CoChat
Sign Up
Cited by 152Privacy-Preserving Technologies in DataAdversarial Robustness in Machine LearningDigital Media Forensic Detection

Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey

Open access
Wan, Yichen, Qu, Youyang, Ni, Wei, Xiang, Yong, Gao, Longxiang, Hossain, Ekram·2024·IEEE Communications Surveys & Tutorials
DOI 10.1109/comst.2024.3361451
Open this paper in CoChat — free accountOpen PDF

Abstract

Due to the greatly improved capabilities of devices, massive data, and increasing concern about data privacy, Federated Learning (FL) has been increasingly considered for applications to wireless communication networks (WCNs). Wireless FL (WFL) is a distributed method of training a global deep learning model in which a large number of participants each train a local model on their training datasets and then upload the local model updates to a central server. However, in general, nonindependent and identically distributed (non-IID) data of WCNs raises concerns about robustness, as a malicious participant could potentially inject a “backdoor” into the global model by uploading poisoned data or models over WCN. This could cause the model to misclassify malicious inputs as a specific target class while behaving normally with benign inputs. This survey provides a comprehensive review of the latest backdoor attacks and defense mechanisms. It classifies them according to their targets (data poisoning or model poisoning), the attack phase (local data collection, training, or aggregation), and defense stage (local training, before aggregation, during aggregation, or after aggregation). The strengths and limitations of existing attack strategies and defense mechanisms are analyzed in detail. Comparisons of existing attack methods and defense designs are carried out, pointing to noteworthy findings, open challenges, and potential future research directions related to security and privacy of WFL.

AI snapshot

Written from the paper’s full text.

TL;DR

This survey reviews backdoor attacks and defenses in wireless federated learning (WFL), classifying attacks by target and phase and defenses by training stage. It reports that model poisoning attacks generally achieve higher backdoor accuracy and longer lifespan than data poisoning attacks, while defenses during or after aggregation perform best but often conflict with secure aggregation.

Key findings

  • On FMNIST with 100 participants and 10 selected per iteration, global model replacement [37] achieved the highest attack performance: BAR 79.86% and MAR 91.68%, versus local model replacement [32] at BAR 71.96%/MAR 88.91%, coordinated trigger [116] at BAR 57.06%/MAR 75.57%, and label flipping [29] at BAR 46.6%/MAR 65.03%; no-attack MAR was 92.92%.
  • Backdoor lifespan after 50 clean iterations: label flipping and coordinated trigger attacks dropped to 0% BAR, local model replacement retained 12.95% BAR, and global model replacement retained 49.51% BAR.
  • Defense performance on FMNIST: model stability [228] gave BAR 9.72%/MAR 78.17%; norm clipping and DP [124] gave BAR 6.59%/MAR 86.12%; model similarity [218] gave BAR 1.12%/MAR 89.53%; WFL with forgetting mechanism [224] gave BAR 0.24%/MAR 94.76%.
  • The survey concludes that data poisoning attacks are lower-cost but weaker and more easily diluted, while model poisoning attacks have higher attack success and stealthiness at higher cost; defenses during and after aggregation handle model poisoning well but often require historical information and are not compatible with SecAgg.

Methods

  • Comprehensive survey reviewing over 200 papers from 2015 to 2023, collected from IEEE Xplore, Elsevier, MDPI, and arXiv, with attacks classified by target (data vs. model poisoning) and phase (local data collection, local training, aggregation), and defenses classified by stage (local training, before aggregation, during aggregation, after aggregation).
  • Experimental comparison used the FMNIST dataset, 100 total participants, 10 randomly selected per training iteration, 100 training iterations, and compromised client rates of 0.1, 0.2, or 0.5 for four representative attacks; metrics were BAR and MAR, with lifespan tested over 50 additional clean iterations.
  • Defense comparison used FMNIST with representative methods from each defense phase, reporting BAR and MAR under specified norm-clipping thresholds and Gaussian noise parameters.

Limitations

  • The paper states that existing defenses often rely on threshold design, require historical information about attacks, assume attackers participate consistently, may not be compatible with SecAgg, and can degrade main-task accuracy; it also notes that many defenses target only specific attack types and struggle with novel attacks.
  • Evident from the text: the survey’s own experimental comparison is limited to FMNIST and a small set of representative attacks and defenses, so the reported numbers may not generalize to other datasets, non-IID settings, or decentralized WFL.
  • Evident from the text: the survey identifies open challenges rather than proposing a new unified defense, and it notes that OTA-WFL and decentralized WFL remain under-explored for backdoor detection and defense.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/comst.2024.3361451

Cites

261 of 261 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 219 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    Data poisoning backdoor attacks, including label flipping-based attacks and centralized trigger-based attacks, have the lowest attack cost.

    “It can be concluded that the data poisoning backdoor attacks, including label flipping-based attacks and centralized trigger-based attacks, have the lowest attack cost.”
    Quote in the paperSubstantial claim
  • Findingnone given
    § F. Performance Analysis of Backdoor Attacks · p. 10

    Model poisoning backdoor attacks implemented at the local training and server aggregation phases take advantage of the white box attack model.

    “The model poisoning backdoor attacks implemented at the local training and server aggregation phases take advantage of the white box attack model.”
    Quote in the paperNot a substantial claim
  • Findingown data
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    The local model replacement backdoor attack during the local model training phase shows the second-best performance.

    “On the other hand, the local model replacement backdoor attack during the local model training phase shows the second-best performance.”
    Quote in the paperNot a substantial claim
  • Findingreasoning
    § A. Comparison Among Backdoor Attack Strategies · p. 25

    The attack strength of data poisoning-based backdoor attacks is limited.

    “It is observed that the backdoor effect of data poisoningbased backdoor attacks is quickly diluted as the attacker can only manipulate the training dataset in the local client, so the attack strength is limited.”
    Quote in the paperNot a substantial claim
  • Findingreasoning
    § C. Summary · p. 26

    Many existing defense methodologies have been proven to be capable of defending both data poisoning-based backdoor attacks and model poisoning-based backdoor attacks.

    “Many existing defense methodologies have been proven to be capable of defending both data poisoningbased backdoor attacks and model poisoning-based backdoor attacks.”
    Quote in the paperSubstantial claim
  • May combine two claims. 116
  • Classified as probably not a substantial claim. 113
  • The quote only partly states this claim. 1

  • May combine two claims.

    Findingreasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    Data poisoning backdoor attacks have weak attack strength, and the backdoor effect will be quickly diluted.

    “In return, the attack strength is weak, and the backdoor effect will be quickly diluted.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingreasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    The backdoor effect can last longer if the attack success rate is higher.

    “The backdoor effect can last longer if the attack success rate is higher.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    Attackers need to know more about the entire network, and the attack cost is greatly increased for model poisoning attacks.

    “Consequently, the attackers need to know more about the entire network, and the attack cost is greatly increased.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given
    § F. Performance Analysis of Backdoor Attacks · p. 10

    The trigger-based backdoor attack can be improved using a coordinated trigger pattern, achieving a higher attack success rate.

    “The trigger-based backdoor attack can be improved using a coordinated trigger pattern, achieving a higher attack success rate.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    Model poisoning-based backdoor attacks outperform data poisoning-based backdoor attacks while yielding a higher complexity.

    “In general, the model poisoning-based backdoor attacks outperform data poisoning-based backdoor attacks while yielding a higher complexity.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    The global model replacement backdoor attack launched during the aggregation process achieves the highest BAR while maintaining a reasonable MAR.

    “It can be seen that the global model replacement backdoor attack [37] launched during the aggregation process achieves the highest BAR while also maintaining a reasonable MAR.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [37] source

      Not checked in the free run.

  • May combine two claims.

    Findingnone given
    § B. Comparison Among Backdoor Attack Defense Methods · p. 25

    All defense methods in different phases can reduce backdoor effects while maintaining a steady MAR.

    “It is noted that all defense methods in different phases can reduce backdoor effects while maintaining a steady MAR.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given
    § VIII. CONCLUSION · p. 31

    In most existing attack methods, a typical assumption is that malicious participants are more likely to be selected in each training round.

    “It is worth mentioning that, in most of the existing attack methods, a typical assumption is that, malicious participants are more likely to be selected in each training round, and the proportion of clients controlled by the attacker is typically high.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given
    § VIII. CONCLUSION · p. 31

    In most existing attack methods, the proportion of clients controlled by the attacker is typically high.

    “It is worth mentioning that, in most of the existing attack methods, a typical assumption is that, malicious participants are more likely to be selected in each training round, and the proportion of clients controlled by the attacker is typically high.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given
    § VIII. CONCLUSION · p. 31

    Backdoor detection relies on threshold design in different defense mechanisms.

    “In fact, backdoor detection relies on threshold design in different defense mechanisms.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given
    § VIII. CONCLUSION · p. 31

    Several defense strategies are not compatible with security aggregation protocols.

    “Meanwhile, several defense strategies are not compatible with the security aggregation protocols.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § I. INTRODUCTION · p. 2

    Backdoor attacks often do not negatively impact the accuracy of the model on primary tasks and do not disrupt the normal system operation before they are activated.

    “A critical challenge faced by detecting and defending against backdoor attacks is that backdoor attacks often do not negatively impact the accuracy of the model on primary tasks and do not disrupt the normal system operation before they are activated [32].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [32] Bagdasaryan, How to backdoor federated learning

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § A. Overview of Wireless Communications Technologies · p. 5

    WFL will be more vulnerable to backdoor attacks than its wired counterpart due to a combination of factors inherent to wireless networks.

    “However, WFL will be more vulnerable to backdoor attacks than its wired counterpart due to a combination of factors inherent to wireless networks.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The broadcast nature of wireless (radio) channels allows misbehaved or compromised participants in WFL to overhear the local model parameters of multiple or all benign participants.

  • May combine two claims.

    Premisecitation
    § I. INTRODUCTION · p. 2

    By taking advantage of overheard local models, misbehaved participants can construct malicious local models to escape malicious model detection at the central server, poison the global model and subsequently the benign local models, and manipulate WFL.

    “By taking advantage of the overheard local models, the misbehaved participants can construct malicious local models to escape malicious model detection at the central server, poison the global model and subsequently the benign local models, and manipulate WFL [35].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [35] source

      Not checked in the free run.

    • Rests on an assumption: The broadcast nature of wireless (radio) channels allows misbehaved or compromised participants in WFL to overhear the local model parameters of multiple or all benign participants.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § C. Scope and Contributions · p. 3

    The WFL vulnerabilities potentially open the door for backdoor attacks.

    “The WFL vulnerabilities potentially open the door for backdoor attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § C. Scope and Contributions · p. 3

    The training of existing defense mechanisms often requires access to historical information about the attacks.

    “The detection of backdoors typically relies on threshold design, and the training of existing defense mechanisms often requires access to historical information about the attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § B. Review of Existing Surveys and Gap Analysis · p. 2

    In some existing surveys, theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed, but limitations of existing methodologies were not systematically analyzed.

    “In [52] and [53], the theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed. However, the limitations of the existing methodologies were not systematically analyzed.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [52] source

      Not checked in the free run.

    • cites [53] Nguyen, 2023, Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions, arXiv:2303.02213

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § B. Review of Existing Surveys and Gap Analysis · p. 2

    In some existing surveys, WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.

    “On the other hand, in [48], [49], [50], and [51], WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [48] Gao, 2020, Backdoor attacks and countermeasures on deep learning: A comprehensive review, arXiv:2007.10760

      Not checked in the free run.

    • cites [49] source

      Not checked in the free run.

    • cites [50] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § A. Motivation · p. 2

    This makes backdoor attacks more threatening and more difficult to defend against, as the defender needs to consider all steps in the process.

    “This makes them more threatening and more difficult to defend against, as the defender needs to consider all steps in the process.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § A. Motivation · p. 2

    Despite the rapid growth of WFL as a research area, there has not yet been a comprehensive and up-to-date review of it from the perspective of backdoor attacks.

    “Despite the rapid growth of WFL as a research area, there has not yet been a comprehensive and up-to-date review of it from the perspective of backdoor attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning
    § A. Motivation · p. 2

    This property allows the backdoor to remain effective for a longer duration, making it difficult to eliminate fully.

    “This property allows the backdoor to remain effective for a longer duration, making it difficult to eliminate fully.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § C. Scope and Contributions · p. 3

    The detection of backdoors typically relies on threshold design.

    “The detection of backdoors typically relies on threshold design, and the training of existing defense mechanisms often requires access to historical information about the attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § B. Review of Existing Surveys and Gap Analysis · p. 2

    In the survey [50], backdoor attack strategies were discussed in depth, but they were not discussed in the context of WFL.

    “In the survey [50], the backdoor attack strategies were discussed in depth, but they were not discussed in the context of WFL.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [50] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § A. Overview of Wireless Communications Technologies · p. 6

    The decentralization of WFL makes it more challenging to maintain constant security measures, making the system more prone to backdoor attacks.

    “This can make it more challenging to maintain constant security measures, making the system more prone to backdoor attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning
    § A. Overview of Wireless Communications Technologies · p. 6

    Inconsistency in wireless data transmission can lead to data corruption or loss, and an attacker might exploit it to inject malicious backdoor attacks.

    “This inconsistency can lead to data corruption or loss, and an attacker might exploit the inconsistency to inject malicious backdoor attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § C. Features of WFL · p. 8

    With the broadcast nature of wireless interfaces, adversaries can potentially overhear local model updates from multiple or even all clients and create malicious local models to compromise WFL.

    “Moreover, with the broadcast nature of wireless interfaces, adversaries can potentially overhear local model updates from multiple or even all clients and accordingly create malicious local models to compromise WFL, e.g., using generative neural networks and machine learning technologies.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [35] source

      Not checked in the free run.

    • cites [114] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Features of WFL · p. 8

    A rogue client can collect local model updates that benign clients upload, take them as input to a graph adversarial encoder (GAE) to produce a malicious local model update, which can poison WFL and stop or slow down its convergence.

    “For example, in [35], [114], a new adversarial attack on WFL is studied by exploiting the broadcast nature of wireless channels, where a rogue client collects the local model updates that benign clients upload. The rogue client can take these overheard local model updates as input to a graph adversarial encoder (GAE) to produce a malicious local model update. The malicious local model update can”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [35] source

      Not checked in the free run.

    • cites [114] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Features of WFL · p. 8

    In OTA-WFL with uncoded transmission, gradients are transmitted directly over wireless channels without encoding or encryption, and their interception can reveal sensitive data.

    “In OTA-WFL with uncoded transmission, gradients are transmitted directly over wireless channels without encoding or encryption. The lack of coding or encryption in transmission means that any vulnerability in the wireless channel, such as weak signal encryption or interception by unauthorized receivers, can lead to significant privacy breaches. Moreover, since gradients carry information about the”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [97] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning
    § A. Overview of Wireless Communications Technologies · p. 6

    The scalability of WFL makes managing and securing each device more difficult and increases the overall attack surface.

    “This makes managing and securing each device more difficult and increases the overall attack surface.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Overview of Wireless Communications Technologies · p. 6

    Wireless links make it easier for attackers to eavesdrop, jam, manipulate data, or intrude networks than wired networks.

    “Data transmissions over wireless links are through airwaves, making it easier for attackers to eavesdrop [75]-[78], jam [79], and manipulate data, e.g., replay attack and Sybil attack, or intrude the networks [80], [81].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [75]-[78]

      Not checked in the free run.

    • cites [79] source

      Not checked in the free run.

    • cites [80], [81]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § · Global model update phase · p. 7

    The primary objective of a backdoor attack is to generate a converged global model with high accuracy of the main task and the backdoor-injected sub-task.

    “The primary objective of the backdoor attack is to generate a converged global model with high accuracy of the main task and the backdoor-injected sub-task [107].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [107] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Features of WFL · p. 8

    In OTA-WFL, controlling the transmit powers of clients can control the relative intensity of receiver noise power at the central server, offering privacy-preserving capability like DP noises.

    “Under the setting of OTA-WFL, the authors of [97] control the relative intensity of the receiver noise power at the central server by controlling the transmit powers of the clients. The resulting relative intensity of the receiver noises can offer privacy-preserving capability, like DP noises.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [97] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § · Backdoor attack at server aggregation phase · p. 9

    The effectiveness of an aggregation phase attack is mainly determined by the knowledge of the model controlled by attackers.

    “The effectiveness of an aggregation phase attack is mainly determined by the knowledge of the model controlled by attackers.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § C. Features of WFL · p. 8

    Random errors from wireless fading and receiver noises can perturb model updates, achieving an effect of differential privacy and alleviating the impact of attacks.

    “This is due to the fact that the random errors resulting from wireless fading and receiver noises can potentially serve to perturb the model updates, hence achieving the effect of DP and alleviating the impact of the attacks.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § E. Evaluation Metrics for Backdoor Attacks · p. 9

    The objective of a backdoor attack on WFL is to mislead the global model to misclassify malicious inputs with injected backdoor patterns into the target output.

    “The objective of a backdoor attack on WFL is to mislead the global model to misclassify malicious inputs with injected backdoor patterns into the target output, with application to image classification [127]-[136], word prediction [137][142], etc.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [127]-[136]

      Not checked in the free run.

    • cites [137][142]

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § · Backdoor attack at server aggregation phase · p. 9

    Backdoor attacks conducted during the aggregation process generally do not alter the targeted model; instead, the attacker tricks it into producing wrong predictions and causing security problems.

    “Backdoor attacks conducted during the aggregation process generally do not alter the targeted model. Instead, the attacker is keen on tricking it into producing wrong predictions and causing security problems [32].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [32] Bagdasaryan, How to backdoor federated learning

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § · Backdoor attack at local data collection phase · p. 9

    In a trigger-based backdoor attack, the model behaves normally and predicts a target class when the trigger appears.

    “The model will behave normally and predict a target class when the trigger appears, e.g., in the same room with a facial recognition lock, all men with glasses will be authorized to enter.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § E. Evaluation Metrics for Backdoor Attacks · p. 9

    A high BAR is equivalent to a high ASR and BTA.

    “Generally, a high BAR is equivalent to a high ASR and BTA.”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [143] source

      Not checked in the free run.

    • cites [144] source

      Not checked in the free run.

    • cites [32] Bagdasaryan, How to backdoor federated learning

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § · Backdoor attack at server aggregation phase · p. 9

    Compared with training process attacks, aggregation phase attacks can have stronger attack effects while there is a trade-off between stealthiness and attack success rate (ASR).

    “Compared with training process attacks, the aggregation phase attacks can have stronger attack effects while there is a trade-off between the stealthiness and the attack success rate (ASR).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § · Backdoor attack at local data collection phase · p. 9

    In a local data collection phase backdoor attack, an individual feature or a small region of the local training data is modified by malicious users deliberately.

    “In a local data collection phase backdoor attack, an individual feature or a small region of the local training data is modified by malicious users deliberately [117].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [117] Schwarzschild, Just how toxic is data poisoning? A unified benchmark for backdoor and data poisoning attacks

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § III. STATUS QUO OF BACKDOOR ATTACKS ON WFL · p. 10

    The primary objective of backdoor attacks is to manipulate the converged global model to misclassify specifically crafted inputs with hidden backdoors into a desired target label while ensuring that normal inputs are classified accurately.

    “The primary objective of backdoor attacks is to manipulate the converged global model to misclassify specifically crafted inputs with hidden backdoors into a desired target label while ensuring that normal inputs are classified accurately.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 11

    The simple label-flipping method results in a remarkable outlier in model training, so it can be detected by norm clipping or differential privacy.

    “The inevitable problem of the simple label-flipping method still exists in that the flipped data set under the targeted label results in a remarkable outlier in the model training. Thus, it can be detected by norm clipping [164] or differential privacy [38], [38], [164], [165].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [164] Xie, CRFL: Certifiably robust federated learning against backdoor attacks

      Not checked in the free run.

    • cites [38] Nguyen, FLAME: Taming backdoors in federated learning

      Not checked in the free run.

    • cites [165] Zhang, 2023, Bounded and unbiased composite differential privacy, arXiv:2311.02324

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given
    § A. Backdoor Attacks at Local Data Collection Phase · p. 11

    Label-flipping depends on the data sets and is agnostic to the models to be trained and the communication interfaces.

    “In general, label-flipping depends on the data sets and is agnostic to the models to be trained and the communication interfaces.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § E. Evaluation Metrics for Backdoor Attacks · p. 10

    Due to the nature of FL, the backdoor effect in the global model tends to be diluted with the increment of the training round.

    “Due to the nature of FL, the backdoor effect in the global model tends to be diluted with the increment of the training round.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 10

    In label-flipping-based backdoor attacks, the training data set under the targeted label is replaced by the backdoored data set.

    “In label-flipping-based backdoor attacks, the training data set under the targeted label is replaced by the backdoored data set [162].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [162] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisereasoning
    § III. STATUS QUO OF BACKDOOR ATTACKS ON WFL · p. 10

    Each client's data distribution is not representative of the global data distribution, implying that the categories in each client are incomplete.

    “Each client's data distribution is not representative of the global data distribution, implying that the categories in each client are incomplete.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 11

    To improve stealthiness of label flipping-based backdoor attack, the target label is selected on the tail, and the edge data set is selected as the target.

    “To improve the stealthiness of the label flipping-based backdoor attack, the target label is selected on the tail in [33]. In this case, the data distribution is required, and the edge data set is selected as the target.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § E. Evaluation Metrics for Backdoor Attacks · p. 10

    Different from Byzantine attacks, which aim to jeopardize the convergence of the global model, backdoor attacks focus on inserting backdoor patterns into the global model while maintaining a reasonable MAR.

    “Different from Byzantine attacks, which aim to jeopardize the convergence of the global model [145]-[147], the backdoor attacks focus on inserting backdoor patterns into the global model while maintaining a reasonable MAR.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [145]-[147]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisereasoning
    § E. Evaluation Metrics for Backdoor Attacks · p. 10

    Defenders aim to minimize the BAR and lifespan of the backdoor effect while preventing the MAR from degradation.

    “Different from backdoor attack designs, which pursue high BAR, MAR, and long lifespan, the defenders aim to minimize the BAR and lifespan of the backdoor effect while preventing the MAR from degradation.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    Label flipping attacks, coordinated trigger attacks, local model replacement attacks, and aggregation process attacks are likely to be exacerbated in WFL.

    “As shown in Table IV, label flipping attacks, coordinated trigger attacks, local model replacement attacks, and aggregation process attacks are likely to be exacerbated in WFL.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 11

    Replacing the edge target data set with a backdoored data set makes the local model behave correctly with normal inputs while misclassifying adversarial inputs on the edge label.

    “Replacing the edge target data set with a backdoored data set, the local model behaves correctly with normal inputs while misclassifying the adversarial inputs on the edge label.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisereasoning
    § F. Performance Analysis of Backdoor Attacks · p. 10

    The broadcast nature of wireless communications facilitates various forms of cyber threats, such as spoofing attacks, Sybil attacks, and eavesdropping attacks.

    “This is due to the broadcast nature of wireless communications, which facilitates various forms of cyber threats, such as spoofing attacks, Sybil attacks, and eavesdropping attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 12

    The primary objective of trigger-based backdoor attacks is to mislead the model to classify trigger-mounted inputs into the target label while behaving normally with non-trigger inputs.

    “The primary objective of triggerbased backdoor attacks is to mislead the model to classify the trigger-mounted inputs into the target label while behaving normally with non-trigger inputs [38], [116], [126].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [38] Nguyen, FLAME: Taming backdoors in federated learning

      Not checked in the free run.

    • cites [116] source

      Not checked in the free run.

    • cites [126] Zhang, Neurotoxin: Durable backdoors in federated learning

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A. Backdoor Attacks at Local Data Collection Phase · p. 12

    In random trigger-based backdoor attacks, the trigger is generated independently of the model.

    “In a random trigger-based backdoor attack, the trigger is generated independently of the model [122], [140], [169], [170].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [122] Xie, DBA: Distributed backdoor attacks against federated learning

      Not checked in the free run.

    • cites [140] Pan, Hidden trigger backdoor attack on NLP models via linguistic style manipulation

      Not checked in the free run.

    • cites [169] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § A. Backdoor Attacks at Local Data Collection Phase · p. 12

    Trigger-based backdoor attacks can be classified into centralized and coordinated based on the number of adversarial participants involved.

    “According to the number of adversarial participants involved in an attack, trigger-based backdoor attacks can be classified into centralized trigger-based backdoor attacks and coordinated triggerbased backdoor attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § [171]. · p. 13

    With additional knowledge of local models and global model, model-dependent triggers can be potentially further enhanced, e.g., by employing adversarial generative networks and training.

    “With the additional knowledge of the local models along with the global model, the model-dependent triggers can be potentially further enhanced, e.g., by employing adversarial generative networks and training [174].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [174] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § A. Backdoor Attacks at Local Data Collection Phase · p. 12

    The advantage of random trigger-based backdoor attacks is that the attack cost is greatly reduced.

    “The advantage is that the attack cost is greatly reduced.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § A. Backdoor Attacks at Local Data Collection Phase · p. 12

    Trigger-based backdoor attacks can be divided into random trigger and model-dependent trigger based on trigger patterns.

    “Depending on different patterns of the trigger, the triggerbased backdoor attacks can be further divided into random trigger backdoor attacks and model-dependent trigger backdoor attacks, as follows.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § [171]. · p. 13

    Model-dependent triggers can help excite the target label and have a higher probability of being successfully injected into the trained local model before aggregation.

    “The model-dependent trigger can help to excite the target label and has a higher probability of being successfully injected into the trained local model before aggregation [172].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [172] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § [171]. · p. 13

    Both label-flipping-based and trigger-based data poisoning backdoor attacks can be treated as black-box attacks.

    “Both label-flipping-based and triggerbased data poisoning backdoor attacks can be treated as blackbox attacks [33].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § B. Backdoor Attacks at Local Model Training Phase · p. 13

    In the local model training phase, backdoor attacks can be conducted by manipulating the model parameters during the training process or modifying the training algorithm.

    “In the local model training phase, the backdoor attacks can be conducted by manipulating the model parameters during the training process or modifying the training algorithm [126], [177].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [126] Zhang, Neurotoxin: Durable backdoors in federated learning

      Not checked in the free run.

    • cites [177] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § [171]. · p. 13

    When the local training time remaining in a communication round is short, local models are insufficiently trained and hence vulnerable to backdoor attacks.

    “The local training time that remains in a communication round would be short, leading to insufficiently trained local models and, hence, vulnerabilities to backdoor attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § [171]. · p. 13

    5G operates in high-frequency bands of up to 40 GHz, and the wavelength of the carrier frequency can be as short as 7.5 millimeters.

    “For instance, the increasingly widely deployed wireless communication technologies, e.g., 5G, operate in high-frequency bands of up to 40 GHz, and the wavelength of the carrier frequency can be as short as 7.5 millimeters [175].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [175] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § B. Backdoor Attacks at Local Model Training Phase · p. 14

    With the newly designed training algorithm, the norm difference between the backdoored and benign models decreases, the backdoor becomes harder to detect, and the attack success rate improves.

    “With a newly designed training algorithm, the norm difference between the backdoored and benign models decreases, the backdoor becomes harder to detect, and the attack success rate improves.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given
    § [171]. · p. 13

    The common problem of centralized trigger-based backdoor attacks is that the single attacker's effect is limited, and it cannot be ensured that the attacker is selected in every round.

    “The common problem of centralized triggerbased backdoor attacks is that the single attacker's effect is limited, and it cannot be ensured that the attacker is selected in every round.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Backdoor Attacks at Local Model Training Phase · p. 13

    The simple label-flipping attack exhibits a low attack success rate.

    “It has been discussed in the previous section that the simple label-flipping attack exhibits a low attack success rate.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Backdoor Attacks at Local Model Training Phase · p. 14

    The attacks at the local model training phase are also known as white box attacks.

    “The attacks at this stage are also known as white box attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Backdoor Attacks at Local Model Training Phase · p. 14

    Knowledge of the defense mechanism adopted in the WFL network is required to ensure the injection of the backdoor.

    “Furthermore, the knowledge of the defense mechanism adopted in the WFL network is also required to ensure the injection of the backdoor.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § B. Backdoor Attacks at Local Model Training Phase · p. 14

    The attacker needs to master the training data set, as well as the local training process, for model poisoning backdoor attacks in the local model training phase.

    “The attacker needs to master the training data set, as well as the local training process.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § B. Backdoor Attacks at Local Model Training Phase · p. 14

    When frequency-division multiple-access (FDMA) protocols, including OFDMA, are considered, each selected client would enjoy much narrower bandwidths, which would prolong their model uploading time at the cost of their model training time.

    “On the other hand, when frequency-division multiple-access (FDMA) protocols, including orthogonal frequency-division multiple-access (OFDMA) protocols, are considered, each selected client would enjoy much narrower bandwidths, which would prolong their model uploading time at the cost of their model training time [180].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [180] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given
    § C. Backdoor Attacks at Aggregation Phase · p. 14

    The proposed aggregation phase attack ensures that the backdoor is bound to be injected in one round and will not be diluted.

    “The proposed attack ensures that the backdoor is bound to be injected in one round and will not be diluted.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § D. Summary · p. 15

    The injected backdoor pattern of label-flipping-based data poisoning backdoor attack is easy to detect, and the life span of the backdoor effect is short.

    “The injected backdoor pattern is also easy to detect, and the life span of the backdoor effect is short.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § D. Summary · p. 15

    Such black-box attacks featured low attack costs but also relatively low backdoor effects.

    “Such black-box attacks featured low attack costs but also relatively low backdoor effects [155].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [155] source

      Not checked in the free run.

  • May combine two claims.

    Premisereasoning
    § D. Summary · p. 15

    Once the attacker obtains the knowledge of the training algorithm, it can fully control the compromised client and initiate the model poisoning backdoor attack during the local model training phase.

    “Once the attacker obtains the knowledge of the training algorithm, it can fully control the compromised client and initiate the model poisoning backdoor attack during the local model training phase.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given
    § C. Backdoor Attacks at Aggregation Phase · p. 15

    The aggregation phase attack shows better performance when the global model is close to complete convergence, so the attacker also needs to know the information on the convergence progress of the global model.

    “Moreover, the attack shows better performance when the global model is close to complete convergence, so the attacker also needs to know the information on the convergence progress of the global model.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § D. Summary · p. 15

    The label-flipping-based data poisoning backdoor attack is the easiest to implement.

    “The label-flippingbased data poisoning backdoor attack is the easiest to implement.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § C. Backdoor Attacks at Aggregation Phase · p. 15

    In decentralized WFL, the malicious attacker can conduct the attack by hijacking one or more compromised clients that are close to the essential node, and thus the backdoor effect is more likely to be injected into the network and spread more broadly.

    “The malicious attacker can then conduct the attack by hijacking one or more compromised clients that are close to the essential node. Thus, the backdoor effect is more likely to be injected into the network and spread more broadly.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Premisenone given
    § C. Backdoor Attacks at Aggregation Phase · p. 15

    In decentralized WFL, each client can behave as the server, and only receives model information from nodes within its neighborhood.

    “However, in decentralized WFL, each client can behave as the server, and only receives model information from nodes within its neighborhood.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given
    § D. Summary · p. 15

    A backdoor attack at the local data collection phase can only pollute the training data, and the attackers do not necessarily know the training algorithm and aggregation protocol.

    “A backdoor attack at this phase can only pollute the training data, and the attackers do not necessarily know the training algorithm and aggregation protocol.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given
    § D. Summary · p. 15

    The global model replacement method aims to manipulate the local training algorithm, and the adversarial updates are guaranteed to be uploaded for aggregation.

    “The global model replacement method aims to manipulate the local training algorithm, and the adversarial updates are guaranteed to be uploaded for aggregation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § A. Defense at Local Training Phase · p. 16

    Training the backdoor filter on the server side requires prior information about the backdoor patterns and backdoored data sets.

    “However, training the backdoor filter on the server side requires prior information about the backdoor patterns and backdoored data sets.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Defense at Local Training Phase · p. 16

    The backdoor attack success rate under the defense mechanism reduces to zero, while the stability-based defense can ensure a high success rate for the main task.

    “The backdoor attack success rate under the defense mechanism reduces to zero, while the stability-based defense can ensure a high success rate for the main task.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [191] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § D. Summary · p. 15

    The attacks at the local model training phase have a better attack success rate, but the requirement of the model training information increases the attack cost.

    “The attacks at this stage have a better attack success rate, but the requirement of the model training information increases the attack cost.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § IV. LATEST DEFENSE METHODOLOGIES AGAINST BACKDOOR ATTACKS · p. 15

    Defense schemes against backdoor attacks on WFL can be classified into four types: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.

    “The defense schemes can be classified into four types: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § D. Summary · p. 15

    The attackers need to master the local training data, local training algorithm, and the global aggregation protocol for the aggregation phase attack, making it hard to implement in practical scenarios.

    “In return, the attackers need to master the local training data, local training algorithm, and the global aggregation protocol, making it hard to implement in practical scenarios.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § A. Defense at Local Training Phase · p. 16

    The blur operation can only deal with the trigger in the pixel pattern.

    “Moreover, the blur operation can only deal with the trigger in the pixel pattern.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § A. Defense at Local Training Phase · p. 17

    In the experimental setup of [191], the number of participants is set to 10, and the training data are IID.

    “In the experimental setup, the number of participants is set to 10, and the training data are IID.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [191] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § B. Defense Before Aggregation Phase · p. 18

    Compared with benign clients, the backdoor attackers are likely to upload updates with relatively larger norms.

    “Compared with benign clients, the backdoor attackers are likely to upload updates with relatively larger norms.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § Local end: · p. 18

    The trade-off between the primary task accuracy and attack defense rate must be considered when adding the noise.

    “Thus, the trade-off between the primary task accuracy and attack defense rate must be considered when adding the noise.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § A. Defense at Local Training Phase · p. 17

    The defense mechanisms at the local training phase are also compatible with the SecAgg protocol.

    “The defense mechanisms at this stage are also compatible with the SecAgg protocol.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § A. Defense at Local Training Phase · p. 17

    The defense performance might degrade in the actual WFL, where the number of clients is larger, and the training data sets are typically non-IID.

    “The defense performance might degrade in the actual WFL, where the number of clients is larger, and the training data sets are typically non-IID.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Local end: · p. 18

    UDP is more commonly adopted in WFL.

    “For this reason, the UDP is more commonly adopted in WFL [201].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [201] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § Local end: · p. 18

    TCP can ensure the reliable delivery of data across a network but requires one or multiple retransmissions in each communication cycle.

    “For instance, the TCP can ensure the reliable delivery of data across a network but requires one or multiple retransmissions in each communication cycle [200].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [200] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Defense Before Aggregation Phase · p. 18

    Another commonly adopted defense strategy against backdoor attacks is to detect the anomaly updates before sending them to the aggregator.

    “Another commonly adopted defense strategy against backdoor attacks is to detect the anomaly updates before sending them to the aggregator.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § A. Defense at Local Training Phase · p. 17

    Wireless devices can be resource-constrained, e.g., in terms of energy supply and communication resources.

    “Wireless devices can be resource-constrained, e.g., in terms of energy supply and communication resources.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Defense at Local Training Phase · p. 17

    The remaining challenges are that the defender requires the proper knowledge of the backdoor patterns, and the trade-off between the defense performance and significant task accuracy must also be considered.

    “The remaining challenges are that the defender requires the proper knowledge of the backdoor patterns, and the trade-off between the defense performance and significant task accuracy must also be considered [192].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [192] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § B. Defense Before Aggregation Phase · p. 18

    Many efforts have been carried out to deal with both data poisoning backdoor attack and model poisoning backdoor attack.

    “Many efforts have been carried out to deal with both data poisoning backdoor attack [193]-[195] and model poisoning backdoor attack [196]-[198].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [193]-[195]

      Not checked in the free run.

    • cites [196]-[198]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § Local end: · p. 18

    TCP retransmissions can penalize the local models by reducing the local training time in a communication cycle.

    “This can penalize the local models by reducing the local training time in a communication cycle.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Premisereasoning
    § A. Defense at Local Training Phase · p. 17

    Client selection and scheduling are indispensable in the context of WFL.

    “Client selection and scheduling are indispensable in the context of WFL.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning
    § A. Defense at Local Training Phase · p. 17

    There is a significant opportunity to couple the designs of both in a holistic way to improve defense effectiveness and efficiency.

    “There is a significant opportunity to couple the designs of both in a holistic way to improve defense effectiveness and efficiency.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § A. Defense at Local Training Phase · p. 17

    To date, the client selection/scheduling has been designed in parallel to the backdoor defense studies.

    “To date, the client selection/scheduling has been designed in parallel to the backdoor defense studies.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    The encoder-decoder architecture requires extra unbiased updates to train the detector and is hard to implement in real WFL applications.

    “The encoder-decoder architecture requires extra unbiased updates to train the detector, and it is pretty hard to implement in real WFL applications.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisereasoning
    § Local end: · p. 18

    After removing the noisy and redundant features of these data instances, the difference between benign and malicious updates becomes apparent.

    “After removing the noisy and redundant features of these data instances, the difference between benign and malicious updates becomes apparent.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § Local end: · p. 18

    The basic idea of low-dimensional anomaly detection methods is to project the compact computed local model onto its low-dimension space.

    “The basic idea of low-dimensional anomaly detection methods is to project the compact computed local model onto its low-dimension space, as given by:”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    PartFedAvg improves the robustness of the global model because the malicious attacker cannot inject completed backdoor patterns in a short time.

    “The malicious attacker cannot inject completed backdoor patterns in a short time, thus improving the robustness of the global model.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [204] source

      Not checked in the free run.

    • Rests on an assumption: The malicious attacker cannot inject completed backdoor patterns in a short time.

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    The PCA-based method requires prior knowledge of the targeted backdoor label, which is hard to know in practical defense implementation.

    “The PCA-based method requires prior knowledge of the targeted backdoor label, which is also hard to know in practical defense implementation.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [203] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    Low-dimensional defense methods are incompatible with the SecAgg protocol, and participant privacy in WFL cannot be guaranteed.

    “The low-dimensional methods are also incompatible with the SecAgg protocol, and the privacy of the participants in the WFL network cannot be guaranteed.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

      Not checked in the free run.

    • cites [203] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisereasoning
    § Local end: · p. 18

    The clipping should filter not only the updates from clients but different communication channels as well.

    “The clipping should filter not only the updates from clients but different communication channels as well.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § Local end: · p. 18

    Due to the feature of WCN, the communication channels with better signals can be better selected in WFL.

    “Due to the feature of WCN, the communication channels with better signals can be better selected in WFL.”
    Quote in the paperNot a substantial claim

  • May combine two claims. The quote only partly states this claim.

    Premisecitation
    § Local end: · p. 19

    The encoder-decoder defense trains a model to approximate low-dimensional embeddings of model updates, and the reconstruction error of benign updates is much smaller than that of malicious updates.

    “The reconstruction error of the benign updates is much smaller than that of the malicious updates.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationcitation
    § Local end: · p. 19

    PartFedAvg ensures the privacy of the participants involved.

    “The proposed method ensures the privacy of the participants involved.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [204] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Premisenone given
    § Local end: · p. 18

    The ratio of information gathered from remote network nodes should be considered to prevent backdoor effects and ensure fairness.

    “The ratio of information gathered from remote network nodes should be considered to prevent backdoor effects and ensure fairness.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    The low-dimensional defense methods can only distinguish label-flipping-based backdoor attacks and cannot deal with trigger-based backdoor attacks.

    “Meanwhile, the above-mentioned methods can only distinguish label-flipping-based backdoor attacks and cannot deal with trigger-based backdoor attacks.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

      Not checked in the free run.

    • cites [203] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § Local end: · p. 18

    Data distortion and packet loss caused by network communications need to be considered when designing the norm clipping threshold.

    “However, the data distortion and packet loss caused by network communications need to be considered when designing the norm clipping threshold.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § Local end: · p. 19

    The PCA-based defense identifies the biggest cluster as the benign update and malicious updates as lying in a visibly different cluster.

    “The biggest cluster is recognized as the benign update, while the malicious updates lie within a visibly different cluster.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [203] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § Local end: · p. 19

    The defense schemes in [204] and [205] require modifying the local training process, and the backdoor effect can only be suppressed and cannot be entirely eliminated.

    “The defense schemes proposed in [204] and [205] require modifying the local training process, and the backdoor effect can only be suppressed and cannot be entirely eliminated.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [204] source

      Not checked in the free run.

    • cites [205] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § Local end: · p. 19

    The methods in [204] and [205] require the number of malicious attacks to be smaller than 50% of the total selected clients in each round.

    “The method requires the number of malicious attacks to be smaller than 50% of the total selected clients in each round.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [204] source

      Not checked in the free run.

    • cites [205] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § Local end: · p. 19

    In Meta-FL, the server selects subsets of participants, each subset computes updates and sends SecAgg-masked updates, and the server mitigates backdoor attacks by ignoring visibly different subset updates.

    “In each round, the central server selects subsets of the participants. Each subset computer updates. Then, each subset follows the SecAgg protocol and sends the cryptographymasked updates. Although the server cannot access each client's update, it can migrate the effect of backdoor attacks by ignoring visibly different subset updates.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [205] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    WFLAME shows good defensive performance against both data poisoning and model poisoning backdoor attacks.

    “It shows good defensive performance against both data poisoning and model poisoning backdoor attacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [38] Nguyen, FLAME: Taming backdoors in federated learning

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § Local end: · p. 19

    Meta-FL ensures participant privacy and can defend against label-flipping-based, trigger-based, and model replacement-based backdoor attacks.

    “In such a design, the participant's privacy is ensured, and it can be applied to defend against label-flipping-based, trigger-based, and model replacement-based backdoor attacks.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [205] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § C. Defense During Aggregation Phase · p. 20

    The adaptive learning rate defense requires individual update information from participants on the server side, is not compatible with SecAgg, and cannot guarantee participants' privacy security.

    “Similar to the aggregation modification method, the proposed defense mechanism requires the individual to update information from the participant on the server side. Thus, it is not compatible with the SecAgg. The participants' privacy security cannot be guaranteed.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [212] source

      Not checked in the free run.

    • cites [213] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § C. Defense During Aggregation Phase · p. 21

    The attention-based neural network defense trains a separate neural network on simulated model updates under various backdoor attacks to learn the potential vulnerability of the global model against different backdoor attacks.

    “The central server simulates the WFL tasks under various types of backdoor attacks. Then, the simulated model updates are collected to train a separate neural network model, which learns the potential vulnerability of the global model against different backdoor attacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [219] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Defense During Aggregation Phase · p. 21

    In the attention-based defense, an alignment score closer to +1 indicates a more likely benign update, while a score close to -1 indicates a likely adversary update.

    “If the alignment score 𝑠 𝑖 is closer to + 1 , 𝑝 𝑖 is more likely to be a benign update. On the other hand, if 𝑠 𝑖 is close to -1 , 𝑝 𝑖 is likely to be an adversary update.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [219] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § C. Defense During Aggregation Phase · p. 21

    ARIBA is an unsupervised anomaly detection framework that pre-processes model weights to obtain discernible patterns of filters and uses an unsupervised anomaly detection algorithm to detect suspicious filters.

    “In this design, the model weights are pre-processed to obtain the discernible patterns of filters. Multiple filters are then collected and fed into an unsupervised anomaly detection algorithm to detect the suspicious filters.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [220] Mi, 2022, ARIBA: Towards accurate and robust identification of backdoor attacks in federated learning, arXiv:2202.04311

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § C. Defense During Aggregation Phase · p. 21

    FoolsGold has no constraints on the number of malicious clients and demonstrates reasonable performance against data poisoning attacks.

    “This design has no constraints on the number of malicious clients, and it demonstrates reasonable performance against data poisoning attacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [218] Fung, The limitations of federated learning in Sybil settings

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Defense During Aggregation Phase · p. 21

    FoolsGold detects adversarial attacks based on the diversity of model updates, where benign client updates tend to have richer diversity while the adversary normally behaves similarly.

    “The FoolsGold is proposed in [218], and the adversarial attack is detected based on the diversity of the model updates. In a WFL framework, the benign client's updates tend to have richer diversity, while the adversary normally behaves similarly.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [218] Fung, The limitations of federated learning in Sybil settings

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § C. Defense During Aggregation Phase · p. 20

    The aggregator in [211] requires knowledge of individual model updates, violating the SecAgg protocol, performs poorly in the non-IID situation, and cannot ensure privacy and security.

    “The aggregator requires the knowledge of individual model updates, which violates the SecAgg protocol. The proposed method performs poorly in the non-IID situation and cannot ensure privacy and security.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [211] Fu, 2019, Attack-resistant federated learning with residual-based reweighting, arXiv:1912.11464

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § C. Defense During Aggregation Phase · p. 21

    The attention-based defense requires all possible backdoor attack patterns to be trained in the server before implementation, and the aggregator requires access to single local updates, risking participant privacy.

    “The major problem of this defense method is that to distinguish the malicious updates, all possible backdoor attack patterns must be trained in the server before implementation. During the detection, the aggregator requires access to single local updates. Thus, the privacy of the participant is at risk of leaking.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [219] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    FedEraser requires no substantial modification to the existing WFL architecture and participant training process, so it is easy to implement.

    “In the FedEraser design, no substantial modification is required to the existing WFL architecture and the training process of the participants. Thus, the proposed method is easy to implement.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [224] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    FedEraser must target the attacker client, which is hard in actual implementation.

    “although the training data and the training process are not required, the FedEraser must target the attacker client, which is also pretty hard in actual implementation.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [224] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § D. Defense After Aggregation Phase · p. 22

    FedEraser stores historical updates, reconstructs an unlearned model in the central server based on stored historical parameters once the global model converges, and uses benign clients as calibrating clients to renew the global model to an unlearned WFL global model.

    “In [224], the federated unlearning methodology, namely, FedEraser, is proposed. In this scheme, the central server stores the historical updates received from clients during the global model training process. Once the global model converges, the FedEraser reconstructs an unlearned model in the central server based on the stored historical parameters.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [224] source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § D. Defense After Aggregation Phase · p. 22

    The knowledge distillation method stores historical parameters, subtracts the contribution of targeted malicious clients to derive a skewed unlearning model, and performs knowledge distillation with the original model as teacher and the skewed unlearning model as student.

    “The knowledge distillation method is proposed in [216], [226] to restore the global model's performance. In this design, the central server stores the historical parameters of the participating clients. Once the global model is obtained. The contribution of the targeted malicious clients is subtracted, and a skewed unlearning model is derived. Then, the knowledge distillation is performed. The”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [216] source

      Not checked in the free run.

    • cites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § C. Defense During Aggregation Phase · p. 21

    Unsupervised anomaly detection methods [220] and [222] are incompatible with the SecAgg protocol, so data privacy and security can hardly be ensured.

    “The unsupervised anomaly detection methods proposed in [220] and [222] are incompatible with the SecAgg protocol. Thus, data privacy and security can hardly be ensured.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [220] Mi, 2022, ARIBA: Towards accurate and robust identification of backdoor attacks in federated learning, arXiv:2202.04311

      Not checked in the free run.

    • cites [222] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § C. Defense During Aggregation Phase · p. 21

    The emerging OTA-WFL may pose new challenges to existing aggregation-phase defenses because the FL server only accesses the aggregated global model, obscuring local models and allowing backdoor attacks to take place unnoticed.

    “the emerging OTA-WFL may pose new challenges to the existing defense mechanisms designed for the aggregation phase due to the fact that the FL server would only access the aggregated global model under OTA-WFL [14], [101]. The local models of individual clients are obscured. While this helps improve the privacy of the individuals' local models to a great extent, it allows backdoor attacks to take”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [14] source

      Not checked in the free run.

    • cites [101] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    FedEraser's calibration process relies on historical updates of participating clients, and limited hardware storage makes it hard to deploy in practice.

    “The calibration process during the unlearned model training relies on the historical updates of the participating clients. The limited store capability of the hardware makes it hard to deploy in practice.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [224] source

      Not checked in the free run.

  • May combine two claims.

    Premisenone given
    § D. Defense After Aggregation Phase · p. 21

    Defense after the aggregation phase stores historic values from participants to train a reference global model, examines the converged WFL global model to filter anomaly contribution from suspicious clients, and by excluding suspicious clients entirely eliminates the backdoor effect.

    “The server will store the historic value gathered from participants to train a reference global model, based on which the trained converged WFL global model is examined to filter the anomaly contribution from suspicious clients. By excluding the influence of suspicious clients, the backdoor effect will be entirely eliminated.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § D. Defense After Aggregation Phase · p. 21

    Post-aggregation backdoor defense mechanisms are particularly important for emerging OTA-WFL systems to circumvent the obscurity of local models.

    “The post-aggregation backdoor defense mechanisms, i.e., performed upon the aggregated global models, can be particularly important for the emerging OTA-WFL systems to circumvent the obscurity of the local models in the OTAWFL processes.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given
    § E. Summary · p. 22

    Defense during the aggregation phase can identify backdoored updates from malicious clients and exclude them, is located on the server side, and is normally not compatible with SecAgg.

    “The defense during the aggregation is capable of identifying the backdoored updates from the malicious clients and excluding them from rejecting backdoor injection. The defenders are located on the server side, and normally, they are not compatible with SecAgg.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    The knowledge distillation method is not compatible with SecAgg, and participant privacy is at risk of leakage.

    “Meanwhile, the proposed method is not compatible with SecAgg, and the privacy of the participants is at risk of leakage.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [216] source

      Not checked in the free run.

    • cites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § E. Summary · p. 22

    Defense before the aggregation phase is mounted on the client side, excludes suspicious updates before sending them to the aggregator, and some methodologies modify SecAgg, making it hard to configure in practical WFL networks.

    “Defense before the aggregation phase is also mounted on the client side. The defender is keen to exclude suspicious updates before sending them to the aggregator. Some methodologies employ the modification of SecAgg, thus making it hard to be configured in practical WFL networks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    The low BAR of trigger-based backdoor attacks could be due to insufficient CCR.

    “The low BAR of triggerbased backdoor attacks could be due to insufficient CCR.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    The knowledge distillation-based unlearning method can improve the robustness of the global model and defend against all types of backdoor attacks.

    “It is also testified that the proposed knowledge distillation-based unlearning method can improve the robustness of the global model and defend against all types of backdoor attacks [227].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [227] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § D. Defense After Aggregation Phase · p. 22

    The unlearning mechanism requires knowledge of the target clients, and attackers are normally stealthy in practical scenarios.

    “The unlearning mechanism requires the knowledge of the target clients, and the attackers are normally stealthy in practical scenarios.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [216] source

      Not checked in the free run.

    • cites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    The attacker must obtain sufficient knowledge of the whole WFL network for the global model replacement backdoor attack, introducing a considerable attack cost.

    “However, the attacker must obtain sufficient knowledge of the whole WFL network, introducing a considerable attack cost, as discussed in Section III-C.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [37] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § E. Summary · p. 22

    Defense methods at the local training phase are implemented on the client side, aim at data poisoning attacks, have relatively low defense cost, and are compatible with SecAgg.

    “Defense methods at the local training phase are implemented on the client side, aiming at the data poisoning attacks. The defense cost is relatively low, and the defense mechanism at this stage is compatible with SecAgg.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationnone given
    § E. Summary · p. 22

    Defense after the aggregation phase evaluates the converged global model to test whether it has been polluted by the backdoor pattern, is at the server side, and necessarily needs historical information gathered from participants.

    “The defense after the aggregation phase will evaluate the converged global model to test whether it has been polluted by the backdoor pattern or not. The defense mechanism is also at the server side, and the historical information gathered from the participant is necessarily needed.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationnone given
    § E. Summary · p. 22

    Existing defense methods can be broadly divided into four categories: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.

    “The existing defense methods can be broadly divided into four categories: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attack Methods · p. 27

    Compared with a backdoor attack for data, a model-based backdoor attack shows better ASR and longer duration.

    “Compared with a backdoor attack for data, a model-based backdoor attack shows better ASR and longer duration [164].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [164] Xie, CRFL: Certifiably robust federated learning against backdoor attacks

      Not checked in the free run.

  • May combine two claims.

    Premisenone given
    § B. Comparison Among Backdoor Attack Defense Methods · p. 25

    Defense methods [218], [224] require the historical information of local model updates and are not compatible with SecAgg.

    “However, such defense methods [218], [224] require the historical information of local model updates and are not compatible with SecAgg, which brings more difficulty in the practical implementation.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [218] Fung, The limitations of federated learning in Sybil settings

      Not checked in the free run.

    • cites [224] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § A. Comparison Among Backdoor Attack Strategies · p. 23

    Consequently, label-flipping-based backdoor attacks are more unlikely to be detected, and the attack strength is relatively weaker.

    “Consequently, it is more unlikely to be detected, and the attack strength is relatively weaker.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given
    § C. Summary · p. 26

    Model poisoning-based backdoor attack algorithms have relatively higher complexity and normally require much more information about the entire network.

    “However, the model poisoning-based backdoor attack algorithms have relatively higher complexity and normally require much more information about the entire network.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given
    § B. Comparison Among Backdoor Attack Defense Methods · p. 25

    Gaussian noise introduced by differential privacy adds extra disturbance to the global model training process.

    “Meanwhile, the Gaussian noise introduced by differential privacy also adds extra disturbance to the global model training process.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given
    § A. Backdoor Attack Methods · p. 26

    Tail backdoor can remain undetected for a longer duration but only affects the classification of a subset of the training samples.

    “This type of 'tail backdoor' can remain undetected for a longer duration but only affects the classification of a subset of the training samples.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 27

    The optimal weight for model-based backdoor attacks must be carefully designed to achieve the highest ASR without detection.

    “The optimal weight must be carefully designed to achieve the highest ASR without detection.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 26

    There is a trade-off between the ASR and the strength of the backdoor effect for tail backdoor.

    “There is a trade-off between the ASR and the strength of the backdoor effect in this case.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Backdoor Defense · p. 27

    The WFL framework is featured for its non-IID property.

    “Third, the WFL framework is featured for its non-IID property.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § B. Backdoor Defense · p. 27

    There is no proven solution to deal with the injected backdoor pattern after the aggregation phase.

    “And there is no proven solution to deal with the injected backdoor pattern after the aggregation phase.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attacks on WFL · p. 28

    Label-flipping-based attacks have low attack costs, but the flipped labels can cause noticeable outliers in the uploaded updates, making them easy to detect and eliminate.

    “Label-flipping-based attacks have low attack costs, but the flipped labels can cause noticeable outliers in the uploaded updates, making them easy to detect and eliminate [123].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [123] Rosenfeld, Certified robustness to label-flipping attacks via randomized smoothing

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § A. Backdoor Attack Methods · p. 27

    Data poisoning backdoor attack shows a relatively lower attack cost, and model poisoning attack has a better attack accuracy rate and longer backdoor life span.

    “Compared to data poisoning with model poisoning, data poisoning backdoor attack shows a relatively lower attack cost, and model poisoning attack has a better attack accuracy rate and longer backdoor life span.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § A. Backdoor Attacks on WFL · p. 28

    The local model training process is difficult to tamper with, and the effects of a backdoor can be quickly diluted if compromised clients are not frequently selected.

    “The local model training process is difficult to tamper with, and the effects of a backdoor can be quickly diluted if compromised clients are not frequently selected.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 27

    With a higher knowledge level known by the attacker, the attack success rate is higher as well.

    “With a higher knowledge level known by the attack, the attack success rate is higher as well.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 27

    The attack cost will dramatically increase with higher knowledge level.

    “In return, the attack cost will also dramatically increase.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § A. Backdoor Attacks on WFL · p. 28

    Backdoor attacks during the model aggregation phase have the highest success rate but also the highest cost.

    “Backdoor attacks during the model aggregation phase have the highest success rate but also the highest cost [212].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [212] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 27

    Within data poisoning attacks, label flipping is one of the easiest attack methods, resulting in a lower success rate, and can be easily detected.

    “Within the data poisoning attack, label flipping is one of the easiest attack methods, resulting in a lower success rate, and can be easily detected.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Backdoor Defense · p. 27

    The defender usually clips the contribution from suspicious clients to get rid of the backdoor effect.

    “The defender usually clips the contribution from suspicious clients to get rid of the backdoor effect.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning
    § B. Backdoor Defense · p. 27

    The defender is hard to trace back to the compromised client and leaves it out of the network.

    “The defender is hard to trace back to the compromised client and leaves it out of the network.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § B. Backdoor Defense · p. 27

    A newly trained classifier to distinguish adversarial input requires information on all possible backdoor patterns, and the defense cost is high.

    “Such a newly trained classifier requires information on all possible backdoor patterns, and the defense cost is high.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § A. Backdoor Attacks on WFL · p. 28

    Trigger-based attacks also create outliers, but these can be designed based on the target label to decrease the likelihood of detection.

    “Trigger-based attacks also create outliers, but these can be designed based on the target label to decrease the likelihood of detection.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given
    § B. Backdoor Defense · p. 27

    All defense methods inherently eliminate the suspicious backdoor effect by clipping the possible malicious updates, inevitably a portion of honest updates will be neglected by mistake.

    “Since all defense methods inherently eliminate the suspicious backdoor effect by clipping the possible malicious updates, inevitably, a portion of honest updates will be neglected by mistake.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given
    § B. Backdoor Defense · p. 27

    In clipping, some honest information will be miss-clipped, and the main task accuracy will be influenced.

    “In this process, some honest information will be miss-clipped, and the main task accuracy will be influenced.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § A. Backdoor Attack Methods · p. 27

    A trigger-based backdoor is the most adopted one, and with the proper design trigger pattern, the attack performance will be greatly improved.

    “A trigger-based backdoor is the most adopted one, and with the proper design trigger pattern, the attack performance will be greatly improved.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given
    § B. Defense Methods in WFL · p. 30

    Defense methods based on differential privacy (DP) can add noise to the model, which can degrade its performance.

    “Defense methods based on differential privacy (DP) can add noise to the model, which can degrade its performance.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 29

    Considering all possible backdoor patterns to achieve good defense performance can be costly, and the defense may not be able to detect novel attacks.

    “However, considering all possible backdoor patterns to achieve good defense performance can be costly, and the defense may not be able to detect novel attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 29

    This type of defense is effective in defending against black-box backdoor attacks and can be used with a secure aggregation protocol.

    “This type of defense is effective in defending against black-box backdoor attacks and can be used with a secure aggregation protocol.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    The training process of WFL is random, which raises questions about the reliability of historic values.

    “However, the training process of WFL is random, which raises questions about the reliability of historic values.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning
    § A. Backdoor Attacks on WFL · p. 28

    Such a coordinated attack is still based on the black box model, resulting in limited attack strength.

    “However, such a coordinated attack is still based on the black box model, resulting in limited attack strength.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    The defense requires the attacker to participate in every training round, which may not be practical.

    “Additionally, the defense requires the attacker to participate in every training round, which may not be practical.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    The non-IID structure of WFL frameworks can make it challenging to defend against backdoor attacks while preserving the privacy and security of participants.

    “Furthermore, the non-IID structure of WFL frameworks can make it challenging to defend against backdoor attacks while preserving the privacy and security of participants.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning
    § A. Backdoor Attacks on WFL · p. 29

    Imbalanced data distribution will have a significant impact on model update calculation and upload.

    “Such imbalanced data distribution will have a significant impact on model update calculation and upload.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § A. Backdoor Attacks on WFL · p. 29

    In WCN, the data distribution among different devices is normally imbalanced.

    “It is noted that in the WCN, the data distribution among different devices is normally imbalanced.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § VIII. CONCLUSION · p. 30

    Data poisoning-based backdoor attacks require limited prior information on the entire model, which contributes to a decreasing attack cost.

    “Since limited prior information on the entire model is required, it contributes to a decreasing attack cost.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    The model difference among nodes within the decentralized network could be significant.

    “The model difference among nodes within the decentralized network could be significant.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § B. Defense Methods in WFL · p. 30

    In decentralized WFL, each node acts as both a contributor and a server.

    “In decentralized WFL, each node acts as both a contributor and a server.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisereasoning
    § B. Defense Methods in WFL · p. 30

    Each model can only obtain part of the network information from its neighbors or selected remote nodes.

    “Each model can only obtain part of the network information from its neighbors or selected remote nodes.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning
    § B. Defense Methods in WFL · p. 30

    It is hard to broadcast a global defender to monitor all the nodes.

    “It is hard to broadcast a global defender to monitor all the nodes.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning
    § B. Defense Methods in WFL · p. 30

    The attacker can take advantage of such unfairness and increase the attack success rate.

    “Moreover, the attacker can take advantage of such unfairness and increase the attack success rate.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning
    § B. Defense Methods in WFL · p. 30

    This approach requires the knowledge of the malicious clients and all possible backdoor patterns, which can be difficult to obtain in a WFL setting where the data is non-IID.

    “However, this approach requires the knowledge of the malicious clients and all possible backdoor patterns, which can be difficult to obtain in a WFL setting where the data is non-IID.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning
    § B. Defense Methods in WFL · p. 30

    During the training process of WFL in the WCN, it is challenging to ensure synchronization and consistency among all devices.

    “During the training process of WFL in the WCN, it is challenging to ensure synchronization and consistency among all devices.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § B. Defense Methods in WFL · p. 30

    The existing similarity-based norm clipping methods may not function properly in decentralized WFL.

    “The existing similaritybased norm clipping methods may not function properly.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given
    § B. Defense Methods in WFL · p. 30

    WFL is featured for its large number of participating devices and different types of devices, and devices might have limited computation abilities.

    “WFL is featured for its large number of participating devices and different types of devices, and devices might have limited computation abilities.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisenone given
    § B. Defense Methods in WFL · p. 30

    There is no central server in the decentralized WFL framework.

    “On the other hand, there is no central server in the decentralized WFL framework.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    The transmission delay or package loss during wireless communication can cause uploaded local model updates to drop and further influence the global model convergence.

    “The transmission delay or package loss during the wireless communication can cause uploaded local model updates to drop and further influence the global model convergence.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § VIII. CONCLUSION · p. 31

    Model poisoning-based backdoor attacks require the attacker to fully control one or more participants.

    “For the model poisoning-based backdoor attacks, the attacker needs to fully control one or more participants.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § B. Defense Methods in WFL · p. 30

    An 'unlearning' model aims to eliminate the residual effects of the backdoor by excluding the influence of suspicious participants and has been shown to be effective.

    “One such approach is the use of an 'unlearning' model, which aims to eliminate the residual effects of the backdoor by excluding the influence of suspicious participants and has been shown to be effective [225], [256], [257].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [225] source

      Not checked in the free run.

    • cites [256] source

      Not checked in the free run.

    • cites [257] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § B. Defense Methods in WFL · p. 30

    Backdoor patterns are easier to parasite within a network and gradually propagate and spread throughout the network.

    “Backdoor patterns are easier to parasite within a network and gradually propagate and spread throughout the network.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § VIII. CONCLUSION · p. 31

    Based on different defense stages, the defender can filter malicious updates from compromised clients controlled by the attacker, either systematically or statistically.

    “Based on different defense stages, the defender can filter the malicious updates from the compromised clients controlled by the attacker, either systematically or statistically.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning
    § VIII. CONCLUSION · p. 31

    Some information in the genuine model will be clipped, which impacts the model's performance.

    “Inevitably, some information in the genuine model will be clipped, which impacts the model's performance.”
    Quote in the paperSubstantial claim
197 of 197

  • The paper relies on this without support.

    The security threats induced by WCN are inevitable when discussing the influence of backdoor attacks on WFL.

    “Nevertheless, the security threats induced by WCNare inevitable when discussing the influence of backdoor attacks on WFL.”

  • The paper relies on this without support.

    The training datasets of WFL participants are non-independent and identically distributed (non-IID).

    “The training datasets of WFL participants are non-independent and identically distributed (non-IID).”

  • The paper relies on this without support.

    The broadcast nature of wireless (radio) channels allows misbehaved or compromised participants in WFL to overhear the local model parameters of multiple or all benign participants.

    “Particularly, the broadcast nature of wireless (radio) channels allows misbehaved or compromised participants in WFL to overhear the local model parameters of multiple or all benign participants.”

  • The paper relies on this without support.

    The malicious attacker cannot inject completed backdoor patterns in a short time.

    “The malicious attacker cannot inject completed backdoor patterns in a short time, thus improving the robustness of the global model.”

  • The authors state this as an assumption.

    The methods in [215]-[218] assume that the attacker is malicious all the time and uploads adversarial models in every round.

    “The methods proposed in [215]-[218] assume that the attacker should be malicious all the time. The attacker needs to upload adversarial models in every round.”

  • The paper relies on this without support.

    In practical scenarios, the attacker can decide to inject the backdoor at a random round.

    “In practical scenarios, the attacker can decide to inject the backdoor at a random round.”

  • The authors state this as an assumption.

    The attacker knows all possible defense patterns, can conduct attacks at any time, and multiple attackers can conduct coordinated attacks.

    “It is assumed that the attacker knows all possible defense patterns, can conduct attacks at any time, and multiple attackers can conduct coordinated attacks.”

  • The authors state this as an assumption.

    Defense mechanisms working on the server side are more powerful than those on the client side.

    “It is reasonable to assume that the defense mechanisms working on the server side are more powerful than those on the client side.”

  • The authors state this as an assumption.

    If the attacker could make use of data imbalances and intentionally control compromised clients to acquire more data from the WCN, the trigger rate will increase.

    “If the attacker could make use of such imbalances and intentionally control compromised clients to acquire more data from the WCN, it is reasonable to assume that the trigger rate will also increase.”
9 of 9

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Untargeted poisoning aims to degrade model efficiency globally, risking patient results over the board.

    “Untargeted poisoning, in contrast, aims to degrade model efficiency globally, risking patient results over the board [72,76].”

    From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [76]

    The survey’s “Backdoor Attack Methods” section (p. 27) contrasts degradation of global-model performance with targeted backdoor attacks, supporting the general distinction in the claim. It does not connect untargeted poisoning to patient outcomes, so the claimed risk to patients is not supported by this source. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Data manipulation attacks are crucial threats in federated learning, particularly in healthcare.

    “Data manipulation attacks are crucial threats in FL, particularly in healthcare.”

    From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [76]

    The Introduction (p. 2) calls poisoning attacks on wireless federated learning a crucial threat to detect and suppress. The Introduction (p. 1) also lists healthcare as a field where wireless federated learning is used, but it does not say these attacks are particularly threatening in healthcare. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • In targeted poisoning attacks, malicious contributors corrupt the model to misidentify specific data, which could be used to target certain diseases or demographic groups.

    “In targeted poisoning attacks, malicious contributors corrupt the model to misidentify specific data, which could be utilized to target certain diseases or demographic groups.”

    From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [76]

    The survey’s “Backdoor Attack Methods” section (p. 27) says targeted attacks make a global model classify a poisoned sample into a chosen target class, supporting the misidentification part of the claim. Our copy does not connect these attacks to targeting particular diseases or demographic groups. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Canon example cites an unrelated reference title

    Minor

    The Canon printer account cites [34], whose listed title concerns backdoors in AccessPress themes and plugins rather than Canon printers.

  • Total client count is assigned to both m and N

    Minor

    Table II defines N as the total number of clients and m as the number selected for an iteration. The performance-analysis section instead calls m the total number of clients.

  • MAR is defined both to include malicious inputs and to use only clean inputs

    Minor

    The evaluation-metrics section includes outputs from backdoored inputs in MAR, whereas the experimental section says MAR is prediction accuracy on clean inputs.

  • Table IV excludes multiple clients from local model replacement

    Minor

    Table IV marks the Multiple compromised-client column × for local model replacement, but Table VII says this attack can control one or multiple compromised clients.

  • Before-aggregation defense is located on both client and server

    Minor

    The summary says defenses before aggregation are mounted on the client side, but the section's norm-clipping defense has the central server scale client updates.

  • Lifespan table reports BAR, not the stated MAR

    Minor

    The text says Table XI records changes in main task accuracy (MAR), but the table labels all three measured columns as backdoor accuracy rate (BAR).

6 of 6

Cites

Flagged first, then by citations

Research works printed but not linked: 6

  1. Eilertsen, Backdoor found in themes and plugins from accesspress themes
  2. Odirichukwu, 2021, Interoperable protocols of the Internet of Things and Internet of Robotic Things: A review, Int. J. Comput. Intell. Security Res., 1, 101
  3. Haji, 2021, Comparison of optimization techniques based on gradient descent algorithm: A review, PalArch’s J. Archaeol. Egypt/Egyptol., 18, 2715
  4. Lu, Where to attack: A dynamic locator model for backdoor attack in text classifications, 984
  5. Pan, Hidden trigger backdoor attack on NLP models via linguistic style manipulation, 3611
  6. Qi, Revisiting the assumption of latent separability for backdoor defenses, 1

Cited by

Sorted by citations

Related

Authors
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E.
Affiliations
  • Deakin University (AU)
  • Commonwealth Scientific and Industrial Research Organisation (AU)
  • Qilu University of Technology (CN)
  • University of Manitoba (CA)
ORCID
Venue
IEEE Communications Surveys & Tutorials
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2024
Volume
26
Issue
3
Pages
1861-1897
ISSN
  • 1553-877X (ISSN-L)
  • 2373-745X
DOI
10.1109/comst.2024.3361451
OpenAlex
W4391620743
Semantic Scholar
fa4382fa8a7e59ef46b11293d30848a388650f07
Cited by
152
References
251
Citations by year
2026: 53 · 2025: 79 · 2024: 20
FWCI
22.38
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Communications Surveys & Tutorials (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • Figshare (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
  • National Key Research and Development Program of China (2022ZD0116800)
  • Taishan Scholars Program (TSQNZ20230621, TSQN202211214)
  • Shandong Excellent Young Scientists Fund Program (2023HWYQ-113)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
wireless federated learning, backdoor attacks, data poisoning, model poisoning, non-IID data, defense mechanisms, malicious participants, model aggregation, federated learning security, privacy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review