The DOI matches its Crossref record; 38 of the 38 references it cites were found in a registry or an index; none of the 16 sources its claims cite is checked for support yet.
Data Poisoning Attacks on Federated Machine Learning
Open accessAbstract
Federated machine learning which enables resource-constrained node devices (e.g., Internet of Things (IoT) devices and smartphones) to establish a knowledge-shared model while keeping the raw data local, could provide privacy preservation, and economic benefit by designing an effective communication protocol. However, this communication protocol can be adopted by attackers to launch data poisoning attacks for different nodes, which has been shown as a big threat to most machine learning models. Therefore, we in this article intend to study the model vulnerability of federated machine learning, and even on IoT systems. To be specific, we here attempt to attacking a popular federated multitask learning framework, which uses a general multitask learning framework to handle statistical challenges in the federated learning setting. The problem of calculating optimal poisoning attacks on federated multitask learning is formulated as a bilevel program, which is adaptive to the arbitrary selection oftargetnodes andsource attackingnodes. We then propose a novel systems-aware optimization method, called as attack on federated learning (AT2FL), to efficiently derive the implicit gradients for poisoned data, and further attain optimal attack strategies in the federated machine learning. This is an earlier work, to our knowledge, that explores attacking federated machine learning via data poisoning. Finally, experiments on several real-world data sets demonstrate that when the attackers directly poison thetargetnodes or indirectly poison the related nodes via using the communication protocol, the federated multitask learning model is sensitive to both poisoning attacks.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper studies data poisoning attacks on federated machine learning, focusing on a federated multi-task learning framework. It formulates optimal attacks as a bilevel program and proposes AT²FL to compute poisoned data that degrades target-node performance, including indirect attacks via the communication protocol.
Key findings
- Direct attacks substantially degrade performance: on EndAD and Human Activity, classification Error deteriorates by 21.707% and 26.836%, respectively, compared with non-attack baselines.
- The proposed attack strategies outperform random attacks in most cases, e.g., direct attack Error on EndAD is 28.588 ± 3.74 vs. random direct 7.659 ± 1.14; on Human Activity, 29.422 ± 2.96 vs. random direct 3.275 ± 0.71.
- Indirect attacks are generally weaker than direct and hybrid attacks, but can work when node correlations are high; the paper reports Landmine indirect attack Error of 7.428 ± 0.39 vs. non-attack 5.682 ± 0.28, and attributes this to high correlation in its Ω matrix.
- Attack effectiveness increases with the ratio of injected data, and AT²FL converges to a local optimum after a few iterations across the tested attack types.
Methods
- The paper formulates poisoning attacks on federated multi-task learning as a bilevel optimization problem, with upper-level poisoned data and lower-level federated multi-task learning, covering direct, indirect, and hybrid attacks.
- It proposes ATTack on Federated Learning (AT²FL), a projected stochastic gradient ascent method that computes implicit gradients for poisoned data using dual variables for least-square and hinge losses.
- Experiments use five datasets: EndAD (6 nodes), Human Activity Recognition (30 nodes), Landmine (29 nodes), Parkinson-Total, and Parkinson-Motor (42 regression tasks each); metrics are classification Error and RMSE, averaged over 10 random runs, with injected data set to 20% of clean data and step size η₁ = 100, λ₁ = λ₂ = 0.001.
Limitations
- The paper does not state limitations explicitly; it notes future work on vertical (feature-based) federated learning and federated transfer learning.
- Evident from the text: the study is limited to horizontal federated multi-task learning and does not evaluate defenses or other federated learning settings.
- Evident from the text: the attack assumes the attacker can inject poisoned data into source nodes and exploit the communication protocol, and the empirical evaluation is limited to the selected datasets and tasks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
17 Own interpretation · 11 Not checked yet · 11 No basis given · 10 Own result
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When comparing with the random attack strategies, our proposed attack strategies can obtain better deterioration performance among most cases for the federated machine learning problems”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For all the used datasets, the performances under different attack strategies are decreased with the increasing of the injected data.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This observation indicates the reason why indirect attack strategy performs better on the Landmine dataset when comparing with other used datasets.”
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Meanwhile, the classification Error on the test data obtains the upper bound when the ratio of injected data is 10% .”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the indirect attack strategy, we can notice its performances are not good as direct and hybrid attack strategies, e.g., Human Activity Recognition dataset.”
plainSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“All the attack strategies ( e.g., direct attacks, random attacks, etc) have the impact on all the datasets”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As illustrated in Figure 3, the nodes from N tar and N sou have highly correlated in Landmine dataset, i.e., Figure 3(c).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the node correlations in the Parkinson dataset ( i.e., Figure 3(d)) are not close.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Among all the attack strategies, notice that the direct attacks can significantly damage the classification or regression on all the datasets.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Indirect attack almost has no effect on EndAD dataset since the values of correlation matrix Ω for this dataset are relatively low, and each node can learn good classifier without the help of other nodes;”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“since the values of correlation matrix Ω for this dataset are relatively low”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Obviously, the performances of direct attack are better than that of indirect attack by varying the ratio of injected data.”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“From the presented curves in Figure 6, we can notice that the original values of primal sub-optimality and classification error are higher.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, these attack strategies also outperforms the non-attack strategy.”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Then our proposed AT 2 FL algorithm can converge to a local optima after a few iterations for all the three kinds of attacks on EndAD and Human Activity Recognition datasets.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This is because the gradient in Eq. (4) with small step size will be treated as noise information, which will just have little impact on the classification performance.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“However, previous researches on poisoning attacks focus on the scenarios that training samples are collected in a centralized location, or the training samples are sent to a centralized location via a distributed network, e.g., support vector machines [5], autoregressive models [1] and collaborative filtering [13].”
What the sources say
- Not checked yetcites [5] Biggio, Poisoning attacks against support vector machines
- Not checked yetcites [1] source
- Not checked yetcites [13] Gascón, 2016, Secure linear regression on vertically partitioned datasets
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the communication protocol amongst different nodes could be exploited by attackers to launch data poisoning attacks, which has been demonstrated as a big threat to most machine learning models.”
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
“The experiment results indicate that the communication protocol among multiple nodes opens a door for attacker to attack federated machine learning.”
- Also stated in: § I. INTRODUCTION · p. 1 · plain
“due to the communication protocol existing amongst different companies, this protocol also opens a door for the attacker to indirectly affect the unaccessible target nodes”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“which justifies that the learning attack strategies can work better than just launching random attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This observation indicates direct attacks are the big threats to the federated machine learning system.”
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“which verifies the vulnerability of federated machine learning”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“and each node can learn good classifier without the help of other nodes;”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Additionally, since R ∗ ( Xα ) is continuous differentiable, W and α could be connected via defining the next formulation by following [14]:”
What the sources say
- Not checked yetcites [14] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This observation demonstrates the effectiveness of attack strategies computed by our proposed AT 2 FL”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim have been checked yet.
In the paper
“However, none of the current works study poisoning attacks on federated machine learning [11], [17], [18], where the training data are distributed across multiple devices”
What the sources say
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We formulate the problem of computing optimal poisoning attacks on federated multi-task learning as a bilevel program that is adaptive to arbitrary choice of target nodes and source attacking nodes.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, due to the communication protocol existing amongst multiple mobile phones, the attacker can inject poisoned data to other mobile phones and affect the target nodes in an indirect way.”
- Also stated in: § I. INTRODUCTION · p. 1 · plain
“due to the communication protocol existing amongst different companies, this protocol also opens a door for the attacker to indirectly affect the unaccessible target nodes”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Also stated in: § I. INTRODUCTION · p. 1 · plain
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“From the study in this paper, we find that the communication protocol in federated learning can be used to effectively launch indirect attacks, e.g., when two nodes have strong correlation.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The communication protocol in federated learning is bridged by the model relationship matrix Ω.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Extensive experiments demonstrate that the attack strategies computed by AT 2 FL can significantly damage performances of real-world applications.”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The benchmark datasets used are representative of real-world applications.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This observation indicates the effectiveness of our proposed AT 2 FL algorithm.”
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This observation indicates that our AT 2 FL can effectively converge to a local optimum when the step size is enough.”
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 10
- The quote only partly states this claim. 1
- Probably not a substantial claim. 12
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In our bilevel formulation Eq. (3), although the upper level problem is a simple primal problem, the lower level problem is highly non-linear and non-convex.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The experiment results strongly support our proposed model when attacking federated machine learning based on the communication protocol.”
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
“The experiment results indicate that the communication protocol among multiple nodes opens a door for attacker to attack federated machine learning.”
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one. The quote only partly states this claim.
- Also stated in: § I. INTRODUCTION · p. 2 · hedged
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The lower level problem in the Eq. (3) is a federated multi-task learning problem with training set consisting of both clean and injected data points.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“the training data it can handle are with the following properties [12]: 1) Non-IID : data on each node/device may be drawn from a different distribution; 2) Unbalanced : the number of training samples for different nodes/devices may vary by orders of magnitude.”
What the sources say
- Not checked yetcites [12] source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“we follow the setting of most data poisoning attack strategies ( e.g., [5], [21]), and design a projected stochastic gradient ascent based algorithm that efficiently maximally increases the empirical loss of target nodes, and further damages their classification/regression performance.”
What the sources say
- Not checked yetcites [5] Biggio, Poisoning attacks against support vector machines
- Not checked yetcites [21] Liu, 2018, FADL:Federated-autonomous deep learning for distributed electronic health record, arXiv:1811.11400
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“From the equation above, we can notice that the first term on the right side can be easily computed since it depends only on the loss function L t ( · ) .”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Notice that there is no closed-form relation between the empirical loss and the injected data, so we intend to compute the gradients by exploiting the optimality conditions of the subproblem.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
In the paper
“The representative work is a multi-task style federated learning system [15], which is proposed to allow multiple nodes to complete separate tasks while preserving security and sharing knowledge”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
In the paper
“From the equation above, we can notice that solving for matrix Ω is not dependent on the data and therefore can be computed centrally; one major contribution of [15] is an efficient distributed optimization method for the W step.”
What the sources say
- Not checked yetcites [15] source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Then we propose a novel systems-aware optimization method, ATTack on Federated Learning (AT 2 FL), which is efficiency to derive the implicit gradients for poisoned data, and further compute optimal attack strategies in the federated machine learning.”
- Also stated in: § I. INTRODUCTION · p. 2 · plain
“we thus design a novel optimization method, ATTack on Federated Learning (AT 2 FL), to derive the implicit gradients for computing poisoned data in the source attacking nodes. Furthermore, the obtained gradient can be effectively used to compute the optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § I. INTRODUCTION · p. 2 · plain
In the paper
“W and α could be connected via defining the next formulation by following [14]:”
What the sources say
- Not checked yetcites [14] source
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“we focus on the recently-proposed federated multi-task learning framework [15], a federated learning framework which captures node relationships among multiple nodes to tackle the statistical challenges in the federated setting.”
What the sources say
- Not checked yetcites [15] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the second term on the right side depends on the optimality conditions of lower level problem of Eq. (3).”
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Furthermore, the update of W can be achieved by extending works on distributed primal-dual optimization [14].”
What the sources say
- Not checked yetcites [14] source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Based on the distribution characteristics of the data, federated learning [18] can be categorized into: 1) horizontal (sample-based) federated learning, i.e., datasets share the same feature space but different in samples.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“2) vertical (feature-based) federated learning, i.e., two datasets share the same sample ID space but differ in feature space.”
- Also stated in: § II. RELATED WORK · p. 2 · plain
“3) federated transfer learning, i.e., two datasets differ not only in samples but also in feature space.”
What the sources say
- Not checked yetcites [18] Konečnỳ, 2015, Federated optimization:Distributed optimization beyond the datacenter, arXiv:1511.03575
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Also stated in: § II. RELATED WORK · p. 2 · plain
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We derive an effective optimization method, i.e., ATTack on Federated Learning (AT 2 FL), to solve the optimal attack problem, which can address systems challenges associated with federated machine learning.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“we propose a bilevel data poisoning attacks formulation by following general data poisoning attacks framework, where it can include three different kinds of attacks.”
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As a key contribution of this work, we design a ATTack on Federated Learning (AT 2 FL) to address the system challenges ( e.g., high communication cost) existing in federated setting, and further compute optimal attack strategies.”
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper relies on this without support.
The attempt to make federated learning more reliable under poisoning attacks is still scarce.
“Although recent improvements have been focusing on overcoming the statistical challenges ( i.e., the data collected across the network are in a non-IID manner, where the data on each node are generated by a distinct distribution) or improving privacypreserving, the attempt that makes federated learning more reliability under poisoning attacks, is still scarce.”
The paper relies on this without support.
Current optimization methods for the bilevel problem are not suited to tackle systems challenges that exist in federated learning, such as high communication cost and stragglers.
“However, current optimization methods for this bilevel problem are not suited to tackle the systems challenges ( e.g., high communication cost, stragglers) that exist in federated learning.”
The authors state this as an assumption.
The attacker aims to degrade the performance of a set of target nodes by injecting corrupted/poisoned data to a set of source attacking nodes.
“Suppose that the attacker aims to degrade the performance of a set of target nodes N tar ⊂ m by injecting corrupted/poisoned data to a set of source attacking nodes N sou ⊂ m .”
The authors state this as an assumption.
The communication protocol in federated learning is bridged by the model relationship matrix Ω.
“where the communication protocol is bridged by the model relationship matrix Ω in this paper.”
The paper relies on this without support.
The benchmark datasets used are representative of real-world applications.
“Extensive experiments demonstrate that the attack strategies computed by AT 2 FL can significantly damage performances of real-world applications.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [77]
In the citing paper
“Moreover, polynomial approximations need to be made to evaluate non-linear functions in machine learning algorithms, resulting in a trade-off between utility and privacy [79], [80].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [79]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ B. Evaluating Attack Strategies · p. 6
“Direct attacks: all the source attacking nodes N sou are set as the same as the target nodes, i.e., N sou = N tar .”
§ C. Sensitivity Study and Convergence Analysis · p. 6
“For each dataset, we take the same attack setting as that in Table II, e.g., for the direct attack, the N tar and N sou are selected by randomly selecting half of nodes as N tar , and the rest of nodes to form N sou .”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ I. INTRODUCTION · p. 1
“exploratory attacks influence learning via controlling over training data”
§ I. INTRODUCTION · p. 1
“exploratory attacks can take use of misclassifications without affecting training”
Citations
Cites
Advances in neural information processing systems 7
(1996) · Computers & Mathematics with Applications · doi:10.1016/s0898-1221(96)90463-0 · Cited by 14,759
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Return of the Devil in the Details: Delving Deep into Convolutional Nets
Chatfield, K., Simonyan, K., Vedaldi, A., & Zisserman, A. (2014) · Proceedings of the British Machine Vision Conference 2014 · doi:10.5244/c.28.6 · Cited by 3,335
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733
Secure, privacy-preserving and federated machine learning in medical imaging
Kaissis, G. A., Makowski, M. R., Rückert, D., & Braren, R. F. (2020) · Nature Machine Intelligence · doi:10.1038/s42256-020-0186-1 · Cited by 1,676
Federated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563
Federated Learning for Healthcare Informatics
Xu, J., Glicksberg, B. S., Su, C., Walker, P., Bian, J., & Wang, F. (2021) · Journal of Healthcare Informatics Research · doi:10.1007/s41666-020-00082-4 · Cited by 1,542
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Regularized multi--task learning
Evgeniou, T., & Pontil, M. (2004) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1014052.1014067 · Cited by 1,473
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Research works printed but not linked: 1
- Caldas, Federated kernelized multi-task learning, 1
Cited by
Sorted by citations
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548
Self-citationDitto: Fair and Robust Federated Learning Through PersonalizationPreprint
Li, T., Hu, S., Beirami, A., & Smith, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.04221 · Cited by 536
Ghimire, B., & Rawat, D. B. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3150363 · Cited by 520
Distributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 439
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362
Metadata
- Authors
- Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J.
- Affiliations
- Shenyang Institute of Automation (CN)
- Sony (Japan) (JP)
- Kuaishou (China) (CN)
- Venue
- IEEE Internet of Things Journal
- Published
- 2022-07-01
- Volume
- 9
- Issue
- 13
- Pages
- 11365-11375
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3213330817
- Cited by
- 310
- References
- 37
- Citations by year
- 2026: 43 · 2025: 79 · 2024: 78 · 2023: 64 · 2022: 32
- FWCI
- 16.19
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (62003336, 62073205)
- National Postdoctoral Innovative Talents Support Program (BX20200353)
- State Key Laboratory of Robotics (2022-Z06)
- Nature Foundation of Liaoning Province of China (2020-KF-11-01)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- data poisoning, federated learning, bi-level optimization, Internet of Things security, privacy preservation, model vulnerability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
