The DOI matches its Crossref record; 92 of the 92 references it cites were found in a registry or an index; none of the 62 sources its claims cite is checked for support yet.
Poisoning Attacks in Federated Learning: A Survey
Open accessAbstract
Federated learning faces many security and privacy issues. Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models. Defending against poisoning attacks is a very urgent and challenging task. However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort. This survey provides an in-depth and up-to-date overview of poisoning attacks and corresponding defense strategies in federated learning. We first classify the poisoning attacks according to their methods and targets. Next, we analyze the differences and connections between the various categories of poisoning attacks. In addition, we classify the defense strategies against poisoning attacks in federated learning into three categories and analyze their advantages and disadvantages. Finally, we discuss the privacy protection problem in poisoning attacks and their countermeasure and propose potential research directions from the perspective of attack and defense, respectively.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This survey reviews poisoning attacks in federated learning and classifies them by attack method and attacker intent, while also classifying defenses into model analysis, Byzantine robust aggregation, and verification-based approaches. It argues that privacy protection and secure aggregation are often overlooked in poisoning defense research and proposes future directions from both attack and defense perspectives.
Key findings
- Poisoning attacks are classified by method into data poisoning attacks (clean-label and dirty-label) and model poisoning attacks, and by attacker intention into targeted, semi-targeted, and untargeted attacks.
- Model poisoning attacks tend to work better in practice because they directly modify local model parameters; the survey cites Eugene et al.’s experimental result that controlling 1% of clients for model poisoning can achieve the same or better effect as controlling 20% of clients for data poisoning.
- Defense strategies are grouped into three categories: model analysis, Byzantine robust aggregation (gradient clipping, removing extreme values, differential privacy), and verification-based methods; the survey evaluates their strengths, weaknesses, and support for secure aggregation.
- Non-IID data makes defense harder because local models are inherently different, and many defenses that require server access to individual local models are incompatible with secure aggregation, though homomorphic encryption and differential privacy offer partial paths.
Methods
- Design: a survey that reviews existing poisoning attack methods and defense strategies in federated learning, with a stated focus on privacy protection and secure aggregation.
- Data/sample: published papers from recent years, including representative poisoning attack and defense works summarized in Tables 2 and 3; no primary dataset or experimental sample is collected.
- Main analysis: qualitative taxonomy and comparative analysis of attack categories, defense categories, data distribution assumptions, stealthiness, persistence, and secure-aggregation support.
Limitations
- Paper-stated: most existing defense strategies are static, targeted at specific known attacks, and assume limited adversary capabilities; defending against poisoning attacks while protecting privacy remains an open problem, and non-IID data makes server-side defense more difficult.
- Paper-stated: many existing studies assume the server can access the client’s local model, which risks privacy leakage and prevents direct integration with secure aggregation.
- Evident from the text: the survey does not report a systematic literature search protocol, quantitative meta-analysis, or primary experiments; its conclusions are based on selected representative works and qualitative synthesis.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
64 Own interpretation · 39 Not checked yet · 11 No basis given
In the paper
“Yuwei et al. [24] proposed the attack distance-aware attack (ADA) to enhance poisoning attacks by finding optimal target classes in the feature space.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [24] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“if an attacker manipulates some of these clients to modify the models before uploading them to the central server by directly (for example, altering the model parameters) or indirectly (such as by flipping the label of the training data) way, it will influence the direction of the global model update and finally cause the non-convergence of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Attackers can implement a clean label attack by modifying the samples in the training set and, for example, adding noise to the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“From the above description, we can find that the direction of the global model update depends on the directions of the local models uploaded by each client.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“For instance, the attacker can add random noise to the local model to affect the convergence of the global model [34], [35].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Moreover, the attacker can also manipulate the update of the global model using the model replacement method with w k+1 0 [30]:”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“For example, the experimental results of Eugene et al. [30] showed that in a given scenario, an attacker controlling 1% of clients to perform a model poisoning attack could achieve the same (or even better) effect as controlling 20% of clients to perform a data poisoning attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“Second, model poisoning attacks often multiply the local gradient by a factor before uploading it to the server to amplify the impact of the malicious gradient [28], [29], [30], [31].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 43
- It may state two separate claims as one. 39
- The quote only partly states this claim. 1
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our observations show that poisoning attacks are becoming more effective, stealthy, and powerful.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the data poisoning attack, an attacker cannot directly modify the local model parameters and can only perform the poisoning attack by falsifying or tampering with the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, federated learning is considered effective in protecting user privacy during training.”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these methods all assume that the data distribution is IID.Once the training data is non-IID, the attacker cannot execute the attack in the above way.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Virat et al. [23] argued that there are two kinds of label-flipping strategies, namely static label flipping (SLF) and dynamic label flipping (DLF).”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [23] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, SLF is inefficient, and some researchers have proposed DLF schemes to improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort.”
- Also stated in: § I. INTRODUCTION · plain
“While several researchers have discussed poisoning attacks in their surveys, few have analyzed the privacy issues that may arise from poisoning attacks and poisoning attack defense strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
- Also stated in: § I. INTRODUCTION · plain
In the paper
“To address this problem, Google developed a distributed machine learning framework called federated learning (FL) in 2016, which allows each client to jointly train a model without sharing data [6].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
- Not checked yetcites [6] McMahan, Communication-efficient learning of deep networks from decentralized data
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
None of the sources cited for this claim have been checked yet.
In the paper
“Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“However, further research shows that federated learning also faces many security and privacy risks [7], [8], [9], [10], such as poisoning attacks [11], [12], [13], [14], [15] and privacy leakage [16], [17], [18], [19], [20], [21].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”
- Also stated in: § a: CLEAN LABEL ATTACK · plain
“With this approach, an attacker can execute a poisoning attack without prior knowledge.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
What the sources say
- Not checked yetcites [26] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § a: CLEAN LABEL ATTACK · plain
None of the sources cited for this claim have been checked yet.
In the paper
“The principle of this approach is that only a tiny fraction of neurons changed during the training phase, while the vast majority of neurons were close to zero.Those unchanged neurons are called the redundant space of neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacker's goals of implementing a poisoning attack can be classified into two categories: 1) reducing the accuracy of the global model on all tasks and 2) affecting the performance of the global model on specific tasks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. CLASSIFICATION ACCORDING TO THE INTENTION OF THE ATTACKERS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The idea of the attack in this setup is that if the AD between the source class c S and the target class c T is small, the scale of the malicious updates required in the adversary's local model is also small.Then the attack has a greater chance of surviving the aggregation of overwhelming legitimate updates, resulting in a more significant effect.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“To avoid detection, Virat et al. [23] also state that model updates should not deviate too far from benign updates to avoid detection.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [23] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In a model poisoning attack, the attacker uses a more direct way to manipulate the client's local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, in the non-IID setting, both the attacker and the server faced significant challenges but affected the server even more.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In a poisoning attack, the data distribution can not only affect the effectiveness of the attack but also determine the success or failure of the attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach increases the risk of being detected by the server, but the right choice of amplification factor can effectively improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The semi-targeted attack can improve the performance of the attack by fixing the source class and choosing the optimal target class.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For example, data poisoning attacks are more intuitive, and attackers can implement label flipping according to their intentions.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since untargeted poisoning attacks affect all tasks, they are more easily detected by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, targeted poisoning attacks are highly stealthy and more challenging to detect, especially when the data is non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, many attackers avoid detection by bounding the norm of their malicious gradients, the range of which is strongly influenced by the data distribution.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
In the paper
“Although Thien et al. [80] propose that it can mix a small number of malicious updates with numerous benign updates to avoid server detection, the server can still identify the attack by comparing historical updates from the client.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [80] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“It is worth noting that if the server can access the client's local model directly, there is a great risk of privacy leakage because the server may recover the original training data from the client's gradients [16], [17], [18], [19].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [16] Fu, Label inference attacks against vertical federated learning
- Not checked yetcites [17] Geiping, Inverting gradients—How easy is it to break privacy in federated learning?
- Not checked yetcites [18] source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This assumption is always valid because benign models and malicious models are inherently different from each other.”
§ Poisoning Attacks in Federated Learning: A Survey > A. MODEL ANALYSIS
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
In the paper
“For example, Clement et al. [53] found that the gradients uploaded by honest clients were more diverse than those uploaded by malicious clients.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [53] Fung, 2018, Mitigating sybils in federated learning poisoning, arXiv:1808.04866
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The experimental results show that both LDP and CDP are effective against poisoning attacks, and CDP is more effective than LDP against poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DIFFERENTIAL PRIVACY
What the sources say
- Not checked yetcites [66] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“In a typical gradient clipping approach, we can set a threshold for the model parameters and discard all parameters that exceed the threshold [29], [65].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) GRADIENT CLIPPING
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [65] Panda, SparseFed: Mitigating model poisoning attacks in federated learning with sparsification
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“BRA is a passive defense strategy that mitigates the damage of poisoning attacks by changing the aggregation method of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > B. BYZANTINE ROBUST AGGREGATION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Therefore, many FL frameworks use secure aggregation [81], [82], [83], [84] algorithms in the aggregation process, at which point most of the poisoning attack defense methods mentioned above will be invalid.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [81] source
- Not checked yetcites [82] Zhang, BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning
- Not checked yetcites [83] Bhowmick, 2018, Protection against reconstruction and its applications in private federated learning, arXiv:1812.00984
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The methods mentioned above for testing global/local models require the server to collect a test set, and the quality of this test set dramatically affects the effectiveness of the defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PERFORMANCE EVALUATION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Poisoning attacks are executed through malicious models, so an intuitive defense strategy is to analyze the model.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among the model analysis methods, we found that in addition to the direct analysis of the global model that supports secure aggregation, the analysis of the encrypted local model can defend against poisoning attacks and protect clients' data privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, directly verifying the client's local data is not always allowed, but introducing a trusted third party can solve this problem.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Finally, differential privacy is a secure aggregation strategy that can also resist poisoning attacks, but its biggest problem is that it reduces the accuracy of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Although trusted third parties are difficult to guarantee in real-world settings, this approach also provides lessons for subsequent research.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“One of the most remarkable features of federated learning is that it protects the data privacy of the clients involved in training.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“While these efforts follow the fundamental principle that the client's original data is not released to the public, the intermediate data in federated learning may cause privacy leaks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Florian et al. [88] pointed out that an attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [88] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, many efforts to defend against poisoning attacks will likely lead to client data privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach also cannot cope with data poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with the latter is that current research is based on the predictive accuracy of the global model on the validation dataset to determine whether an attack has been poisoned, and targeted poisoning attacks may evade this defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“However, some researchers [68] have proposed an iterative median approximation method that can approximate the median of all models without accessing the local model and thus can also support the secure aggregation strategy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
What the sources say
- Not checked yetcites [68] Pillutla, 2019, Robust aggregation for federated learning, arXiv:1912.13445
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with this approach is that it requires thorough training of an SVM on poisoned and non-poisoned datasets that are relatively similar to the client's data source and thus may not apply to scenarios where the data is Non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Research on implementing poisoning attacks and defending against poisoning attacks has made significant progress in recent years, but some issues still need further research.”
§ Poisoning Attacks in Federated Learning: A Survey > VI. CHALLENGES AND FUTURE DIRECTIONS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“First, each training round of FL selects some clients randomly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Furthermore, in the approach proposed by Henger et al. [32], the malicious client first uses a gradient inversionbased inference attack to learn approximations of other client data distributions from model updates received by the server.Then, the attacker uses his local data and the learned distributions to construct a simulator of the FL environment.Finally, the attacker uses reinforcement learn”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
What the sources say
- Not checked yetcites [32] Li, Learning to attack federated learning: A model-based reinforcement learning attack framework
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, frequent attacks increase the risk of exposure.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the existing attacks are constantly enriched with increasingly sophisticated attack methods being proposed.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have already solved the feasibility problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In poisoning attacks, multiple attacks may be combined (e.g., with privacy inference attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Once an attacker knows these defense strategies exist, it is easy to bypass them.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, many researchers assume that the adversary in their experiments undisguisedly performs the attack.Thus, they are vulnerable to more sophisticated poisoning attacks, despite the positive results they have achieved in their experiments.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Another problem with existing defense strategies is that they are primarily targeted at specific attacks.They can only defend against known attack methods.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, the defense against poisoning attacks, although well studied, still has many issues to be addressed.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
None of the sources cited for this claim have been checked yet.
In the paper
“In model replacement, the attacker attempts to replace the global model w (k+1) 0 with the malicious model w k+1 0 .”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
- Not checked yetcites [31] Xie, DBA: Distributed backdoor attacks against federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One existing trend is to design defense strategies against poisoning attacks in the cryptographic mode with existing privacy-preserving cryptographic algorithms.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, the challenge for defenders is much tougher, as effectively preventing or detecting poisoning attacks remains an open problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a result, they may be more concerned with the trade-off between efficiency and stealth.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have used methods such as reinforcement learning to improve the efficiency of their attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, there are relatively few studies in this direction, mainly focusing on homomorphic encryption and differential privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Many existing studies assume the server has access to the client's local model, which poses a significant risk of privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Worse, these defense strategies cannot be directly integrated with existing privacy protection strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“During the federated learning training process, an attacker can execute a poisoning attack by modifying the client's local data or directly modifying the local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper relies on this without support.
In federated learning, it is impossible to guarantee that all clients are reliable.
“Since many clients are involved in training in federation learning, it is impossible to guarantee that all clients are reliable.”
The paper relies on this without support.
Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.
“Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.”
The authors state this as an assumption.
There are significant differences between poisoned and benign models, and there is some way to distinguish these differences.
“Model analysis methods are based on the assumption that there are significant differences between the poisoned and benign models and that there is some way to distinguish these differences.”
The paper relies on this without support.
Neural networks have catastrophic forgetting properties and may quickly forget previously acquired concepts.
“Moreover, neural networks have catastrophic forgetting properties, where neural networks may quickly forget previously acquired concepts.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“But further research reveals that FL still faces privacy and security risks, including privacy leakage [87][88][89] and poisoning attacks [169,170].”
From Federated learning for medical image analysis: A survey (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Poisoning Attacks in Federated Learning: A Survey > 2) REMOVE EXTREME VALUES
“In trimmed mean and median, for each parameter p in the model, the server uses the median value of each local model to update the global model [85].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) REMOVE EXTREME VALUES
“In trimmed mean, for each parameter p, the largest b parameters and the smallest b parameters are removed from all m local models, and the mean of the remaining m -2b parameters is used to update the global model.”
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Federated Learning in Mobile Edge Networks: A Comprehensive Survey
Lim, W. Y. B., Luong, N. C., Hoang, D. T., Jiao, Y., Liang, Y.-C., Yang, Q., Niyato, D., & Miao, C. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2986024 · Cited by 2,565
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
(2017) · neural information processing systems · Cited by 1,413
Research works printed but not linked: 2
- Fu, Label inference attacks against vertical federated learning, 1
- Li, Learning to attack federated learning: A model-based reinforcement learning attack framework, 1
Cited by
Sorted by citations
Federated learning for medical image analysis: A survey
Guan, H., Yap, P.-T., Bozoki, A., & Liu, M. (2024) · Pattern Recognition · doi:10.1016/j.patcog.2024.110424 · Cited by 518
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Ferrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
An overview of implementing security and privacy in federated learning
Hu, K., Gong, S., Zhang, Q., Seng, C., Xia, M., & Jiang, S. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10846-8 · Cited by 175
FLAD: Adaptive Federated Learning for DDoS attack detection
Doriguzzi-Corin, R., & Siracusa, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103597 · Cited by 152
Ennaji, S., Gaspari, F. D., Hitaj, D., Bidi, A. K., & Mancini, L. V. (2025) · IEEE Access · doi:10.1109/access.2025.3600984 · Cited by 106
A Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy
Manzoor, H. U., Shabbir, A., Chen, A., Flynn, D., & Zoha, A. (2024) · Future Internet · doi:10.3390/fi16100374 · Cited by 58
The Current State and Challenges of Fairness in Federated Learning
Vucinich, S., & Zhu, Q. (2023) · IEEE Access · doi:10.1109/access.2023.3295412 · Cited by 44
Chen, X., Li, Z., Ni, W., Wang, X., Zhang, S., Sun, Y., Xu, S., & Pei, Q. (2024) · IEEE Transactions on Communications · doi:10.1109/tcomm.2024.3420733 · Cited by 36
MESAS: Poisoning Defense for Federated Learning Resilient against Adaptive Attackers
Krauß, T., & Dmitrienko, A. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623212 · Cited by 35
Ali, H., Chen, D., Harrington, M., Salazar, N., Ameedi, M. A., Khan, A. F., Butt, A. R., & Cho, J.-H. (2023) · IEEE Access · doi:10.1109/access.2023.3326410 · Cited by 41
A survey on privacy-preserving federated learning against poisoning attacks
Feng, X., & Cheng, W. (2024) · Cluster Computing · doi:10.1007/s10586-024-04629-7 · Cited by 34
Privacy-Preserving Federated Learning-Based Intrusion Detection System for IoHT Devices
Mosaiyebzadeh, F., Pouriyeh, S., Han, M., Liu, L., Xie, Y., Zhao, L., & Batista, D. M. (2024) · Electronics · doi:10.3390/electronics14010067 · Cited by 27
Prathiba, S. B., Govindarajan, Y., Ganesan, V. P. A., Ramachandran, A., Selvaraj, A. K., Bashir, A. K., & Gadekallu, T. R. (2024) · IEEE Access · doi:10.1109/access.2024.3401039 · Cited by 26
Untargeted Poisoning Attack Detection in Federated Learning via Behavior AttestationAl
Mallah, R. A., Lopez, D. L., Badu-Marfo, G., & Farooq, B. (2023) · IEEE Access · doi:10.1109/access.2023.3330144 · Cited by 53
FedRDF: A Robust and Dynamic Aggregation Function Against Poisoning Attacks in Federated Learning
Campos, E. M., Gonzalez-Vidal, A., Hernández-Ramos, J. L., & Skarmeta, A. (2025) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2024.3474484 · Cited by 22
Securing federated learning: a defense strategy against targeted data poisoning attack
Khraisat, A., Alazab, A., Alazab, M., Jan, T., Singh, S., & Uddin, M. A. (2025) · Discover Internet of Things · doi:10.1007/s43926-025-00108-6 · Cited by 21
Shalabi, E., Khedr, W. I., Rushdy, E., & Salah, A. (2025) · Information · doi:10.3390/info16030244 · Cited by 22
DART: A Solution for decentralized federated learning model robustness analysis
Feng, C., Celdrán, A. H., von der Assen, J., Beltrán, E. T. M., Bovet, G., & Stiller, B. (2024) · Array · doi:10.1016/j.array.2024.100360 · Cited by 23
Peng, J., Xing, H., Xu, L., Luo, S., Dai, P., Feng, L., Song, J. H., Zhao, B., & Xiao, Z. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3447087 · Cited by 20
Alshede, H., Jambi, K. M., Nassef, L., Alowidi, N., & Fadel, E. A. (2024) · Sensors · doi:10.3390/s24175492 · Cited by 18
Markovic, T., León, M., Buffoni, D., & Punnekkat, S. (2024) · Applied Intelligence · doi:10.1007/s10489-024-05589-6 · Cited by 22
The revolution and vision of explainable AI for Android malware detection and protection
Ullah, S., Li, J., Ullah, F., Chen, J., Ali, I., Khan, S., Ahad, A., & Leung, V. C. M. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101320 · Cited by 19
Self-citationFederated learning: a privacy-preserving approach to data-centric regulatory cooperation
Horst, A., Loustalot, P., Yoganathan, S., Li, T., Xu, J., Tong, W., Schneider, D., Löffler-Perez, N., Renzo, E. D., & Renaudin, M. (2025) · Frontiers in Drug Safety and Regulation · doi:10.3389/fdsfr.2025.1579922 · Cited by 15
Pawlicki, M., Pawlicka, A., Kozik, R., & Choraś, M. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.131231 · Cited by 15
Chennoufi, S., Blanc, G., Jmila, H., & Kiennert, C. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3664500 · Cited by 14
End-to-End Verifiable Decentralized Federated Learning
Lee, C., Heiss, J., Tai, S., & Hong, J. W. (2024) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc59979.2024.10634412 · Cited by 14
Reputation-Based Model Aggregation and Resource Optimization in Wireless Federated Learning Systems
Feng, J., Liao, Y., Liu, L., Pei, Q., Zhang, N., & Li, K. (2025) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2025.3528408 · Cited by 14
Sawaika, A., Krishna, S., Tomar, T., Suggisetti, D. P., Lal, A., Shrivastav, T., Innan, N., & Shafique, M. (2025) · IEEE International Conference on Quantum Computing and Engineering (QCE) · doi:10.1109/qce65121.2025.00175 · Cited by 17
BVDFed: Byzantine-resilient and verifiable aggregation for differentially private federated learning
Gao, X., Fu, S., Liu, L., & Luo, Y. (2023) · Frontiers of Computer Science · doi:10.1007/s11704-023-3142-5 · Cited by 13
Luo, P., Wang, B., Tian, J., & Yang, Y. J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3446675 · Cited by 13
Analysis of deep learning under adversarial attacks in hierarchical federated learning
Alqattan, D. S., Snåšel, V., Ranjan, R. K., & Ojha, V. (2025) · High-Confidence Computing · doi:10.1016/j.hcc.2025.100321 · Cited by 12
Smart grid security through fusion-enhanced federated learning against adversarial attacks
Shabbir, A., Manzoor, H. U., Zoha, A., & Halim, Z. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.111169 · Cited by 12
M3D-FL: Multi-layer Malicious Model Detection for Federated Learning in IoT networks
Atia, O. B., Samara, M. A., Bennis, I., Abouaïssa, A., Gaber, J., & Lorenz, P. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104444 · Cited by 11
DT-FU: Digital Twin-Driven Federated Unlearning for Resilient Vehicular Networks in the 6G Era
Daluwatta, W., Edirimannage, S., Elvitigala, C., Khalil, I., & Atiquzzaman, M. (2024) · IEEE Communications Magazine · doi:10.1109/mcom.001.2400229 · Cited by 10
UaaS-SFL: Unlearning as a Service for Safeguarding Federated Learning
Daluwatta, W., Khalil, I., Edirimannage, S., & Atiquzzaman, M. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3520109 · Cited by 9
Edge-Assisted Label-Flipping Attack Detection in Federated Learning
Alotaibi, N., Felemban, M., & Mahmood, S. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3496872 · Cited by 9
Ahmadpanah, S. H., Mirabi, M., Sobhanloo, S., Afsharfarnia, P., Fallah, D., & Bayati, M. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.104080 · Cited by 8
A Federated Approach to Scalable and Trustworthy Financial Fraud Detection
Alhasawi, Y., Almtrf, A. A., & Asad, M. (2025) · Security and Privacy · doi:10.1002/spy2.70099 · Cited by 8
Using Anomaly Detection to Detect Poisoning Attacks in Federated Learning ApplicationsPreprint
Raza, A., Tran, K. P., Koehl, L., Li, S., & Tran, K. D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4811423 · Cited by 8
TrustBandit: Optimizing Client Selection for Robust Federated Learning Against Poisoning Attacks
Deressa, B., & Hasan, M. A. (2024) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps61880.2024.10620802 · Cited by 7
Secure and incentivized federated learning for resilient telemedicine diagnostics
Dib, O. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114622 · Cited by 9
Balancing Privacy and Accuracy: Federated Learning with Differential Privacy for Medical Image Data
Mehmood, M. H., Khan, M. I., & Ibrahim, A. (2024) · International Conference on Data Science and Information Technology (DSIT) · doi:10.1109/dsit61374.2024.10880906 · Cited by 8
Graph-Enhanced Explainable Asynchronous Federated Learning for Internet of Vehicles
Zhou, H., Zhou, Y., & Yang, W. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3556933 · Cited by 7
Rodríguez-Aguilar, R., Marmolejo-Saucedo, J. A., & Köse, U. (2025) · Mathematics · doi:10.3390/math13152393 · Cited by 9
Blockchain-enabled identity management for IoT: a multi-layered defense against adversarial AI
Usama, M., Aziz, A., Alasbali, N. A., Alturki, N. M., Hanif, M. U., & Rehman, M. U. (2026) · Scientific Reports · doi:10.1038/s41598-026-35208-y · Cited by 6
Adaptive Model Aggregation in Federated Learning Based on Model Accuracy
Wang, R., & Chen, Y. J. (2024) · IEEE Wireless Communications · doi:10.1109/mwc.012.2300444 · Cited by 6
HaghighiFard, M. S., & Çöleri, S. (2024) · IEEE Vehicular Networking Conference (VNC) · doi:10.1109/vnc61989.2024.10576001 · Cited by 6
Security strategies for AI systems in Industry 4.0
Bairaktaris, J. A., Johannssen, A., & Tran, K. P. (2024) · Quality and Reliability Engineering International · doi:10.1002/qre.3678 · Cited by 6
A Verifiable, Privacy-Preserving, and Poisoning Attack-Resilient Federated Learning Framework
Mbonu, W. E., Maple, C. R., Epiphaniou, G., & Panchev, C. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9040085 · Cited by 7
AIDFL: An Information-Driven Anomaly Detector for Data Poisoning in Decentralized Federated Learning
Chen, X., Feng, C., & Wang, S. (2025) · IEEE Access · doi:10.1109/access.2025.3552168 · Cited by 5
FedCVG: a two-stage robust federated learning optimization algorithm
Zhang, R., Zhang, Y., Zhao, Y., Jia, B., & Lian, W. (2025) · Scientific Reports · doi:10.1038/s41598-025-02722-4 · Cited by 5
Undermining Federated Learning Accuracy in EdgeIoT via Variational Graph Auto-Encoders
Li, K., Hu, S., Wu, B., Zou, S., Ni, W., & Dressler, F. (2025) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc65282.2025.11059509 · Cited by 5
Moyeen, M. A., Kaur, K., Agarwal, A., Manzano, S. R., Zaman, M., & Goel, N. (2025) · IEEE Access · doi:10.1109/access.2025.3592207 · Cited by 5
Chen, L., Zhai, W., Bu, X., Sun, M., & Zhu, C. (2025) · Drones · doi:10.3390/drones9080528 · Cited by 5
Trusted Compute Units: A Framework for Chained Verifiable Computations
Castillo, F., Heiss, J., Werner, S., & Tai, S. (2025) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc64466.2025.11114627 · Cited by 5
Cybersecurity and Artificial Intelligence: Triad-Based Analysis and Attacks Review
Veprytska, O., Kharchenko, V. S., & Illiashenko, O. A. (2025) · Cybernetics and Information Technologies · doi:10.2478/cait-2025-0028 · Cited by 6
Data Poisoning Attacks in Gossip Learning
Pham, A., Potop-Butucaru, M., Tixeuil, S., & Serge Fdida, B. (2024) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-3-031-57853-3_18 · Cited by 5
Cristiano, G. M., D’Antonio, S., & Uccello, F. (2024) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr61664.2024.10679472 · Cited by 5
SGAN-RA: Reconstruction Attack for Big Model in Asynchronous Federated Learning
Wang, K., Zhang, H., Kaddoum, G., Shin, H., Quek, T. Q. S., & Win, M. Z. (2025) · IEEE Communications Magazine · doi:10.1109/mcom.001.2400062 · Cited by 5
Voyager: MTD-Based Aggregation Protocol for Mitigating Poisoning Attacks on DFL
Feng, C., Celdrán, A. H., Vuong, M., Bovet, G., & Stiller, B. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575335 · Cited by 5
Zhang, G., & Sikdar, B. (2025) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2025.3629243 · Cited by 4
Robust Federated-Learning-Based Classifier for Smart Grid Power Quality Disturbances
Alsabaan, M., Elsayed, A., Bondok, A. H., Badr, M. M., Mahmoud, M. M. E. A., Alshawi, T. A., & Ibrahem, M. I. (2025) · Sensors · doi:10.3390/s25226880 · Cited by 4
Secure and adaptive authentication in fog-assisted smart homes using personalized federated learning
Abbass, W., Abbas, N., Javed, M. A., & Saudagar, A. K. J. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-08055-3 · Cited by 4
Blockchain-enabled defenses in federated learning: A comprehensive survey
Dib, O. (2026) · Computer Science Review · doi:10.1016/j.cosrev.2026.100932 · Cited by 4
Model Poisoning Attack Against Federated Learning with Adaptive Aggregation
Nabavirazavi, S., Taheri, R., Ghahremani, M., & Iyengar, S. S. (2023) · Advances in information security · doi:10.1007/978-3-031-49803-9_1 · Cited by 7
Analyzing Poisoning Attacks on Non-IID Federated Learning Systems for Credit Scoring
Patil, A., Choudhar, A., Shah, D., Abraham, J., & Bochare, A. (2024) · International Conference on Computing, Communication and Networking Technologies (ICCCNT) · doi:10.1109/icccnt61001.2024.10724119 · Cited by 4
FLGT: label-flipping-robust federated learning via guiding trust
Li, H., Shi, Z., Jin, M., Yin, A., & Zhao, Z. W. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-024-02323-z · Cited by 4
An Asynchronous Federated Learning Aggregation Method Based on Adaptive Differential Privacy
Wu, J., Xia, G., Huang, H., Yu, C., Zhang, Y., & Li, H. (2025) · Electronics · doi:10.3390/electronics14142847 · Cited by 4
Self-citationDetecting Data Poisoning in Split Learning Using Intraclass- Distance Inflated Loss
Kohankhaki, M., Ayad, A., Barhoush, M., & Schmeink, A. (2023) · IEEE Globecom Workshops (GC Wkshps) · doi:10.1109/gcwkshps58843.2023.10464883 · Cited by 4
A Novel Adaptive Cluster-Based Federated Learning Framework for Anomaly Detection in VANETs
Ch, R., Sudheer, P., Batra, I., & Sembiring, F. (2025) · International Global Conference Series on ICT Integration in Technical Education & Smart Society · doi:10.3390/engproc2025107079 · Cited by 3
Choi, J., & Oh, S. (2025) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2025.103569 · Cited by 3
Hasan, S. M., Imteaj, A., & Shahid, A. R. (2025) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2025.3633995 · Cited by 3
AI-RMF-Governed, Zero-Trust Architecture for AI-Enabled IoTaaS: An Industrial Perspective
Julio, Y. R., Viloria-Núñez, C., Sacoto-Cabrera, E. J., Tello, E. A., Mubarik, M., & Pinto, A. D. (2025) · IEEE Global Conference on Artificial Intelligence and Internet of Things (GCAIoT) · doi:10.1109/gcaiot68269.2025.11275565 · Cited by 3
Zhang, Y., Liu, Z., Xu, Y., Deng, N., Luo, X., & Lin, F. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2025.3617901 · Cited by 3
A Review on Fuzzy Cognitive Mapping: Recent Advances and Algorithms
Nápoles, G., Jastrzębska, A., Grau, I., Salgueiro, Y., & León, M. (2026) · Big Data and Cognitive Computing · doi:10.3390/bdcc10010022 · Cited by 3
Alruwaili, E., & Moulahi, T. (2026) · Frontiers in Public Health · doi:10.3389/fpubh.2026.1762346 · Cited by 3
Technical considerations of federated learning in digital healthcare systems
Alozie, E., Olagunju, H. I., Faruk, N., & Garba, S. (2024) · Elsevier eBooks · doi:10.1016/b978-0-443-13897-3.00009-6 · Cited by 3
Adversarial attack vulnerability for multi‐biometric authentication system
Lee, M. H., Yoon, J., & Choi, C. (2024) · Expert Systems · doi:10.1111/exsy.13655 · Cited by 3
Securing Federated Learning: Enhancing Defense Mechanisms against Poisoning Attacks
Birchman, B., & Thamilarasu, G. (2024) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn61486.2024.10637632 · Cited by 3
Protection Against Poisoning Attacks on Federated Learning-Based Spectrum Sensing
Wasilewska, M., & Bogucka, H. (2025) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2025.3560285 · Cited by 3
Raza, A. (2023) · theses.fr (ABES) · doi:10.70675/ac35dc8az89ccz4977z8f25zb7c8937f7cf0 · Cited by 4
DistilGuard - Large Language Models for Poisoning Detection in Federated Learning
Nehara, T., Samaraweera, C. K., Nettasinghe, O., Nethsara, A., Sandeepa, C., Gamage, T. D., & Liyanage, M. (2025) · IEEE Conference on Communications and Network Security · doi:10.1109/cns66487.2025.11195054 · Cited by 2
Rodríguez-Barroso, N., García-Márquez, M., Luzón, M. V., & Herrera, F. (2026) · Information Fusion · doi:10.1016/j.inffus.2026.104236 · Cited by 5
FLGuard: A Rényi-Differential Privacy Empowered Federated Learning Framework for 6G Networks
Du, M., Liu, Y., Tian, W., Shi, H., & Han, Z. (2025) · IEEE Wireless Communications · doi:10.1109/mwc.2025.3600040 · Cited by 2
Advancing Privacy and Accuracy With Federated Learning and Homomorphic Encryption
Phan, Q. B., Nguyen, D. C., Doan, T. T., & Nguyen, T. T. (2026) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2026.3670702 · Cited by 2
Survey of privacy preserving federated tree-based learning
Babalola, O., Cano, J., Tran, N. H., Deepaisarn, S., & Truong, N. B. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11555-0 · Cited by 2
Defending Against Model Inversion Attacks for Biomedical Images via Learnable Data Perturbation
Jiang, S., Firouzi, F., & Chakrabarty, K. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3693688 · Cited by 3
Real Time Poisoning Attacks and Privacy Strategies on Machine Learning Systems
Archa, A. T., & Kartheeban, K. (2024) · International Conference on Sentiment Analysis and Deep Learning (ICSADL) · doi:10.1109/icsadl61749.2024.00036 · Cited by 2
Tackling Non-IID Data and Data Poisoning in Federated Learning using Adversarial Synthetic Data
Danilenka, A. (2024) · Journal of Automation Mobile Robotics & Intelligent Systems · doi:10.14313/jamris/3-2024/17 · Cited by 3
Ye, J., Shi, L., Xu, H., Pan, S., & Xu, J. (2024) · ACM Annual International Conference on Mobile Computing and Networking (MobiCom) · doi:10.1145/3636534.3698247 · Cited by 3
Han, C., Yang, T., Cui, Z., & Sun, X. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3521329 · Cited by 2
Homomorphic Encryption-Based Federated Active Learning on GCNs
He, X., Song, Z., Zhang, D., Ju, H., & Meng, Q. (2025) · Symmetry · doi:10.3390/sym17060969 · Cited by 2
SecureTransfer: A Transfer Learning Based Poison Attack Detection in ML Systems
T, A., & Kartheeban, K. (2024) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2024.01507141 · Cited by 2
A Triad of Defenses to Mitigate Poisoning Attacks in Federated Learning
Mazetto, B. O., & Zarpel�ão, B. B. (2024) · Simpósio Brasileiro de Cibersegurança (SBSeg) · doi:10.5753/sbseg.2024.241712 · Cited by 1
A Defense Method for Mitigating Poisoning Attacks in Federated Learning Using ACGAN
Han, Y., & Liu, Y. (2024) · International Conference on Ubiquitous Computing and Communications (IUCC) · doi:10.1109/iucc65928.2024.00037 · Cited by 1
Personalized poison attack tolerant federated learning for residential load forecasting
Mostafanezhad, M., Mohammadi, M., Asl, D. K., & Karimipour, H. (2025) · Sustainable Energy Grids and Networks · doi:10.1016/j.segan.2025.101794 · Cited by 1
Deception-Based Defense of Poisoning Attack in Federated Learning
Masse, G. C. T., Benslimane, A., Tchendji, V. K., & Hemida, A. H. A. (2025) · IEEE Access · doi:10.1109/access.2025.3611806 · Cited by 1
A dual-aggregation approach to fortify federated learning against poisoning attacks in IoTs
Dalaien, M. N. A., Ullah, R., & Al-Haija, Q. S. A. (2025) · Array · doi:10.1016/j.array.2025.100520 · Cited by 1
The Built-In Robustness of Decentralized Federated Averaging to Bad Data
Sabella, S., Boldrini, C., Valerio, L., Passarella, A., & Conti, M. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11229161 · Cited by 1
Metadata
- Authors
- Xia, G., Chen, J., Yu, C., & Ma, J.
- Affiliations
- National University of Defense Technology (CN)
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 10708-10722
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4317795078
- Cited by
- 212
- References
- 87
- Citations by year
- 2026: 78 · 2025: 76 · 2024: 47 · 2023: 11
- FWCI
- 19.90
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- federated learning, poisoning attacks, attack classification, defense strategy, privacy preservation, malicious clients
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
