The DOI matches its Crossref record; 92 of the 92 references it cites were found in a registry or an index; none of the 62 sources its claims cite is checked for support yet.
Poisoning Attacks in Federated Learning: A Survey
Open accessAbstract
Federated learning faces many security and privacy issues. Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models. Defending against poisoning attacks is a very urgent and challenging task. However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort. This survey provides an in-depth and up-to-date overview of poisoning attacks and corresponding defense strategies in federated learning. We first classify the poisoning attacks according to their methods and targets. Next, we analyze the differences and connections between the various categories of poisoning attacks. In addition, we classify the defense strategies against poisoning attacks in federated learning into three categories and analyze their advantages and disadvantages. Finally, we discuss the privacy protection problem in poisoning attacks and their countermeasure and propose potential research directions from the perspective of attack and defense, respectively.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This survey reviews poisoning attacks in federated learning and classifies them by attack method and attacker intent, while also classifying defenses into model analysis, Byzantine robust aggregation, and verification-based approaches. It argues that privacy protection and secure aggregation are often overlooked in poisoning defense research and proposes future directions from both attack and defense perspectives.
Key findings
- Poisoning attacks are classified by method into data poisoning attacks (clean-label and dirty-label) and model poisoning attacks, and by attacker intention into targeted, semi-targeted, and untargeted attacks.
- Model poisoning attacks tend to work better in practice because they directly modify local model parameters; the survey cites Eugene et al.’s experimental result that controlling 1% of clients for model poisoning can achieve the same or better effect as controlling 20% of clients for data poisoning.
- Defense strategies are grouped into three categories: model analysis, Byzantine robust aggregation (gradient clipping, removing extreme values, differential privacy), and verification-based methods; the survey evaluates their strengths, weaknesses, and support for secure aggregation.
- Non-IID data makes defense harder because local models are inherently different, and many defenses that require server access to individual local models are incompatible with secure aggregation, though homomorphic encryption and differential privacy offer partial paths.
Methods
- Design: a survey that reviews existing poisoning attack methods and defense strategies in federated learning, with a stated focus on privacy protection and secure aggregation.
- Data/sample: published papers from recent years, including representative poisoning attack and defense works summarized in Tables 2 and 3; no primary dataset or experimental sample is collected.
- Main analysis: qualitative taxonomy and comparative analysis of attack categories, defense categories, data distribution assumptions, stealthiness, persistence, and secure-aggregation support.
Limitations
- Paper-stated: most existing defense strategies are static, targeted at specific known attacks, and assume limited adversary capabilities; defending against poisoning attacks while protecting privacy remains an open problem, and non-IID data makes server-side defense more difficult.
- Paper-stated: many existing studies assume the server can access the client’s local model, which risks privacy leakage and prevents direct integration with secure aggregation.
- Evident from the text: the survey does not report a systematic literature search protocol, quantitative meta-analysis, or primary experiments; its conclusions are based on selected representative works and qualitative synthesis.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
0 of 62 cited sources checked · 0 supported · 0 flagged
In the paper
“Yuwei et al. [24] proposed the attack distance-aware attack (ADA) to enhance poisoning attacks by finding optimal target classes in the feature space.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [24] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“if an attacker manipulates some of these clients to modify the models before uploading them to the central server by directly (for example, altering the model parameters) or indirectly (such as by flipping the label of the training data) way, it will influence the direction of the global model update and finally cause the non-convergence of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesThe paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Attackers can implement a clean label attack by modifying the samples in the training set and, for example, adding noise to the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“From the above description, we can find that the direction of the global model update depends on the directions of the local models uploaded by each client.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIn the paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“For instance, the attacker can add random noise to the local model to affect the convergence of the global model [34], [35].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“Moreover, the attacker can also manipulate the update of the global model using the model replacement method with w k+1 0 [30]:”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“For example, the experimental results of Eugene et al. [30] showed that in a given scenario, an attacker controlling 1% of clients to perform a model poisoning attack could achieve the same (or even better) effect as controlling 20% of clients to perform a data poisoning attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“Second, model poisoning attacks often multiply the local gradient by a factor before uploading it to the server to amplify the impact of the malicious gradient [28], [29], [30], [31].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passes
- Probably not a substantial claim. 43
- It may state two separate claims as one. 39
- The quote only partly states this claim. 1
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our observations show that poisoning attacks are becoming more effective, stealthy, and powerful.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the data poisoning attack, an attacker cannot directly modify the local model parameters and can only perform the poisoning attack by falsifying or tampering with the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA POISONING ATTACK
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, federated learning is considered effective in protecting user privacy during training.”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these methods all assume that the data distribution is IID.Once the training data is non-IID, the attacker cannot execute the attack in the above way.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
In the paper
“Virat et al. [23] argued that there are two kinds of label-flipping strategies, namely static label flipping (SLF) and dynamic label flipping (DLF).”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [23] source
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, SLF is inefficient, and some researchers have proposed DLF schemes to improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort.”
- Also stated in: § I. INTRODUCTION · plain
“While several researchers have discussed poisoning attacks in their surveys, few have analyzed the privacy issues that may arise from poisoning attacks and poisoning attack defense strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence.
- Also stated in: § I. INTRODUCTION · plain
In the paper
“To address this problem, Google developed a distributed machine learning framework called federated learning (FL) in 2016, which allows each client to jointly train a model without sharing data [6].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
- Not checked yetcites [6] McMahan, Communication-efficient learning of deep networks from decentralized data
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
None of the sources cited for this claim have been checked yet.
In the paper
“Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“However, further research shows that federated learning also faces many security and privacy risks [7], [8], [9], [10], such as poisoning attacks [11], [12], [13], [14], [15] and privacy leakage [16], [17], [18], [19], [20], [21].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
In the paper
“To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”
- Also stated in: § a: CLEAN LABEL ATTACK · plain
“With this approach, an attacker can execute a poisoning attack without prior knowledge.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
What the sources say
- Not checked yetcites [26] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
- Also stated in: § a: CLEAN LABEL ATTACK · plain
None of the sources cited for this claim have been checked yet.
In the paper
“The principle of this approach is that only a tiny fraction of neurons changed during the training phase, while the vast majority of neurons were close to zero.Those unchanged neurons are called the redundant space of neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacker's goals of implementing a poisoning attack can be classified into two categories: 1) reducing the accuracy of the global model on all tasks and 2) affecting the performance of the global model on specific tasks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. CLASSIFICATION ACCORDING TO THE INTENTION OF THE ATTACKERS
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The idea of the attack in this setup is that if the AD between the source class c S and the target class c T is small, the scale of the malicious updates required in the adversary's local model is also small.Then the attack has a greater chance of surviving the aggregation of overwhelming legitimate updates, resulting in a more significant effect.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“To avoid detection, Virat et al. [23] also state that model updates should not deviate too far from benign updates to avoid detection.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [23] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In a model poisoning attack, the attacker uses a more direct way to manipulate the client's local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, in the non-IID setting, both the attacker and the server faced significant challenges but affected the server even more.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In a poisoning attack, the data distribution can not only affect the effectiveness of the attack but also determine the success or failure of the attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach increases the risk of being detected by the server, but the right choice of amplification factor can effectively improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The semi-targeted attack can improve the performance of the attack by fixing the source class and choosing the optimal target class.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For example, data poisoning attacks are more intuitive, and attackers can implement label flipping according to their intentions.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since untargeted poisoning attacks affect all tasks, they are more easily detected by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, targeted poisoning attacks are highly stealthy and more challenging to detect, especially when the data is non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, many attackers avoid detection by bounding the norm of their malicious gradients, the range of which is strongly influenced by the data distribution.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:boosted· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearIt may state two separate claims as one.
In the paper
“Although Thien et al. [80] propose that it can mix a small number of malicious updates with numerous benign updates to avoid server detection, the server can still identify the attack by comparing historical updates from the client.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [80] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“It is worth noting that if the server can access the client's local model directly, there is a great risk of privacy leakage because the server may recover the original training data from the client's gradients [16], [17], [18], [19].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [16] Fu, Label inference attacks against vertical federated learning
- Not checked yetcites [17] Geiping, Inverting gradients—How easy is it to break privacy in federated learning?
- Not checked yetcites [18] source
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This assumption is always valid because benign models and malicious models are inherently different from each other.”
§ Poisoning Attacks in Federated Learning: A Survey > A. MODEL ANALYSIS
Load-bearingStrength:boosted· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
In the paper
“For example, Clement et al. [53] found that the gradients uploaded by honest clients were more diverse than those uploaded by malicious clients.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [53] Fung, 2018, Mitigating sybils in federated learning poisoning, arXiv:1808.04866
Strength:plain· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The experimental results show that both LDP and CDP are effective against poisoning attacks, and CDP is more effective than LDP against poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DIFFERENTIAL PRIVACY
What the sources say
- Not checked yetcites [66] source
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“In a typical gradient clipping approach, we can set a threshold for the model parameters and discard all parameters that exceed the threshold [29], [65].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) GRADIENT CLIPPING
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [65] Panda, SparseFed: Mitigating model poisoning attacks in federated learning with sparsification
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“BRA is a passive defense strategy that mitigates the damage of poisoning attacks by changing the aggregation method of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > B. BYZANTINE ROBUST AGGREGATION
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Therefore, many FL frameworks use secure aggregation [81], [82], [83], [84] algorithms in the aggregation process, at which point most of the poisoning attack defense methods mentioned above will be invalid.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [81] source
- Not checked yetcites [82] Zhang, BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning
- Not checked yetcites [83] Bhowmick, 2018, Protection against reconstruction and its applications in private federated learning, arXiv:1812.00984
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The methods mentioned above for testing global/local models require the server to collect a test set, and the quality of this test set dramatically affects the effectiveness of the defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PERFORMANCE EVALUATION
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Poisoning attacks are executed through malicious models, so an intuitive defense strategy is to analyze the model.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among the model analysis methods, we found that in addition to the direct analysis of the global model that supports secure aggregation, the analysis of the encrypted local model can defend against poisoning attacks and protect clients' data privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, directly verifying the client's local data is not always allowed, but introducing a trusted third party can solve this problem.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Finally, differential privacy is a secure aggregation strategy that can also resist poisoning attacks, but its biggest problem is that it reduces the accuracy of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Although trusted third parties are difficult to guarantee in real-world settings, this approach also provides lessons for subsequent research.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“One of the most remarkable features of federated learning is that it protects the data privacy of the clients involved in training.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“While these efforts follow the fundamental principle that the client's original data is not released to the public, the intermediate data in federated learning may cause privacy leaks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“Florian et al. [88] pointed out that an attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [88] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, many efforts to defend against poisoning attacks will likely lead to client data privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:hedged· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach also cannot cope with data poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearThe quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with the latter is that current research is based on the predictive accuracy of the global model on the validation dataset to determine whether an attack has been poisoned, and targeted poisoning attacks may evade this defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“However, some researchers [68] have proposed an iterative median approximation method that can approximate the median of all models without accessing the local model and thus can also support the secure aggregation strategy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
What the sources say
- Not checked yetcites [68] Pillutla, 2019, Robust aggregation for federated learning, arXiv:1912.13445
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with this approach is that it requires thorough training of an SVM on poisoned and non-poisoned datasets that are relatively similar to the client's data source and thus may not apply to scenarios where the data is Non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Research on implementing poisoning attacks and defending against poisoning attacks has made significant progress in recent years, but some issues still need further research.”
§ Poisoning Attacks in Federated Learning: A Survey > VI. CHALLENGES AND FUTURE DIRECTIONS
Strength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“First, each training round of FL selects some clients randomly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
In the paper
“Furthermore, in the approach proposed by Henger et al. [32], the malicious client first uses a gradient inversionbased inference attack to learn approximations of other client data distributions from model updates received by the server.Then, the attacker uses his local data and the learned distributions to construct a simulator of the FL environment.Finally, the attacker uses reinforcement learn”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
What the sources say
- Not checked yetcites [32] Li, Learning to attack federated learning: A model-based reinforcement learning attack framework
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, frequent attacks increase the risk of exposure.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the existing attacks are constantly enriched with increasingly sophisticated attack methods being proposed.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have already solved the feasibility problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In poisoning attacks, multiple attacks may be combined (e.g., with privacy inference attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Strength:hedged· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Once an attacker knows these defense strategies exist, it is easy to bypass them.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, many researchers assume that the adversary in their experiments undisguisedly performs the attack.Thus, they are vulnerable to more sophisticated poisoning attacks, despite the positive results they have achieved in their experiments.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Another problem with existing defense strategies is that they are primarily targeted at specific attacks.They can only defend against known attack methods.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, the defense against poisoning attacks, although well studied, still has many issues to be addressed.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence.
None of the sources cited for this claim have been checked yet.
In the paper
“In model replacement, the attacker attempts to replace the global model w (k+1) 0 with the malicious model w k+1 0 .”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
- Not checked yetcites [31] Xie, DBA: Distributed backdoor attacks against federated learning
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One existing trend is to design defense strategies against poisoning attacks in the cryptographic mode with existing privacy-preserving cryptographic algorithms.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, the challenge for defenders is much tougher, as effectively preventing or detecting poisoning attacks remains an open problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a result, they may be more concerned with the trade-off between efficiency and stealth.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Strength:hedged· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have used methods such as reinforcement learning to improve the efficiency of their attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, there are relatively few studies in this direction, mainly focusing on homomorphic encryption and differential privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Many existing studies assume the server has access to the client's local model, which poses a significant risk of privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Worse, these defense strategies cannot be directly integrated with existing privacy protection strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“During the federated learning training process, an attacker can execute a poisoning attack by modifying the client's local data or directly modifying the local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
The paper relies on this without support.
In federated learning, it is impossible to guarantee that all clients are reliable.
“Since many clients are involved in training in federation learning, it is impossible to guarantee that all clients are reliable.”
The paper relies on this without support.
Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.
“Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.”
The authors state this as an assumption.
There are significant differences between poisoned and benign models, and there is some way to distinguish these differences.
“Model analysis methods are based on the assumption that there are significant differences between the poisoned and benign models and that there is some way to distinguish these differences.”
The paper relies on this without support.
Neural networks have catastrophic forgetting properties and may quickly forget previously acquired concepts.
“Moreover, neural networks have catastrophic forgetting properties, where neural networks may quickly forget previously acquired concepts.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“But further research reveals that FL still faces privacy and security risks, including privacy leakage [87][88][89] and poisoning attacks [169,170].”
From Federated learning for medical image analysis: A survey (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Trimmed mean is described as using the median
MinorThe first passage says trimmed mean uses the median value for each parameter. The later definition says it removes the largest and smallest values and uses the mean of those remaining.
“In trimmed mean and median, for each parameter p in the model, the server uses the median value of each local model to update the global model [85].”
“In trimmed mean, for each parameter p, the largest b parameters and the smallest b parameters are removed from all m local models, and the mean of the remaining m -2b parameters is used to update the global model.”
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Federated Learning in Mobile Edge Networks: A Comprehensive Survey
Lim, W. Y. B., Luong, N. C., Hoang, D. T., Jiao, Y., Liang, Y.-C., Yang, Q., Niyato, D., & Miao, C. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2986024 · Cited by 2,565
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
(2017) · neural information processing systems · Cited by 1,413
Flagged first, then by citations
Research works printed but not linked: 2
- Fu, Label inference attacks against vertical federated learning, 1
- Li, Learning to attack federated learning: A model-based reinforcement learning attack framework, 1
Cited by
Sorted by citations
Items 101–200 of 211
A Robust Federated Learning System Against Data Poisoning Attacks in IoT Networks
Vu, L., & Tran, T. P. (2025) · Journal of Reliable Intelligent Environments · doi:10.1007/s40860-025-00263-1 · Cited by 1
Lu, Y., Chen, J., & Qin, J. (2025) · Computer Standards & Interfaces · doi:10.1016/j.csi.2025.104113 · Cited by 1
Self-citationLiao, X., Wu, Z., He, B., Zhao, H., Shang, S., Wu, D., & Su, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3645273 · Cited by 1
Masse, G. C. T., Benslimane, A., Tchendji, V. K., Hemida, A. H. A., Su, Z., & Han, S. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11161880 · Cited by 1
TCFL: Trapdoor homomorphic encryption based federated learning aggregator with filter
Shen, X., Jia, Y., Xu, C. L., & Zhu, L. (2026) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-025-02193-4 · Cited by 1
Ebrahimi, M., Sahay, R., Akram, B., & Hosseinalipour, S. (2026) · Frontiers in Psychiatry · doi:10.3389/fpsyt.2026.1792429 · Cited by 1
Effective Dual-Layer Poison Attacks Detection in Privacy-preserving Federated Learning
Zhang, X., Chi, H., Li, Y., Jiang, S., Du, X., & Hughes, D. (2025) · Globecom · doi:10.1109/globecom59602.2025.11432262 · Cited by 1
FPGA Acceleration of Homomorphic Encryption-Assisted Federated Learning
Ahmed, M. A., Alsharkawy, M., Bothe, S., Nassar, H., Bauer, L., & Henkel, J. (2026) · Journal of Circuits Systems and Computers · doi:10.1142/s0218126626450040 · Cited by 1
Privacy-preserving federated learning system under malicious collaborators and aggregators
Azad, M. A., & Shah, S. A. (2026) · Future Generation Computer Systems · doi:10.1016/j.future.2026.108530 · Cited by 2
Federated Learning Applications in Healthcare Informatics: A Comprehensive Review
Howlader, S. M. R. K., Liu, L., Chen, X., Wu, H., Yuan, B., & Bhattacharjee, A. (2026) · ACM Computing Surveys · doi:10.1145/3809485 · Cited by 2
Efficient Federated Learning with Low-Rank Updates under Homomorphic Encryption
Ahmed, M. A., Alsharkawy, M., Nassar, H., Khdr, H., González-Gómez, J., & Henkel, J. (2026) · Design, Automation, and Test in Europe · doi:10.23919/date69613.2026.11539679 · Cited by 2
Zheng, P., Zhou, Y., Yu, X., Wang, W., & Liao, S. (2026) · Bulletin of the National Research Centre/Bulletin of the National Research Center · doi:10.1186/s42269-026-01452-5 · Cited by 1
Reis, M. J. C. S., Serôdio, C., & Branco, F. (2026) · Electronics · doi:10.3390/electronics15143069 · Cited by 1
Security of NVMe Offloaded Data in Large-Scale Machine Learning
Krauß, T., Götz, R., & Dmitrienko, A. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-51482-1_8 · Cited by 1
Vasa, J., Thakkar, A. R., Bhavsar, D., & Patel, P. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-97-9523-9_19 · Cited by 1
Vu, L., Tran, T. P., & Nguyen, Q. U. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-329032-9.00014-2 · Cited by 1
Xie, X., Xian, X., Li, D., & Wang, A. (2024) · IISE Transactions · doi:10.1080/24725854.2024.2367224
Backdoor Attack and Defense in Asynchronous Federated Learning for Multiple Unmanned Vehicles
Wang, K., & Zhang, H. (2024) · Conference on Fully Actuated System Theory and Applications (FASTA) · doi:10.1109/fasta61401.2024.10595233
Decentralized Edge-Based Detection of Label Flipping Attacks in Federated Learning
Alotaibi, N., Felemban, M., & Mahmood, S. (2024) · Lecture notes in networks and systems · doi:10.1007/978-3-031-75016-8_19
FEFL: A Fair & Efficient Defense Against Poisoning Attacks via Discrete Update Space
Zhao, Y., Zhang, J., Cao, Y., & Ye, T. (2024) · International Conference on Information Communication and Signal Processing (ICICSP) · doi:10.1109/icicsp62589.2024.10809244
DefMPA: Defending Model Poisoning Attacks in Federated Learning via Model Update Prediction
Guo, M., Chen, B., Xue, B., & Liu, J. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-80419-9_13
FL-ProtectX: Combating Label flipping in complex multi-agent environments
Zamani, M. A., Amiri, F., Jamshidi, P., Hosseini, S. M., & Yazdani, N. (2024) · International Symposium on Telecommunications · doi:10.1109/ist64061.2024.10843483
FedSV: A Privacy-Preserving Byzantine-Robust Federated Learning Scheme with Self-validation
Jiang, W., Fu, S., Luo, Y., Liu, L., & Wang, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-1525-4_13
Ahmed, Y., Sverdlov, M., & Miratnia, N. (2024) · Intelligent Cybersecurity Conference (ICSC) · doi:10.1109/icsc63108.2024.10895779
Loss Based Byzantine Resilience for Decentralized Learning
Masuda, S., & Shudo, K. (2025) · International Conference on Consumer Electronics · doi:10.1109/icce63647.2025.10930090
SecureFed: Blockchain-Based Defence for Data Poisoning Attack in Federated Learning
Alsharidah, A. A., Jha, D. N., Wei, B. W., Solaiman, E., & Ranjan, R. K. (2024) · IEEE/ACM International Conference on Utility and Cloud Computing (UCC) · doi:10.1109/ucc63386.2024.00064
Fenics: A Modular Framework for Security Evaluation in Decentralized Federated Learning
Saha, S., Nova, S. N., Duvignau, R., & Chiasserini, C. F. (2025) · ACM International Conference on Distributed and Event-Based Systems (DEBS) · doi:10.1145/3701717.3730550
Data Leakage and Data Poisoning
Kobayashi, M. (2025) · Springer eBooks · doi:10.1007/978-981-96-9223-1_5 · Cited by 1
Poisoning Attack on Federated Learning with Non-IID Data: A Historical-Global-Model-Based Approach
Sun, Y., Wang, X., Zhang, Z., Ming, Y., He, Y., & Wu, X. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-94458-1_12
Poisoning-Resilient Federated Learning for MEC-IoT Environments Using Blockchain
García-Sáez, L. M., Ruiz-Villafranca, S., Roldán-Gómez, J., Carrillo-Mondéjar, J., & Martínez, J. L. (2025) · ACM Transactions on Internet Technology · doi:10.1145/3767740
Desai, H. (2025) · Medical virology · doi:10.1007/978-981-96-8919-4_10
FortiFed-SP: Client-Side Defense Against Label-Flipping Attacks in Federated Learning
Katabarwa, R., Chen, J., Zhao, Z., Messou, F. J. A., & Yu, K. (2025) · International Conference on Intelligent Communications and Computing (ICICC) · doi:10.1109/icicc66840.2025.11199513
Self-citationEnhanced security verifiable secure aggregation scheme in federated learning
Yao, W., Han, Y., Zhou, T., & Wang, X. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-025-02111-8
Secure federated learning with configurable reliability in heterogeneous edge computing
Liu, Y., Liang, Y., Zhang, R., & Zhou, Z. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111808
A Learning Behavior Based Framework for Secure Personalised Blockchain Federated Learning
Tang, Y., Zhang, Z., & Liu, Q. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4142-3_10
Enhancing Security and Privacy in Federated Learning for Distributed Systems: The REMINDER Approach
Cortés-Delgado, F. J., Campos, E. M., Hernández-Ramos, J. L., Skármeta, A., Latif, S., Djenouri, D., Krenn, S., Puiu, A., & Vizitiu, A. (2025) · Communications in computer and information science · doi:10.1007/978-3-032-09555-8_4
Alipanahloo, Z., Duchesne, M., & Zhang, K. (2025) · IEEE International Conference on Blockchain (Blockchain) · doi:10.1109/blockchain67634.2025.00028
Jalali, N. A., & Chen, H. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5888413
Navigating Cybersecurity and Privacy in Smart Urban Ecosystems
Hassan, S. N. (2025) · IGI Global eBooks · doi:10.4018/979-8-3373-4455-3.ch007
ADFL-DSV: An Adaptive Dynamic Federated Learning Aggregation Based on Shapley Value
Wu, J., Xia, G., Huang, H., Yu, C., Zhang, Y., & Li, H. (2025) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai66417.2025.00011
Self-citationSybil-aware adaptive defence framework for robust federated learning
Khedekar, D., Mahapatra, T., & Rajput, A. S. (2025) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2025.102157
Peng, H., Wu, C., & Xiao, Y. (2025) · Electronics · doi:10.3390/electronics15010074
Xu, W., Xu, Y., & Zhang, S. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104353
Li, S., Zhang, Y., Bai, J., & Fan, K. G. (2025) · Scientific Reports · doi:10.1038/s41598-025-33685-1
A Cross-View Trusted Federated Training Method for Models in Intelligent Surveillance
Chen, G., Li, X., Sun, Y., & Fan, K. (2025) · International Conference on Computer Engineering and Intelligent Control (ICCEIC) · doi:10.1109/icceic67916.2025.11309031
Sayed, A. N., Hossen, M. M., Bensaali, F., & Nhlabatsi, A. (2026) · Lecture notes in networks and systems · doi:10.1007/978-981-96-8793-0_27
Chen, Y.-C., Liao, Y.-S., & Lai, Z.-S. (2026) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2026.3653218
Inversion, Membership, and Poisoning Attacks in Federated Learning - Challenges and Defenses
Farooqi, S. A., Rahman, A. A., & Saad, A. B. (2026) · International Conference on Ubiquitous Information Management and Communication (IMCOM) · doi:10.1109/imcom69009.2026.11360927
Pathak, J., Mundra, P., Sejpal, Y., Mahapatra, T., & Rajput, A. S. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112098
Adversarial Robustness of Federated Learning in Healthcare
Saranya, P., Saranya, A., Janardhanan, J., Shukla, G., Iyer, R., & Panthakkan, A. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6224-3.ch007
A Model Consistency-Based Countermeasure to GAN-Based Data Poisoning Attack in Federated Learning
Sun, W. J., Gao, B., Xiong, K., Wang, Y., Fan, P., & Letaief, K. B. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3665336 · Cited by 2
Federated Learning Privacy-Preserving Approach for Consumer-Centric Multimodal Healthcare Data
Singh, N. K., Singhal, N., Jain, K., & Lee, J. (2026) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2026.3668598
Overview of Poisoning Attacks and Defence Against Large AI Models
Hou, W., Wen, H., Mao, J., Luo, W., Zhang, P., & Xu, X. (2025) · IEEE International Conference on Artificial Intelligence, Computer Science and Information Processing (AICSIP) · doi:10.1109/aicsip65423.2025.11427220
Data Poisoning Attacks of Fine-Tuning for Large Language Models
Chen, Y., Wen, H., Hou, W., Mao, J., Luo, W., & Zhao, W. (2025) · IEEE International Conference on Artificial Intelligence, Computer Science and Information Processing (AICSIP) · doi:10.1109/aicsip65423.2025.11427210
A Triad of Defenses to Mitigate Poisoning Attacks in Federated Learning
Mazetto, B. O., & Zarpel�ão, B. B. (2026) · Journal of the Brazilian Computer Society · doi:10.5753/jbcs.2026.5558
Арм, А. А. С. (2026) · Modelling and Data Analysis · doi:10.17759/mda.2026160103
Severity-First Risk Prioritization for AI Poisoning in Edge-Integrated Internet of Vehicles
Islam, S. U., Kumar, M., Maple, C. R., Epiphaniou, G., Kumar, P., & Lambert, A. (2026) · International Conference on Consumer Electronics · doi:10.1109/icce67443.2026.11449595
RAFL-DSV: Robustness-Driven Adaptive Federated Learning with Dynamic Shapley Value
Wu, J., Xia, G., Yu, C., Zhang, Y., Huang, H., & Li, H. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-8402-4_27
Self-citationFedTriad: A “Self-Peer-Global” Trust Triangle for Federated Learning Backdoor Defense
Dong, Y. (2026) · International Symposium on Computer Applications and Information Systems (ISCAIS) · doi:10.1109/iscait69154.2026.11477358
pFedDDS: Personalized Federated Learning via Dual Defense Strategies
Rui, X., Song, Q., Chen, L., Hu, N., & Wen, J. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-23447-6_28
Xiao, F., Wang, K., & Zhang, K. (2025) · International Conference on Big Data, Artificial Intelligence and Risk Management (ICBAR) · doi:10.1145/3800227.3800293
Miloudi, A., Laouid, A., Bounceur, A., Bouhamed, M. M., & Hammoudeh, M. (2025) · International Conference on Future Networks and Distributed Systems (ICFNDS) · doi:10.1145/3789692.3789788
Secure Cross-Cloud Federated Learning: A Layered Defense Architecture
Karaboga, D., & Karaarslan, E. (2026) · Computer · doi:10.1109/mc.2025.3649076
Federated Spectrum Poisoning: Attacks and Defenses
Pham, N. D., Dayaratne, T. T., Vo, V., Haydon, B., Lai, S., Abuadbba, A., Suzuki, H., Rudolph, C., & Yuan, X. (2025) · doi:10.1145/3733814.3765493
Efficient privacy-preserving federated learning with local differential privacy
Yin, C., & Zeng, Q. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112351
AIoT Security Landscape Threat Models and Vulnerability Assessment
Al-E’mari, S., Sanjalawe, Y. K., & Fataftah, F. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6299-1.ch002
Analyzing Adversarial Attacks on Federated Learning based Medical Image Classification
Hamid, S., & Bawany, N. Z. (2026) · International Conference on Data Science, Machine Learning, and Intelligence (DataSciMI) · doi:10.1109/datascimi67380.2026.11523793
Gazis, A., Pappas, S. S., Vavouras, T., Kiokes, G., & Vita, V. (2026) · Electronics · doi:10.3390/electronics15112411
Random Client Selection for Contrastive Federated Learning in Parameter Poisoning Attacks
Ginanjar, A., Li, X., Singh, P., & Hua, W. (2026) · IEEE International Conference on Computing and Machine Intelligence (ICMI) · doi:10.1109/icmi68585.2026.11539928
Beyond accuracy: Convergence degradation under pixel-level perturbations in federated learning
Chen, A., Manzoor, H. U., Rais, R. N. B., Hussain, S., Mohjazi, L., & Zoha, A. (2026) · Neurocomputing · doi:10.1016/j.neucom.2026.134212
SimGuard: Towards Resilience of Community-based Intrusion Detection
Eichhammer, P., & Reiser, H. P. (2026) · ACM Symposium on Applied Computing · doi:10.1145/3748522.3779878
Resilience of federated learning: perspectives on attacks and defenses
Raj, P. V. P., Gupta, A., & Das, S. K. (2026) · Elsevier eBooks · doi:10.1016/b978-0-44-344433-3.00016-2
Ruan, J.-H., Zhang, Z.-L., Liu, W.-A., Ruan, Y.-P., & Xiong, Q. (2026) · Information Processing & Management · doi:10.1016/j.ipm.2026.104973
Son, N. D. H., Ngan, V. D. T., Nha, L. M., Luong, T. D., Pham, V.-H., & Duy, P. T. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111349 · Cited by 1
A comprehensive survey on communication optimization and privacy preservation in federated learning
Kunjumon, A., Sarath, G., & Nair, J. J. (2026) · Discover Computing · doi:10.1007/s10791-026-10272-0 · Cited by 1
Detection and Mitigation Data Poisoning Attacks in Multimodal Online Federated Learning
Wang, H., Zhong, X., Yang, W., Wu, H., Liu, F., & Zhang, W. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3707417
Djemaa, A., Djenouri, D., & Legg, P. (2026) · Electronics · doi:10.3390/electronics15132876
Blockchain-Assisted Privacy-Preserving and Robust Federated Learning in Edge Computing
Shen, X., Xu, C. L., Zhu, L., Liu, H., Sun, L., & Sharif, K. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3710509
Towards Durable and Generalizable Backdoor Attacks against Federated Graph Learning
Yang, H., Gu, S., Fu, J., & Chen, Z. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582215
A Secure and Resilient Framework for Wildfire Management via UAVs and Blockchain Federated Learning
Lamani, L., Leka, E., Rexha, G., & Aliti, A. (2026) · International Convention on Information and Communication Technology, Electronics and Microelectronics · doi:10.1109/mipro70003.2026.11591814
P-Orion: Trusted hierarchical learning and allocation in 6G satellite constellations
Ibrahim, H., Ahakonye, L. A. C., Lee, J. H., & Rizal, S. (2026) · ICT Express · doi:10.1016/j.icte.2026.06.016
Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning
Foroughi, M. H., Rastegar, S. H., Sabokrou, M., & Khonsari, A. (2026) · International Conference on Communications · doi:10.1109/icc59461.2026.11588117
Oliveira, J. F. S., Salles, R. M., & Filgueiras, M. Q. (2026) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-30805-4_17
Roadmap and benchmarking: Privacy in federated load forecasting
Abebe, W. M., Potnis, A. V., Sadik, J., Cunningham, J., Longcoy, A., Prout, R., Sundararajan, A., Chinthavali, S., & Lunga, D. (2026) · Future Generation Computer Systems · doi:10.1016/j.future.2026.108713 · Cited by 1
MONZA: A Score System for Malicious Clients Detection
Veiga, R., Morais, R., Bastos, L., Sargento, S., do Rosário, D. L., & Cerqueira, E. (2026) · Journal of Internet Services and Applications · doi:10.5753/jisa.2026.7098
David, T.-M., & Udrescu, M. (2026) · Computers · doi:10.3390/computers15080547
Mohammed, S., Alhadidi, D., & Ngom, A. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6040133
Aditama, A. R., & Nugraha, I. G. D. (2026) · International Conference on Advancement in Data Science, E-learning and Information System (ICADEIS) · doi:10.1109/icadeis71120.2026.11644538
Hachimi, K. E., Orhanou, G., & Ballihi, L. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111459
Privacy-Preserving and Poisoning-Robust Federated Learning for Industrial IoT
Yin, H., Chen, C., Zhang, J., Dian, Y. U., & Liu, S. (2026) · Sensors · doi:10.3390/s26165297
Eleven quick tips for Biomedical Federated Learning
Ellrott, K., Malladi, V. S., Bélisle‐Pipon, J., Demir, E., Bensoussan, Y. E., Mangul, S., Bui, A. A. T., & Boutros, P. C. (2026) · PLoS Computational Biology · doi:10.1371/journal.pcbi.1014530
Clean-Label Data Poisoning Attacks Based on Data FeaturesPreprint
Wang, Y., Zhao, N., Zhang, J., niu, J., & hu, J. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7346357
SiftFL: Scheduling-Based Robust Backdoor Detection in Federated Learning
Hashem, E., Felemban, M., Mahmood, S., & Barnawi, A. Y. (2026) · IEEE Access · doi:10.1109/access.2026.3727396
Baali, F. A., Lhasnaoui, C., Ait‐Mlouk, A., & Agouti, T. (2026) · Machine Learning · doi:10.1007/s10994-026-07142-7
Ferreira, T., & Duraes, J. A. (2026) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan15050072
Gao, C., Wang, H., Lou, J., Deng, W., Zhou, N., Liang, X., & Cui, W. (2026) · Information Sciences · doi:10.1016/j.ins.2026.124097
The Role of Federated Learning in Transforming Data Privacy for AI Applications
Sivasamy, S., & Gangrade, M. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-27691-9_30
Incentive-Driven Zero-Knowledge Proof-Based Gradient Aggregation for Federated Learning
Kowouvi, C., Ahene, E., Walker, J., Akyere, R., Agyili, D. K. O., Nani, D., & Kponyo, J. J. (2026) · Communications in computer and information science · doi:10.1007/978-981-95-9514-3_31
Adversarial poisoning attacks for online deep receivers
Huang, H., Wu, K., Liu, H., Luo, C., Qin, J., Chen, S., & Jiang, W. (2026) · Physical Communication · doi:10.1016/j.phycom.2026.103367
Cheng, S., Huo, D., Hu, Y., Ouyang, W., Ma, Y., & Mu, J. (2026) · IEEE/CIC International Conference on Communications in China (ICCC) · doi:10.1109/iccc70295.2026.11680513
Metadata
- Authors
- Xia, G., Chen, J., Yu, C., & Ma, J.
- Affiliations
- National University of Defense Technology (CN)
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 10708-10722
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4317795078
- Cited by
- 212
- References
- 87
- Citations by year
- 2026: 78 · 2025: 76 · 2024: 47 · 2023: 11
- FWCI
- 19.90
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- federated learning, poisoning attacks, attack classification, defense strategy, privacy preservation, malicious clients
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
