Vulnerabilities in federated learning

Classified as probably not a substantial claim.

There are no simple and straightforward defenses to attacks on federated learning systems due to privacy restrictions.

“It is noticeable that there are no simple and straightforward defenses to the attacks on the FL systems due to privacy restrictions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Model poisoning attacks are more likely to effectively contaminate the trained model.

“Model poisoning attacks are more likely to effectively contaminate the trained model.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Server-based federated learning models are more vulnerable to backdoor insertion in later rounds of training nearing convergence.

“Server-based FL models are more vulnerable to backdoors insertion in later rounds of training nearing convergence.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Major technology companies have already deployed federated learning in production, and a number of startups were founded on the basis of using federated learning to address privacy and data collection challenges in various industries.

“Major technology companies have already deployed FL in production, and a number of startups were founded on the basis of using FL to address privacy and data collection challenges in various industries.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The server can observe client updates, tamper with the aggregation process, and control the view of the participants of the global model and compression parameters.

“The server can observe client updates, tamper with the aggregation process, and control the view of the participants of the global model and compression parameters.”

May combine two claims.

Homomorphic Encryption protecting measures have been initially designed for privacy purposes and do not prevent FL from being susceptible to HE attacks.

“However, these protecting measures have been initially designed for privacy purposes and do not prevent FL from being susceptible to HE attacks [28], [29].”

• cites [28]Not checked yet

  Not checked in the free run.

• cites [29] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Designing and enforcing coordination protocols can be difficult to pin and may result in situations where we cannot guarantee the robustness of collaborative training.

“Beyond fundamental and domain-specific constraints, designing and enforcing coordination protocols can be difficult to pin [45] and may result in situations where we cannot guarantee the robustness of collaborative training.”

• cites [45]Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

Poisoning attacks seek to induce model corruption by maliciously manipulating training data samples and/or model updates.

“Poisoning attacks [52], [53] seek to induce model corruption by maliciously manipulating training data samples and/or model updates.”

• cites [52]Not checked yet

  Not checked in the free run.

• cites [53]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based).

Training with thousands of personal devices makes it impossible to ensure that none of them are malicious or compromised.

“Besides, training with thousands of personal devices makes it impossible to ensure that none of them are malicious or compromised.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

FL offers a new paradigm to protect user privacy while performing machine learning tasks on an extensive scale, but it is fraught with several vulnerabilities that must be addressed.

“FL offers a new paradigm to protect user privacy while performing machine learning tasks on an extensive scale, but it is fraught with several vulnerabilities that must be addressed.”

Probably not a substantial claim: may not pass S4 (based).

Existing FL protocols exhibit new unique vulnerabilities that adversaries can exploit to compromise the trained model.

“The existing FL protocols exhibit new unique vulnerabilities that adversaries can exploit to compromise the trained model.”

May combine two claims.

The distributed nature of FL, particularly when augmented with secure aggregation, causes many attacks to go unnoticed because secure aggregation prevents the server from inspecting each user's model update.

“The distributed nature of FL, particularly when augmented with secure aggregation [17], causes many attacks to go unnoticed [18] because secure aggregation prevents the server from inspecting each user's model update.”

• cites [17]Not checked yet

  Not checked in the free run.

• cites [18]Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

Federated Learning enables multiple clients located at different geographical locations to learn a machine learning model collaboratively without sharing their data.

“A new decentralized training paradigm, known as Federated Learning (FL), enables multiple clients located at different geographical locations to learn a machine learning model collaboratively without sharing their data.”

• cites [4]- [8]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based).

Compromised clients corrupt the FL training process by either exploiting model parameters or training data to craft an attack.

“Compromised clients corrupt the FL training process by either exploiting model parameters or training data to craft an attack.”

May combine two claims.

A compromised server can inspect all gradient updates sent to the server in any training rounds and tamper with the aggregation process.

“Furthermore, a compromised server can inspect all gradient updates sent to the server in any training rounds and tamper with the aggregation process.”

May combine two claims.

Although the data is not explicitly shared in the training process, it is still feasible for adversaries to reveal delicate information and even reconstruct the raw data approximately.

“Nevertheless, although the data is not explicitly shared in the training process, it is still feasible for the adversaries to reveal delicate information and even reconstruct the raw data approximately [31], [32].”

• cites [31] sourceNot checked yet

  Not checked in the free run.

• cites [32]Not checked yet

  Not checked in the free run.

May combine two claims.

Model parameters sharing combined with an increased number of communication rounds between the clients and the server exposes the FL environment to a new set of risks and opens new avenues for privacy leakage.

“To some extent, model parameters sharing combined with an increased number of communication rounds between the clients and the server exposes the FL environment to a new set of risks and opens new avenues for privacy leakage [19].”

• cites [19]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When training with thousands or millions of clients, there is no way to detect malicious ones by relying solely on their security guarantees.

“When training with thousands or millions of clients, there is no way to detect malicious ones by relying solely on their security guarantees.”

May combine two claims.

Eavesdroppers can intercept the models exchanged between different participants, as well as the final FL model in the deployment phase, and replace them with malicious models.

“Eavesdroppers can intercept the models exchanged between different participants, as well as the final FL model in the deployment phase, and replace them with malicious models.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A non-secure channel is an open vulnerability.

“A non-secure channel is an open vulnerability.”

May combine two claims.

Since the clients' data and the training pipelines cannot be inspected for anomalies due to privacy guarantees, the aggregator represents the most critical defense line against attacks.

“Since the clients' data and the training pipelines cannot be inspected for anomalies due to privacy guarantees, the aggregator represents the most critical defense line against attacks.”

Probably not a substantial claim: may not pass S4 (based).

Even benign clients cannot be trusted in a federated setting because they can be curious and attempt to infer sensitive information without necessarily corrupting the model updates.

“Even benign clients cannot be trusted in a federated setting because they can be curious and attempt to infer sensitive information without necessarily corrupting the model updates.”

May combine two claims.

An adversary can take a snapshot of FL model parameters and conduct property inference by calculating the difference between consecutive snapshots, which is equivalent to the aggregated model updates from all participants minus the adversary.

“The adversary can also take a snapshot of the FL model parameters and conduct property inference by calculating the difference between the consecutive snapshots, which is equivalent to the aggregated model updates from all participants minus the adversary.”

May combine two claims.

Examining model updates can reveal substantial private information such as class membership, class representations, and properties of other participants' data.

“As a result, examining the model updates can reveal a substantial amount of private information such as class membership [75], class representations [76] and properties of other participants' data [31].”

• cites [75]Not checked yet

  Not checked in the free run.

• cites [76]Not checked yet

  Not checked in the free run.

• cites [31] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Small changes to the training rules, such as increasing or decreasing the learning rate, may cause the optimizer to behave erratically and the global model convergence to fail.

“Small changes to the training rules, such as increasing or decreasing the learning rate, may cause the optimizer to behave erratically and the global model convergence to fail.”

May combine two claims.

With knowledge about class representations, data properties, memberships, and original data samples, outsiders have the necessary tools to produce a corrupted model update and perform a model replacement procedure.

“With knowledge about class representations, data properties, memberships, and even original data samples, outsiders will have the necessary tools to produce a corrupted model update and perform a model replacement procedure.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Techniques that aim to reduce communication cost, such as compression, can be applied in a negative way to degrade the quality of the model.

“Additionally, techniques that aim to reduce the communication cost, such as compression, can be applied in a negative way to degrade the quality of the model.”

May combine two claims.

GAN can be used to get training samples through inference and use these recovered samples to poison the training data.

“For instance, authors in [78] demonstrate how GAN can be used to get training samples through inference and use these recovered samples to poison the training data.”

• cites [78]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Non-i.i.d data distribution and large variance exhibited by gradients among different clients disrupt their basic assumptions in practical FL environments.

“As a matter of fact, non-i.i.d data distribution and large variance exhibited by gradients among different clients disrupt their basic assumptions in practical FL environments.”

May combine two claims.

Sophisticated backdoor attacks in FL can effectively overturn the catastrophic forgetting problem, stopping the backdoor from being omitted while the training progress.

“Besides, sophisticated backdoor attacks in FL can effectively overturn the catastrophic forgetting problem [13], stopping the backdoor from being omitted while the training progress.”

• cites [13]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The GAN-based threat can be a serious breach of FL security because it cannot be foreseen in advance.

“The GAN-based threat can be a serious breach of FL security because it cannot be foreseen in advance.”

May combine two claims.

An adversary can infer labels from gradients and recover the original training data without prior knowledge about the training set.

“Even worse, an adversary can infer labels from the gradients and recover the original training data without expecting any prior knowledge about the training set [14].”

• cites [14]Not checked yet

  Not checked in the free run.

May combine two claims.

Attackers can gain direct access to the global model from the server, which widens the attack surface.

“On the one hand, attackers can gain direct access to the global model from the server, which widens the attack surface.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Free-riding attacks against FL consist of intentionally dissimulating participation in the FL process to obtain the final model without actually contributing to the training process.

“Free-riding attacks [82], [83] against FL consist of intentionally dissimulating participation in the FL process to obtain the final model without actually contributing to the training process.”

• cites [82]Not checked yet

  Not checked in the free run.

• cites [83]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

In evasion attacks, an adversary tries to evade a deployed model by carefully manipulating the data samples fed into it.

“In evasion attacks [48], [68]- [70], an adversary tries to evade a deployed model by carefully manipulating the data samples fed into it.”

• cites [48]Not checked yet

  Not checked in the free run.

• cites [68]- [70]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Creating a federated system with ideal security properties is a daunting feat on its own due to multiple attacks that target the federation itself.

“Creating a federated system with ideal security properties is a daunting feat on its own due to multiple attacks that target the federation itself.”

May combine two claims.

Compromised or malicious servers can easily extract private client data or manipulate the global model to utilize shared computational power in building malicious tasks when training a machine learning model.

“They can easily extract private client data or manipulate the global model to utilize shared computational power in building malicious tasks when training a machine learning model [79].”

• cites [79]Not checked yet

  Not checked in the free run.

May combine two claims.

An adversary can act as a benign participant and stealthily train a GAN to simulate prototypical samples of other clients' training set, then use the generated samples to create poisoned updates and compromise the global model by uploading scaled poisoned updates to the server.

“An adversary can act as a benign participant and stealthily trains a GAN to simulate prototypical samples of the other clients' training set, which does not belong to the attacker.The latter will fully control these generated samples to create the poisoned updates.Then, it compromises the global model by uploading the scaled version of these poisoned updates to the server.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A similar work proposed identifying abnormal updates from clients in FL by generating low-dimensional surrogates of the model weight vectors.

“A similar work [91] proposed identifying abnormal updates from clients in FL by generating low-dimensional surrogates of the model weight vectors.”

• cites [91]Not checked yet

  Not checked in the free run.

May combine two claims.

Dropout of participating clients in training rounds may yield unproductive results and cause fairness issues when training the global model.

“Dropout of participating clients in training rounds may yield unproductive results and cause fairness issues when training the global model [86], [87].”

• cites [86]Not checked yet

  Not checked in the free run.

• cites [87]Not checked yet

  Not checked in the free run.

• AssumptionThe authors state this as an assumption: FL assumes that participating clients, once selected, remain connected to the server during a training round.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

An attacker who can only modify a few training samples cannot cause a large change in the learned models' distribution.

“Intuitively, an attacker who can only modify a few training samples cannot cause a large change in the learned models' distribution.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Man-in-the-Middle attacks are carried out through intervening with genuine networks or building fake networks that the attacker commands.

“This attack is carried out through intervening with genuine networks or building fake networks that the attacker commands.”

Probably not a substantial claim: may not pass S3 (load-bearing).

AUROR detects harmful client updates by using the K-Means clustering algorithm to separate all clients into groups based on their uploaded indicative features.

“The authors in [89] proposed AUROR, a defense mechanism that detects harmful client updates by using the K-Means clustering algorithm to separate all the clients into many groups based on their uploaded indicative features.”

• cites [89]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

FL exposes several new attack surfaces at training time, giving rise to complex and novel defenses.

“FL exposes several new attack surfaces at training time, giving rise to complex and novel defenses.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

With data access out of the question, most defenses prevent model corruption by ensuring that the trained model has learned the actual training data's underlying statistical distribution.

“With data access being out of the question, most of these defenses prevent model corruption by ensuring that the trained model has learned to realize the actual training data's underlying statistical distribution.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The impact of free-riding attacks can be particularly disastrous in a smaller landscape FL environment, where data is scarce and the model has high commercial value.

“This attack's impact can be particularly disastrous in a smaller landscape FL environment, where data is scarce and the model has high commercial value.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Anomaly detection is considered a more proactive type of defense that explicitly detects malicious updates and prevents their impact on the system.

“Anomaly detection is considered a more proactive type of defense that explicitly detects malicious updates and prevents their impact on the system.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Most commonly, a norm constraint is enforced on the client model update on top of differential privacy to exclude outliers.

“Most commonly, we enforce a norm constraint on the client model update on top of differential privacy (e.g., by clipping the client updates before adding noise) to exclude outliers, such as the aggregated model updates bound the variance in the global distribution.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Defense methods help to protect FL against a diverse range of attacks and decrease the probability of risks.

“Defense methods help to protect FL against a diverse range of attacks and decrease the probability of risks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Research work extends spectral anomaly detection to FL.

“Furthermore, the research work in [94] extends spectral anomaly detection to FL.”

• cites [94]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RONI was proposed in the context of spam filters and tries to identify outliers by observing a model's performance trained with and without each point.

“In a similar work, RONI (Reject On Negative Impact) [93] was proposed in the context of spam filters and tries to identify outliers by observing a model's performance trained with and without each point.”

• cites [93]Not checked yet

  Not checked in the free run.

May combine two claims.

Differential privacy offers robustness to poisoning attacks based on its group privacy property, and this protection exponentially diminishes with a larger number of attackers.

“Additionally, differential privacy offers robustness to poisoning attacks based on its group privacy property.Thus, this protection will exponentially diminish with a larger number of attackers.”

May combine two claims.

Free-riding clients play a passive role by either not updating the local model update parameters during iterative federated optimization or inserting dummy updates without training the model with their local data.

“The free-riding clients play a passive role by either not updating the local model update parameters during the iterative federated optimization or inserting dummy updates without training the model with their local data.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Some dropped clients may have valuable or exclusive data entries needed to produce a high-quality deep learning model.

“Some of the dropped clients may have valuable or exclusive data entries needed to produce a highquality deep learning model.”

• AssumptionThe authors state this as an assumption: FL assumes that participating clients, once selected, remain connected to the server during a training round.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The goal of differential privacy is to guarantee with high confidence that no single data record can be meaningfully distinguished from the rest.

“The goal of differential privacy is to guarantee with high confidence that no single data record can be meaningfully distinguished from the rest.”

May combine two claims.

Anomaly detectors that measure test error work well against untargeted adversarial attacks but are most likely to fail against targeted backdoor attacks because training on backdoor data usually produces poisoned model updates that look and behave similarly to intact models.

“Although these types of anomaly detectors work well against untargeted adversarial attacks, they are most likely to fail when it comes to targeted backdoor attacks because training on backdoor data usually produces poisoned model updates that look and behave similarly to intact models [11].”

• cites [11]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

TEE establishes digital trust by securing connected devices in FL.

“TEE establishes digital trust by securing connected devices in FL.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The problem of operating at scale when clients are anticipated to be intermittently available has a systematic consequence on FL analytics.

“The problem of operating at scale when clients are anticipated to be intermittently available has a systematic consequence on FL analytics.”

• AssumptionThe authors state this as an assumption: FL assumes that participating clients, once selected, remain connected to the server during a training round.

Probably not a substantial claim: may not pass S3 (load-bearing).

Defenses often seek to ensure that the model does not overfit to malicious updates, minimizing their overall influence on the global model.

“However, defenses often seek to ensure that the model does not overfit to these malicious updates, minimizing their overall influence on the global model.”

May combine two claims.

The main weakness of differential privacy is that the noise injected into the learning procedure is added on top of the noise generated by the learning algorithm, and the accumulated noise can contaminate the learned model.

“The main weakness of differential privacy is that the noise injected into the learning procedure is added on top of the noise generated by the learning algorithm.The accumulated noise can contaminate the learned model.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

TEE protects connected devices against injecting false training results by enabling an isolated, cryptographic electronic structure and permitting end-to-end security.

“It protects them against injecting false training results by enabling an isolated, cryptographic electronic structure and permitting end-to-end security.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Differential privacy works by injecting statistical noise into the updates.

“It works by injecting statistical noise into the updates.”

Probably not a substantial claim: may not pass S3 (load-bearing).

TRIM finds a subset of updates that reduces the global objective loss by removing outliers with large residuals.

“One interesting type of anomaly detection is TRIM [92], which finds a subset of updates that reduces the global objective loss by removing outliers with large residuals.”

• cites [92]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

FL requires the aggregation mechanism to be robust against the client dropouts' long-term effect.

“FL requires the aggregation mechanism to be robust against the client dropouts' longterm effect.”

• AssumptionThe authors state this as an assumption: FL assumes that participating clients, once selected, remain connected to the server during a training round.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

MTD's goal is to grow uncertainty and complicate attacks.

“Its goal is to grow uncertainty and complicate attacks.”

May combine two claims.

There is no canonical form of adversarial training, and preferences such as the minimax problem formulation and training hyperparameters can significantly impair the trained model robustness.

“However, there is no canonical form of adversarial training, and preferences such as the minimax problem formulation and training hyperparameters can significantly impair the trained model robustness.”

Probably not a substantial claim: may not pass S3 (load-bearing).

FedProx was introduced as a generalization and re-parametrization of FedAvg.

“FedProx [40] was introduced as a generalization and re-parametrization of FedAvg.”

• cites [40] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Pruning reduces the backdoored model's size by dropping neurons that are dormant on clean inputs, consequently disabling backdoor behavior.

“It reduces the backdoored model's size by dropping neurons that are dormant on clean inputs, consequently disabling backdoor behavior.”

• cites [66]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

ZKPs can be used to validate that model updates were trained correctly using data instances produced by a client's smartphone sensors.

“For instance, ZKPs can be used to validate that the model updates were trained correctly using data instances produced by a client's smartphone sensors.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Robust aggregation methods should be able to sustain communications instabilities, clients dropout, erroneous model updates on top of malicious actors.

“Additionally, robust aggregation methods should be able to sustain communications instabilities, clients dropout, erroneous model updates on top of malicious actors [105].”

• cites [105]Not checked yet

  Not checked in the free run.

May combine two claims.

MOCHA speeds up convergence, is robust to statistical heterogeneity, and can handle clients periodically dropping out.

“MOCHA speeds up convergence, is robust to statistical heterogeneity, and can handle clients periodically dropping out (fault tolerance).”

• cites [116]Not checked yet

  Not checked in the free run.

May combine two claims.

In FL, ZKPs can ensure that clients are submitting model updates with prespecified properties to defend against model corruption and backdoor attacks, avoiding sharing private data.

“In FL, ZKPs can ensure that clients are submitting model updates with prespecified properties to defend against model corruption and backdoor attacks, avoiding sharing private data.”

May combine two claims.

MTD limits vulnerabilities exposure and the possibilities for an attack, and increases system resiliency.

“As a result, this defense limits the vulnerabilities exposure and the possibilities for an attack.Also, it increases the system resiliency.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Recognizing legitimate clients operates by identifying genuine users and dramatically reducing the success rate of poisoning attacks even when multiple adversaries are involved.

“This defense strategy operates by identifying genuine users and dramatically reducing the success rate of poisoning attacks even when multiple adversaries are involved.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Experiments show that this aggregation mechanism outperforms FedAvg in terms of convergence speed and global model robustness against attacks.

“Experiments show that this aggregation mechanism outperforms the famous FedAvg in terms of convergence speed and global model robustness against attacks.”

• cites [106]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

ZKPs provide an efficient solution for the verifiability problem on private data.

“Therefore, ZKPs provide an efficient solution for the verifiability problem on private data.”

Probably not a substantial claim: may not pass S3 (load-bearing).

MOCHA is a novel systems-aware optimization framework for federated multi-task learning.

“The most prominent example of this type of defense is MOCHA [116], a novel systems-aware optimization framework for federated multi-task learning.”

• cites [116]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

MTD's goal can be achieved by constantly moving the FL system's components in a randomized fashion.

“That goal can be achieved by constantly moving the FL system's components in a randomized fashion.”

May combine two claims.

Adversarial training was originally developed for i.i.d data, and it is unclear how it performs for non-i.i.d data distribution.

“Moreover, adversarial training was originally developed for i.i.d data, and it is unclear how it performs for non-i.i.d data distribution [113].”

• cites [113]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Adaptive aggregation combines repeated median regression with a reweighting scheme in iteratively reweighted least squares and a novel robust aggregation oracle based on the classical geometric median.

“The latter combines repeated median regression with a reweighting scheme in iteratively reweighted least squares [71] and a novel robust aggregation oracle based on the classical geometric median [103].”

• cites [71]Not checked yet

  Not checked in the free run.

• cites [103]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Nowadays, ZKPs protocols can attain proof sizes of hundreds of bytes and attestations of milliseconds' order regardless of the model updates' size.

“Nowadays, ZKPs protocols can attain proof sizes of hundreds of bytes and attestations of milliseconds' order regardless of the model updates' size.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Zero-knowledge protocols are probabilistic assessments, which implies they cannot prove something with complete certainty; instead they provide small pieces of unlinkable knowledge that can accumulate to show that an assertion's validity is overwhelmingly presumable.

“Zero-knowledge protocols are probabilistic assessments, which implies they cannot prove something with the complete certainty that will uncover it.Instead, they provide small pieces of unlinkable knowledge that can accumulate to show that an assertion's validity is overwhelmingly presumable.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

TEE can help solve a significant problem for FL security since it plays an increasingly central role in preventing hacking of the central server or clients, data breaches, and malware use.

“TEE can help solve a significant problem for FL security since it plays an increasingly central role in preventing hacking of the central server or clients, data breaches, and malware use.”

May combine two claims.

Federated multi-task learning can directly infer relationships amongst non-IID and unbalanced data, making it particularly well-suited for FL's statistical challenges.

“Federated multi-task learning can directly infer relationships amongst non-IID and unbalanced data, making it particularly well-suited for FL's statistical challenges.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Pruning reduces the deep learning model's size by dropping neurons to decrease complexity, improve accuracy, and disable backdoors.

“Pruning reduces the deep learning model's size by dropping neurons to decrease the complexity, improve the accuracy, and disable backdoors.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Although distributed poisoning attacks are a more significant threat in FL, the effectiveness of distributed poisoning with multiple attackers is still unclear compared to traditional poisoning.

“Although distributed poisoning attacks are a more significant threat in FL, the effectiveness of distributed poisoning with multiple attackers is still unclear compared to traditional poisoning.”

May combine two claims.

Federated Dropout results in a decrease in both communication overhead and local computation.

“FD results in a decrease in both communication overhead and local computation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

With MTD's dynamic protection, outsider adversaries will be unable to precisely identify the resources they require to target the FL training process.

“With this defense's dynamic protection, outsider adversaries will be unable to precisely identify the resources they require to target the FL training process.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Authors suggested using Gaussian distribution to measure clients' potential contributions and proposed layer-wise optimizing steps so that aggregation works well on different functional units in the neural network.

“Authors in [106] suggested using Gaussian distribution to measure clients' potential contributions.They also proposed layer-wise optimizing steps, so the aggregation works well on different functional units in the neural network.”

• cites [106]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

MTD is designed to provide an end-to-end safeguard against the most damaging eavesdropping-based attacks.

“MTD is designed to provide an end-to-end safeguard against the most damaging eavesdropping-based attacks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

PruneFL performs adaptive pruning by maximizing the estimated empirical risk reduction divided by the time of a single FL round.

“Furthermore, another pruning technique, known as PruneFL [67], performs adaptive pruning by maximizing the estimated empirical risk reduction divided by the time of a single FL round.”

• cites [67] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Adversaries can collude or generate aliases to increase their impact in a sybil attack.

“However, adversaries can collude or generate aliases to increase their impact in a sybil attack.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Backward tracking capability can assist deployers in distinguishing which clients are behind any change in the aggregated model.

“Backward tracking capability can assist deployers in distinguishing which clients are behind any change in the aggregated model.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Selecting key roles helps arrange the privacy and security of peer model updates.

“Selecting key roles helps arrange the privacy and security of peer model updates.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The notion of sharing knowledge instead of model weights can enhance the robustness of FL and saves communication and computations costs.

“The notion of sharing knowledge instead of model weights can enhance the robustness of FL and saves communication and computations costs.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There is no longer a global state of the model as in standard FL in peer-to-peer FL.

“There is no longer a global state of the model as in standard FL.”

May combine two claims.

Peer-to-peer FL does not need an aggregation server given that the training nodes exchange their partially trained models after each training round, and the aggregation happens on each node in parallel.

“As shown in Fig. 8, peer-to-peer FL does not need an aggregation server given that the training nodes exchange their partially trained models after each training round, and the aggregation happens on each node in parallel.”

May combine two claims.

Federated distillation is a compelling FL solution that only transfers the model outputs whose dimensions are commonly much smaller than the model sizes.

“In this regard, federated distillation [124] is a compelling FL solution that only transfers the model outputs whose dimensions are commonly much smaller than the model sizes.”

• cites [124]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Even in the decentralized FL setting, a central authority may still be in charge of establishing up the learning task.

“As previously mentioned, even in the decentralized FL setting, a central authority may still be in charge of establishing up the learning task.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Peer-to-peer topology is an excellent fit for cross-silo FL, where clients are typically of small-scale numbers, usually indexed, and almost always available for training.

“However, peer-to-peer topology is an excellent fit for cross-silo FL, where clients are typically of small-scale numbers, usually indexed, and almost always available for training.”

Classified as probably not a substantial claim. May combine two claims.

Federated learning architecture introduces new threat models, resulting in unique vulnerabilities.

“FL architecture introduces new threat models, resulting in unique vulnerabilities.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Some participating parties may not have the best interests of other participants in mind, and establishing trust is not straightforward.

“Some participating parties may not have the best interests of other participants in mind, and establishing trust is not straightforward.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Federated learning security is not binary and presents a range of threat models relevant under a variety of assumptions, each with unique challenges.

“We argue that FL security is not binary and presents a range of threat models relevant under a variety of assumptions, each of which provides its own unique challenges.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Transparent tracing of the training process can be achieved through blockchain technologies or the notion of transactions.

“Transparent tracing of the training process can be achieved through blockchain technologies or the notion of transactions [131], [132].”

• cites [131]Not checked yet

  Not checked in the free run.

• cites [132] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There is no central authority that can be trusted to regulate and coordinate the machine learning efforts and ensure convergence in peer-to-peer FL.

“There is no central authority that can be trusted to regulate and coordinate the machine learning efforts and ensure convergence.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In peer-to-peer FL, each client communicates directly with a subset of the other participants or all of them; there is no gatekeeper role, so all training protocols must be agreed upon in advance between the different participants.

“In peer-to-peer FL, each client communicates directly with a subset of the other participants or all of them.In other words, there is no gatekeeper role.Thus, all training protocols must be agreed upon in advance between the different participants.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Knowledge Distillation aims to transfer knowledge from a fully trained model (teacher model) to a smaller model (an empty student model).

“One foundational algorithm of federated distillation is Knowledge Distillation (KD) [125].It aims to transfer knowledge from a fully trained model (teacher model) to a smaller model (an empty student model).”

• cites [125]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In a trustless-based architecture such as peer-to-peer FL, clients can be cryptographically locked into being honest by means of a secure protocol, but this may introduce high computational costs.

“However, in a trustless-based architecture such as peer-to-peer FL, the clients can be cryptographically locked into being honest by means of a secure protocol, but this may introduce high computational costs.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Peer-to-peer FL setup removes certain components that can create an active ground for vulnerabilities and threats.

“Peer-to-peer FL setup removes certain components that can create an active ground for vulnerabilities and threats.”

Classified as probably not a substantial claim. May combine two claims.

The first layers of the eleven-layer MLP achieved higher testing accuracy than the last layers, showing a superior ability to promote generalization.

“The first layers have shown a superior ability to promote generalization by achieving higher testing accuracy than the network's last layers.”

• cites [133]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In a trustless-based structure, the traditional defenses for centralized FL may not be compatible with peer-to-peer topologies.

“In a trustless-based structure, the traditional defenses for centralized FL may not be compatible with peer-to-peer topologies.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Differential privacy enhances the privacy and security guarantees of FL at a small cost.

“Differential privacy enhances the privacy and security guarantees of FL at a small cost.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Traceability of the global model helps to expose hidden vulnerabilities through the FL lifecycle.

“Traceability of the global model helps to expose hidden vulnerabilities through the FL lifecycle.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In this way, the updates of other peers can be verified without observing their un-noised versions.

“In this way, we can verify the updates of other peers without observing their un-noised versions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Model poisoning, backdoor attacks, and inference attacks are among the most common threats in FL.

“Model poisoning, backdoor attacks, and inference attacks are among the most common threats in FL.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

The overall FL system may require an independent entity to assume control and arbitration roles, which may not always be desirable due to additional expenses and procedural viscosity.

“Nevertheless, the overall FL system may require an independent entity to assume control and arbitration roles, which may not always be desirable due to additional expenses and procedural viscosity.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

The adoption of federated learning may come to a halt if researchers fail to address the new security vulnerabilities resulting from shifting training to personal devices and private organizations.

“The adoption of FL may come to a halt if researchers fail to address the new security vulnerabilities resulting from shifting the training to personal devices and private organizations.”

Probably not a substantial claim: may not pass S4 (based).

By observing a peer's model updates from each training round, an attacker can perform gradient leakage operations and retrieve details about his victim's training data.

“By observing a peer's model updates from each training round, an attacker can perform gradient leakage operations and retrieve details about his victim's training data.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Peer-to-peer FL should also have the ability to withstand poisoning and gradient leakage attacks, frequent failures, and an increased number of training nodes.

“It should also have the ability to withstand poisoning and gradient leakage attacks, frequent failures, and an increased number of training nodes.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Regardless of the topology, FL implicitly grants a certain degree of privacy, as FL participants cannot access other participants' private data and only obtain model parameters aggregated over several training nodes.

“Regardless of the topology, FL implicitly grants a certain degree of privacy, as FL participants cannot access other participants' private data and only obtain model parameters aggregated over several training nodes.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The knowledge in KD can also be a collection of other student models' logits, in that the collection of forecasts is often more accurate than individual predictions.

“The knowledge can also be a collection of other student models' logits, in that the collection of forecasts is often more accurate than individual predictions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Hackers with expert knowledge of the communication network can launch attacks on the scheduling algorithm, causing increasing stragglers nodes or consensus issues.

“Hackers with expert knowledge of the communication network can launch attacks on the scheduling algorithm, causing increasing stragglers nodes or consensus issues.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The emergence of large-scale multi-party machine learning workloads and distributed ledgers for scalable consensus can offer practical solutions to peer-to-peer FL.

“The emergence of large-scale multi-party machine learning workloads and distributed ledgers for scalable consensus can offer practical solutions to peer-to-peer FL.”

Probably not a substantial claim: may not pass S2 (checkable).

Federated learning has a set of security challenges that require further review and research.

“FL has a set of security challenges that need further review and research.”

May combine two claims.

The unique characteristics of peer-to-peer FL bring challenges such as preventing data leakage, ensuring data integrity when communicating models, and designing scheduling algorithms for distributed computation to reduce idle time.

“The unique characteristics of peer-to-peer FL also bring challenges such as preventing data leakage, ensuring data integrity when communicating models, and designing scheduling algorithms for distributed computation to reduce idle time.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Inference attacks can be conducted without the need for eavesdropping on secure channels.

“The inference attacks can be conducted without the need for eavesdropping on secure channels.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Peer-to-peer FL systems have limited scalability due to the constraints in processing power and network bandwidth of participating hosts.

“Additionally, peer-to-peer FL systems have limited scalability due to the constraints in processing power and network bandwidth of participating hosts.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The peer-to-peer FL process is designed such that all local models in the training nodes converge to the desired global solution as the individual models gradually reach consensus.

“The peer-to-peer FL process is designed such that all local models in the training nodes converge to the desired global solution as the individual models gradually reach consensus.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Any changes to peer-to-peer communications and training protocols must be made in a synchronized fashion by all parties involved; otherwise, the system can fail in its entirety.

“Moreover, any changes to peer-to-peer communications and training protocols must be made in a synchronized fashion by all parties involved; otherwise, the system can fail in its entirety.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By eliminating the central server from FL architecture, there is no need to worry about attacks caused by a malicious server or hackers compromising the cloud security layers.

“By eliminating the central server from FL architecture, there is no need to worry about attacks caused by a malicious server or hackers compromising the cloud security layers.”

Probably not a substantial claim: may not pass S4 (based).

Many previous works in federated learning treat neural networks as black-box functions without internal structure, rather than decomposing them into layers.

“Furthermore, many previous works in FL do not consider the decomposition of neural networks in layers but treat them as black-box functions without internal structure.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In peer-to-peer settings, known baseline models are not available to participants, so a model update can be validated by evaluating it with respect to the models submitted by other clients.

“In peer-to-peer settings, known baseline models are not available to participants, so we can validate a model update by evaluating it with respect to the models submitted by other clients.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

With these strategies, peer-to-peer FL should be able to coordinate a collaborative learning process across more and more peers and produce a final model that is similar in utility to the state-of-the-art centralized FL.

“With these strategies, peer-to-peer FL should be able to coordinate a collaborative learning process across more and more peers and produce a final model that is similar in utility to the stateof-the-art centralized FL.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Federated learning is a fairly new concept in the machine learning community, which needs further research and advancements before deploying it in sensitive applications with confidence.

“FL is a fairly new concept in the machine learning community, which needs further research and advancements before deploying it in sensitive applications with confidence.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Proactive forms of defenses such as anomaly detection and robust aggregation shield the global model from malicious updates.

“Proactive forms of defenses such as anomaly detection and robust aggregation shield the global model from malicious updates.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Typically, the knowledge in KD is a pre-trained teacher model's logits, transferred to a small student model for model compression.

“Typically, the knowledge is a pre-trained teacher model's logits, transferred to a small student model for model compression.”

Probably not a substantial claim: may not pass S4 (based).

Inspecting individual model updates reveals more information than the aggregated model.

“Also, inspecting individual model updates reveals more information than the aggregated model.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

FL workflow can be realized with diverse topologies; the two most common are the centralized approach via an aggregation server or peer-to-peer decentralized approaches.

“FL workflow can be realized with diverse topologies.The two most common ones are either the centralized approach via an aggregation server or peer-to-peer decentralized approaches [126]- [130].”

• cites [126]Not checked yet

  Not checked in the free run.

• cites [127] sourceNot checked yet

  Not checked in the free run.

• cites [128]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Groups of colluding peers can be prevented from overtaking the system if they do not have sufficient stake ownership after establishing a stake system.

“We can prevent groups of colluding peers from overtaking the system if they do not have sufficient stake ownership after establishing a stake system (e.g., using blockchains).”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Such attacks can be prevented using differentially-private updates and using consistent hashing based on proof of stake in combination with Verifiable Random Functions (VRFs).

“We can prevent such attacks using differentially-private updates and using consistent hashing based on proof of stake in combination with Verifiable Random Functions (VRFs).”

Classified as probably not a substantial claim.

Unlike traditional machine learning, federated learning systems should withstand three potential adversaries: clients, the aggregator, and outsiders or eavesdroppers.

“Unlike traditional machine learning, FL systems should withstand three potential adversaries: (1) Clients, (2) The aggregator, and (3) Outsiders or eavesdroppers.”