The DOI matches its Crossref record; 38 of the 38 references it cites were found in a registry or an index; none of the 16 sources its claims cite is checked for support yet.
Data Poisoning Attacks on Federated Machine Learning
Open accessAbstract
Federated machine learning which enables resource-constrained node devices (e.g., Internet of Things (IoT) devices and smartphones) to establish a knowledge-shared model while keeping the raw data local, could provide privacy preservation, and economic benefit by designing an effective communication protocol. However, this communication protocol can be adopted by attackers to launch data poisoning attacks for different nodes, which has been shown as a big threat to most machine learning models. Therefore, we in this article intend to study the model vulnerability of federated machine learning, and even on IoT systems. To be specific, we here attempt to attacking a popular federated multitask learning framework, which uses a general multitask learning framework to handle statistical challenges in the federated learning setting. The problem of calculating optimal poisoning attacks on federated multitask learning is formulated as a bilevel program, which is adaptive to the arbitrary selection oftargetnodes andsource attackingnodes. We then propose a novel systems-aware optimization method, called as attack on federated learning (AT2FL), to efficiently derive the implicit gradients for poisoned data, and further attain optimal attack strategies in the federated machine learning. This is an earlier work, to our knowledge, that explores attacking federated machine learning via data poisoning. Finally, experiments on several real-world data sets demonstrate that when the attackers directly poison thetargetnodes or indirectly poison the related nodes via using the communication protocol, the federated multitask learning model is sensitive to both poisoning attacks.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper studies data poisoning attacks on federated machine learning, focusing on a federated multi-task learning framework. It formulates optimal attacks as a bilevel program and proposes AT²FL to compute poisoned data that degrades target-node performance, including indirect attacks via the communication protocol.
Key findings
- Direct attacks substantially degrade performance: on EndAD and Human Activity, classification Error deteriorates by 21.707% and 26.836%, respectively, compared with non-attack baselines.
- The proposed attack strategies outperform random attacks in most cases, e.g., direct attack Error on EndAD is 28.588 ± 3.74 vs. random direct 7.659 ± 1.14; on Human Activity, 29.422 ± 2.96 vs. random direct 3.275 ± 0.71.
- Indirect attacks are generally weaker than direct and hybrid attacks, but can work when node correlations are high; the paper reports Landmine indirect attack Error of 7.428 ± 0.39 vs. non-attack 5.682 ± 0.28, and attributes this to high correlation in its Ω matrix.
- Attack effectiveness increases with the ratio of injected data, and AT²FL converges to a local optimum after a few iterations across the tested attack types.
Methods
- The paper formulates poisoning attacks on federated multi-task learning as a bilevel optimization problem, with upper-level poisoned data and lower-level federated multi-task learning, covering direct, indirect, and hybrid attacks.
- It proposes ATTack on Federated Learning (AT²FL), a projected stochastic gradient ascent method that computes implicit gradients for poisoned data using dual variables for least-square and hinge losses.
- Experiments use five datasets: EndAD (6 nodes), Human Activity Recognition (30 nodes), Landmine (29 nodes), Parkinson-Total, and Parkinson-Motor (42 regression tasks each); metrics are classification Error and RMSE, averaged over 10 random runs, with injected data set to 20% of clean data and step size η₁ = 100, λ₁ = λ₂ = 0.001.
Limitations
- The paper does not state limitations explicitly; it notes future work on vertical (feature-based) federated learning and federated transfer learning.
- Evident from the text: the study is limited to horizontal federated multi-task learning and does not evaluate defenses or other federated learning settings.
- Evident from the text: the attack assumes the attacker can inject poisoned data into source nodes and exploit the communication protocol, and the empirical evaluation is limited to the selected datasets and tasks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
17 Own interpretation · 11 Not checked yet · 11 No basis given · 10 Own result
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When comparing with the random attack strategies, our proposed attack strategies can obtain better deterioration performance among most cases for the federated machine learning problems”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For all the used datasets, the performances under different attack strategies are decreased with the increasing of the injected data.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This observation indicates the reason why indirect attack strategy performs better on the Landmine dataset when comparing with other used datasets.”
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Meanwhile, the classification Error on the test data obtains the upper bound when the ratio of injected data is 10% .”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the indirect attack strategy, we can notice its performances are not good as direct and hybrid attack strategies, e.g., Human Activity Recognition dataset.”
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“All the attack strategies ( e.g., direct attacks, random attacks, etc) have the impact on all the datasets”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As illustrated in Figure 3, the nodes from N tar and N sou have highly correlated in Landmine dataset, i.e., Figure 3(c).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the node correlations in the Parkinson dataset ( i.e., Figure 3(d)) are not close.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among all the attack strategies, notice that the direct attacks can significantly damage the classification or regression on all the datasets.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Indirect attack almost has no effect on EndAD dataset since the values of correlation matrix Ω for this dataset are relatively low, and each node can learn good classifier without the help of other nodes;”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 10
- The quote only partly states this claim. 1
- Probably not a substantial claim. 12
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In our bilevel formulation Eq. (3), although the upper level problem is a simple primal problem, the lower level problem is highly non-linear and non-convex.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The experiment results strongly support our proposed model when attacking federated machine learning based on the communication protocol.”
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
“The experiment results indicate that the communication protocol among multiple nodes opens a door for attacker to attack federated machine learning.”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one. The quote only partly states this claim.
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The lower level problem in the Eq. (3) is a federated multi-task learning problem with training set consisting of both clean and injected data points.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“the training data it can handle are with the following properties [12]: 1) Non-IID : data on each node/device may be drawn from a different distribution; 2) Unbalanced : the number of training samples for different nodes/devices may vary by orders of magnitude.”
What the sources say
- Not checked yetcites [12] source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“we follow the setting of most data poisoning attack strategies ( e.g., [5], [21]), and design a projected stochastic gradient ascent based algorithm that efficiently maximally increases the empirical loss of target nodes, and further damages their classification/regression performance.”
What the sources say
- Not checked yetcites [5] Biggio, Poisoning attacks against support vector machines
- Not checked yetcites [21] Liu, 2018, FADL:Federated-autonomous deep learning for distributed electronic health record, arXiv:1811.11400
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“From the equation above, we can notice that the first term on the right side can be easily computed since it depends only on the loss function L t ( · ) .”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Notice that there is no closed-form relation between the empirical loss and the injected data, so we intend to compute the gradients by exploiting the optimality conditions of the subproblem.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
In the paper
“The representative work is a multi-task style federated learning system [15], which is proposed to allow multiple nodes to complete separate tasks while preserving security and sharing knowledge”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
In the paper
“From the equation above, we can notice that solving for matrix Ω is not dependent on the data and therefore can be computed centrally; one major contribution of [15] is an efficient distributed optimization method for the W step.”
What the sources say
- Not checked yetcites [15] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Then we propose a novel systems-aware optimization method, ATTack on Federated Learning (AT 2 FL), which is efficiency to derive the implicit gradients for poisoned data, and further compute optimal attack strategies in the federated machine learning.”
- Also stated in: § I. INTRODUCTION · p. 2 · plain
“we thus design a novel optimization method, ATTack on Federated Learning (AT 2 FL), to derive the implicit gradients for computing poisoned data in the source attacking nodes. Furthermore, the obtained gradient can be effectively used to compute the optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § I. INTRODUCTION · p. 2 · plain
In the paper
“W and α could be connected via defining the next formulation by following [14]:”
What the sources say
- Not checked yetcites [14] source
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“we focus on the recently-proposed federated multi-task learning framework [15], a federated learning framework which captures node relationships among multiple nodes to tackle the statistical challenges in the federated setting.”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the second term on the right side depends on the optimality conditions of lower level problem of Eq. (3).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Furthermore, the update of W can be achieved by extending works on distributed primal-dual optimization [14].”
What the sources say
- Not checked yetcites [14] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Based on the distribution characteristics of the data, federated learning [18] can be categorized into: 1) horizontal (sample-based) federated learning, i.e., datasets share the same feature space but different in samples.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“2) vertical (feature-based) federated learning, i.e., two datasets share the same sample ID space but differ in feature space.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“3) federated transfer learning, i.e., two datasets differ not only in samples but also in feature space.”
What the sources say
- Not checked yetcites [18] Konečnỳ, 2015, Federated optimization:Distributed optimization beyond the datacenter, arXiv:1511.03575
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Also stated in: § II. RELATED WORK · p. 2 · plain
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We derive an effective optimization method, i.e., ATTack on Federated Learning (AT 2 FL), to solve the optimal attack problem, which can address systems challenges associated with federated machine learning.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“we propose a bilevel data poisoning attacks formulation by following general data poisoning attacks framework, where it can include three different kinds of attacks.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a key contribution of this work, we design a ATTack on Federated Learning (AT 2 FL) to address the system challenges ( e.g., high communication cost) existing in federated setting, and further compute optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper relies on this without support.
The attempt to make federated learning more reliable under poisoning attacks is still scarce.
“Although recent improvements have been focusing on overcoming the statistical challenges ( i.e., the data collected across the network are in a non-IID manner, where the data on each node are generated by a distinct distribution) or improving privacypreserving, the attempt that makes federated learning more reliability under poisoning attacks, is still scarce.”
The paper relies on this without support.
Current optimization methods for the bilevel problem are not suited to tackle systems challenges that exist in federated learning, such as high communication cost and stragglers.
“However, current optimization methods for this bilevel problem are not suited to tackle the systems challenges ( e.g., high communication cost, stragglers) that exist in federated learning.”
The authors state this as an assumption.
The attacker aims to degrade the performance of a set of target nodes by injecting corrupted/poisoned data to a set of source attacking nodes.
“Suppose that the attacker aims to degrade the performance of a set of target nodes N tar ⊂ m by injecting corrupted/poisoned data to a set of source attacking nodes N sou ⊂ m .”
The authors state this as an assumption.
The communication protocol in federated learning is bridged by the model relationship matrix Ω.
“where the communication protocol is bridged by the model relationship matrix Ω in this paper.”
The paper relies on this without support.
The benchmark datasets used are representative of real-world applications.
“Extensive experiments demonstrate that the attack strategies computed by AT 2 FL can significantly damage performances of real-world applications.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [77]
In the citing paper
“Moreover, polynomial approximations need to be made to evaluate non-linear functions in machine learning algorithms, resulting in a trade-off between utility and privacy [79], [80].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [79]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ B. Evaluating Attack Strategies · p. 6
“Direct attacks: all the source attacking nodes N sou are set as the same as the target nodes, i.e., N sou = N tar .”
§ C. Sensitivity Study and Convergence Analysis · p. 6
“For each dataset, we take the same attack setting as that in Table II, e.g., for the direct attack, the N tar and N sou are selected by randomly selecting half of nodes as N tar , and the rest of nodes to form N sou .”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ I. INTRODUCTION · p. 1
“exploratory attacks influence learning via controlling over training data”
§ I. INTRODUCTION · p. 1
“exploratory attacks can take use of misclassifications without affecting training”
Citations
Cites
Advances in neural information processing systems 7
(1996) · Computers & Mathematics with Applications · doi:10.1016/s0898-1221(96)90463-0 · Cited by 14,759
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Return of the Devil in the Details: Delving Deep into Convolutional Nets
Chatfield, K., Simonyan, K., Vedaldi, A., & Zisserman, A. (2014) · Proceedings of the British Machine Vision Conference 2014 · doi:10.5244/c.28.6 · Cited by 3,335
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733
Secure, privacy-preserving and federated machine learning in medical imaging
Kaissis, G. A., Makowski, M. R., Rückert, D., & Braren, R. F. (2020) · Nature Machine Intelligence · doi:10.1038/s42256-020-0186-1 · Cited by 1,676
Federated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563
Federated Learning for Healthcare Informatics
Xu, J., Glicksberg, B. S., Su, C., Walker, P., Bian, J., & Wang, F. (2021) · Journal of Healthcare Informatics Research · doi:10.1007/s41666-020-00082-4 · Cited by 1,542
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Regularized multi--task learning
Evgeniou, T., & Pontil, M. (2004) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1014052.1014067 · Cited by 1,473
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Research works printed but not linked: 1
- Caldas, Federated kernelized multi-task learning, 1
Cited by
Sorted by citations
Items 101–200 of 310
FedGuard: Selective Parameter Aggregation for Poisoning Attack Mitigation in Federated Learning
Chelli, M., Prigent, C., Schubotz, R., Costan, A., Antoniu, G., Cudennec, L., & Slusallek, P. (2023) · IEEE International Conference on Cluster Computing (CLUSTER) · doi:10.1109/cluster52292.2023.00014 · Cited by 15
Toward Cleansing Backdoored Neural Networks in Federated Learning
Wu, C., Yang, X., Zhu, S., & Mitra, P. (2022) · 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs54860.2022.00084 · Cited by 12
Smart grid security through fusion-enhanced federated learning against adversarial attacks
Shabbir, A., Manzoor, H. U., Zoha, A., & Halim, Z. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.111169 · Cited by 12
Covert Channel Attack to Federated Learning Systems.Preprint
Costa, G., Pinelli, F., Soderi, S., & Tolomei, G. (2021) · arXiv (Cornell University) · Cited by 12
MITDBA: Mitigating Dynamic Backdoor Attacks in Federated Learning for IoT Applications
Wang, Y., Zhai, D., Han, D., Guan, Y., & Xia, Y. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3325634 · Cited by 12
Lavaur, L., Busnel, Y., & Autrel, F. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3670434 · Cited by 12
Zhao, H., Geng, L., Feng, W., & Changming, Z. H. O. U. (2024) · Chinese Journal of Aeronautics · doi:10.1016/j.cja.2024.06.023 · Cited by 11
A Secure Object Detection Technique for Intelligent Transportation Systems
Mia, M. J., & Amini, M. H. (2024) · IEEE Open Journal of Intelligent Transportation Systems · doi:10.1109/ojits.2024.3440876 · Cited by 11
Guan, M., Bao, H., Li, Z., Pan, H., Huang, C., & Dai, H. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103304 · Cited by 11
Privacy preserving federated learning with convolutional variational bottlenecks
Scheliga, D., Mäder, P., & Seeland, M. (2025) · Cybersecurity · doi:10.1186/s42400-024-00295-9 · Cited by 14
Majeed, A., Patni, S., & Hwang, S. O. (2025) · Electronics · doi:10.3390/electronics14112106 · Cited by 14
Distributed Learning in Healthcare
Tuladhar, A., Rajashekar, D., & Forkert, N. D. (2022) · Integrated science · doi:10.1007/978-3-031-11199-0_10 · Cited by 11
Incentive-Driven Federated Learning and Associated Security Challenges: A Systematic ReviewPreprint
Ali, A., Ilahi, I., Qayyum, A., Mohammed, I., Al‐Fuqaha, A., & Qadir, J. (2021) · doi:10.36227/techrxiv.14945433 · Cited by 13
Multi-agent Learning for Resilient Distributed Control Systems
Zhao, Y., Rieger, C. G., & Zhu, Q. (2025) · Power electronics and power systems · doi:10.1007/978-3-031-73978-1_10 · Cited by 10
Avoid attacks: A Federated Data Sanitization Defense in IoMT Systems
Chen, C., Gao, Y., Huang, S., & Yan, X. (2023) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps57453.2023.10225791 · Cited by 10
Xu, Y., Zhang, S., Lyu, C., Liu, J., Shen, Y., & Shiratori, N. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3474299 · Cited by 11
Self-citationBlockchain Based Secure Federated Learning With Local Differential Privacy and Incentivization
Chaudhury, S. D., Morreddigari, L. R., Varun, M., Sengupta, T., Chakraborty, S., Sural, S., Vaidya, J. S., & Atluri, V. (2024) · IEEE Transactions on Privacy · doi:10.1109/tp.2024.3487819 · Cited by 11
Federated Learning for 6G Security: A Survey on Threats, Solutions, and Research Directions
de Alwis, C., Aouedi, O., Xu, J., Wang, S., Siriwardhana, Y., Hewa, T. M., Zeydan, E., Sandeepa, C., & Liyanage, M. (2026) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2026.3663434 · Cited by 16
Yang, D., Luo, S., Zhou, J., Pan, L., Yang, X., & Xing, J. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119743 · Cited by 9
Cybersecurity Challenges and Solutions in IoT-based Precision Farming Systems
Balaji, S. R. A., Rao, S. P., & Ranganathan, P. (2023) · IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON) · doi:10.1109/uemcon59035.2023.10316154 · Cited by 9
Defending against Poisoning Attack in Federated Learning Using Isolated Forest
Huang, S., Bai, Y. Z., Wang, Z., & Liu, P. (2022) · International Conference on Computer, Control and Robotics (ICCCR) · doi:10.1109/icccr54399.2022.9790094 · Cited by 8
Low dimensional secure federated learning framework against poisoning attacks
Erdöl, E. S., Üstübioğlu, B., Erdöl, H., & Ulutaş, G. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.04.017 · Cited by 8
Harmonizing Global and Local Class Imbalance for Federated Learning
Zhu, J., Zheng, H., Xu, W., Wang, H., He, Z., Liu, Y., Wang, S., & Sun, Q. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3476340 · Cited by 8
Robust Federated Learning Against Data Poisoning Attacks: Prevention and Detection of Attacked Nodes
Ovi, P. R., & Gangopadhyay, A. (2025) · Electronics · doi:10.3390/electronics14152970 · Cited by 8
Malpetti, D., Scutari, M., Gualdi, F., van Setten, J., van der Laan, S. W., Haitjema, S., Lee, A. M., Hering, I., & Mangili, F. (2025) · Frontiers in Digital Health · doi:10.3389/fdgth.2025.1644291 · Cited by 12
Zhang, L., Fan, L., Luo, Y., & Duan, L. (2022) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3523059 · Cited by 8
Using Anomaly Detection to Detect Poisoning Attacks in Federated Learning ApplicationsPreprint
Raza, A., Tran, K. P., Koehl, L., Li, S., & Tran, K. D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4811423 · Cited by 8
Poisoning Attacks on Federated Learning for Autonomous Driving
Garg, S., Jönsson, H., Kalander, G., Nilsson, A., Pirange, B., Valadi, V., & Östman, J. (2024) · Linköping electronic conference proceedings · doi:10.3384/ecp208002 · Cited by 9
Robustness Against Data Integrity Attacks in Decentralized Federated Load Forecasting
Shabbir, A., Manzoor, H. U., Manzoor, M. Z., Hussain, S., & Zoha, A. (2024) · Electronics · doi:10.3390/electronics13234803 · Cited by 7
Kaushal, V., & Sharma, S. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02339-z · Cited by 9
FLCom: Robust federated learning against strong model poisoning attacks
Li, Y., Xu, J., & Yang, D. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111442 · Cited by 9
Rezaie, H., Taheri, R., Nowroozi, E., Hajizadeh, M., Shiaeles, S. N., & Bauschert, T. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2025.3644477 · Cited by 11
Dib, M. A. D. S., Prates, P. A., & Ribeiro, B. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121139 · Cited by 7
Jodayree, M., He, W., & Janicki, R. (2023) · Procedia Computer Science · doi:10.1016/j.procs.2023.10.264 · Cited by 7
Data Poisoning Attacks and Mitigation Strategies on Federated Support Vector Machines
Mouri, I. J., Ridowan, M., & Adnan, M. A. (2024) · SN Computer Science · doi:10.1007/s42979-023-02556-9 · Cited by 7
Defending Against Data and Model Backdoor Attacks in Federated Learning
Wang, H., Mu, X., Wang, D., Xu, Q., & Li, K. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3415628 · Cited by 6
Securing Federated Learning in IoT: A Survey of Attacks, Defenses, and Frameworks
Atia, O. B., Samara, M. A., Bennis, I., Gaber, J., Abouaïssa, A., & Lorenz, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600617 · Cited by 6
Analysis on Security and Privacy-preserving in Federated Learning
Li, J., Li, X., & Zhang, C. (2022) · Highlights in Science Engineering and Technology · doi:10.54097/hset.v4i.923 · Cited by 6
Efficient and Privacy-Preserving Integrity Verification for Federated Learning with TEEs
Li, J., Chen, N., Yu, S., & Srivatanakul, T. (2024) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom61039.2024.10773815 · Cited by 6
A Verifiable, Privacy-Preserving, and Poisoning Attack-Resilient Federated Learning Framework
Mbonu, W. E., Maple, C. R., Epiphaniou, G., & Panchev, C. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9040085 · Cited by 7
OCTOPUS: Overcoming Performance and Privatization Bottlenecks in Distributed Learning
Wang, S., Nepal, ., Moore, K., Grobler, M. M., Rudolph, C., & Abuadbba, A. (2022) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2022.3157258 · Cited by 6
Incentive-Driven Federated Learning and Associated Security Challenges: A Systematic ReviewPreprint
Ali, A. M., Ilahi, I., Qayyum, A., Mohammed, I., Al‐Fuqaha, A., & Qadir, J. (2021) · doi:10.36227/techrxiv.14945433.v1 · Cited by 6
Detection of Physiological Data Tampering Attacks with Quantum Machine Learning
Onim, M. S. H., & Thapliyal, H. (2025) · IEEE International Symposium on Circuits and Systems proceedings · doi:10.1109/iscas56072.2025.11043495 · Cited by 5
Chen, L., Zhai, W., Bu, X., Sun, M., & Zhu, C. (2025) · Drones · doi:10.3390/drones9080528 · Cited by 5
Jiang, J., Hao, F., Gu, T., Wang, K., Liu, X., & Wen, Z. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3657365 · Cited by 5
SoK: Systematizing Attack Studies in Federated Learning – From Sparseness to Completeness
Sharma, G., Chamikara, M. A. P., Chhetri, M. B., & Chen, Y. P. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3590328 · Cited by 6
Boi, B., Santis, M. D., & Esposito, C. (2024) · IEEE International Symposium on Real-Time Distributed Computing (ISORC) · doi:10.1109/isorc61049.2024.10551371 · Cited by 5
Logits Poisoning Attack in Federated Distillation
Tang, Y., Wu, Z., Gao, B., Wen, T., Wang, Y., & Sun, S. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-5498-4_22 · Cited by 5
Secure Federated Dataset Distillation
Arazzi, M., Cihangiroglu, M., Nicolazzo, S., & Nocera, A. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.111911 · Cited by 8
Liu, I., Li, J.-S., Peng, Y.-C., & Liu, C.-G. (2022) · Applied Sciences · doi:10.3390/app12157753 · Cited by 6
Security Enhanced Federated Learning Approach using Blockchain
Revathy, S., & Priya, S. S. (2022) · International Conference on Computer, Power and Communications (ICCPC) · doi:10.1109/iccpc55978.2022.10072091 · Cited by 5
Wang, S., & Zhang, Y. (2023) · Measurement Science and Technology · doi:10.1088/1361-6501/acf7da · Cited by 6
Sun, K., Liu, L., Pan, Q., Li, J., & Wu, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3409610 · Cited by 6
Gao, H., Pan, X., Zhang, X., Ye, K., Zhang, P., & Sun, L. (2023) · International Conference on Computer Science and Communication Technology (ICCSCT) · doi:10.1117/12.3009373 · Cited by 5
A Security-Oriented Overview of Federated Learning Utilizing Layered Reference Model
Lu, J., Fukumoto, N., & Nakao, A. (2024) · IEEE Access · doi:10.1109/access.2024.3404948 · Cited by 5
Recovering Traceability Links Between Code and Documentation: A Retrospective
Antoniol, G., Canfora, G., Casazza, G., Lucia, A. D., & Merlo, E. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3534027 · Cited by 4
FedMAR: A Privacy-Preserving and Robust Server-Side Multistage Federated Learning
Shi, L., Gao, Y., Chen, C., Huang, S., Zhao, J., Hu, X., & Leung, V. C. M. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600099 · Cited by 4
Addressing data quality decompensation in federated learning via dynamic client selection
Fei, Q., Rodríguez-Barroso, N., Luzón, M. V., Zhang, Z.-L., & Herrera, F. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.108138 · Cited by 5
Wang, J., Yu, J., Yang, H., Zhu, Y., Jiang, L., Li, X., Zhang, J., & Xu, Y. (2025) · npj Digital Medicine · doi:10.1038/s41746-025-02196-8 · Cited by 5
Malware Aware UAV-Assisted Data Collection and Processing in Solar-Powered IoT Networks
He, T., Zheng, M., Chin, K., Liu, T., & Luo, Y. (2026) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3644942 · Cited by 4
Zhou, S., Chen, Y., Liang, W., Li, K., & Zomaya, A. Y. (2026) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2026.3688316 · Cited by 4
Wu, Y., Chen, J., Lei, T., Jia-hua, Y., & Hossain, M. S. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.06.022 · Cited by 4
Singh, P. (2024) · Biomedical Signal Processing and Control · doi:10.1016/j.bspc.2024.107320 · Cited by 4
Data Poisoning Attacks over Diabetic Retinopathy Images Classification
Martinelli, F., Mercaldo, F., Giammarco, M. D., & Santone, A. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386903 · Cited by 4
PraaKrum: A Practical Byzantine-Resilient Federated Learning Algorithm
Kukreja, P., & Mahendran, V. (2024) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets59351.2024.10427404 · Cited by 5
PrSeFL: Achieving Practical Privacy and Robustness in Blockchain-Based Federated Learning
Xiao, Y., Xu, L., Wu, Y. X., Sun, J., & Zhu, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3454087 · Cited by 4
Label Flipping Attacks on Federated Learning: GAN-Based Poisoning and Countermeasures
Abdullah, M., Bapu, V., Akash, K. A., Khan, A. H., & Bhargavi, M. S. (2024) · International Conference on Data Science and Network Security (ICDSNS) · doi:10.1109/icdsns62112.2024.10690919 · Cited by 4
Assessing adversarial attacks in real-world fraud detection
Lunghi, D., Simitsis, A., & Bontempi, G. (2024) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws62655.2024.00021 · Cited by 5
Enhancing Trajectory Recovery From Gradients via Mobility Prior Knowledge
Zhang, K., Fan, Z., Song, X., & Yu, S. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3221964 · Cited by 4
CSFL: Cooperative Security Aware Federated Learning Model Using The Blockchain
Zhang, J., Ye, A., Chen, J., Zhang, Y., & Yang, W. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad060 · Cited by 4
An Efficient Distributed Intrusion Detection System in IoT: GAN-Based Attacks and a Countermeasure
Gupta, N., Shojafar, M., Foh, C. H., & Tafazolli, R. (2023) · IEEE International Conference on Communications workshops · doi:10.1109/iccworkshops57953.2023.10283577 · Cited by 4
PARL: Poisoning Attacks Against Reinforcement Learning-based Recommender Systems
Du, L., Yuan, Q., Chen, M., Sun, M., Cheng, P., Chen, J., & Zhang, Z. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3637660 · Cited by 3
Zhu, J., Shao, M., Sun, L., & Xia, S. (2024) · The Visual Computer · doi:10.1007/s00371-024-03548-3 · Cited by 3
Li, X., Tao, X., Chen, G., You, L., & Sun, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3573910 · Cited by 4
A Review on Fuzzy Cognitive Mapping: Recent Advances and Algorithms
Nápoles, G., Jastrzębska, A., Grau, I., Salgueiro, Y., & León, M. (2026) · Big Data and Cognitive Computing · doi:10.3390/bdcc10010022 · Cited by 3
Chen, B., Wang, Y., Santos, L., Yang, X., Liu, C., & Im, S. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3662349 · Cited by 7
An Investigation of Recent Backdoor Attacks and Defenses in Federated Learning
Chen, Q., & Tao, Y. (2023) · International Conference on Fog and Mobile Edge Computing (FMEC) · doi:10.1109/fmec59375.2023.10306127 · Cited by 3
RobFL: Robust Federated Learning via Feature Center Separation and Malicious Center Detection
Zhou, T., Liu, N., Song, B., Lv, H., Guo, D., & Liu, L. (2024) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde60146.2024.00076 · Cited by 3
Fed-HA: A Privacy-Preserving Robust Federated Learning Scheme based on Homomorphic Assessment
Xu, W., Xu, X., & Wang, H. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104144 · Cited by 4
Data complexity-based batch sanitization method against poison in distributed learning
Wang, S., Fan, K., Zhang, K., Li, H., & Yang, Y. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.12.001 · Cited by 3
Bhadle, R. V., & Rathod, D. (2023) · Biennial International Conference on Nascent Technologies in Engineering (ICNTE) · doi:10.1109/icnte56631.2023.10146665 · Cited by 3
DEFENSES FOR MACHINE LEARNING MODELS FROM ADVERSARIAL ATTACKS
Григорьевна, Ф. С., & Bezzateev, S. V. (2023) · T-Comm - Телекоммуникации и Транспорт · doi:10.36724/2072-8735-2023-17-10-28-42 · Cited by 5
Performance Analysis of Gradient Inversion Attack in Federated Learning with Healthcare Systems
Dao, T.-N., & Nguyen, T. P. (2023) · REV Journal on Electronics and Communications · doi:10.21553/rev-jec.338 · Cited by 4
Counterfactual Explanations and Federated Learning for Enhanced Data Analytics Optimisation
Hasan, S. I., Nimmy, S. F., & Kamal, M. S. (2024) · Springer tracts in nature-inspired computing · doi:10.1007/978-981-97-0353-1_2 · Cited by 3
BATFL: Battling Backdoor Attacks in Federated Learning
Kumar, M., Agrawal, R., & Singh, P. (2023) · International Conference on Security of Information and Networks (SIN) · doi:10.1109/sin60469.2023.10474981 · Cited by 3
JamholeHunter: On detecting new wormhole attack in Opportunistic Mobile Networks
Altaweel, A., Aslam, S., & Kamel, I. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103953 · Cited by 3
Comprehensive Artificial Intelligence Vulnerability Taxonomy
Pispa, A., & Halunen, K. (2024) · European Conference on Cyber Warfare and Security · doi:10.34190/eccws.23.1.2157 · Cited by 2
Integrity Verifiable Privacy-preserving Federated Learning for Healthcare-IoT
Li, J., & Yu, S. (2024) · IEEE International Conference on e-Health Networking, Applications and Services (Healthcom) · doi:10.1109/healthcom60970.2024.10880846 · Cited by 2
Zhang, H., Zhou, H., Elsayed, M., Bavand, M., Gaigalas, R., Ozcan, Y., & Erol‐Kantarci, M. (2025) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2025.3563157 · Cited by 2
Liu, X., Li, B., Chen, S., & Xu, Z. (2025) · Electronics · doi:10.3390/electronics14122401 · Cited by 2
A Review of Federated Learning Attacks: Threat Models and Defence Strategies
Zakaria, F., & Khalid, S. K. (2025) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2025.0160754 · Cited by 2
NAAFL: A Non-Authoritative Anarchic Federated Learning for Defending Against Malicious Attacks
Xiu, R., Le, J., Zhang, D., Lü, Q., Xiang, T., & Liao, X. (2025) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2025.3605384 · Cited by 2
Zhou, R., Wang, Z., Yang, S., He, D., & Chan, S. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114804 · Cited by 2
A blockchain-based privacy-preserving reputation consensus federated learning
Guo, J., Liu, R., & Xing, J. (2025) · Alexandria Engineering Journal · doi:10.1016/j.aej.2025.11.016 · Cited by 2
Machine learning for resilience analysis: a review of systems under cyberattacks
Yin, R., & Varga, L. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.113542 · Cited by 2
Defense Strategies in Federated Learning Against Adversarial Attacks
Rezaei, H., Taheri, R., & Nowroozi, E. (2026) · Springer eBooks · doi:10.1007/978-3-031-99447-0_17 · Cited by 2
A privacy-preserving and byzantine-robust consensus for blockchain Federated Learning
Feng, L., Liu, M., Jing, Z., Yao, S., Li, H., & Yu, Y. (2026) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2026.114589 · Cited by 3
MPHM: Model poisoning attacks on federal learning using historical information momentum
Shi, L., Chen, Z., Shi, Y., Lin, W., Tao, Y., He, M., Wang, Q., Zhou, Y. H., & Gao, Y. (2023) · Security and Safety · doi:10.1051/sands/2023006 · Cited by 2
Self-citationSecDefender: Detecting low-quality models in multidomain federated learning systems
Sameera, K. M., Sgueglia, A., Vinod, P., A., R. R. K., Visaggio, C. A., Sorbo, A. D., & Conti, M. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107587 · Cited by 2
Securing Machine Learning Against Data Poisoning Attacks
Allheeib, N. (2024) · International Journal of Data Warehousing and Mining · doi:10.4018/ijdwm.358335 · Cited by 4
Metadata
- Authors
- Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J.
- Affiliations
- Shenyang Institute of Automation (CN)
- Sony (Japan) (JP)
- Kuaishou (China) (CN)
- Venue
- IEEE Internet of Things Journal
- Published
- 2022-07-01
- Volume
- 9
- Issue
- 13
- Pages
- 11365-11375
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3213330817
- Cited by
- 310
- References
- 37
- Citations by year
- 2026: 43 · 2025: 79 · 2024: 78 · 2023: 64 · 2022: 32
- FWCI
- 16.19
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (62003336, 62073205)
- National Postdoctoral Innovative Talents Support Program (BX20200353)
- State Key Laboratory of Robotics (2022-Z06)
- Nature Foundation of Liaoning Province of China (2020-KF-11-01)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- data poisoning, federated learning, bi-level optimization, Internet of Things security, privacy preservation, model vulnerability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
