Label noise analysis meets adversarial training: A defense against label poisoning in federated learning
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Existing works show reasonable defense performance on label-flipping backdoor attack and trigger-based backdoor attack.
“The existing works show reasonable defense performance on label-flipping backdoor attack [186], [187] and trigger-based backdoor attack [188], [189].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [186]
Cites
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Moustafa, N., & Slay, J. (2015) · 2015 Military Communications and Information Systems Conference (MilCIS) · doi:10.1109/milcis.2015.7348942 · Cited by 4,033 · see citing works
A survey on federated learning
Zhang, C., Xie, Y., Bai, H., Yu, B., Li, W., & Gao, Y. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.106775 · Cited by 1,899 · see citing works
Classification in the Presence of Label Noise: A Survey
Frenay, B., & Verleysen, M. (2014) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2013.2292894 · Cited by 1,777 · see citing works
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760 · see citing works
Co-teaching: Robust Training of Deep Neural Networks with Extremely Noisy LabelsPreprint
Han, B., Yao, Q., Yu, X., Niu, G., Xu, M., Hu, W., Tsang, I. W.-H., & Sugiyama, M. (2018) · arXiv (Cornell University) · doi:10.5555/3327757.3327944 · Cited by 1,674 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480 · see citing works
Symmetric Cross Entropy for Robust Learning With Noisy Labels
Wang, Y., Ma, X., Chen, Z., Luo, Y., Yi, J., & Bailey, J. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00041 · Cited by 1,046 · see citing works
Meta-Weight-Net: Learning an Explicit Mapping For Sample WeightingPreprint
Shu, J., Xie, Q., Yi, L., Zhao, Q., Zhou, S., Xu, Z., & Meng, D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.07379 · Cited by 626 · see citing works
Moustafa, N., Turnbull, B., & Choo, K. R. (2018) · IEEE Internet of Things Journal · doi:10.1109/jiot.2018.2871719 · Cited by 597 · see citing works
Probabilistic End-To-End Noise Correction for Learning With Noisy Labels
Yi, K., & Wu, J. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00718 · Cited by 481 · see citing works
Using Trusted Data to Train Deep Networks on Labels Corrupted by Severe NoisePreprint
Hendrycks, D., Mazeika, M., Wilson, D., & Gimpel, K. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.05300 · Cited by 424 · see citing works
Bessière, C. (2020) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 309 · see citing works
Delving Deep Into Label Smoothing
Zhang, C., Jiang, P.-T., Hou, Q., Wei, Y., Han, Q., Li, Z., & Cheng, M.-M. (2021) · IEEE Transactions on Image Processing · doi:10.1109/tip.2021.3089942 · Cited by 284 · see citing works
Analyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 256 · see citing works
CNN and RNN based payload classification methods for attack detection
Liu, H., Lang, B., Liu, M., & Yan, H. (2018) · Knowledge-Based Systems · doi:10.1016/j.knosys.2018.08.036 · Cited by 211 · see citing works
Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?
Alshammari, R., & Zincir-Heywood, N. (2010) · Computer Networks · doi:10.1016/j.comnet.2010.12.002 · Cited by 153 · see citing works
Wang, R., Huang, W., Shi, M., Wang, J., Shen, C., & Zhu, Z. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.109880 · Cited by 77 · see citing works
ProSelfLC: Progressive Self Label Correction for Training Robust Deep Neural Networks
Wang, X., Yang, H., Kodirov, E., Clifton, D. A., & Robertson, N. M. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00081 · Cited by 71 · see citing works
Hallaji, E., Razavi‐Far, R., Wang, M., Saif, M., & Fardanesh, B. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3216948 · Cited by 53 · see citing works
Self-citationFederated and Transfer Learning
(2022) · Adaptation, learning, and optimization · doi:10.1007/978-3-031-11748-0 · Cited by 39 · see citing works
Rodríguez-Barroso, N., Martínez-Cámara, E., Luzón, M. V., & Herrera, F. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.108588 · Cited by 38 · see citing works
Trusted-Data-Guided Label Enhancement on Noisy Labels
Xu, N., Li, J., Liu, Y., & Geng, X. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3162316 · Cited by 24 · see citing works
Federated and Transfer Learning: A Survey on Adversaries and Defense Mechanisms
Hallaji, E., Razavi‐Far, R., & Saif, M. (2022) · Adaptation, learning, and optimization · doi:10.1007/978-3-031-11748-0_3 · Cited by 22 · see citing works
Self-citationTowards privacy-preserving and verifiable federated matrix factorization
Wan, X., Zheng, Y., Li, Q., Fu, A., Su, M., & Gao, Y. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.109193 · Cited by 18 · see citing works
Label Distribution for Learning with Noisy Labels
Liu, Y., Xu, N., Zhang, Y., & Geng, X. (2020) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2020/356 · Cited by 14 · see citing works
Flagged first, then by citations
2 of the 29 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 191 · see citing works
“Examples of this strategy include FAT [81], FedDynAT [82], and GALP [83].”
MethodDecentralized Federated Learning: A Survey on Security and Privacy
Hallaji, E., Razavi‐Far, R., Saif, M., Wang, B., & Yang, Q. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3362191 · Cited by 191 · see citing works
“As an example, reference [68] studies different variations of label poisoning in federated learning systems and mitigates these attacks by reformulating the problem as a label noise classification task.”
BackgroundSelf-citationWan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“The existing works show reasonable defense performance on label-flipping backdoor attack [186], [187] and trigger-based backdoor attack [188], [189].”
BackgroundDependable federated learning for IoT intrusion detection against poisoning attacks
Yang, R., He, H. X., Wang, Y., Qu, Y., & Zhang, W. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103381 · Cited by 58 · see citing works
A Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy
Manzoor, H. U., Shabbir, A., Chen, A., Flynn, D., & Zoha, A. (2024) · Future Internet · doi:10.3390/fi16100374 · Cited by 58 · see citing works
Nowroozi, E., Haider, I., Taheri, R., & Conti, M. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3525554 · Cited by 57 · see citing works
“The authors in [15], [16], [17], [18], investigated extensive strategies for FL with a special focus on applying and tackling the issue of LF.”
Intrusion detection for Industrial Internet of Things based on deep learning
Lu, Y., Chai, S., Suo, Y., Yao, F., & Zhang, C. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126886 · Cited by 49 · see citing works
Arbaoui, M., Brahmia, M., Rahmoun, A., & Zghal, M. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3678182 · Cited by 49 · see citing works
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38 · see citing works
“Motivated by the fact that noisy label classification can assist in correcting or discarding noisy labels during training, the study [100] treats label poisoning as a noisy label classification problem and proposes a novel noisy-label classifier.”
Generative AI in Intrusion Detection Systems for Internet of Things: A Systematic Literature Review
Deng, Z., Torim, A., Yahia, S. B., & Bahşi, H. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2025.3573194 · Cited by 26 · see citing works
“CICIDS2017 dataset performance. using techniques like anomaly detection and outlier detection [68], [108] and vaccination through the use of GAN label poisoners [93].”
Li, B., Song, P., Zhao, C., & Xie, M. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111491 · Cited by 20 · see citing works
Lu, R., Zhang, W., He, H. X., Li, Q., Zhong, X., Yang, H., Wang, D., Shi, L., Guo, Y., & Wang, Z. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3431555 · Cited by 16 · see citing works
“Then, many studies [22], [24], [25], [26], [27], [28], [29], [30], [31], [32] focus on dealing with poison attacks and backdoor attacks in FL systems.”
BackgroundFederated Learning and Semantic Communication for the Metaverse: Challenges and Potential Solutions
Bian, Y., Zhang, X., Luosang, G., Duojie, R., Renqing, D., & Ding, X. (2025) · Electronics · doi:10.3390/electronics14050868 · Cited by 14 · see citing works
“Some research techniques are expected to address these challenges, adopting differential privacy techniques to protect the privacy of individual contributors; adversarial training can improve the resistance of the model to adversarial samples [56].”
Manzoor, H. U., Arshad, K., Assaleh, K. T., & Zoha, A. (2024) · doi:10.36227/techrxiv.171468119.91309905/v1 · Cited by 13 · see citing works
Cyber Threat Intelligence and Security for Federated Learning in Digital Forensics
Iyengar, S. S., Nabavirazavi, S., Hariprasad, Y., Prasad, H. B., & Mohan, C. K. (2025) · Signals and communication technology · doi:10.1007/978-3-031-89327-8_6 · Cited by 11 · see citing works
Against network attacks in renewable power plants: Malicious behavior defense for federated learning
Wu, X., Jin, Z., Zhou, J., Liu, K., & Liu, Z. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110577 · Cited by 10 · see citing works
Understanding the adversary: A survey of adversarial machine learning in network intrusion detection
Espindola, A. D. S., Santin, A. O., Casimiro, A., Ferreira, P. M., & Viegas, E. K. (2026) · Computer Science Review · doi:10.1016/j.cosrev.2026.100995 · Cited by 9 · see citing works
Enhancing SIoT Security Through Advanced Machine Learning Techniques for Intrusion Detection
Divya, S., & Tanuja, R. (2024) · Lecture notes in networks and systems · doi:10.1007/978-981-97-2053-8_8 · Cited by 7 · see citing works
Label Noise Correction for Federated Learning: A Secure, Efficient and Reliable Realization
Wang, H., Jiang, T., Guo, Y. H., Guo, F., Bie, R., & Jia, X. (2024) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde60146.2024.00277 · Cited by 7 · see citing works
“Other works pay attention to detecting the noisy clients directly in order to increase the robustness of the federated-training model [1], [23], [24].”
BackgroundGhoneim, O., Dobiáš, P., & Romain, O. (2025) · Machine Learning with Applications · doi:10.1016/j.mlwa.2025.100762 · Cited by 9 · see citing works
Rezaie, H., Taheri, R., Nowroozi, E., Hajizadeh, M., Shiaeles, S. N., & Bauschert, T. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2025.3644477 · Cited by 7 · see citing works
“Additionally, Hallaji et al. address the specific challenge of label poisoning by fusing adversarial training with label noise detection, strengthening the model’s ability to withstand mislabeled or tampered data during training [150].”
Wang, Z., Wang, B., Zhang, C., Liu, Y., & Guo, J. (2023) · Remote Sensing · doi:10.3390/rs15123157 · Cited by 6 · see citing works
MDD-FedGNN: A vertical federated graph learning framework for malicious domain detection
Zhang, S., Hao, Q., Gong, Z., Zhu, F., Wang, Y., & Wang, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104093 · Cited by 5 · see citing works
Byzantine-robust federated learning with ensemble incentive mechanism
Shi-hai, Z., Pu, J., Fu, X., Liu, L., & Dai, F. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.05.017 · Cited by 5 · see citing works
The Differential Privacy Framework for Convolutional Neural Network using PATE, ADLM and SGD models
Tang, S., & Wang, W. (2023) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana60121.2023.00085 · Cited by 4 · see citing works
“We use adversarial training[17] to help models work better when the data they were trained on is different from the data they're being used on.”
MethodRobust Federated Learning for Mitigating Advanced Persistent Threats in Cyber-Physical Systems
Hallaji, E., Razavi‐Far, R., & Saif, M. (2024) · Applied Sciences · doi:10.3390/app14198840 · Cited by 4 · see citing works
Self-citationA Study on Semi-Supervised Detection of DDoS Attacks under Class Imbalance
Hallaji, E., Shanmugam, V., Razavi‐Far, R., & Saif, M. (2025) · Conference proceedings - Canadian Conference on Electrical and Computer Engineering · doi:10.1109/ccece64018.2025.11364502 · Cited by 2 · see citing works
“One of the recent advancements in this domain is the use of machine learning to build intelligent IDSs to detect cyber attacks [2]–[5].”
Self-citationPandya, D., & Thakkar, A. (2026) · Knowledge-Based Systems · doi:10.1016/j.knosys.2026.115348 · Cited by 2 · see citing works
Trillos, N. G., Akash, A. K., Li, S., Riedl, K., & Zhu, Y. (2025) · Philosophical Transactions of the Royal Society A Mathematical Physical and Engineering Sciences · doi:10.1098/rsta.2024.0235 · Cited by 2 · see citing works
“They may do this by modifying the labels of a subset of the local training data (label-flipping attacks) [32, 36, 37, 39, 50, 51, 79], by altering data features by adding manually designed patterns to images [1,16,76] or generating poisoned samples using generative models [86,87], which are…”
Singh, V. P., Singh, M. P., & Hegde, S. (2025) · Progress in Artificial Intelligence · doi:10.1007/s13748-025-00415-7 · Cited by 1 · see citing works
Manzoor, H. U., Shabbir, A., Rais, R. N. B., Hussain, S., & Zoha, A. (2026) · International Journal of Intelligent Systems · doi:10.1155/int/8810907 · Cited by 1 · see citing works
A Comprehensive Review on Deep Learning With Noisy Labels: Challenges, Solutions, and Frontiers
Fang, J., Wang, Z., Liu, W., Zhang, Y. J., He, Y., & liu, X. (2026) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2026.3683790 · Cited by 1 · see citing works
“3) Adversarial Training in Federated Learning: A generative adversarial ( GA-LNL ) framework has been proposed in [97] for training noise-robust classifiers in federated learning by simulating label poisoning attacks.”
Integrating Federated Learning for Privacy Protection in Intelligent Home Care Robots
Liu, B., & Blancaflor, E. (2024) · International Symposium on Intelligent Robotics and Systems (ISoIRS) · doi:10.1109/isoirs63136.2024.00039
“Intelligent nursing robots collect a large amount of privacy data related to personal lifestyle habits and health status when performing tasks [9].”
BackgroundFederated Learning: An Overview of Attacks and Defense Methods
Sameera, K. M., Arikkat, D. R., Vinod, P., A., R. R. K., Aneez, A., & Conti, M. (2025) · Springer eBooks · doi:10.1007/978-3-031-83157-7_14
CoCF: Consistent Selection and Flexible Masking for Learning with Noisy Labels
Wang, Z., Tao, S., Zhao, W., & Dong, Y. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11227346
“However, acquiring perfectly labeled data is often unfeasible due to factors such as human errors, ambiguous class boundaries, and the high costs associated with labeling large datasets [1].”
A robust federated aggregation algorithm for multimodal data in smart grid scenarios
He, D., Yan, J., Wang, Y., Fei, Z., Xia, Y., Li, H., & Wang, W. (2026) · Multimedia Systems · doi:10.1007/s00530-025-02070-3
“GALP [ 22] designs a noise countermeasure mechanism to mitigate the impact of poisoning attacks, but this defense method is also based on the single assumption of label reversal attacks.”
Makris, A., Dousis, C., Kritharakis, E., Bouras, S., & Tserpes, K. (2026) · International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) · doi:10.1109/dcoss-iot69657.2026.00117
“Representative solutions include anomaly detection [23], verification techniques [24], adversarial training [25], and federated distillation [26].”
Analyzing Adversarial Attacks on Federated Learning based Medical Image Classification
Hamid, S., & Bawany, N. Z. (2026) · International Conference on Data Science, Machine Learning, and Intelligence (DataSciMI) · doi:10.1109/datascimi67380.2026.11523793
“In terms of adversarial robustness, techniques such as adversarial training [13] have been proven effective in enhancing the model's ability to resist adversarial attacks.”
Peng, J., Li, W., Vlaski, S., & Ling, Q. H. (2026) · IEEE Transactions on Signal and Information Processing over Networks · doi:10.1109/tsipn.2026.3712234
“For example, works such as [14], [39], [40], [41] focus on label poisoning attacks, where some agents have poisoned local labels and update their local models with these poisoned data.”
Stability-Aware Aggregation for Binary Federated Learning in the Presence of Noisy Client Data
Serbetci, A. (2026) · Cognitive Models and Artificial Intelligence Conference (AICCONF) · doi:10.1109/aicconf69182.2026.11600726
“The labeling process may be performed erronously or malicious poisoning attacks may introduce harmful data, 979-8-3315-9203-5/26/$31.00 ©2026 IEEE both of which can negatively affect global model convergence [3].”
InfluentialEvaluation of Label-Flipping Attacks on Federated Anomaly Detection in xG Networks
Bin-Ruba, S. A., Velloso, P. B., & Gu, P. (2026) · International Conference on Future and Intelligent Networking (FINE) · doi:10.1109/fine71157.2026.00052
“Hallaji et al. [16] proposed a defence that combines label noise analysis with adversarial training, showing that characterising the noise structure of poisoned updates is key to effective mitigation.”
- Authors
- Hallaji, E., Razavi-Far, R., Saif, M., & Herrera-Viedma, E.
- Affiliations
- University of Windsor (CA)
- Venue
- Knowledge-Based Systems
- Publisher
- Elsevier BV
- Published
- 2023-04
- Volume
- 266
- Pages
- 110384
- ISSN
- 0950-7051 (ISSN-L)
- OpenAlex
- W4320717670
- Cited by
- 41
- References
- 29
- Citations by year
- 2026: 10 · 2025: 12 · 2024: 14 · 2023: 5
- FWCI
- 3.63
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- Knowledge-Based Systems (publishedVersion)
- Scholarship at UWindsor (University of Windsor) (submittedVersion)
- Funders
- Natural Sciences and Engineering Research Council of Canada (CGSD3-569341-2022, RGPIN-04002-2018, RGPIN-2021-02968)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Machine Learning and Data Classification
- Keywords
- federated learning, adversarial training, backdoor attacks, label-flipping attacks, generative adversarial training, poisoning defense, intrusion detection, Internet of Things
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
