PUNCT
fcis-25103	385	1	in	in	ADP
fcis-25103	385	2	:	:	PUNCT
fcis-25103	385	3	proceedings	proceeding	NOUN
fcis-25103	385	4	of	of	ADP
fcis-25103	385	5	the	the	DET
fcis-25103	385	6	35th	35th	ADJ
fcis-25103	385	7	international	international	ADJ
fcis-25103	385	8	conference	conference	NOUN
fcis-25103	385	9	on	on	ADP
fcis-25103	385	10	machine	machine	NOUN
fcis-25103	385	11	learning	learning	NOUN
fcis-25103	385	12	,	,	PUNCT
fcis-25103	385	13	icml	icml	VERB
fcis-25103	385	14	2018	2018	NUM
fcis-25103	385	15	.	.	PUNCT
fcis-25103	386	1	[	[	X
fcis-25103	386	2	25	25	NUM
fcis-25103	386	3	]	]	X
fcis-25103	386	4	melis	melis	PROPN
fcis-25103	386	5	,	,	PUNCT
fcis-25103	386	6	l.	l.	PROPN
fcis-25103	386	7	,	,	PUNCT
fcis-25103	386	8	song	song	NOUN
fcis-25103	386	9	,	,	PUNCT
fcis-25103	386	10	c.	c.	PROPN
fcis-25103	386	11	,	,	PUNCT
fcis-25103	386	12	cristofaro	cristofaro	NOUN
fcis-25103	386	13	,	,	PUNCT
fcis-25103	386	14	e.d	e.d	PROPN
fcis-25103	386	15	.	.	PROPN
fcis-25103	386	16	,	,	PUNCT
fcis-25103	386	17	shmatikov	shmatikov	PROPN
fcis-25103	386	18	,	,	PUNCT
fcis-25103	386	19	v.	v.	ADV
fcis-25103	386	20	:	:	PUNCT
fcis-25103	386	21	exploiting	exploit	VERB
fcis-25103	386	22	unintended	unintended	ADJ
fcis-25103	386	23	feature	feature	NOUN
fcis-25103	386	24	leakage	leakage	NOUN
fcis-25103	386	25	in	in	ADP
fcis-25103	386	26	collaborative	collaborative	ADJ
fcis-25103	386	27	learning	learning	NOUN
fcis-25103	386	28	.	.	PUNCT
fcis-25103	387	1	in	in	ADP
fcis-25103	387	2	:	:	PUNCT
fcis-25103	387	3	2019	2019	NUM
fcis-25103	387	4	ieee	ieee	NOUN
fcis-25103	387	5	symposium	symposium	NOUN
fcis-25103	387	6	on	on	ADP
fcis-25103	387	7	security	security	NOUN
fcis-25103	387	8	and	and	CCONJ
fcis-25103	387	9	privacy	privacy	NOUN
fcis-25103	387	10	,	,	PUNCT
fcis-25103	387	11	sp	sp	ADP
fcis-25103	387	12	2019	2019	NUM
fcis-25103	387	13	.	.	PUNCT