The DOI matches its Crossref record; 92 of the 92 references it cites were found in a registry or an index; none of the 62 sources its claims cite is checked for support yet.
Poisoning Attacks in Federated Learning: A Survey
Open accessAbstract
Federated learning faces many security and privacy issues. Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models. Defending against poisoning attacks is a very urgent and challenging task. However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort. This survey provides an in-depth and up-to-date overview of poisoning attacks and corresponding defense strategies in federated learning. We first classify the poisoning attacks according to their methods and targets. Next, we analyze the differences and connections between the various categories of poisoning attacks. In addition, we classify the defense strategies against poisoning attacks in federated learning into three categories and analyze their advantages and disadvantages. Finally, we discuss the privacy protection problem in poisoning attacks and their countermeasure and propose potential research directions from the perspective of attack and defense, respectively.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This survey reviews poisoning attacks in federated learning and classifies them by attack method and attacker intent, while also classifying defenses into model analysis, Byzantine robust aggregation, and verification-based approaches. It argues that privacy protection and secure aggregation are often overlooked in poisoning defense research and proposes future directions from both attack and defense perspectives.
Key findings
- Poisoning attacks are classified by method into data poisoning attacks (clean-label and dirty-label) and model poisoning attacks, and by attacker intention into targeted, semi-targeted, and untargeted attacks.
- Model poisoning attacks tend to work better in practice because they directly modify local model parameters; the survey cites Eugene et al.’s experimental result that controlling 1% of clients for model poisoning can achieve the same or better effect as controlling 20% of clients for data poisoning.
- Defense strategies are grouped into three categories: model analysis, Byzantine robust aggregation (gradient clipping, removing extreme values, differential privacy), and verification-based methods; the survey evaluates their strengths, weaknesses, and support for secure aggregation.
- Non-IID data makes defense harder because local models are inherently different, and many defenses that require server access to individual local models are incompatible with secure aggregation, though homomorphic encryption and differential privacy offer partial paths.
Methods
- Design: a survey that reviews existing poisoning attack methods and defense strategies in federated learning, with a stated focus on privacy protection and secure aggregation.
- Data/sample: published papers from recent years, including representative poisoning attack and defense works summarized in Tables 2 and 3; no primary dataset or experimental sample is collected.
- Main analysis: qualitative taxonomy and comparative analysis of attack categories, defense categories, data distribution assumptions, stealthiness, persistence, and secure-aggregation support.
Limitations
- Paper-stated: most existing defense strategies are static, targeted at specific known attacks, and assume limited adversary capabilities; defending against poisoning attacks while protecting privacy remains an open problem, and non-IID data makes server-side defense more difficult.
- Paper-stated: many existing studies assume the server can access the client’s local model, which risks privacy leakage and prevents direct integration with secure aggregation.
- Evident from the text: the survey does not report a systematic literature search protocol, quantitative meta-analysis, or primary experiments; its conclusions are based on selected representative works and qualitative synthesis.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
0 of 62 cited sources checked · 0 supported · 0 flagged
In the paper
“Yuwei et al. [24] proposed the attack distance-aware attack (ADA) to enhance poisoning attacks by finding optimal target classes in the feature space.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [24] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“if an attacker manipulates some of these clients to modify the models before uploading them to the central server by directly (for example, altering the model parameters) or indirectly (such as by flipping the label of the training data) way, it will influence the direction of the global model update and finally cause the non-convergence of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesThe paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Attackers can implement a clean label attack by modifying the samples in the training set and, for example, adding noise to the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“From the above description, we can find that the direction of the global model update depends on the directions of the local models uploaded by each client.”
§ Poisoning Attacks in Federated Learning: A Survey > III. FEDERATED LEARNING
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIn the paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“For instance, the attacker can add random noise to the local model to affect the convergence of the global model [34], [35].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“Moreover, the attacker can also manipulate the update of the global model using the model replacement method with w k+1 0 [30]:”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“For example, the experimental results of Eugene et al. [30] showed that in a given scenario, an attacker controlling 1% of clients to perform a model poisoning attack could achieve the same (or even better) effect as controlling 20% of clients to perform a data poisoning attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“Second, model poisoning attacks often multiply the local gradient by a factor before uploading it to the server to amplify the impact of the malicious gradient [28], [29], [30], [31].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“A widely used strategy is alternating minimization [28], [33].”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [33] source
Strength:boosted· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“First, a server is more likely to detect an attack when the data is IID.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, IID data facilitates the execution of data poisoning attacks (especially clean label attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In general, the execution of poisoning attacks in the IID setting is more challenging.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“The alternating minimization approach decouples the poisoning attack target from the stealthiness target.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the increased number of attacks increases the risk of being detected.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The difference between malicious and benign model parameters can identify malicious models.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach relies heavily on humandiscovered patterns to defend against poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One of the simplest methods to solve this problem is to perform poisoning attacks continuously.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“The first one is a similarity-based malicious model detection algorithm, which considers that statistical methods (such as euclidean distance [40], [52], cosine similarity [37], [38], k-means [46], Pearson correlation coefficient [49], [51], etc.) can be used to measure the differences between benign and malicious models [36], [80].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“An attacker can train a malicious model and then use measures such as bounding the norm of the malicious gradient to provide greater stealth.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“This is because when the data is Non-IID it can bias the model more, especially when trained with SGD [79].”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
What the sources say
- Not checked yetcites [79] source
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIn the paper
“Typically, non-IID data distribution provides a good cover for the attack [78].”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
What the sources say
- Not checked yetcites [78] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with the above approach is that it assumpts that the attacker is in the minority of all clients.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIn the paper
“Interestingly, at the same time, some attackers exploit the differential privacy mechanism in FL to perform stealthy and persistent model poisoning attacks by adding specific fake noise [34].”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DIFFERENTIAL PRIVACY
What the sources say
- Not checked yetcites [34] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“To solve this problem, [38], [49], [51] used homomorphic encryption to evaluate the local model securely.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, this approach may compromise the user's privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The drawback of this approach is that it cannot cope with attackers' training models using fake or tampered data (data poisoning attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We can also remove extreme values from the model parameters to defend against the poisoning attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) REMOVE EXTREME VALUES
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest challenge of the former is that the server cannot access individual client models in a secure aggregation setting.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Access to the client's local model is also usually required in the extreme value removal strategy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:hedged· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesNone of the sources cited for this claim have been checked yet.
In the paper
“First, the attacker can learn the characteristics of benign clients, such as controlling the Euclidean distance between the malicious and benign models [28] or controlling the poisoning data rate (PDR) [80] to reduce the risk of detection by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [28] Bhagoji, Analyzing federated learning through an adversarial lens
- Not checked yetcites [80] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In a verification-based approach, the support for secure aggregation depends on its verification policy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In BRA, gradient clipping cannot support secure aggregation because it requires operations on individual gradients and can only be done by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The stealthiness of poisoning attacks can be improved in two ways.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these methods often reduce the attack's efficiency, requiring the attacker to make a trade-off between stealth and efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The attacker cannot guarantee that the clients under his control will be selected to participate in the training every time, especially if many clients are participating in the training.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIn the paper
“For example, an attacker can use GAN to reconstruct other clients' datasets so that the attacker can execute the attack by generating fake data, even if the attacker lacks a specific class of sample data [26].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
What the sources say
- Not checked yetcites [26] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Exploiting the data privacy of other clients can help attackers improve the efficiency of poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Most current defense strategies limit the attacker's capabilities.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Most existing defense strategies are static, and cannot be dynamically adjusted to the attackers' attack methods.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In general, defenses against poisoning attacks are at a relative disadvantage.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesA conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For example, many studies assume that the attacker only uses label-flipping attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passes
- Probably not a substantial claim. 43
- It may state two separate claims as one. 39
- The quote only partly states this claim. 1
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our observations show that poisoning attacks are becoming more effective, stealthy, and powerful.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the data poisoning attack, an attacker cannot directly modify the local model parameters and can only perform the poisoning attack by falsifying or tampering with the training data.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA POISONING ATTACK
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, federated learning is considered effective in protecting user privacy during training.”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these methods all assume that the data distribution is IID.Once the training data is non-IID, the attacker cannot execute the attack in the above way.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
In the paper
“Virat et al. [23] argued that there are two kinds of label-flipping strategies, namely static label flipping (SLF) and dynamic label flipping (DLF).”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
What the sources say
- Not checked yetcites [23] source
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, SLF is inefficient, and some researchers have proposed DLF schemes to improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort.”
- Also stated in: § I. INTRODUCTION · plain
“While several researchers have discussed poisoning attacks in their surveys, few have analyzed the privacy issues that may arise from poisoning attacks and poisoning attack defense strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence.
- Also stated in: § I. INTRODUCTION · plain
In the paper
“To address this problem, Google developed a distributed machine learning framework called federated learning (FL) in 2016, which allows each client to jointly train a model without sharing data [6].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
- Not checked yetcites [6] McMahan, Communication-efficient learning of deep networks from decentralized data
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
None of the sources cited for this claim have been checked yet.
In the paper
“Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models.”
§ Poisoning Attacks in Federated Learning: A Survey > Abstract
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“However, further research shows that federated learning also faces many security and privacy risks [7], [8], [9], [10], such as poisoning attacks [11], [12], [13], [14], [15] and privacy leakage [16], [17], [18], [19], [20], [21].”
§ Poisoning Attacks in Federated Learning: A Survey > I. INTRODUCTION
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
In the paper
“To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”
- Also stated in: § a: CLEAN LABEL ATTACK · plain
“With this approach, an attacker can execute a poisoning attack without prior knowledge.”
§ Poisoning Attacks in Federated Learning: A Survey > a: CLEAN LABEL ATTACK
What the sources say
- Not checked yetcites [26] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
- Also stated in: § a: CLEAN LABEL ATTACK · plain
None of the sources cited for this claim have been checked yet.
In the paper
“The principle of this approach is that only a tiny fraction of neurons changed during the training phase, while the vast majority of neurons were close to zero.Those unchanged neurons are called the redundant space of neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacker's goals of implementing a poisoning attack can be classified into two categories: 1) reducing the accuracy of the global model on all tasks and 2) affecting the performance of the global model on specific tasks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. CLASSIFICATION ACCORDING TO THE INTENTION OF THE ATTACKERS
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The idea of the attack in this setup is that if the AD between the source class c S and the target class c T is small, the scale of the malicious updates required in the adversary's local model is also small.Then the attack has a greater chance of surviving the aggregation of overwhelming legitimate updates, resulting in a more significant effect.”
§ Poisoning Attacks in Federated Learning: A Survey > b: DIRTY LABEL ATTACK
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“To avoid detection, Virat et al. [23] also state that model updates should not deviate too far from benign updates to avoid detection.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [23] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In a model poisoning attack, the attacker uses a more direct way to manipulate the client's local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, in the non-IID setting, both the attacker and the server faced significant challenges but affected the server even more.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In a poisoning attack, the data distribution can not only affect the effectiveness of the attack but also determine the success or failure of the attack.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach increases the risk of being detected by the server, but the right choice of amplification factor can effectively improve the attack's efficiency.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The semi-targeted attack can improve the performance of the attack by fixing the source class and choosing the optimal target class.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For example, data poisoning attacks are more intuitive, and attackers can implement label flipping according to their intentions.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since untargeted poisoning attacks affect all tasks, they are more easily detected by the server.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, targeted poisoning attacks are highly stealthy and more challenging to detect, especially when the data is non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
Strength:plain· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) DATA AND MODEL POISONING ATTACK
What the sources say
- Not checked yetcites [33] source
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, many attackers avoid detection by bounding the norm of their malicious gradients, the range of which is strongly influenced by the data distribution.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DATA DISTRIBUTION AND STEALTHINESS STRATEGY
Strength:boosted· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearIt may state two separate claims as one.
In the paper
“Although Thien et al. [80] propose that it can mix a small number of malicious updates with numerous benign updates to avoid server detection, the server can still identify the attack by comparing historical updates from the client.”
§ Poisoning Attacks in Federated Learning: A Survey > 4) PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [80] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“It is worth noting that if the server can access the client's local model directly, there is a great risk of privacy leakage because the server may recover the original training data from the client's gradients [16], [17], [18], [19].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [16] Fu, Label inference attacks against vertical federated learning
- Not checked yetcites [17] Geiping, Inverting gradients—How easy is it to break privacy in federated learning?
- Not checked yetcites [18] source
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This assumption is always valid because benign models and malicious models are inherently different from each other.”
§ Poisoning Attacks in Federated Learning: A Survey > A. MODEL ANALYSIS
Load-bearingStrength:boosted· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
In the paper
“For example, Clement et al. [53] found that the gradients uploaded by honest clients were more diverse than those uploaded by malicious clients.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [53] Fung, 2018, Mitigating sybils in federated learning poisoning, arXiv:1808.04866
Strength:plain· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The experimental results show that both LDP and CDP are effective against poisoning attacks, and CDP is more effective than LDP against poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > 3) DIFFERENTIAL PRIVACY
What the sources say
- Not checked yetcites [66] source
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“In a typical gradient clipping approach, we can set a threshold for the model parameters and discard all parameters that exceed the threshold [29], [65].”
§ Poisoning Attacks in Federated Learning: A Survey > 1) GRADIENT CLIPPING
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [65] Panda, SparseFed: Mitigating model poisoning attacks in federated learning with sparsification
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“BRA is a passive defense strategy that mitigates the damage of poisoning attacks by changing the aggregation method of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > B. BYZANTINE ROBUST AGGREGATION
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Therefore, many FL frameworks use secure aggregation [81], [82], [83], [84] algorithms in the aggregation process, at which point most of the poisoning attack defense methods mentioned above will be invalid.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) SIMILARITY-BASED METHOD
What the sources say
- Not checked yetcites [81] source
- Not checked yetcites [82] Zhang, BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning
- Not checked yetcites [83] Bhowmick, 2018, Protection against reconstruction and its applications in private federated learning, arXiv:1812.00984
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The methods mentioned above for testing global/local models require the server to collect a test set, and the quality of this test set dramatically affects the effectiveness of the defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PERFORMANCE EVALUATION
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Poisoning attacks are executed through malicious models, so an intuitive defense strategy is to analyze the model.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among the model analysis methods, we found that in addition to the direct analysis of the global model that supports secure aggregation, the analysis of the encrypted local model can defend against poisoning attacks and protect clients' data privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In addition, directly verifying the client's local data is not always allowed, but introducing a trusted third party can solve this problem.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Finally, differential privacy is a secure aggregation strategy that can also resist poisoning attacks, but its biggest problem is that it reduces the accuracy of the global model.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Although trusted third parties are difficult to guarantee in real-world settings, this approach also provides lessons for subsequent research.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“One of the most remarkable features of federated learning is that it protects the data privacy of the clients involved in training.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“While these efforts follow the fundamental principle that the client's original data is not released to the public, the intermediate data in federated learning may cause privacy leaks.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“Florian et al. [88] pointed out that an attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
What the sources say
- Not checked yetcites [88] source
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, many efforts to defend against poisoning attacks will likely lead to client data privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
Strength:hedged· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach also cannot cope with data poisoning attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear? Based: unclearThe quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with the latter is that current research is based on the predictive accuracy of the global model on the validation dataset to determine whether an attack has been poisoned, and targeted poisoning attacks may evade this defense.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) MODEL ANALYSIS, BRA AND VERIFICATION-BASED METHOD
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
In the paper
“However, some researchers [68] have proposed an iterative median approximation method that can approximate the median of all models without accessing the local model and thus can also support the secure aggregation strategy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) SECURE AGGREGATION SUPPORT
What the sources say
- Not checked yetcites [68] Pillutla, 2019, Robust aggregation for federated learning, arXiv:1912.13445
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biggest problem with this approach is that it requires thorough training of an SVM on poisoned and non-poisoned datasets that are relatively similar to the client's data source and thus may not apply to scenarios where the data is Non-IID.”
§ Poisoning Attacks in Federated Learning: A Survey > C. VERIFICATION-BASED METHOD
Strength:hedged· not yet calibratedCausal:conditional· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Research on implementing poisoning attacks and defending against poisoning attacks has made significant progress in recent years, but some issues still need further research.”
§ Poisoning Attacks in Federated Learning: A Survey > VI. CHALLENGES AND FUTURE DIRECTIONS
Strength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“First, each training round of FL selects some clients randomly.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
In the paper
“Furthermore, in the approach proposed by Henger et al. [32], the malicious client first uses a gradient inversionbased inference attack to learn approximations of other client data distributions from model updates received by the server.Then, the attacker uses his local data and the learned distributions to construct a simulator of the FL environment.Finally, the attacker uses reinforcement learn”
§ Poisoning Attacks in Federated Learning: A Survey > 2) POISONING ATTACKS COMBINED WITH PRIVACY INFERENCE ATTACKS
What the sources say
- Not checked yetcites [32] Li, Learning to attack federated learning: A model-based reinforcement learning attack framework
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes? Load-bearing: unclear✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Second, frequent attacks increase the risk of exposure.”
§ Poisoning Attacks in Federated Learning: A Survey > 1) STEALTHINESS, EFFICIENCY, AND PERSISTENCE OF POISONING ATTACK
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the existing attacks are constantly enriched with increasingly sophisticated attack methods being proposed.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have already solved the feasibility problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In poisoning attacks, multiple attacks may be combined (e.g., with privacy inference attacks).”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Strength:hedged· not yet calibratedCausal:correlational· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Once an attacker knows these defense strategies exist, it is easy to bypass them.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, many researchers assume that the adversary in their experiments undisguisedly performs the attack.Thus, they are vulnerable to more sophisticated poisoning attacks, despite the positive results they have achieved in their experiments.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Another problem with existing defense strategies is that they are primarily targeted at specific attacks.They can only defend against known attack methods.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, the defense against poisoning attacks, although well studied, still has many issues to be addressed.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✗ Checkable: fails✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim. It may be too vague to check against evidence.
None of the sources cited for this claim have been checked yet.
In the paper
“In model replacement, the attacker attempts to replace the global model w (k+1) 0 with the malicious model w k+1 0 .”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
What the sources say
- Not checked yetcites [29] Sun, 2019, Can you really backdoor federated learning?, arXiv:1911.07963
- Not checked yetcites [30] Bagdasaryan, How to backdoor federated learning
- Not checked yetcites [31] Xie, DBA: Distributed backdoor attacks against federated learning
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“One existing trend is to design defense strategies against poisoning attacks in the cryptographic mode with existing privacy-preserving cryptographic algorithms.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the same time, the challenge for defenders is much tougher, as effectively preventing or detecting poisoning attacks remains an open problem.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesProbably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a result, they may be more concerned with the trade-off between efficiency and stealth.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Strength:hedged· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✓ Based: passesProbably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Attackers have used methods such as reinforcement learning to improve the efficiency of their attacks.”
§ Poisoning Attacks in Federated Learning: A Survey > B. STRATEGIES FOR DEFENDING AGAINST POISONING ATTACKS 1) MORE POWERFUL ADVERSARIES
Strength:plain· not yet calibratedCausal:direct· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, there are relatively few studies in this direction, mainly focusing on homomorphic encryption and differential privacy.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Strength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✗ Load-bearing: fails✗ Based: failsProbably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Many existing studies assume the server has access to the client's local model, which poses a significant risk of privacy leakage.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Worse, these defense strategies cannot be directly integrated with existing privacy protection strategies.”
§ Poisoning Attacks in Federated Learning: A Survey > 2) PRIVACY PROTECTION
Load-bearingStrength:plain· not yet calibratedTests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✗ Based: failsProbably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“During the federated learning training process, an attacker can execute a poisoning attack by modifying the client's local data or directly modifying the local model parameters.”
§ Poisoning Attacks in Federated Learning: A Survey > VII. SUMMARY
Tests✓ Asserted: passes✓ Checkable: passes✓ Load-bearing: passes✓ Based: passesIt may state two separate claims as one.
The paper relies on this without support.
In federated learning, it is impossible to guarantee that all clients are reliable.
“Since many clients are involved in training in federation learning, it is impossible to guarantee that all clients are reliable.”
The paper relies on this without support.
Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.
“Due to the catastrophic forgetting property of neural networks, an attacker's malicious updates may be forgotten during subsequent training.”
The authors state this as an assumption.
There are significant differences between poisoned and benign models, and there is some way to distinguish these differences.
“Model analysis methods are based on the assumption that there are significant differences between the poisoned and benign models and that there is some way to distinguish these differences.”
The paper relies on this without support.
Neural networks have catastrophic forgetting properties and may quickly forget previously acquired concepts.
“Moreover, neural networks have catastrophic forgetting properties, where neural networks may quickly forget previously acquired concepts.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“But further research reveals that FL still faces privacy and security risks, including privacy leakage [87][88][89] and poisoning attacks [169,170].”
From Federated learning for medical image analysis: A survey (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Trimmed mean is described as using the median
MinorThe first passage says trimmed mean uses the median value for each parameter. The later definition says it removes the largest and smallest values and uses the mean of those remaining.
“In trimmed mean and median, for each parameter p in the model, the server uses the median value of each local model to update the global model [85].”
“In trimmed mean, for each parameter p, the largest b parameters and the smallest b parameters are removed from all m local models, and the mean of the remaining m -2b parameters is used to update the global model.”
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Federated Learning in Mobile Edge Networks: A Comprehensive Survey
Lim, W. Y. B., Luong, N. C., Hoang, D. T., Jiao, Y., Liang, Y.-C., Yang, Q., Niyato, D., & Miao, C. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2986024 · Cited by 2,565
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
(2017) · neural information processing systems · Cited by 1,413
Flagged first, then by citations
Research works printed but not linked: 2
- Fu, Label inference attacks against vertical federated learning, 1
- Li, Learning to attack federated learning: A model-based reinforcement learning attack framework, 1
Cited by
Sorted by citations
Federated learning for medical image analysis: A survey
Guan, H., Yap, P.-T., Bozoki, A., & Liu, M. (2024) · Pattern Recognition · doi:10.1016/j.patcog.2024.110424 · Cited by 518
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Ferrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
An overview of implementing security and privacy in federated learning
Hu, K., Gong, S., Zhang, Q., Seng, C., Xia, M., & Jiang, S. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10846-8 · Cited by 175
FLAD: Adaptive Federated Learning for DDoS attack detection
Doriguzzi-Corin, R., & Siracusa, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103597 · Cited by 152
Metadata
- Authors
- Xia, G., Chen, J., Yu, C., & Ma, J.
- Affiliations
- National University of Defense Technology (CN)
- Venue
- IEEE Access
- Published
- 2023
- Volume
- 11
- Pages
- 10708-10722
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4317795078
- Cited by
- 212
- References
- 87
- Citations by year
- 2026: 78 · 2025: 76 · 2024: 47 · 2023: 11
- FWCI
- 19.90
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- federated learning, poisoning attacks, attack classification, defense strategy, privacy preservation, malicious clients
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
