The DOI matches its Crossref record; 92 of the 92 references it cites were found in a registry or an index; none of the 62 sources its claims cite is checked for support yet.
Poisoning Attacks in Federated Learning: A Survey
Open accessAbstract
Federated learning faces many security and privacy issues. Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models. Defending against poisoning attacks is a very urgent and challenging task. However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort. This survey provides an in-depth and up-to-date overview of poisoning attacks and corresponding defense strategies in federated learning. We first classify the poisoning attacks according to their methods and targets. Next, we analyze the differences and connections between the various categories of poisoning attacks. In addition, we classify the defense strategies against poisoning attacks in federated learning into three categories and analyze their advantages and disadvantages. Finally, we discuss the privacy protection problem in poisoning attacks and their countermeasure and propose potential research directions from the perspective of attack and defense, respectively.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This survey reviews poisoning attacks in federated learning and classifies them by attack method and attacker intent, while also classifying defenses into model analysis, Byzantine robust aggregation, and verification-based approaches. It argues that privacy protection and secure aggregation are often overlooked in poisoning defense research and proposes future directions from both attack and defense perspectives.
Key findings
- Poisoning attacks are classified by method into data poisoning attacks (clean-label and dirty-label) and model poisoning attacks, and by attacker intention into targeted, semi-targeted, and untargeted attacks.
- Model poisoning attacks tend to work better in practice because they directly modify local model parameters; the survey cites Eugene et al.’s experimental result that controlling 1% of clients for model poisoning can achieve the same or better effect as controlling 20% of clients for data poisoning.
- Defense strategies are grouped into three categories: model analysis, Byzantine robust aggregation (gradient clipping, removing extreme values, differential privacy), and verification-based methods; the survey evaluates their strengths, weaknesses, and support for secure aggregation.
- Non-IID data makes defense harder because local models are inherently different, and many defenses that require server access to individual local models are incompatible with secure aggregation, though homomorphic encryption and differential privacy offer partial paths.
Methods
- Design: a survey that reviews existing poisoning attack methods and defense strategies in federated learning, with a stated focus on privacy protection and secure aggregation.
- Data/sample: published papers from recent years, including representative poisoning attack and defense works summarized in Tables 2 and 3; no primary dataset or experimental sample is collected.
- Main analysis: qualitative taxonomy and comparative analysis of attack categories, defense categories, data distribution assumptions, stealthiness, persistence, and secure-aggregation support.
Limitations
- Paper-stated: most existing defense strategies are static, targeted at specific known attacks, and assume limited adversary capabilities; defending against poisoning attacks while protecting privacy remains an open problem, and non-IID data makes server-side defense more difficult.
- Paper-stated: many existing studies assume the server can access the client’s local model, which risks privacy leakage and prevents direct integration with secure aggregation.
- Evident from the text: the survey does not report a systematic literature search protocol, quantitative meta-analysis, or primary experiments; its conclusions are based on selected representative works and qualitative synthesis.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
64 Own interpretation · 39 Not checked yet · 11 No basis given
In the paper
“Yuwei et al. [24] proposed the attack distance-aware attack (ADA) to enhance poisoning attacks by finding optimal target classes in the feature space.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [24] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“if an attacker manipulates some of these clients to modify the models before uploading them to the central server by directly (for example, altering the model parameters) or indirectly (such as by flipping the label of the training data) way, it will influence the direction of the global model update and finally cause the non-convergence of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Attackers can implement a clean label attack by modifying the samples in the training set and, for example, adding noise to the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“From the above description, we can find that the direction of the global model update depends on the directions of the local models uploaded by each client.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“For instance, the attacker can add random noise to the local model to affect the convergence of the global model [34], [35].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Moreover, the attacker can also manipulate the update of the global model using the model replacement method with w k+1 0 [30]:”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“For example, the experimental results of Eugene et al. [30] showed that in a given scenario, an attacker controlling 1% of clients to perform a model poisoning attack could achieve the same (or even better) effect as controlling 20% of clients to perform a data poisoning attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“Second, model poisoning attacks often multiply the local gradient by a factor before uploading it to the server to amplify the impact of the malicious gradient [28], [29], [30], [31].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 43
- It may state two separate claims as one. 39
- The quote only partly states this claim. 1
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our observations show that poisoning attacks are becoming more effective, stealthy, and powerful.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the data poisoning attack, an attacker cannot directly modify the local model parameters and can only perform the poisoning attack by falsifying or tampering with the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, federated learning is considered effective in protecting user privacy during training.”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these methods all assume that the data distribution is IID.Once the training data is non-IID, the attacker cannot execute the attack in the above way.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Virat et al. [23] argued that there are two kinds of label-flipping strategies, namely static label flipping (SLF) and dynamic label flipping (DLF).”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [23] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, SLF is inefficient, and some researchers have proposed DLF schemes to improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort.”
- Also stated in: § I. INTRODUCTION · plain
“While several researchers have discussed poisoning attacks in their surveys, few have analyzed the privacy issues that may arise from poisoning attacks and poisoning attack defense strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
- Also stated in: § I. INTRODUCTION · plain
In the paper
“To address this problem, Google developed a distributed machine learning framework called federated learning (FL) in 2016, which allows each client to jointly train a model without sharing data [6].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
- Not checked yetcites [6] McMahan, Communication-efficient learning of deep networks from decentralized data
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
None of the sources cited for this claim have been checked yet.
In the paper
“Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“However, further research shows that federated learning also faces many security and privacy risks [7], [8], [9], [10], such as poisoning attacks [11], [12], [13], [14], [15] and privacy leakage [16], [17], [18], [19], [20], [21].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”
- Also stated in: § a: CLEAN LABEL ATTACK · plain
“With this approach, an attacker can execute a poisoning attack without prior knowledge.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
What the sources say
- Not checked yetcites [26] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § a: CLEAN LABEL ATTACK · plain
None of the sources cited for this claim have been checked yet.
In the paper
“The principle of this approach is that only a tiny fraction of neurons changed during the training phase, while the vast majority of neurons were close to zero.Those unchanged neurons are called the redundant space of neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacker's goals of implementing a poisoning attack can be classified into two categories: 1) reducing the accuracy of the global model on all tasks and 2) affecting the performance of the global model on specific tasks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. CLASSIFICATION ACCORDING TO THE INTENTION OF THE ATTACKERS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The idea of the attack in this setup is that if the AD between the source class c S and the target class c T is small, the scale of the malicious updates required in the adversary's local model is also small.Then the attack has a greater chance of surviving the aggregation of overwhelming legitimate updates, resulting in a more significant effect.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“To avoid detection, Virat et al. [23] also state that model updates should not deviate too far from benign updates to avoid detection.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [23] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In a model poisoning attack, the attacker uses a more direct way to manipulate the client's local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, in the non-IID setting, both the attacker and the server faced significant challenges but affected the server even more.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In a poisoning attack, the data distribution can not only affect the effectiveness of the attack but also determine the success or failure of the attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach increases the risk of being detected by the server, but the right choice of amplification factor can effectively improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The semi-targeted attack can improve the performance of the attack by fixing the source class and choosing the optimal target class.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For example, data poisoning attacks are more intuitive, and attackers can implement label flipping according to their intentions.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since untargeted poisoning attacks affect all tasks, they are more easily detected by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, targeted poisoning attacks are highly stealthy and more challenging to detect, especially when the data is non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, many attackers avoid detection by bounding the norm of their malicious gradients, the range of which is strongly influenced by the data distribution.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
In the paper
“Although Thien et al. [80] propose that it can mix a small number of malicious updates with numerous benign updates to avoid server detection, the server can still identify the attack by comparing historical updates from the client.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [80] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“It is worth noting that if the server can access the client's local model directly, there is a great risk of privacy leakage because the server may recover the original training data from the client's gradients [16], [17], [18], [19].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [16] Fu, Label inference attacks against vertical federated learning
- Not checked yetcites [17] Geiping, Inverting gradients—How easy is it to break privacy in federated learning?
- Not checked yetcites [18] source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This assumption is always valid because benign models and malicious models are inherently different from each other.”
§ Poisoning Attacks in Federated Learning: A Survey > A. MODEL ANALYSIS
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
In the paper
“For example, Clement et al. [53] found that the gradients uploaded by honest clients were more diverse than those uploaded by malicious clients.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [53] Fung, 2018, Mitigating sybils in federated learning poisoning, arXiv:1808.04866
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The experimental results show that both LDP and CDP are effective against poisoning attacks, and CDP is more effective than LDP against poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DIFFERENTIAL PRIVACY
What the sources say
- Not checked yetcites [66] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“In a typical gradient clipping approach, we can set a threshold for the model parameters and discard all parameters that exceed the threshold [29], [65].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) GRADIENT CLIPPING
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [65] Panda, SparseFed: Mitigating model poisoning attacks in federated learning with sparsification
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“BRA is a passive defense strategy that mitigates the damage of poisoning attacks by changing the aggregation method of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > B. BYZANTINE ROBUST AGGREGATION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Therefore, many FL frameworks use secure aggregation [81], [82], [83], [84] algorithms in the aggregation process, at which point most of the poisoning attack defense methods mentioned above will be invalid.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [81] source
- Not checked yetcites [82] Zhang, BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning
- Not checked yetcites [83] Bhowmick, 2018, Protection against reconstruction and its applications in private federated learning, arXiv:1812.00984
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The methods mentioned above for testing global/local models require the server to collect a test set, and the quality of this test set dramatically affects the effectiveness of the defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PERFORMANCE EVALUATION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Poisoning attacks are executed through malicious models, so an intuitive defense strategy is to analyze the model.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among the model analysis methods, we found that in addition to the direct analysis of the global model that supports secure aggregation, the analysis of the encrypted local model can defend against poisoning attacks and protect clients' data privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, directly verifying the client's local data is not always allowed, but introducing a trusted third party can solve this problem.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Finally, differential privacy is a secure aggregation strategy that can also resist poisoning attacks, but its biggest problem is that it reduces the accuracy of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Although trusted third parties are difficult to guarantee in real-world settings, this approach also provides lessons for subsequent research.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“One of the most remarkable features of federated learning is that it protects the data privacy of the clients involved in training.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“While these efforts follow the fundamental principle that the client's original data is not released to the public, the intermediate data in federated learning may cause privacy leaks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Florian et al. [88] pointed out that an attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [88] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, many efforts to defend against poisoning attacks will likely lead to client data privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach also cannot cope with data poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with the latter is that current research is based on the predictive accuracy of the global model on the validation dataset to determine whether an attack has been poisoned, and targeted poisoning attacks may evade this defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“However, some researchers [68] have proposed an iterative median approximation method that can approximate the median of all models without accessing the local model and thus can also support the secure aggregation strategy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
What the sources say
- Not checked yetcites [68] Pillutla, 2019, Robust aggregation for federated learning, arXiv:1912.13445
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with this approach is that it requires thorough training of an SVM on poisoned and non-poisoned datasets that are relatively similar to the client's data source and thus may not apply to scenarios where the data is Non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Research on implementing poisoning attacks and defending against poisoning attacks has made significant progress in recent years, but some issues still need further research.”
§ Poisoning Attacks in Federated Learning: A Survey > VI. CHALLENGES AND FUTURE DIRECTIONS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“First, each training round of FL selects some clients randomly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Furthermore, in the approach proposed by Henger et al. [32], the malicious client first uses a gradient inversionbased inference attack to learn approximations of other client data distributions from model updates received by the server.Then, the attacker uses his local data and the learned distributions to construct a simulator of the FL environment.Finally, the attacker uses reinforcement learn”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
What the sources say
- Not checked yetcites [32] Li, Learning to attack federated learning: A model-based reinforcement learning attack framework
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, frequent attacks increase the risk of exposure.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the existing attacks are constantly enriched with increasingly sophisticated attack methods being proposed.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have already solved the feasibility problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In poisoning attacks, multiple attacks may be combined (e.g., with privacy inference attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Once an attacker knows these defense strategies exist, it is easy to bypass them.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, many researchers assume that the adversary in their experiments undisguisedly performs the attack.Thus, they are vulnerable to more sophisticated poisoning attacks, despite the positive results they have achieved in their experiments.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Another problem with existing defense strategies is that they are primarily targeted at specific attacks.They can only defend against known attack methods.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, the defense against poisoning attacks, although well studied, still has many issues to be addressed.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
None of the sources cited for this claim have been checked yet.
In the paper
“In model replacement, the attacker attempts to replace the global model w (k+1) 0 with the malicious model w k+1 0 .”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
- Not checked yetcites [31] Xie, DBA: Distributed backdoor attacks against federated learning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One existing trend is to design defense strategies against poisoning attacks in the cryptographic mode with existing privacy-preserving cryptographic algorithms.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, the challenge for defenders is much tougher, as effectively preventing or detecting poisoning attacks remains an open problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a result, they may be more concerned with the trade-off between efficiency and stealth.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have used methods such as reinforcement learning to improve the efficiency of their attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, there are relatively few studies in this direction, mainly focusing on homomorphic encryption and differential privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Many existing studies assume the server has access to the client's local model, which poses a significant risk of privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Worse, these defense strategies cannot be directly integrated with existing privacy protection strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“During the federated learning training process, an attacker can execute a poisoning attack by modifying the client's local data or directly modifying the local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper relies on this without support.
In federated learning, it is impossible to guarantee that all clients are reliable.
“Since many clients are involved in training in federation learning, it is impossible to guarantee that all clients are reliable.”
The paper relies on this without support.
Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.
“Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.”
The authors state this as an assumption.
There are significant differences between poisoned and benign models, and there is some way to distinguish these differences.
“Model analysis methods are based on the assumption that there are significant differences between the poisoned and benign models and that there is some way to distinguish these differences.”
The paper relies on this without support.
Neural networks have catastrophic forgetting properties and may quickly forget previously acquired concepts.
“Moreover, neural networks have catastrophic forgetting properties, where neural networks may quickly forget previously acquired concepts.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“But further research reveals that FL still faces privacy and security risks, including privacy leakage [87][88][89] and poisoning attacks [169,170].”
From Federated learning for medical image analysis: A survey (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Poisoning Attacks in Federated Learning: A Survey > 2) REMOVE EXTREME VALUES
“In trimmed mean and median, for each parameter p in the model, the server uses the median value of each local model to update the global model [85].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) REMOVE EXTREME VALUES
“In trimmed mean, for each parameter p, the largest b parameters and the smallest b parameters are removed from all m local models, and the mean of the remaining m -2b parameters is used to update the global model.”
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Federated Learning in Mobile Edge Networks: A Comprehensive Survey
Lim, W. Y. B., Luong, N. C., Hoang, D. T., Jiao, Y., Liang, Y.-C., Yang, Q., Niyato, D., & Miao, C. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2986024 · Cited by 2,565
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
(2017) · neural information processing systems · Cited by 1,413
Deep learning-enabled medical computer vision
Esteva, A., Chou, K., Yeung, S., Naik, N., Madani, A., Mottaghi, A., Liu, Y., Topol, E., Dean, J., & Socher, R. (2021) · npj Digital Medicine · doi:10.1038/s41746-020-00376-2 · Cited by 1,406
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
Yin, D., Chen, Y., Ramchandran, K., & Bartlett, P. (2018) · arXiv · doi:10.48550/arxiv.1803.01498 · Cited by 1,130
Robust Aggregation for Federated Learning
Pillutla, K., Kakade, S. M., & Harchaoui, Z. (2022) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2022.3153135 · Cited by 1,068
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999
Health Insurance Portability and Accountability Act
(2007) · Sage eBooks · doi:10.4135/9781412952644.n199 · Cited by 971
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Inverting Gradients -- How easy is it to break privacy in federated learning?Preprint
Geiping, J., Bauermeister, H., Dröge, H., & Moeller, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.14053 · Cited by 848
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
iDLG: Improved Deep Leakage from GradientsPreprint
Zhao, B., Mopuri, K. R., & Bilen, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.02610 · Cited by 800
Abdulrahman, S., Tout, H., Ould-Slimane, H., Mourad, A., Talhi, C., & Guizani, M. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3030072 · Cited by 796
The use of machine learning algorithms in recommender systems: a systematic review
Portugal, I., Alencar, P., & Cowan, D. (2018) · Expert Systems with Applications · doi:10.1016/j.eswa.2017.12.020 · Cited by 743 · cited 1×
“Artificial intelligence technologies are widely used in various fields, such as computer vision [1], natural language processing [2], and recommendation systems [3], which have significantly changed our lives.”
BackgroundAnalyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703
The Hidden Vulnerability of Distributed Learning in Byzantium
Mhamdi, E. M. E., Guerraoui, R., & Rouault, S. (2018) · arXiv · doi:10.48550/arxiv.1802.07927 · Cited by 648
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626
Reliable Federated Learning for Mobile Networks
Kang, J., Xiong, Z., Niyato, D., Zou, Y., Zhang, Y., & Guizani, M. (2020) · IEEE Wireless Communications · doi:10.1109/mwc.001.1900119 · Cited by 617
Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning
Shejwalkar, V., & Houmansadr, A. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24498 · Cited by 615
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548
BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning
Zhang, C., Li, S., XIA, J., Wang, W., Yan, F., & Liu, Y. (2020) · Rare & Special e-Zone (The Hong Kong University of Science and Technology) · Cited by 522
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 472
Lyu, L., Yu, H., Zhao, J., & Yang, Q. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_1 · Cited by 444
Protection Against Reconstruction and Its Applications in Private Federated LearningPreprint
Bhowmick, A., Duchi, J. C., Freudiger, J., Kapoor, G., & Rogers, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.00984 · Cited by 420
From distributed machine learning to federated learning: a survey
Liu, J., Huang, J., Zhou, Y., Li, X., Ji, S., Xiong, H., & Dou, D. (2022) · Knowledge and Information Systems · doi:10.1007/s10115-022-01664-x · Cited by 397
Federated Learning: Opportunities and ChallengesPreprint
Mammen, P. M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.05428 · Cited by 388
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371
Self-citationZhang, Z., Cao, X., Jia, J., & Gong, N. Z. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539231 · Cited by 359
TiFL: A Tier-based Federated Learning System
Chai, Z., Ali, A. Z. E., Zawad, S., Truex, S., Anwar, A., Baracaldo, N., Zhou, Y., Ludwig, H., Yan, F., & Cheng, Y. (2020) · ACM International Symposium on High-Performance Parallel and Distributed Computing (HPDC) · doi:10.1145/3369583.3392686 · Cited by 352
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351 · cited 6×
“…malicious model detection algorithm, which considers that statistical methods (such as euclidean distance [40], [52], cosine similarity [37], [38], k-means [46], Pearson correlation coefficient [49], [51], etc.) can be used to measure the differences between benign and malicious models [36], [80].”
MethodInfluentialCan You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348
Learning to Detect Malicious Clients for Robust Federated LearningPreprint
Li, S., Cheng, Y. J., Wang, W., Liu, Y., & Chen, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.00211 · Cited by 313
Data Poisoning Attacks on Federated Machine Learning
Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3128646 · Cited by 310
Shejwalkar, V., Houmansadr, A., Kairouz, P., & Ramage, D. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833647 · Cited by 292
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291
A Secure Federated Learning Framework for 5G Networks
Liu, Y., Peng, J., Kang, J., Iliyasu, A. M., Niyato, D., & El-Latif, A. A. A. (2020) · IEEE Wireless Communications · doi:10.1109/mwc.01.1900525 · Cited by 290
Understanding Distributed Poisoning Attack in Federated Learning
Cao, D., Chang, S., Lin, Z., Liu, G., & Sun, D. (2019) · 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads47876.2019.00042 · Cited by 285
Oort: Efficient Federated Learning via Guided Participant SelectionPreprint
Lai, F., Zhu, X., Madhyastha, H. V., & Chowdhury, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.06081 · Cited by 262
Vulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248
Preserving Data Privacy via Federated Learning: Challenges and Solutions
Li, Z., Sharma, V., & P. Mohanty, S. (2020) · IEEE Consumer Electronics Magazine · doi:10.1109/mce.2019.2959108 · Cited by 226
Health Insurance Portability and Accountability Act of 1996
Hing, E., & Jensen, G. A. (1999) · Medical Care · doi:10.1097/00005650-199907000-00009 · Cited by 224
Threats to federated learning A survey
Lyu, L., Yu, H., & Yang, Q. (2020) · arXiv · doi:10.48550/arxiv.2003.02133 · Cited by 221
BaFFLe: Backdoor Detection via Feedback-based Federated Learning
Andreina, S., Marson, G. A., Mollering, H., & Karame, G. (2021) · 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs51616.2021.00086 · Cited by 205
MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clients
Cao, X., & Gong, N. Z. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw56347.2022.00383 · Cited by 205
Poisoning Attacks on Federated Learning-based IoT Intrusion Detection System
Nguyen, T. D., Rieger, P., Miettinen, M., & Sadeghi, A.-R. (2020) · Proceedings 2020 Workshop on Decentralized IoT Systems and Security · doi:10.14722/diss.2020.23003 · Cited by 200
A training-integrity privacy-preserving federated learning scheme with trusted execution environment
Chen, Y., Luo, F., Li, T., Xiang, T., Liu, Z., & Li, J. (2020) · Information Sciences · doi:10.1016/j.ins.2020.02.037 · Cited by 194
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188
CONTRA: Defending Against Poisoning Attacks in Federated Learning
Awan, S., Luo, B., & Li, F. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_22 · Cited by 182
Privacy and Security in Federated Learning: A Survey
Gosselin, R., Vieu, L., Loukil, F., & Benoît, A. (2022) · Applied Sciences · doi:10.3390/app12199901 · Cited by 178
Deep Model Poisoning Attack on Federated Learning
Zhou, X., Xu, M., Wu, Y., & Zheng, N. (2021) · Future Internet · doi:10.3390/fi13030073 · Cited by 170
Data Poisoning against Differentially-Private Learners: Attacks and Defenses
Ma, Y., Zhu, X., & Hsu, J. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/657 · Cited by 158
LoMar: A Local Defense Against Poisoning Attack on Federated Learning
Li, X., Qu, Z., Zhao, S., Tang, B., Lu, Z., & Liu, Y. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3135422 · Cited by 158
Li, D., Wong, W. E., Wang, W., Yao, Y., & Chau, M. (2021) · International Conference on Dependable Systems and Their Applications (DSA) · doi:10.1109/dsa52907.2021.00081 · Cited by 115
FLCert: Provably Secure Federated Learning Against Poisoning Attacks
Cao, X., Zhang, Z., Jia, J., & Gong, N. Z. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3212174 · Cited by 92
FedRecAttack: Model Poisoning Attack to Federated Recommendation
Rong, D., Ye, S., Zhao, R., Yuen, H. N., Chen, J., & He, Q. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00243 · Cited by 78
Self-citationPDGAN: A Novel Poisoning Defense Method in Federated Learning Using Generative Adversarial Network
Zhao, Y., Chen, J., Zhang, J., Wu, D., Teng, J., & Yu, S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-38991-8_39 · Cited by 75
Self-citationZhao, Y., Chen, J., Zhang, J., Wu, D., Blumenstein, M., & Yu, S. (2020) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.5906 · Cited by 64
Self-citationBiscotti: A Ledger for Private and Secure Peer-to-Peer Machine Learning
Shayan, M., Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1811.09904 · Cited by 61
Federated Anomaly Analytics for Local Model Poisoning Attack
Shi, S., Hu, C., Wang, D., Zhu, Y., & Han, Z. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3118347 · Cited by 59
Liu, W., Lin, H., Wang, X., Hu, J. W., Kaddoum, G., Piran, M. J., & Alamri, A. M. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3081606 · Cited by 58
SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with SparsificationPreprint
Panda, A., Mahloujifar, S., Bhagoji, A. N., Chakraborty, S., & Mittal, P. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.06274 · Cited by 54
RobustFL: Robust Federated Learning Against Poisoning Attacks in Industrial IoT Systems
Zhang, J., Ge, C., Hu, F., & Chen, B. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3132954 · Cited by 52
Pocket diagnosis: Secure federated learning against poisoning attack in the cloud
Ma, Z., Ma, J., Miao, Y., Liu, X., Choo, K.-K. R., & Deng, R. H. (2022) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2021.3090771 · Cited by 50
ADFL: A Poisoning Attack Defense Framework for Horizontal Federated Learning
Guo, J., Li, H., Huang, F., Liu, Z., Peng, Y., Li, X., Ma, J., Menon, V. G., & Igorevich, K. K. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3156645 · Cited by 49
Self-citationRomoa: Robust Model Aggregation for the Resistance of Federated Learning to Model Poisoning Attacks
Mao, Y., Yuan, X., Zhao, X., & Zhong, S. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_23 · Cited by 48
Mitigating Data Poisoning Attacks On a Federated Learning-Edge Computing Network
Doku, R., & Rawat, D. B. (2021) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc49032.2021.9369581 · Cited by 46
DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning
Hossain, M. T., Islam, S., Badsha, S., & Shen, H. (2021) · 2021 17th International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn53354.2021.00038 · Cited by 44
Toward Smart Security Enhancement of Federated Learning Networks
Tan, J., Liang, Y.-C., Luong, N. C., & Niyato, D. (2021) · IEEE Network · doi:10.1109/mnet.011.2000379 · Cited by 42
Data Poisoning in Sequential and Parallel Federated Learning
Nuding, F., & Mayer, R. (2022) · Proceedings of the 2022 ACM on International Workshop on Security and Privacy Analytics · doi:10.1145/3510548.3519372 · Cited by 42
Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Survey
Wang, Z., Kang, Q., Zhang, X., & Hu, Q. (2022) · 2022 IEEE Wireless Communications and Networking Conference (WCNC) · doi:10.1109/wcnc51071.2022.9771619 · Cited by 41
Model Poisoning Defense on Federated Learning: A Validation Based Approach
Wang, Y., Zhu, T., Chang, W., Shen, S., & Ren, W. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65745-1_12 · Cited by 37
Federated Learning with Gaussian Differential Privacy
Chuan-xin, Z., Sun, Y., & Degang, W. (2020) · International Conference on Robotics, Intelligent Control and Artificial Intelligence (RICAI) · doi:10.1145/3438872.3439097 · Cited by 36
FLTrust: Byzantine-robust Federated Learning via Trust BootstrappingPreprint
Cao, X., Fang, M., Liu, J., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.13995 · Cited by 34
Local and Central Differential Privacy for Robustness and Privacy in Federated LearningPreprint
Naseri, M., Hayes, J., & Cristofaro, E. D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.03561 · Cited by 34
Mitigating Poisoning Attack in Federated Learning
Uprety, A., & Rawat, D. B. (2021) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci50451.2021.9659839 · Cited by 31
Semi-Targeted Model Poisoning Attack on Federated Learning via Backward Error Analysis
Sun, Y., Ochiai, H., & Sakuma, J. (2022) · 2022 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9891990 · Cited by 28
Privacy-Preserving in Defending against Membership Inference Attacks
Ying, Z., Zhang, Y., & Liu, X. (2020) · doi:10.1145/3411501.3419428 · Cited by 27
Defending Poisoning Attacks in Federated Learning via Adversarial Training Method
Zhang, J., Wu, D., Liu, C., & Chen, B. (2020) · Communications in computer and information science · doi:10.1007/978-981-15-9739-8_7 · Cited by 26
Moat: Model Agnostic Defense against Targeted Poisoning Attacks in Federated Learning
Manna, A., Kasyap, H., & Tripathy, S. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-86890-1_3 · Cited by 22
Untargeted Poisoning Attack Detection in Federated Learning via Behavior AttestationPreprint
Mallah, R. A., Lopez, D. L., Badu-Marfo, G., & Farooq, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.10904 · Cited by 20
Perception Poisoning Attacks in Federated Learning
Chow, K.-H., & Liu, L. (2021) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tpsisa52974.2021.00017 · Cited by 13
Ji, Y., & Gao, S. (2023) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.giscience.2023.43 · Cited by 10
Shejwalkar, V., Houmansadr, A., Kairouz, P., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.10241 · Cited by 9
Research works printed but not linked: 2
- Fu, Label inference attacks against vertical federated learning, 1
- Li, Learning to attack federated learning: A model-based reinforcement learning attack framework, 1
Cited by
Sorted by citations
Federated learning for medical image analysis: A survey
Guan, H., Yap, P.-T., Bozoki, A., & Liu, M. (2024) · Pattern Recognition · doi:10.1016/j.patcog.2024.110424 · Cited by 518
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Ferrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
An overview of implementing security and privacy in federated learning
Hu, K., Gong, S., Zhang, Q., Seng, C., Xia, M., & Jiang, S. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10846-8 · Cited by 175
FLAD: Adaptive Federated Learning for DDoS attack detection
Doriguzzi-Corin, R., & Siracusa, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103597 · Cited by 152
Metadata
- Authors
- Xia, G., Chen, J., Yu, C., & Ma, J.
- Affiliations
- National University of Defense Technology (CN)
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 10708-10722
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4317795078
- Cited by
- 212
- References
- 87
- Citations by year
- 2026: 78 · 2025: 76 · 2024: 47 · 2023: 11
- FWCI
- 19.90
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- federated learning, poisoning attacks, attack classification, defense strategy, privacy preservation, malicious clients
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
