The DOI matches its Crossref record; 62 of the 64 references it cites were found in a registry or an index.
Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning
Open accessAbstract
While recent works have indicated that federated learning (FL) may be vulnerable to poisoning attacks by compromised clients, their real impact on production FL systems is not fully understood. In this work, we aim to develop a comprehensive systemization for poisoning attacks on FL by enumerating all possible threat models, variations of poisoning, and adversary capabilities. We specifically put our focus on un-targeted poisoning attacks, as we argue that they are significantly relevant to production FL deployments. We present a critical analysis of untargeted poisoning attacks under practical, production FL environments by carefully characterizing the set of realistic threat models and adversarial capabilities. Our findings are rather surprising: contrary to the established belief, we show that FL is highly robust in practice even when using simple, low-cost defenses. We go even further and propose novel, state-of-the-art data and model poisoning attacks, and show via an extensive set of experiments across three benchmark datasets how (in)effective poisoning attacks are in the presence of simple defense mechanisms. We aim to correct previous misconceptions and offer concrete guidelines to conduct more accurate (and more realistic) research on this topic.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Virat et al. [23] argued that there are two kinds of label-flipping strategies, namely static label flipping (SLF) and dynamic label flipping (DLF).”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [23]
In the citing paper
“To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [23]
In the citing paper
“To avoid detection, Virat et al. [23] also state that model updates should not deviate too far from benign updates to avoid detection.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [23]
In the citing paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [23]
In the citing paper
“This attack can be applied on a batch of target data samples all at the same time [73].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [73]
In the citing paper
“One such attack is the gradient ascent attack [73], where the attacker runs gradient ascent on a target data sample and observes whether its increased loss can be drastically reduced in the next communication round, if so, the sample is very likely to be in the training set.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [73]
Citations
Cites
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 114,148
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Self-citationAdvances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Self-citationFederated Learning: Strategies for Improving Communication Efficiency
Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016) · arXiv · doi:10.48550/arxiv.1610.05492 · Cited by 3,766
EMNIST: Extending MNIST to handwritten letters
Cohen, G., Afshar, S., Tapson, J. C., & André, V. S. (2017) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2017.7966217 · Cited by 2,410
Towards Federated Learning at Scale: System Design
Bonawitz, K., Eichner, H., Grieskamp, W., Huba, D., Ingerman, A., Ivanov, V., Kiddon, C., Konečný, J., Mazzocchi, S., McMahan, H. B., et al. (2019) · arXiv · doi:10.48550/arxiv.1902.01046 · Cited by 2,334
Self-citationNeural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563
Research works printed but not linked: 1
- 2020, Google Workshop on Federated Learning and Analytics
Cited by
Sorted by citations
Items 101–200 of 290
Low dimensional secure federated learning framework against poisoning attacks
Erdöl, E. S., Üstübioğlu, B., Erdöl, H., & Ulutaş, G. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.04.017 · Cited by 8
Robust Adversarial Defenses in Federated Learning: Exploring the Impact of Data Heterogeneity
Li, Q., Wu, D., Zhou, D., Lin, C., Liu, S., Wang, C., & Shen, C. Q. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3576594 · Cited by 9
Wang, S., & Zuccon, G. (2023) · International Conference on the Theory of Information Retrieval · doi:10.1145/3578337.3605117 · Cited by 11
Optimal Transport Barycentric Aggregation for Byzantine-Resilient Federated Learning
Kumar, K. N., Chalamala, S. R., Singh, A. K., & Mohan, C. K. (2025) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2025.3604177 · Cited by 8
Poisoning Attacks on Federated Learning for Autonomous Driving
Garg, S., Jönsson, H., Kalander, G., Nilsson, A., Pirange, B., Valadi, V., & Östman, J. (2024) · Linköping electronic conference proceedings · doi:10.3384/ecp208002 · Cited by 9
Low Complexity Byzantine-Resilient Federated Learning
Gouissem, A., Hassanein, S., Abualsaud, K., Yaacoub, E. E., Mabrok, M. A., Abdallah, M. M., Khattab, T. M., & Guizani, M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3482727 · Cited by 9
AMA: Adaptive Model Poisoning Attacks Towards Federated Learning
Wu, D., Guo, Q., Qi, Y., Qi, S., & Li, Q. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3594175 · Cited by 7
Accelerating and Securing Blockchain-Enabled Distributed Machine Learning
Du, Y., Wang, Z., Leung, C., & Leung, V. C. M. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3325334 · Cited by 8
Data Poisoning Attacks and Mitigation Strategies on Federated Support Vector Machines
Mouri, I. J., Ridowan, M., & Adnan, M. A. (2024) · SN Computer Science · doi:10.1007/s42979-023-02556-9 · Cited by 7
Liu, Y., Wang, C., & Yuan, X. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671879 · Cited by 7
DeMAC: Towards detecting model poisoning attacks in federated learning system
Yang, H., Gu, D., & He, J. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100875 · Cited by 8
Hao, Y., Chen, X., Lyu, X., Liu, J., Yongsheng, Z., Wan, Z., Mauw, S., & Wang, W. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670365 · Cited by 7
Security Assessment of Hierarchical Federated Deep Learning
Alqattan, D. S., Sun, R., Liang, H., Nicosia, G., Snåšel, V., Ranjan, R. K., & Ojha, V. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72347-6_14 · Cited by 6
Securing Federated Learning in IoT: A Survey of Attacks, Defenses, and Frameworks
Atia, O. B., Samara, M. A., Bennis, I., Gaber, J., Abouaïssa, A., & Lorenz, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600617 · Cited by 6
Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learning
Kumar, K. N., Mohan, C. K., & Machiry, A. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3626232.3653268 · Cited by 6
Fair and Robust Federated Learning via Decentralized and Adaptive Aggregation based on Blockchain
Du, B., Wang, H., Yuxuan, L., Zhao, J., Ma, Y., & Huang, R. (2024) · ACM Transactions on Sensor Networks · doi:10.1145/3673656 · Cited by 6
Can We Trust the Similarity Measurement in Federated Learning?
Wang, Z., Hu, Q., Zou, X., Hu, P., & Cheng, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3516567 · Cited by 6
Robust privacy-preserving aggregation against poisoning attacks for secure distributed data fusion
Huang, C., Yao, Y., & Zhang, X. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103223 · Cited by 7
Federated learning security mechanisms for protecting sensitive data
Al-Ameer, A. A. A., & Bhaya, W. S. (2023) · Bulletin of Electrical Engineering and Informatics · doi:10.11591/beei.v12i4.4751 · Cited by 7
Fabricated Flips: Poisoning Federated Learning without Data
Huang, J., Zhao, Z., Chen, L. Y., & Roos, S. (2023) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58367.2023.00036 · Cited by 6
Manzoor, H. U., Habib, U., Hussain, S., Flynn, D., & Zoha, A. (2024) · doi:10.36227/techrxiv.171779422.29509780/v1 · Cited by 6
Attacking Byzantine Robust Aggregation in High Dimensions
Choudhary, S., Kolluri, A., & Saxena, P. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00217 · Cited by 9
FLARE: A Backdoor Attack to Federated Learning with Refined Evasion
Wang, Q., Wu, Y., Xuan, H., & Wu, H. (2024) · Mathematics · doi:10.3390/math12233751 · Cited by 5
Byzantine-Robust Federated Learning Framework via a Server-Client Defense Mechanisms
Song, A., Zhang, T., Cheng, K., Cao, Y., Zhu, X., & Shen, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3568443 · Cited by 7
Toward Malicious Clients Detection in Federated Learning
Dou, Z., Wang, J., Sun, W., Liu, Z., & Fang, M. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736194 · Cited by 8
Jiang, J., Hao, F., Gu, T., Wang, K., Liu, X., & Wen, Z. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3657365 · Cited by 5
Enhancing Federated Learning Robustness Using Data-Agnostic Model Pruning
Meng, M. H., Teo, S. G., Bai, G., Wang, K., & Dong, J. S. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-33377-4_34 · Cited by 5
SoK: Systematizing Attack Studies in Federated Learning – From Sparseness to Completeness
Sharma, G., Chamikara, M. A. P., Chhetri, M. B., & Chen, Y. P. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3590328 · Cited by 6
FedCut: A Spectral Analysis Framework for Reliable Detection of Byzantine Colluders
Gu, H., Fan, L., Tang, X., & Yang, Q. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3375287 · Cited by 5
Fake or Compromised? Making Sense of Malicious Clients in Federated Learning
Mozaffari, H., Choudhary, S., & Houmansadr, A. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70879-4_10 · Cited by 5
Self-citationLinkage on security, privacy and fairness in federated learning: New balances and new perspectives
Wang, L., Zhu, T., Zhou, W., & Yu, P. S. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107874 · Cited by 11
FLGuard: Byzantine-Robust Federated Learning via Ensemble of Contrastive Models
Lee, Y., Cho, Y., Han, W., Bae, H., & Paek, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-51482-1_4 · Cited by 7
Yi, Y., You, R., Liu, H., Liu, C., Wang, Y., & Lv, J. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i15.29584 · Cited by 5
Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractors
Lu, Y., Yang, M. Y. R., Kamath, G., & Yu, Y. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00023 · Cited by 8
Byzantine-robust federated learning with ensemble incentive mechanism
Shi-hai, Z., Pu, J., Fu, X., Liu, L., & Dai, F. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.05.017 · Cited by 5
Classification Auto-Encoder Based Detector Against Diverse Data Poisoning Attacks
Razmi, F., & Xiong, L. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-37586-6_16 · Cited by 8
Voyager: MTD-Based Aggregation Protocol for Mitigating Poisoning Attacks on DFL
Feng, C., Celdrán, A. H., Vuong, M., Bovet, G., & Stiller, B. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575335 · Cited by 5
Attacks and countermeasures on federated learning via historical knowledge modeling
Zhang, S., Jiang, Z., Gao, H., Gui, S., & Gao, T. (2025) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-025-00115-1 · Cited by 5
Defense-Guided Adaptive Attack on Byzantine-Robust Federated Learning
Hu, C., Liu, Y., Zhang, M., & Yang, Z. (2024) · Communications in computer and information science · doi:10.1007/978-981-96-0151-6_7 · Cited by 4
Federated Learning - Opportunities and Application Challenges
Ilić, M., & Ivanović, M. D. (2023) · Communications in computer and information science · doi:10.1007/978-3-031-41774-0_38 · Cited by 4
PrSeFL: Achieving Practical Privacy and Robustness in Blockchain-Based Federated Learning
Xiao, Y., Xu, L., Wu, Y. X., Sun, J., & Zhu, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3454087 · Cited by 4
Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelines
Bagdasarian, E., & Shmatikov, V. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690337 · Cited by 7
Ye, D., Zhu, T., Gao, K., Zhu, C., & Zhou, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3532351 · Cited by 4
Almutairi, S., & Barnawi, A. (2025) · IEEE Access · doi:10.1109/access.2025.3584948 · Cited by 4
Time-Distributed Backdoor Attacks on Federated Spiking Learning
Abad, G., Picek, S., & Urbieta, A. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_1 · Cited by 6
Maabreh, M., Darwish, O., Karajeh, O., & Tashtoush, Y. M. (2022) · International Arab Conference on Information Technology (ACIT) · doi:10.1109/acit57182.2022.9994126 · Cited by 4
SPoiL: Sybil-Based Untargeted Data Poisoning Attacks in Federated Learning
Lian, Z., Zhang, C., Nan, K., & Su, C. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-39828-5_13 · Cited by 4
Robust Locally Differentially Private Graph Analysis
Chowdhury, A. R., Imola, J., & Chaudhuri, K. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736199 · Cited by 3
Li, K., Liang, Y., Lió, P., Ni, W., Dressler, F., Crowcroft, J., & Akan, Ö. B. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3636440 · Cited by 3
Practical Framework for Privacy-Preserving and Byzantine-Robust Federated Learning
Zhang, B., Fang, M., Liu, Z., Yi, B., Zhou, P., Wang, Y., Li, T., & Liu, Z. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3642546 · Cited by 3
Zhang, H., He, X., Wu, J., & Wang, Q. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3650413 · Cited by 3
Alruwaili, E., & Moulahi, T. (2026) · Frontiers in Public Health · doi:10.3389/fpubh.2026.1762346 · Cited by 3
LZKSA: Lattice-Based Special Zero-Knowledge Proofs for Secure Aggregation's Input Verification
Lu, Z. G., & Lu, S. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3744812 · Cited by 2
GRAPHSEC – Advancing the Application of AI/ML to Network Security Through Graph Neural Networks
Casas, P., Vanerio, J., Ullrich, J., Findrik, M., & Barlet‐Ros, P. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-36183-8_5 · Cited by 3
Anika, T. (2023) · Systematic Literature Review and Meta-Analysis Journal · doi:10.54480/slr-m.v3i4.42 · Cited by 3
Brief Announcement: A Case for Byzantine Machine Learning
Farhadkhani, S., Guerraoui, R., Gupta, N., & Pinot, R. (2024) · ACM Symposium on Principles of Distributed Computing (PODC) · doi:10.1145/3662158.3662802 · Cited by 3
Fedeval: Defending Against Lazybone Attack via Multi-dimension Evaluation in Federated Learning
Wang, H., Zhang, H., Wang, L., Xuan, S., & Zhang, Q. (2024) · ACM Transactions on Sensor Networks · doi:10.1145/3703631 · Cited by 3
Robust Privacy-Enhanced Aggregation Scheme for Federated Learning in Industrial Internet of Things
Liu, Z., Gao, P., & Wang, B. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3601856 · Cited by 4
PoE: Poisoning Enhancement Through Label Smoothing in Federated Learning
Zheng, H., Liu, T., Li, R., & Chen, J. (2023) · IEEE Transactions on Circuits & Systems II Express Briefs · doi:10.1109/tcsii.2023.3249461 · Cited by 3
Harnessing dynamic heterogeneous redundancy to empower deep learning safety and security
Zhang, F., Chen, X., Huang, W., Wu, J., Zhang, Z., Zhou, C., Li, J., Peng, Z., Wei, G., Yang, G., et al. (2024) · Security and Safety · doi:10.1051/sands/2024011 · Cited by 2
Yan, G., Wang, H., Yuan, X., & Li, J. (2024) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3678890.3678915 · Cited by 2
GCPA: GAN-Based Collusive Poisoning Attack in Federated Recommender Systems
Gu, T., TAN, S., Hao, F., Liu, X., Chang, L., & Liu, Y. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3579807 · Cited by 2
SuperMPFL: A Supermask-Based Mechanism for Personalized Federated Learning
Sun, Z., Li, S., Yin, L., Chen, Y., Zhang, A., Zhang, M., & He, Y. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3587663 · Cited by 2
A Comprehensive Evaluation of Byzantine Attacks and Defenses Under Data Heterogeneity
Errami, L., Bergou, E. H., & Hammouti, H. E. (2025) · IEEE Access · doi:10.1109/access.2025.3602217 · Cited by 2
Fine-Grained Poisoning Framework Against Federated Learning
Li, M.-H., Zhang, H., Zhang, Y.-J., Zeng, L., Chen, C., Shao, Q., Wan, W., Hu, S.-S., & Zhang, L. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3604514 · Cited by 5
A Client-level Assessment of Collaborative Backdoor Poisoning in Non-IID Federated Learning
Lai, P., Liu, G., Phan, N., Khalil, I. M., Khreishah, A. A., & Wu, X. (2025) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs63083.2025.00010 · Cited by 2
DamPa: Dynamic Adaptive Model Poisoning Attack in Federated Learning
Hu, F., Zhang, A., Liu, X., & Li, M. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3631449 · Cited by 2
Song, X., Fu, X., Xing, L., & Peng, R. (2025) · IEEE Transactions on Reliability · doi:10.1109/tr.2025.3639129 · Cited by 2
Yang, C., Zhou, Z., Liang, Y., & Tang, C. (2026) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2026.3665733 · Cited by 2
MPHM: Model poisoning attacks on federal learning using historical information momentum
Shi, L., Chen, Z., Shi, Y., Lin, W., Tao, Y., He, M., Wang, Q., Zhou, Y. H., & Gao, Y. (2023) · Security and Safety · doi:10.1051/sands/2023006 · Cited by 2
Mixing Gradients in Neural Networks as a Strategy to Enhance Privacy in Federated Learning
Eloul, S., Silavong, F., Kamthe, S., Georgiadis, A., & Moran, S. J. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00391 · Cited by 2
FedQV: Leveraging Quadratic Voting in Federated Learning
Chu, T., & Laoutaris, N. (2024) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3656006 · Cited by 4
Qiao, Y., Liu, D., Wang, R., & Liang, K. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3450527 · Cited by 2
Explore Patterns to Detect Sybil Attack during Federated Learning in Mobile Digital Twin Network
Zhang, W., Yu, C., Meng, Z., Shen, S., & Zhang, K. (2024) · International Conference on Communications · doi:10.1109/icc51166.2024.10622975 · Cited by 2
SecDefender: Detecting low-quality models in multidomain federated learning systems
Sameera, K. M., Sgueglia, A., Vinod, P., A., R. R. K., Visaggio, C. A., Sorbo, A. D., & Conti, M. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107587 · Cited by 2
FDBA: Feature-guided Defense against Byzantine and Adaptive attacks in Federated Learning
Hu, C., Hu, Q., Zhang, M., & Yang, Z. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104035 · Cited by 2
PPoison: A Pluggable Poisoning attack against distributed training of split learning
Liu, J., Lyu, X., Zheng, L., Ren, C., & Cui, Q. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.108045 · Cited by 2
FADO: A Federated Learning Attack and Defense Orchestrator
Rodrigues, F. M., Simões, R., & Neves, N. (2023) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w58399.2023.00043 · Cited by 2
Defending against Poisoning Attacks in Federated Learning from a Spatial-temporal Perspective
Gu, Z., Shi, J., Yang, Y., & He, L. (2023) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds60354.2023.00013 · Cited by 2
Adversarial robustness in federated learning
Xie, C., & Wang, X. (2024) · Elsevier eBooks · doi:10.1016/b978-0-44-319037-7.00013-2 · Cited by 2
Towards Unified, Practical Evaluation of Model Poisoning Attacks and Defence in Federated Learning
Yang, H., Gu, D., & He, J. (2023) · IEEE Globecom Workshops (GC Wkshps) · doi:10.1109/gcwkshps58843.2023.10464739 · Cited by 2
Mouri, I. J., Ridowan, M., & Adnan, M. A. (2024) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac61105.2024.00138 · Cited by 2
Efficient DP-FL: Efficient Differential Privacy Federated Learning Based on Early Stopping Mechanism
Jiao, S., Cai, L., Meng, J., Zhao, Y., & Cheng, K. (2024) · Computer Systems Science and Engineering · doi:10.32604/csse.2023.040194 · Cited by 3
Literature Review of Backdoor Attacks
Li, S., Zhu, H., Wu, W., & Shen, X. (2024) · Wireless networks · doi:10.1007/978-3-031-57389-7_2 · Cited by 2
Federated Learning Poison Attack Detection Scheme Based on Gradient Similarity
Zhao, Q., Zhang, Y., Jing, Z., Zhou, Y., & Xin, Z. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-80419-9_2 · Cited by 1
Integrating CP-ABE and Device Fingerprint Into Federated Learning
Chen, C., Román, R., Wang, K. I., & Sakurai, K. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-2417-1_23 · Cited by 1
Lee, C., Kao, C.-C., Yeh, C.-H., Lu, C.-S., Yu, C.-M., & Chen, C.-S. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00630 · Cited by 1
Poisoning Attack Detection Method Based on Adaptive Statistical Features
Liao, F., Wang, Y., & Liu, D. (2024) · International Conference on Digital Society and Intelligent Systems (DSInS) · doi:10.1109/dsins64146.2024.10992065 · Cited by 1
Tan, X. M., & Chen, P. (2025) · Journal of Computer Security · doi:10.1177/0926227x251335198 · Cited by 1
Covert and Persistent Backdoor Attacks in Federated Learning-Powerd Autonomous Driving
Wang, Z., Yang, F., Peng, L., & Song, J. (2024) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc64274.2024.00114 · Cited by 1
Dual-Model Backdoor Defense with Contrast Learning
Chen, Y., & Yin, J.-L. (2025) · International Conference on Big Data and Privacy Computing (BDPC) · doi:10.1109/bdpc63545.2025.11135804 · Cited by 1
LGP: Layerwise Gradient Purify for Robust Federated Learning Against Poisoning Attacks
Issa, W., Moustafa, N., Turnbull, B., & Tari, Z. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3604778 · Cited by 1
Nguyen, M. V., Zhao, L., Deng, B., & Wu, S. (2025) · IEEE Vehicular Technology Conference · doi:10.1109/vtc2025-spring65109.2025.11174863 · Cited by 1
On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning
Lachnit, S., & Karame, G. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3765211 · Cited by 1
Jaszcz, A., Połap, D., & Srivastava, G. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3638263 · Cited by 1
Untargeted poisoning attack based on fake clients and its defense in federated learning
Wang, C., Xu, K., He, A., Sun, Z., Pan, J., & Ren, Y. (2025) · Cybersecurity · doi:10.1186/s42400-025-00389-y · Cited by 1
Masse, G. C. T., Benslimane, A., Tchendji, V. K., Hemida, A. H. A., Su, Z., & Han, S. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11161880 · Cited by 1
Key-Value Mapping-Based Text-to-Image Diffusion Model Backdoor Attacks
Chai, L., Hou, Y., Liao, G., & Yue, Q. (2026) · Algorithms · doi:10.3390/a19010074
Poisoning Attacks and Defenses Techniques for Federated Learning: A Survey
Shan, X., Rong, Y., Li, J., Quan, A., Yu, M., Ye, Z., Yu, J., & Zhang, J. (2025) · International Conference on Computer Communication and Network Security (CCNS) · doi:10.1109/ccns66849.2025.11338107 · Cited by 1
Exploring Subtle Manipulation Vulnerabilities in Federated Distillation
Chen, P., Wan, C., Zou, H., Wen, T., & Wu, Z. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00205 · Cited by 1
Metadata
- Authors
- Shejwalkar, V., Houmansadr, A., Kairouz, P., & Ramage, D.
- Affiliations
- University of Massachusetts Amherst (US)
- Google (United States) (US)
- Venue
- 2022 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2022-05
- Pages
- 1354-1371
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4288057793
- Cited by
- 292
- References
- 64
- Citations by year
- 2026: 53 · 2025: 78 · 2024: 97 · 2023: 52 · 2022: 12
- FWCI
- 32.95
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553301, 1953786, 1739462)
- U.S. Department of Defense
- Defense Advanced Research Projects Agency
- Naval Information Warfare Center Pacific
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- federated learning, poisoning attacks, untargeted attacks, threat model, adversary capabilities, data poisoning, model poisoning, defense mechanisms, production systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
