Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environments
Open accessAbstract
The main premise of federated learning (FL) is that machine learning model updates are computed locally to preserve user data privacy. This approach avoids by design user data to ever leave the perimeter of their device. Once the updates aggregated, the model is broadcast to all nodes in the federation. However, without proper defenses, compromised nodes can probe the model inside their local memory in search for adversarial examples, which can lead to dangerous real-world scenarios. For instance, in image-based applications, adversarial examples consist of images slightly perturbed to the human eye getting misclassified by the local model. These adversarial images are then later presented to a victim node's counterpart model to replay the attack. Typical examples harness dissemination strategies such as altered traffic signs (patch attacks) no longer recognized by autonomous vehicles or seemingly unaltered samples that poison the local dataset of the FL scheme to undermine its robustness. PELTA is a novel shielding mechanism leveraging Trusted Execution Environments (TEEs) that reduce the ability of attackers to craft adversarial samples. PELTA masks inside the TEE the first part of the back-propagation chain rule, typically exploited by attackers to craft the malicious samples. We evaluate PELTA on state-of-the-art accurate models using three well-established datasets: CIFAR-10, CIFAR-100 and ImageNet. We show the effectiveness of PELTA in mitigating six white-box state-of-the-art adversarial attacks, such as Projected Gradient Descent, Momentum Iterative Method, Auto Projected Gradient Descent, the Carlini & Wagner attack. In particular, PELTA constitutes the first attempt at defending an ensemble model against the Self-Attention Gradient attack to the best of our knowledge. Our code is available to the research community at https://github.com/queyrusi/Pelta
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Trusted Execution Environments such as GradSec safely conceal critical parameter values during inference to prevent adversary interventions.
“Trusted Execution Environments (TEEs), like GradSec, safely conceal critical parameter values during inference to prevent adversary interventions [74].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [74]
Cites
Jakubův, J., Chvalovský, K., Goertzel, Z., et al. (2023) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.itp.2023.19 · Cited by 76,648 · see citing works
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. (2020) · arXiv · doi:10.48550/arxiv.2010.11929 · Cited by 21,793 · see citing works
Visualizing and understanding convolutional networks
Zeiler, M. D., & Fergus, R. (2014) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-10590-1_53 · Cited by 15,839 · see citing works
Kaugeranna, R., Kaugeranna, E., & Aion, (. S. 4. 6. (2023) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.giscience.2023.43 · Cited by 13,695 · see citing works
Identity mappings in deep residual networks
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-46493-0_38 · Cited by 10,741 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723 · see citing works
Boosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,168 · see citing works
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176 · see citing works
Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
Bengio, Y., Léonard, N., & Courville, A. (2013) · arXiv · doi:10.48550/arxiv.1308.3432 · Cited by 1,910 · see citing works
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
BEiT: BERT Pre-Training of Image Transformers
Bao, H., Dong, L., Piao, S., & Wei, F. (2021) · arXiv · doi:10.48550/arxiv.2106.08254 · Cited by 1,392 · see citing works
A guide to convolution arithmetic for deep learningPreprint
Dumoulin, V., & Visin, F. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.07285 · Cited by 1,223 · see citing works
Big Transfer (BiT): General Visual Representation Learning
Kolesnikov, A., Beyer, L., Zhai, X., Puigcerver, J., Yung, J., Gelly, S., & Houlsby, N. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58558-7_29 · Cited by 1,039 · see citing works
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacksPreprint
Croce, F., & Hein, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.01690 · Cited by 965 · see citing works
Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelism
Shoeybi, M., Patwary, M., Puri, R., LeGresley, P., Casper, J., & Catanzaro, B. (2019) · arXiv · doi:10.48550/arxiv.1909.08053 · Cited by 893 · see citing works
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
Adversarial Attacks and Defenses in Deep Learning
Ren, K., Zheng, T., Qin, Z., & Liu, X. (2020) · Engineering · doi:10.1016/j.eng.2019.12.012 · Cited by 678 · see citing works
Recent Advances in Adversarial Training for Adversarial Robustness
Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021) · Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/591 · Cited by 490 · see citing works
Recent Advances in Adversarial Training for Adversarial Robustness
Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021) · arXiv · doi:10.48550/arxiv.2102.01356 · Cited by 490 · see citing works
Attention Bottlenecks for Multimodal Fusion
Nagrani, A., Yang, S., Arnab, A., Jansen, A., Schmid, C., & Sun, C. (2021) · arXiv · doi:10.48550/arxiv.2107.00135 · Cited by 400 · see citing works
Towards Reverse-Engineering Black-Box Neural Networks
Oh, S. J., Schiele, B., & Fritz, M. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-28954-6_7 · Cited by 291 · see citing works
Mo, F., Haddadi, H., Katevas, K., Marin, E., Perino, D., & Kourtellis, N. (2021) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3458864.3466628 · Cited by 291 · see citing works
An Analysis of Encoder Representations in Transformer-Based Machine Translation
Raganato, A., & Tiedemann, J. (2018) · Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks for NLP · doi:10.18653/v1/w18-5431 · Cited by 277 · see citing works
Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives
Liu, P., Xu, X., & Wang, W. (2022) · Cybersecurity · doi:10.1186/s42400-021-00105-6 · Cited by 261 · see citing works
On the Robustness of Vision Transformers to Adversarial Examples
Mahmood, K., Mahmood, R., & van Dijk, M. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00774 · Cited by 217 · see citing works
Mo, F., Shamsabadi, A. S., Katevas, K., Demetriou, S., Ilias Leontiadis, A., Cavallaro, A., & Haddadi, H. (2020) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3386901.3388946 · Cited by 193 · see citing works
Adversarial Training Can Hurt GeneralizationPreprint
Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., & Liang, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.06032 · Cited by 185 · see citing works
Contrastive Learning Rivals Masked Image Modeling in Fine-tuning via Feature DistillationPreprint
Wei, Y., Hu, H., Xie, Z., Zhang, Z., Cao, Y., Bao, J., Chen, D., & Guo, B. (2022) · arXiv.org · doi:10.48550/arxiv.2205.14141 · Cited by 148 · see citing works
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service
Hanzlik, L., Zhang, Y., Grosse, K., Salem, A., Augustin, M., Michael Backes, A., & Fritz, M. (2021) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00368 · Cited by 106 · see citing works
The Limitations of Adversarial Training and the Blind-Spot AttackPreprint
Zhang, H., Chen, H., Song, Z., Boning, D. S., Dhillon, I. S., & Hsieh, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.04684 · Cited by 103 · see citing works
Qian, Z., Huang, K., Wang, Q., & Zhang, X.-Y. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.108889 · Cited by 101 · see citing works
Regaining Lost Cycles with HotCalls: A Fast Interface for SGX Secure Enclaves
Weisse, O., Bertacco, V., & Austin, T. (2017) · ACM SIGARCH Computer Architecture News · doi:10.1145/3140659.3080208 · Cited by 47 · see citing works
Securing Input Data of Deep Learning Inference Systems via Partitioned Enclave Execution.Preprint
Gu, Z., Huang, H., Zhang, J., et al. (2018) · arXiv (Cornell University) · Cited by 45 · see citing works
An Efficient Preprocessing-Based Approach to Mitigate Advanced Adversarial Attacks
Qiu, H., Zeng, Y., Zheng, Q., Guo, S., Zhang, T., & Li, H. (2021) · IEEE Transactions on Computers · doi:10.1109/tc.2021.3076826 · Cited by 39 · see citing works
WaTZ: A Trusted WebAssembly Runtime Environment with Remote Attestation for TrustZone
Ménétrey, J., Pasin, M., Felber, P. A., et al. (2022) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs54860.2022.00116 · Cited by 36 · see citing works
Self-citationOn the Performance of ARM TrustZone
Amacher, J., & Schiavoni, V. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-22496-7_9 · Cited by 33 · see citing works
Self-citationMore Data Can Expand the Generalization Gap Between Adversarially Robust and Standard ModelsPreprint
Chen, L., Min, Y., Zhang, M., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.04725 · Cited by 33 · see citing works
Why adversarial training can hurt robust accuracyPreprint
Clarysse, J., Hörrmann, J., & Yang, F. (2022) · International Conference on Learning Representations · doi:10.48550/arxiv.2203.02006 · Cited by 26 · see citing works
Scaling Language Model Size in Cross-Device Federated Learning
Ro, J., Breiner, T., McConnaughey, L., Chen, M., Suresh, A., Kumar, S., & Mathews, R. (2022) · doi:10.18653/v1/2022.fl4nlp-1.2 · Cited by 25 · see citing works
Lessons on Parameter Sharing across Layers in TransformersPreprint
Takase, S., & Kiyono, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.06022 · Cited by 24 · see citing works
Privacy Leakage of Adversarial Training Models in Federated Learning Systems
Zhang, J., Chen, Y., & Li, H. H. (2022) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw56347.2022.00021 · Cited by 22 · see citing works
Shielding federated learning systems against inference attacks with ARM TrustZone
Messaoud, A. A., Mokhtar, S. B., Nitu, V., & Schiavoni, V. (2022) · International Middleware Conference · doi:10.1145/3528535.3565255 · Cited by 20 · see citing works
Self-citationMULDEF: Multi-model-based Defense Against Adversarial Examples for Neural NetworksPreprint
Srisakaokul, S., Zhang, Y., Zhong, Z., et al. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.00065 · Cited by 16 · see citing works
Optimized trusted execution for hard real-time applications on COTS processors
Mukherjee, A., Mishra, T., Chantem, T., et al. (2019) · International Conference on Real-Time Networks and Systems (RTNS) · doi:10.1145/3356401.3356419 · Cited by 14 · see citing works
Robust Federated Learning Against Adversarial Attacks for Speech Emotion RecognitionPreprint
Chang, Y., Laridi, S., Ren, Z., et al. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2203.04696 · Cited by 13 · see citing works
Black-Box Adversarial Attacks on Deep Neural Networks: A Survey
Wang, C., Zhang, M., Zhao, J., & Kuang, X. (2022) · International Conference on Data Intelligence and Security (ICDIS) · doi:10.1109/icdis55630.2022.00021 · Cited by 13 · see citing works
Distributed Non-Convex Optimization with Sublinear Speedup under Intermittent Client AvailabilityPreprint
Yan, Y., Niu, C., Ding, Y., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.07399 · Cited by 10 · see citing works
Image reconstruction attacks on distributed machine learning models
Benkraouda, H., & Nahrstedt, K. (2021) · doi:10.1145/3488659.3493779 · Cited by 8 · see citing works
Real-Time Scheduling of TrustZone-enabled DNN Workloads
Babar, M. F., & Hasan, M. (2022) · doi:10.1145/3560826.3563386 · Cited by 7 · see citing works
Mitigating Adversarial Attacks by Distributing Different Copies to Different UsersPreprint
Zhang, J., Fang, H., Tann, W. J.-W., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.15160 · Cited by 3 · see citing works
Demystifying the Adversarial Robustness of Random Transformation DefensesPreprint
Sitawarin, C., Golan-Strieb, Z., & Wagner, D. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2207.03574 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Abbas, S. R., Abbas, Z., Zahir, A., & Lee, S. W. (2024) · Healthcare · doi:10.3390/healthcare12242587 · Cited by 228 · see citing works
- Authors
- Queyrut, S., Schiavoni, V., & Felber, P.
- Affiliations
- University of Neuchâtel (CH)
- Venue
- 2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS)
- Publisher
- IEEE
- Published
- 2023-07
- Pages
- 626-637
- OpenAlex
- W4387544261
- Cited by
- 18
- References
- 59
- Citations by year
- 2026: 1 · 2025: 11 · 2024: 6
- FWCI
- 3.19
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE International Conference on Distributed Computing Systems (ICDCS) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- federated learning, trusted execution environments, adversarial attacks, adversarial example generation, pelta, white-box attacks, ensemble learning, data privacy, model robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
