The DOI matches its Crossref record; 38 of the 38 references it cites were found in a registry or an index; none of the 16 sources its claims cite is checked for support yet.
Data Poisoning Attacks on Federated Machine Learning
Open accessAbstract
Federated machine learning which enables resource-constrained node devices (e.g., Internet of Things (IoT) devices and smartphones) to establish a knowledge-shared model while keeping the raw data local, could provide privacy preservation, and economic benefit by designing an effective communication protocol. However, this communication protocol can be adopted by attackers to launch data poisoning attacks for different nodes, which has been shown as a big threat to most machine learning models. Therefore, we in this article intend to study the model vulnerability of federated machine learning, and even on IoT systems. To be specific, we here attempt to attacking a popular federated multitask learning framework, which uses a general multitask learning framework to handle statistical challenges in the federated learning setting. The problem of calculating optimal poisoning attacks on federated multitask learning is formulated as a bilevel program, which is adaptive to the arbitrary selection oftargetnodes andsource attackingnodes. We then propose a novel systems-aware optimization method, called as attack on federated learning (AT2FL), to efficiently derive the implicit gradients for poisoned data, and further attain optimal attack strategies in the federated machine learning. This is an earlier work, to our knowledge, that explores attacking federated machine learning via data poisoning. Finally, experiments on several real-world data sets demonstrate that when the attackers directly poison thetargetnodes or indirectly poison the related nodes via using the communication protocol, the federated multitask learning model is sensitive to both poisoning attacks.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper studies data poisoning attacks on federated machine learning, focusing on a federated multi-task learning framework. It formulates optimal attacks as a bilevel program and proposes AT²FL to compute poisoned data that degrades target-node performance, including indirect attacks via the communication protocol.
Key findings
- Direct attacks substantially degrade performance: on EndAD and Human Activity, classification Error deteriorates by 21.707% and 26.836%, respectively, compared with non-attack baselines.
- The proposed attack strategies outperform random attacks in most cases, e.g., direct attack Error on EndAD is 28.588 ± 3.74 vs. random direct 7.659 ± 1.14; on Human Activity, 29.422 ± 2.96 vs. random direct 3.275 ± 0.71.
- Indirect attacks are generally weaker than direct and hybrid attacks, but can work when node correlations are high; the paper reports Landmine indirect attack Error of 7.428 ± 0.39 vs. non-attack 5.682 ± 0.28, and attributes this to high correlation in its Ω matrix.
- Attack effectiveness increases with the ratio of injected data, and AT²FL converges to a local optimum after a few iterations across the tested attack types.
Methods
- The paper formulates poisoning attacks on federated multi-task learning as a bilevel optimization problem, with upper-level poisoned data and lower-level federated multi-task learning, covering direct, indirect, and hybrid attacks.
- It proposes ATTack on Federated Learning (AT²FL), a projected stochastic gradient ascent method that computes implicit gradients for poisoned data using dual variables for least-square and hinge losses.
- Experiments use five datasets: EndAD (6 nodes), Human Activity Recognition (30 nodes), Landmine (29 nodes), Parkinson-Total, and Parkinson-Motor (42 regression tasks each); metrics are classification Error and RMSE, averaged over 10 random runs, with injected data set to 20% of clean data and step size η₁ = 100, λ₁ = λ₂ = 0.001.
Limitations
- The paper does not state limitations explicitly; it notes future work on vertical (feature-based) federated learning and federated transfer learning.
- Evident from the text: the study is limited to horizontal federated multi-task learning and does not evaluate defenses or other federated learning settings.
- Evident from the text: the attack assumes the attacker can inject poisoned data into source nodes and exploit the communication protocol, and the empirical evaluation is limited to the selected datasets and tasks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
17 Own interpretation · 11 Not checked yet · 11 No basis given · 10 Own result
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When comparing with the random attack strategies, our proposed attack strategies can obtain better deterioration performance among most cases for the federated machine learning problems”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For all the used datasets, the performances under different attack strategies are decreased with the increasing of the injected data.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This observation indicates the reason why indirect attack strategy performs better on the Landmine dataset when comparing with other used datasets.”
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Meanwhile, the classification Error on the test data obtains the upper bound when the ratio of injected data is 10% .”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the indirect attack strategy, we can notice its performances are not good as direct and hybrid attack strategies, e.g., Human Activity Recognition dataset.”
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“All the attack strategies ( e.g., direct attacks, random attacks, etc) have the impact on all the datasets”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As illustrated in Figure 3, the nodes from N tar and N sou have highly correlated in Landmine dataset, i.e., Figure 3(c).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the node correlations in the Parkinson dataset ( i.e., Figure 3(d)) are not close.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among all the attack strategies, notice that the direct attacks can significantly damage the classification or regression on all the datasets.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Indirect attack almost has no effect on EndAD dataset since the values of correlation matrix Ω for this dataset are relatively low, and each node can learn good classifier without the help of other nodes;”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 10
- The quote only partly states this claim. 1
- Probably not a substantial claim. 12
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In our bilevel formulation Eq. (3), although the upper level problem is a simple primal problem, the lower level problem is highly non-linear and non-convex.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The experiment results strongly support our proposed model when attacking federated machine learning based on the communication protocol.”
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
“The experiment results indicate that the communication protocol among multiple nodes opens a door for attacker to attack federated machine learning.”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one. The quote only partly states this claim.
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The lower level problem in the Eq. (3) is a federated multi-task learning problem with training set consisting of both clean and injected data points.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“the training data it can handle are with the following properties [12]: 1) Non-IID : data on each node/device may be drawn from a different distribution; 2) Unbalanced : the number of training samples for different nodes/devices may vary by orders of magnitude.”
What the sources say
- Not checked yetcites [12] source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“we follow the setting of most data poisoning attack strategies ( e.g., [5], [21]), and design a projected stochastic gradient ascent based algorithm that efficiently maximally increases the empirical loss of target nodes, and further damages their classification/regression performance.”
What the sources say
- Not checked yetcites [5] Biggio, Poisoning attacks against support vector machines
- Not checked yetcites [21] Liu, 2018, FADL:Federated-autonomous deep learning for distributed electronic health record, arXiv:1811.11400
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“From the equation above, we can notice that the first term on the right side can be easily computed since it depends only on the loss function L t ( · ) .”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Notice that there is no closed-form relation between the empirical loss and the injected data, so we intend to compute the gradients by exploiting the optimality conditions of the subproblem.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
In the paper
“The representative work is a multi-task style federated learning system [15], which is proposed to allow multiple nodes to complete separate tasks while preserving security and sharing knowledge”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
In the paper
“From the equation above, we can notice that solving for matrix Ω is not dependent on the data and therefore can be computed centrally; one major contribution of [15] is an efficient distributed optimization method for the W step.”
What the sources say
- Not checked yetcites [15] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Then we propose a novel systems-aware optimization method, ATTack on Federated Learning (AT 2 FL), which is efficiency to derive the implicit gradients for poisoned data, and further compute optimal attack strategies in the federated machine learning.”
- Also stated in: § I. INTRODUCTION · p. 2 · plain
“we thus design a novel optimization method, ATTack on Federated Learning (AT 2 FL), to derive the implicit gradients for computing poisoned data in the source attacking nodes. Furthermore, the obtained gradient can be effectively used to compute the optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § I. INTRODUCTION · p. 2 · plain
In the paper
“W and α could be connected via defining the next formulation by following [14]:”
What the sources say
- Not checked yetcites [14] source
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“we focus on the recently-proposed federated multi-task learning framework [15], a federated learning framework which captures node relationships among multiple nodes to tackle the statistical challenges in the federated setting.”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the second term on the right side depends on the optimality conditions of lower level problem of Eq. (3).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Furthermore, the update of W can be achieved by extending works on distributed primal-dual optimization [14].”
What the sources say
- Not checked yetcites [14] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Based on the distribution characteristics of the data, federated learning [18] can be categorized into: 1) horizontal (sample-based) federated learning, i.e., datasets share the same feature space but different in samples.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“2) vertical (feature-based) federated learning, i.e., two datasets share the same sample ID space but differ in feature space.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“3) federated transfer learning, i.e., two datasets differ not only in samples but also in feature space.”
What the sources say
- Not checked yetcites [18] Konečnỳ, 2015, Federated optimization:Distributed optimization beyond the datacenter, arXiv:1511.03575
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Also stated in: § II. RELATED WORK · p. 2 · plain
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We derive an effective optimization method, i.e., ATTack on Federated Learning (AT 2 FL), to solve the optimal attack problem, which can address systems challenges associated with federated machine learning.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“we propose a bilevel data poisoning attacks formulation by following general data poisoning attacks framework, where it can include three different kinds of attacks.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a key contribution of this work, we design a ATTack on Federated Learning (AT 2 FL) to address the system challenges ( e.g., high communication cost) existing in federated setting, and further compute optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper relies on this without support.
The attempt to make federated learning more reliable under poisoning attacks is still scarce.
“Although recent improvements have been focusing on overcoming the statistical challenges ( i.e., the data collected across the network are in a non-IID manner, where the data on each node are generated by a distinct distribution) or improving privacypreserving, the attempt that makes federated learning more reliability under poisoning attacks, is still scarce.”
The paper relies on this without support.
Current optimization methods for the bilevel problem are not suited to tackle systems challenges that exist in federated learning, such as high communication cost and stragglers.
“However, current optimization methods for this bilevel problem are not suited to tackle the systems challenges ( e.g., high communication cost, stragglers) that exist in federated learning.”
The authors state this as an assumption.
The attacker aims to degrade the performance of a set of target nodes by injecting corrupted/poisoned data to a set of source attacking nodes.
“Suppose that the attacker aims to degrade the performance of a set of target nodes N tar ⊂ m by injecting corrupted/poisoned data to a set of source attacking nodes N sou ⊂ m .”
The authors state this as an assumption.
The communication protocol in federated learning is bridged by the model relationship matrix Ω.
“where the communication protocol is bridged by the model relationship matrix Ω in this paper.”
The paper relies on this without support.
The benchmark datasets used are representative of real-world applications.
“Extensive experiments demonstrate that the attack strategies computed by AT 2 FL can significantly damage performances of real-world applications.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [77]
In the citing paper
“Moreover, polynomial approximations need to be made to evaluate non-linear functions in machine learning algorithms, resulting in a trade-off between utility and privacy [79], [80].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [79]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ B. Evaluating Attack Strategies · p. 6
“Direct attacks: all the source attacking nodes N sou are set as the same as the target nodes, i.e., N sou = N tar .”
§ C. Sensitivity Study and Convergence Analysis · p. 6
“For each dataset, we take the same attack setting as that in Table II, e.g., for the direct attack, the N tar and N sou are selected by randomly selecting half of nodes as N tar , and the rest of nodes to form N sou .”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ I. INTRODUCTION · p. 1
“exploratory attacks influence learning via controlling over training data”
§ I. INTRODUCTION · p. 1
“exploratory attacks can take use of misclassifications without affecting training”
Citations
Cites
Advances in neural information processing systems 7
(1996) · Computers & Mathematics with Applications · doi:10.1016/s0898-1221(96)90463-0 · Cited by 14,759
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Return of the Devil in the Details: Delving Deep into Convolutional Nets
Chatfield, K., Simonyan, K., Vedaldi, A., & Zisserman, A. (2014) · Proceedings of the British Machine Vision Conference 2014 · doi:10.5244/c.28.6 · Cited by 3,335
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733
Secure, privacy-preserving and federated machine learning in medical imaging
Kaissis, G. A., Makowski, M. R., Rückert, D., & Braren, R. F. (2020) · Nature Machine Intelligence · doi:10.1038/s42256-020-0186-1 · Cited by 1,676
Federated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563
Federated Learning for Healthcare Informatics
Xu, J., Glicksberg, B. S., Su, C., Walker, P., Bian, J., & Wang, F. (2021) · Journal of Healthcare Informatics Research · doi:10.1007/s41666-020-00082-4 · Cited by 1,542
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Regularized multi--task learning
Evgeniou, T., & Pontil, M. (2004) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1014052.1014067 · Cited by 1,473
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Federated Multi-Task LearningPreprint
Smith, V., Chiang, C.-K., Sanjabi, M., & Talwalkar, A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1705.10467 · Cited by 1,282
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194
Adversarial Attacks on Neural Networks for Graph Data
Zügner, D., Akbarnejad, A., & Günnemann, S. (2018) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3219819.3220078 · Cited by 997
Can machine learning be secure?
Barreno, M., Nelson, B. A., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1128817.1128824 · Cited by 852
The security of machine learning
Barreno, M., Nelson, B. A., Joseph, A. D., & Tygar, J. D. (2010) · Machine Learning · doi:10.1007/s10994-010-5188-5 · Cited by 839
Verifynet: Secure and verifiable federated learning
Xu, G., Li, H., Liu, S., Yang, K., & Lin, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2929409 · Cited by 839
Return of the Devil in the Details: Delving Deep into Convolutional NetsPreprint
Chatfield, K., Simonyan, K., Vedaldi, A., et al. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1405.3531 · Cited by 663
Federated Optimization:Distributed Optimization Beyond the DatacenterPreprint
Konečný, J., McMahan, B., & Ramage, D. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1511.03575 · Cited by 547
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 472
Coupled Multi-Layer Attentions for Co-Extraction of Aspect and Opinion Terms
Wang, W., Pan, S. J., Dahlmeier, D., & Xiao, X. (2017) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v31i1.10974 · Cited by 439
Accelerated proximal stochastic dual coordinate ascent for regularized loss minimization
Shalev‐Shwartz, S., & Zhang, T. (2014) · Mathematical Programming · doi:10.1007/s10107-014-0839-0 · Cited by 387
Yu, S., Chen, X., Zhou, Z., Gong, X., & Wu, D. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3026589 · Cited by 362
Addressing Class Imbalance in Federated Learning
Wang, L., Xu, S., Wang, X., & Zhu, Q. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i11.17219 · Cited by 306
Accelerated Projected Gradient Method for Linear Inverse Problems with Sparsity Constraints
Daubechies, I., Fornasier, M., & Loris, I. (2008) · Journal of Fourier Analysis and Applications · doi:10.1007/s00041-008-9039-8 · Cited by 258
Data poisoning attacks on factorization-based collaborative filtering
Li, B., Wang, Y., Singh, A., & Vorobeychik, Y. (2016) · arXiv · doi:10.48550/arxiv.1608.08182 · Cited by 235
Data Poisoning Attacks against Autoregressive Models
Alfeld, S., Zhu, X., & Barford, P. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10237 · Cited by 205
Variational Federated Multi-Task LearningPreprint
Corinzia, L., Beuret, A., & Buhmann, J. M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.06268 · Cited by 198
What Can Be Transferred: Unsupervised Domain Adaptation for Endoscopic Lesions Segmentation
Dong, J., Cong, Y., Sun, G., Zhong, B., & Xu, X. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00408 · Cited by 149
Self-citationFederated Learning for Task and Resource Allocation in Wireless High-Altitude Balloon Networks
Wang, S., Chen, M., Yin, C., Saad, W., Hong, C. S., Cui, S. R., & Poor, H. V. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3080078 · Cited by 106
Secure Linear Regression on Vertically Partitioned Datasets.Preprint
Gascón, A., Schoppmann, P., Balle, B., Raykova, M., Doerner, J., Zahur, S., & Evans, D. (2016) · IACR Cryptology ePrint Archive · Cited by 94
Privacy-Preserving Gradient-Descent Methods
Han, S., Ng, W. K., Wan, L., & Lee, V. C. S. (2010) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2009.153 · Cited by 70
Fadl Federated-autonomous deep learning for distributed electronic health record
Liu, D., Miller, T., Sayeed, R., & Mandl, K. D. (2018) · arXiv · doi:10.48550/arxiv.1811.11400 · Cited by 65
On lightweight privacy-preserving collaborative learning for internet-of-things objects
Jiang, L., Tan, R., Lou, X., & Lin, G. (2019) · IEEE/ACM International Conference on Internet-of-Things Design and Implementation (IoTDI) · doi:10.1145/3302505.3310070 · Cited by 56
A Flexible Privacy-Preserving Data Sharing Scheme in Cloud-Assisted IoT
Deng, H., Qin, Z., Sha, L., & Yin, H. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2999350 · Cited by 56
Federated Data Cleaning: Collaborative and Privacy-Preserving Data Cleaning for Edge Intelligence
Ma, L., Pei, Q., Zhou, L., Zhu, H., Wang, L., & Ji, Y. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3027980 · Cited by 48
Joint Household Characteristic Prediction via Smart Meter Data
Sun, G., Cong, Y., Hou, D., Fan, H., Xu, X., & Yu, H. (2017) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2017.2778428 · Cited by 43
Self-citationOptimizing Personalized Email Filtering Thresholds to Mitigate Sequential Spear Phishing Attacks
Zhao, M., An, B., & Kiekintveld, C. D. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10030 · Cited by 38
Data Poisoning Attacks on Multi-Task Relationship Learning
Zhao, M., An, B., Yu, Y., Liu, S., & Pan, S. J. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11838 · Cited by 37
Research works printed but not linked: 1
- Caldas, Federated kernelized multi-task learning, 1
Cited by
Sorted by citations
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548
Self-citationDitto: Fair and Robust Federated Learning Through PersonalizationPreprint
Li, T., Hu, S., Beirami, A., & Smith, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.04221 · Cited by 536
Ghimire, B., & Rawat, D. B. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3150363 · Cited by 520
Distributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 439
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362
Metadata
- Authors
- Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J.
- Affiliations
- Shenyang Institute of Automation (CN)
- Sony (Japan) (JP)
- Kuaishou (China) (CN)
- Venue
- IEEE Internet of Things Journal
- Published
- 2022-07-01
- Volume
- 9
- Issue
- 13
- Pages
- 11365-11375
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3213330817
- Cited by
- 310
- References
- 37
- Citations by year
- 2026: 43 · 2025: 79 · 2024: 78 · 2023: 64 · 2022: 32
- FWCI
- 16.19
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (62003336, 62073205)
- National Postdoctoral Innovative Talents Support Program (BX20200353)
- State Key Laboratory of Robotics (2022-Z06)
- Nature Foundation of Liaoning Province of China (2020-KF-11-01)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- data poisoning, federated learning, bi-level optimization, Internet of Things security, privacy preservation, model vulnerability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
