The DOI matches its Crossref record; 44 of the 47 references it cites were found in a registry or an index.
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Abstract
Federated learning (FL), as a distributed machine learning setting, has received considerable attention in recent years. To alleviate privacy concerns, FL essentially promises that multiple parties jointly train the model by exchanging gradients rather than raw data. However, intrinsic privacy issue still exists in FL, e.g., user’s training samples could be revealed by solely inferring gradients. Moreover, the emerging poisoning attack also poses a crucial security threat to FL. In particular, due to the distributed nature of FL, malicious users may submit crafted gradients during the training process to undermine the integrity and availability of the model. Furthermore, there exists a contradiction in simultaneously addressing two issues, that is, privacy-preserving FL solutions are dedicated to ensuring gradients indistinguishability, whereas the defenses against poisoning attacks tend to remove outliers based on their similarity. To solve such a dilemma, in this paper, we aim to build a bridge between the two issues. Specifically, we present a privacy-enhanced FL (PEFL) framework that adopts homomorphic encryption as the underlying technology and provides the server with a channel to punish poisoners via the effective gradient data extraction of the logarithmic function. To the best of our knowledge, the PEFL is the first effort to efficiently detect the poisoning behaviors in FL under ciphertext. Detailed theoretical analyses illustrate the security and convergence properties of the scheme. Moreover, the experiments conducted on real-world datasets show that the PEFL can effectively defend against label-flipping and backdoor attacks, two representative poisoning attacks in FL.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To solve this problem, [38], [49], [51] used homomorphic encryption to evaluate the local model securely.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [51]
Citations
Cites
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Paillier, P. (2007) · Lecture Notes in Computer Science · doi:10.1007/3-540-48910-x_16 · Cited by 7,250
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
ADADELTA: An Adaptive Learning Rate Method
Zeiler, M. D. (2012) · arXiv · doi:10.48550/arxiv.1212.5701 · Cited by 5,322
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Pearson Correlation Coefficient
Benesty, J., Chen, J., Huang, Y. A., & Cohen, I. (2009) · Springer topics in signal processing · doi:10.1007/978-3-642-00296-0_5 · Cited by 3,540
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
On the momentum term in gradient descent learning algorithms
Ning Qian, A. (1999) · Neural Networks · doi:10.1016/s0893-6080(98)00116-6 · Cited by 2,318
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Cited by
Sorted by citations
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682
“In contrast, some works [30], [101]–[103] also questioned whether federal learning is really easy to be attacked.”
ResultA robust privacy-preserving federated learning model against model poisoning attacks
Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., & Parizi, R. M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3420126 · Cited by 380
“Model poisoning adversaries manipulate user input by submitting poisonous updates to local models to create arbitrary deviance from correct trends [3].”
BackgroundMethodInfluentialShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371
Blockchain-Based Federated Learning for Securing Internet of Things: A Comprehensive Survey
Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., & Tari, Z. (2022) · ACM Computing Surveys · doi:10.1145/3560816 · Cited by 347
“In addition, Truex et al. [144] and Xu et al. [164] combined SMC and DP for FL privacy preservation.”
BackgroundMethodInfluentialPrivacy-Preserving Byzantine-Robust Federated Learning via Blockchain Systems
Miao, Y., Liu, Z., Li, H., Choo, K.-K. R., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3196274 · Cited by 303
Self-citationWhen Federated Learning Meets Privacy-Preserving Computation
Chen, J., Yan, H., Liu, Z., Zhang, M., Xiong, H., & Yu, S. (2024) · ACM Computing Surveys · doi:10.1145/3679013 · Cited by 278
“The philosophy of this protocol is different from protocols [76, 87, 125] based on SMC, HE, DP.”
InfluentialA Privacy-Aware and Incremental Defense Method Against GAN-Based Poisoning Attack
Qiao, F., Li, Z., & Kong, Y. (2023) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3263241 · Cited by 222
“Liu et al. [28] utilize homomorphic encryption and extract the gradient of the logarithmic function to detect and penalize poisoners.”
BackgroundPoisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212
“…malicious model detection algorithm, which considers that statistical methods (such as euclidean distance [40], [52], cosine similarity [37], [38], k-means [46], Pearson correlation coefficient [49], [51], etc.) can be used to measure the differences between benign and malicious models [36], [80].”
MethodInfluentialThe Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152
“…How to Balance the Model Performance and the Detection Rate Before the Aggregation Phase: Defending before the aggregation phase is a common strategy in which the server aggregator detects and ignores malicious updates and restricts participation from suspicious clients [212], [246], [247], [248].”
BackgroundLSFL: A Lightweight and Secure Federated Learning Scheme for Edge Computing
Zhang, Z., Wu, L., Ma, C., Li, J., Wang, J., Wang, Q., & Yu, S. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3221899 · Cited by 143
“Compared with [37], [52], O(2m|w|) < O(m|wenc|), where”
MethodResultInfluentialSarhan, M., Lo, W. W., Layeghy, S., & Portmann, M. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.108379 · Cited by 154
Javeed, D., Saeed, M. S., Ahmad, I., Adil, M., Kumar, P., & Islam, A. K. M. N. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.06.023 · Cited by 143
“Early detection of such threats ensures smooth operations of FL models [123].”
BackgroundKalapaaking, A. P., Khalil, I., & Yi, X. (2024) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2023.3268186 · Cited by 122
“In [17], the author proposed a privacy-enhanced FL against poisoning adversaries.”
BackgroundPrivacy-Preserving Federated Learning With Malicious Clients and Honest-but-Curious Servers
Le, J., Zhang, D., Lei, X., Jiao, L., Zeng, K., & Liao, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3295949 · Cited by 110
“In recent years, numerous researchers have studied the aforementioned security issues of FL and proposed various defense solutions such as the Secure Multiparty Computation (SMC)-based schemes [13], the Homomorphic Encryption (HE)-based schemes [14], the Differential Privacy (DP)-based schemes [15], [16], [17], the by…”
BackgroundMethodData Quality Detection Mechanism Against Label Flipping Attacks in Federated Learning
Jiang, Y., Zhang, W., & Chen, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3249568 · Cited by 102
“Liu et al. [25] also detected malicious clients via the similarity of local updates, and adopted homomorphic encryption as the underlying technology to avoid privacy leakage from updates.”
BackgroundPrivacy-Preserving Federated Learning via Functional Encryption, Revisited
Chang, Y., Zhang, K., Gong, J., & Qian, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3255171 · Cited by 93
“3) Using Homomorphic Encryption (HE) [18], [19], [20],”
Privacy-Preserving Federated Learning for Intrusion Detection in IoT Environments: A Survey
Vyas, A., Lin, P., Hwang, R., & Tripathi, M. (2024) · IEEE Access · doi:10.1109/access.2024.3454211 · Cited by 115
“…and update, maintaining transparency in the FL process, and allow for auditing of the system to ensure compliance with privacy and security standards of the system being operated upon, and continuous collaboration and research with the experts also helps [113], [114], [115], [143], [146].”
BackgroundTrustworthy federated learning: privacy, security, and beyond
Chen, C., Liu, J., Tan, H., Li, X., Wang, K. I., Li, P., Sakurai, K., & Dou, D. (2024) · Knowledge and Information Systems · doi:10.1007/s10115-024-02285-2 · Cited by 110
“Adversarial attacks, characterized by the strategic infusion of minuscule alterations within training datasets, are tailored to mislead target models [225].”
Li, G., Wu, J., Li, S., Yang, W., & Li, C. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3173996 · Cited by 84
Privacy-Preserving and Byzantine-Robust Federated Learning
Dong, C., Weng, J., Li, M., Liu, J.-N., Liu, Z., Cheng, Y., & Yu, S. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3264697 · Cited by 88
“Liu et al. [15] presented a privacy-enhanced FL (PEFL) framework that adopts homomorphic encryption to preserve the privacy of model parameters and proposed a novel adaptive federated aggregation to mitigate poisoning attacks.”
BackgroundMohammadi, S., Balador, A., Sinaei, S., & Flammini, F. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104918 · Cited by 93
FedForgery: Generalized Face Forgery Detection With Residual Federated Learning
Liu, D., Dang, Z., Peng, C., Zheng, Y., Li, S., Wang, N., & Gao, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3293951 · Cited by 83
“[37] proposed a privacy-enhanced based federated learning framework using homomorphic encryption as the underlying technique, which is the early exploration to effectively detect poisoning behavior in the federated learning”
Yamany, W., Moustafa, N., & Turnbull, B. (2021) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2021.3130906 · Cited by 87
“[37] introduced a privacy preservation Fl framework, named (PEFL), based on Homomorphic Encryption technology to defend against data poisoning attacks.”
MethodA Survey on Security of UAV Swarm Networks: Attacks and Countermeasures
Wang, X., Zhao, Z., Yi, L., Ning, Z., Guo, L., Yu, F. R., & Guo, S. (2024) · ACM Computing Surveys · doi:10.1145/3703625 · Cited by 77
“For example, model aggregation attacks aim to compromise FL models by uploading malicious parameters [92], and model privacy attacks target the privacy of FL through inference on aggregated parameters and data during training.”
Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance
Wei, W., & Liu, L. (2024) · ACM Computing Surveys · doi:10.1145/3645102 · Cited by 105
VOSA: Verifiable and Oblivious Secure Aggregation for Privacy-Preserving Federated Learning
Wang, Y., Zhang, A., Wu, S., & Yu, S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3226508 · Cited by 69
“For instance, SecureML (IEEE S&P’17) [41], EPRFL(ACM ACSAC’21) [43], PEFL(IEEE TIFS’21) [44] all adopted double non-colluding server architecture.”
Yang, R., Zhao, T., Yu, F. R., Li, M., Zhang, D., & Zhao, X. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3379395 · Cited by 71
“Despite the implementation of privacy measures, malicious attackers may still pose security threats to both the original data and trained models [15] through methods, such as evasion attacks [16], poisoning attacks [17], and other prevalent attack techniques.”
BackgroundSVeriFL: Successive verifiable federated learning with privacy-preserving
Gao, H., He, N., & Gao, T. (2022) · Information Sciences · doi:10.1016/j.ins.2022.11.124 · Cited by 61
SafeFL: MPC-friendly Framework for Private and Robust Federated Learning
Gehlhar, T., Marx, F., Schneider, T. H., Suresh, A., Wehrle, T., & Yalame, H. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00012 · Cited by 60
“FedAvg [59] – ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✗ Krum [10] – ✗ ✓ ✗ ✗ ✗ ✗ ✓ ✓ SecAgg [15] Masking ✓ ✗ ✓ ✗ ✗ ✓ ✗ ✗ PPDL [71] HE ✓ ✗ ✗ ✗ ✗ ✓ ✓ ✗ Median [87] – ✗ ✓ ✗ ✗ ✗ ✗ ✓ ✗ SecAgg+ [8] Masking ✓ ✗ ✓ ✗ ✓ ✓ ✗ ✗ BatchCrypt [88] HE ✓ ✗ ✓ ✗ ✗ ✓ ✓ ✓ FoolsGold [37] – ✗ ✓ ✗ ✗ ✗ ✗ ✓ ✓ SAFELearn [35] MPC ✓ ✗ ✗ ✓ ✓ ✓ ✓ ✓ BREA [77] Masking ✓ ✓ ✗ ✗ ✗…”
BackgroundPrivacy-Preserving Federated Learning of Remote Sensing Image Classification With Dishonest Majority
Zhu, J., Wu, J., Bashir, A. K., Pan, Q., & Yang, W. (2023) · IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing · doi:10.1109/jstars.2023.3276781 · Cited by 59
“Liu et al. [35] proposed the privacy-enhanced federated learning against poisoning attacks, which adopted pearson correction coefficient as the identifi-cation method in their work.”
MethodPrivacy-Preserving Federated Learning Against Label-Flipping Attacks on Non-IID Data
Shen, X., Liu, Y., Li, F., & Li, C. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3288886 · Cited by 62
“On this basis, Liu et al. [16] proposed an adaptive aggregation strategy, which takes coordinate-wise medians as the benchmark and adaptively adjusts the aggregation weights according to the correlation between clients’ gradient and the benchmark.”
BackgroundMethodInfluentialA Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy
Manzoor, H. U., Shabbir, A., Chen, A., Flynn, D., & Zoha, A. (2024) · Future Internet · doi:10.3390/fi16100374 · Cited by 58
A comprehensive review of federated learning for COVID‐19 detection
Naz, S., Phan, K. T., & Chen, Y. P. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22777 · Cited by 59
“• During model training 7,8 • Through gradient 7,9 • To central server or third party 10,11 Compromise privacy 7 – 9 Risk of data poisoning Data poisoning attacks 12 can be random or targeted Miss ‐ classification with high confidence 13 • By data 14 • By model 13,15,16 • By backdoor 17”
BackgroundRFed: Robustness-Enhanced Privacy-Preserving Federated Learning Against Poisoning Attack
Miao, Y., Yan, X., Li, X., Xu, S., Liu, X., Li, H., & Deng, R. H. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402113 · Cited by 59
“…mechanism Cheon-Kim-Kim-Song (CKKS), rather than Differential Privacy (DP) [16], [17], Homomorphic Encryption (HE) [18], [19], [20], [21], [22] and Secure Multi-party Computation (SMC) [23], [24], due to low model accuracy, high computation overhead and communication overhead,…”
BackgroundSelf-citationExploring privacy mechanisms and metrics in federated learning
Shenoy, D., Bhat, R., & Prakash, K. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11170-5 · Cited by 63
APFed: Anti-Poisoning Attacks in Privacy-Preserving Heterogeneous Federated Learning
Chen, X., Yu, H., Jia, X., & Yu, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3315125 · Cited by 50
TDFL: Truth Discovery Based Byzantine Robust Federated Learning
Xu, C. L., Jia, Y., Zhu, L., Zhang, C., Jin, G., & Sharif, K. (2022) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2022.3205714 · Cited by 51
“According to prior work, the vanilla federated learning with the aggregation rule of average is vulnerable even if there is only one malicious participant [26].”
BackgroundEnhanced Security and Privacy via Fragmented Federated Learning
Jebreel, N., Domingo‐Ferrer, J., Blanco-Justicia, A., & Sánchez, D. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3212627 · Cited by 50
“PEFL [42] tries to address both privacy and security, but assumes there are two noncolluding servers that collaborate to filter out malicious updates while preventing each other from seeing individual updates.”
BackgroundRoseAgg: Robust Defense Against Targeted Collusion Attacks in Federated Learning
Yang, H., Xi, W., Shen, Y., Wu, C., & Zhao, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3352415 · Cited by 48
“Digital Object Identifier 10.1109/TIFS.2024.3352415 eliminate potentially poisoned model updates [1], [11], [17].”
BackgroundInfluentialVerifiable Federated Learning With Privacy-Preserving Data Aggregation for Consumer Electronics
Xie, H., Wang, Y., Ding, Y., Yang, C., Zheng, H., & Qin, B. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2023.3323206 · Cited by 46
“As a technology that can ensure that the participants’ original data does not need to be uploaded to a central server, while avoiding centralized data collection and modeltraining [7], 1558-4127 c (cid:2) 2023 IEEE.”
BackgroundBlockDFL: A Blockchain-based Fully Decentralized Peer-to-Peer Federated Learning Framework
Qin, Z., Yan, X., Zhou, M., & Deng, S. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645425 · Cited by 55
“This problem is solved in several rounds, where in each round, some of the participants train w by a stochastic gradient descent (SGD) [27, 29] algorithm for several steps and then send the trained w (local model) to the server for aggregation.”
BackgroundMethodInfluentialSAFELearning: Secure Aggregation in Federated Learning With Backdoor Detectability
Zhang, Z., Li, J., Yu, S., & Makaya, C. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3280032 · Cited by 54
“In Table III, we compared our protocol with PEFL [27] (simulated via Paillier cryptosystem) in terms of client and server running time.”
BackgroundMethodToward Efficient and Certified Recovery From Poisoning Attacks in Federated Learning
Jiang, Y., Shen, J., Liu, Z., Tan, C. W., & Lam, K. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3533907 · Cited by 48
“…assess the direction similarity between a client’s update, i.e., gradients, and the global update, i.e., the aggregated gradients from all participating clients, in the same FL round, a widely employed metric for evaluating the similarity between two vectors in an FL setting [10], [52], [53], [54].”
Novel Evasion Attacks Against Adversarial Training Defense for Smart Grid Federated Learning
Bondok, A. H., Abdallah, M. M., Badr, M. M., Fouda, M. M., Abdallah, M. M., & Alsabaan, M. (2023) · IEEE Access · doi:10.1109/access.2023.3323617 · Cited by 42
“Following the works in [38], [39], [40], and [41], We set an upper limit on the number of malicious consumers as follows : where M is the total number of malicious consumers and N is the total number of consumers where N ≥ 3.”
BackgroundMethodRPIFL: Reliable and Privacy-Preserving Federated Learning for the Internet of Things
Wang, R., Lai, J., Li, X., He, D., & Khan, M. K. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103768 · Cited by 42
Efficiently Achieving Privacy Preservation and Poisoning Attack Resistance in Federated Learning
Li, X.-Y., Yang, X. S., Zhou, Z., & Lu, R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3378006 · Cited by 40
“For example, [14] emphasizes that unprotected coefficients carry the risk of privacy leakage.”
BackgroundMethodInfluentialSelf-citationBPFL: Blockchain-based privacy-preserving federated learning against poisoning attack
Ren, Y., Hu, M., Yang, Z., Feng, G., & Zhang, X. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120377 · Cited by 34
Chen, L., Xiao, D., Xiao, X., & Zhang, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3486611 · Cited by 37
Tensor-Empowered Federated Learning for Cyber-Physical-Social Computing and Communication Systems
Yang, L. T., Zhao, R., Liu, D., Lu, W., & Deng, X. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3282264 · Cited by 36
“cess of clients are not visible to FL platform, it provides an inherent advantage for malicious clients to launch data poisoning attacks [13].”
BackgroundPapadopoulos, C., Kollias, K.-F., & Fragulis, G. F. (2024) · Future Internet · doi:10.3390/fi16110415 · Cited by 35
“In [123], the PEFL framework presented faces challenges in balancing privacy and security, with privacy-preserving methods hindering poisoning attack detection.”
ESVFL: Efficient and secure verifiable federated learning with privacy-preserving
Cai, J., Shen, W., & Qin, J. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102420 · Cited by 37
Fotohi, R., Aliee, F. S., & Farahani, B. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.111764 · Cited by 35
“Li et al. (Li et al., 2021) proposed a method called FEDBN for cancer detection without sharing privacy-sensitive data.”
Wang, D., & Guan, S. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102796 · Cited by 33
Trustworthy Federated Learning Against Malicious Attacks in Web 3.0
Zheng, Y., Tian, Y., Zhou, Z., Li, T., Wang, S., & Xiong, J. (2024) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2024.3350365 · Cited by 33
“Additionally, since users’ data in federated learning remains unshared, the server is often unable to discern whether a user has initiated a poisoning attack, which can result in a flawed or compromised aggregated model, affecting its accuracy [12], [13].”
BackgroundTowards robust and privacy-preserving federated learning in edge computing
Zhou, H., Zheng, Y., & Jia, X. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110321 · Cited by 38
A survey on privacy-preserving federated learning against poisoning attacks
Feng, X., & Cheng, W. (2024) · Cluster Computing · doi:10.1007/s10586-024-04629-7 · Cited by 34
“…privacy techniques to enable the comparison of metrics such as cosine similarity, Euclidean distance, etc. (1) Similarity-based approach with privacy protection Liu et al. proposed the first FL framework PEFL (Privacy-Enhanced Federated Learning) [50] for detecting abnormal data on ciphertext.”
Privacy preserving and secure robust federated learning: A survey
Han, Q., Lu, S., Wang, W., Qu, H., Li, J., & Gao, Y. (2024) · Concurrency and Computation: Practice and Experience · doi:10.1002/cpe.8084 · Cited by 29
A Privacy-Preserving Federated Learning Scheme Against Poisoning Attacks in Smart Grid
Li, X., Wen, M., He, S., Lu, R., & Wang, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3365142 · Cited by 31
“Liu et al. [18] used the correlation coefficient to evaluate the training quality of each participant but it required a trusted third party to generate secure parameters.”
BackgroundSelf-citationDPFLA: Defending Private Federated Learning Against Poisoning Attacks
Feng, X., Cheng, W., Cao, C., Wang, L., & Sheng, V. S. (2024) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2024.3376255 · Cited by 29
“These similarity calculations operated on the encrypted gradi-entsusingHomomorphicEncryption(HE)[7],[8],[9],[10]arise expensivecomputationoverhead.”
MethodTrustiness-based hierarchical decentralized federated learning
Li, Y., Wang, X., Sun, R., Xie, X., Ying, S., & Ren, S. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110763 · Cited by 30
DefendFL: A Privacy-Preserving Federated Learning Scheme Against Poisoning Attacks
Liu, J., Li, X., Liu, X., Zhang, H., Miao, Y., & Deng, R. H. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3423397 · Cited by 29
“1) Privacy Protection: We use provable security based on simulation to prove that DefendFL achieves security, which are captured using the real-world versus ideal world game [30], [32].”
Self-citationSplit Aggregation: Lightweight Privacy-Preserving Federated Learning Resistant to Byzantine Attacks
Lu, Z. G., Lu, S., Cui, Y., Tang, X., & Wu, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402993 · Cited by 30
“Here we choose GAS nested Dnc; b) Robust Privacy FL: PEFL [17], FFL [20] uses the angular distance and coordinate-dependent , removing gradients below a threshold.”
BackgroundMethodInfluentialDifferentially Private Set Intersection for Asymmetrical ID Alignment
He, Y., Tan, X., Ni, J., Yang, L. T., & Deng, X. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3207911 · Cited by 27
“W ITH ever-evolving concerns on privacy leakage, especially after the release of the General Data Protection Regulation [1], Federated Learning (FL) [2], [3], [4], [5] has been a heated topic, since it can analyze the patterns of”
BackgroundExplainable Data Poison Attacks on Human Emotion Evaluation Systems Based on EEG Signals
Zhang, Z., Umar, S., Hammadi, A. Y. A., Yoon, S.-Y., Damiani, E., Ardagna, C. A., Bena, N., & Yeun, C. Y. (2023) · IEEE Access · doi:10.1109/access.2023.3245813 · Cited by 25
“The most frequent method of producing this type of poisoning is through willful flipping of the data’s labels [16].”
MethodStealthy and Flexible Trojan in Deep Learning Framework
Wang, Y., Chen, K., Tan, Y., Huang, S., Ma, W., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3164073 · Cited by 27
“Trojan attacks against various DNN models have attracted wide-spread attention [9], [10], [11], [12], [13], [14] and have become a serious threat to the security of the DNN supply chain.”
BackgroundLightweight and Dynamic Privacy-Preserving Federated Learning via Functional Encryption
Yu, B., Zhao, J., Zhang, K., Gong, J., & Qian, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3540312 · Cited by 27
“Liu et al. introduced PEFL, a PPFL framework designed to defend against poisoning attacks [37].”
SGBoost: An Efficient and Privacy-Preserving Vertical Federated Tree Boosting Framework
Zhao, J., Zhu, H., Xu, W., Wang, F., Lu, R., & Li, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3232955 · Cited by 23
“, Sybil attack [26], data poisoning attack [27], [28], etc.”
BackgroundSelf-citationEfficient Byzantine-Robust and Privacy-Preserving Federated Learning on Compressive Domain
Hu, G., Li, H., Fan, W., & Zhang, Y. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3314748 · Cited by 25
“We analyze the functional advantages of our scheme by comparing with five state-of-the-art robust schemes, which are Krum [5], Trimmed Mean [6], AFA [7], RLR [11], PEFL [10], FLTrust [9], and FLOD [8].”
BackgroundMethodInfluentialSelf-citationLyu, X., Hou, X., Ren, C., Ge, X., Yang, P., Cui, Q., & Tao, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3374590 · Cited by 23
“Gradient indistin-guishability is the intrinsic feature of privacy-preserving FL solutions [42].”
BackgroundPRoT-FL: A privacy-preserving and robust Training Manager for Federated Learning
Gamiz, I., Regueiro, C., Jacob, E., Lage, Ó., & Higuero, M. (2024) · Information Processing & Management · doi:10.1016/j.ipm.2024.103929 · Cited by 23
FLAD: Byzantine-Robust Federated Learning Based on Gradient Feature Anomaly Detection
Tang, P., Zhu, X., Qiu, W., Huang, Z. R., Mu, Z., & Li, S. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3542437 · Cited by 23
“Given the significant distinctions between gradients from malicious and honest clients [5], server can construct anomaly detectors using server dataset to extract features from local gradients and categorizes them as honest or malicious.”
InfluentialA framework reforming personalized Internet of Things by federated meta-learning
You, L., Guo, Z., Yuen, C., Chen, C. Y., Zhang, Y., & Poor, H. V. (2025) · Nature Communications · doi:10.1038/s41467-025-59217-z · Cited by 23
“…Gradient Defence) methods 39 are used as baselines against the inverting gradient attack; and CMA (Coordinate-wise Median Aggregation) 40 , LFRPPFL (Label-Flipping-Robust and Privacy-Preserving FL) 41 and PEFL (Privacy-Enhanced FL) 42 are used as baselines against the local fl ipping attack.”
Comments on “Privacy-Enhanced Federated Learning Against Poisoning Adversaries”
Schneider, T. H., Suresh, A., & Yalame, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3238544 · Cited by 21
“However, using different pads for the coordinates does not address the issue since the use of the same pad is required for the SecPear algorithm to remain correct (cf. Proposition 1 in [7]).”
BackgroundMethodInfluentialVPPFL: A verifiable privacy-preserving federated learning scheme against poisoning attacks
Huang, Y., Yang, G., Zhou, H., Dai, H., Yuan, D., & Yu, S. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103562 · Cited by 21
Peng, J., Xing, H., Xu, L., Luo, S., Dai, P., Feng, L., Song, J. H., Zhao, B., & Xiao, Z. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3447087 · Cited by 20
“…instanceswithinthetrainingdata,therebyaidinginthedetection ofmaliciouslypoisonedsamples[29],[30],[31],[32],andfed-eratedlearning-baseddefensemethodsthatfilterparticipating members during aggregation or eliminate potentially malicious updates during the model aggregation stage [33], [34], [35], [36].”
BackgroundShalabi, E., Khedr, W. I., Rushdy, E., & Salah, A. (2025) · Information · doi:10.3390/info16030244 · Cited by 22
Building Trusted Federated Learning: Key Technologies and Challenges
Chen, D., Jiang, X., Zhong, H., & Cui, J. (2023) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan12010013 · Cited by 21
“For example, the work in [15] designed an outlier data point detection mechanism that can effectively eliminate tag reversal and backdoor-based poisoning attacks.”
Privacy-Preserving Collaborative Learning: A Scheme Providing Heterogeneous Protection
Wang, X., Zhang, H., Yang, M., Wu, X., & Cheng, P. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3289546 · Cited by 20
“For instance, Liu et al. [14] introduced two noncollusive servers to aggregate the clients’ local models, where the interactive information among clients and servers is in ciphertext form.”
BackgroundCSRA: Robust Incentive Mechanism Design for Differentially Private Federated Learning
Yang, Y., Hu, M., Zhou, Y., Liu, X., & Wu, D. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3329441 · Cited by 21
“The results are consist with that in prior works [32], [33].”
ResultSelf-citationMBA: Backdoor Attacks Against 3D Mesh Classifier
Fan, L., He, F., Si, T., Fan, R., Ye, C., & Li, B. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3346644 · Cited by 20
“The first scenario [14], [21], [57], [58], [59], [60] is suitable for MGF-MBA .”
BackgroundWei, Z., Wang, J., Zhao, Z., & Shi, K. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107559 · Cited by 23
ROBY: A Byzantine-Robust and Privacy-Preserving Serverless Federated Learning Framework
Tang, X., Li, M., Shen, M., Kang, J., Zhu, L., Liu, Z., Yang, G., Niyato, D. T., & Deng, R. H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3589066 · Cited by 21
“A S PRIVACY concerns and data protection laws prevent organizations from openly sharing users’ private data [1], Federated Learning (FL) [2], [3], [4] has been proposed to enable multiple organizations (i.e., the data owners) to jointly train deep learning models without sharing private data.”
Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries
Zhao, J., Zhu, H., Wang, F., Zheng, Y., Lu, R., & Li, H. (2024) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2024.3377931 · Cited by 23
“To evaluate the effectiveness of ELFL, we compare its prediction accuracy with the vanilla FL scheme (Baseline) [1], a notable HE-based FL scheme (PEFL) [12], and a masking-based FL scheme with grouped aggregation (SBRDL) [19].”
BackgroundMethodSelf-citationQin, Z., Chen, F., Zhi, C., Yan, X., & Deng, S. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i13.29385 · Cited by 19
“…neither significantly alter the statistical characteristics of models as Gaussian-noise attacks (Blanchard et al. 2017) nor cause a distinct modification to the training data as label-flipping attacks (Liu et al. 2021), and thus, are more covert against many existing defenses (Zeng et al. 2022).”
BackgroundFVFL: A Flexible and Verifiable Privacy-Preserving Federated Learning Scheme
Wang, G., Zhou, L., Li, Q., Yan, X., Liu, X., & Wu, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3385479 · Cited by 21
“Research [10] shows that the method of poison attack makes the global model deviate, which reduces the accuracy of the model.”
MethodSelf-citationPEFL: Privacy-Preserved and Efficient Federated Learning With Blockchain
Tian, L., Lin, F., Gan, J., Jia, R., Zheng, Z., & Li, M. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3479328 · Cited by 19
“Privacy security is the core issue in FL and has attracted widespread research interest [15], [17], [18].”
Privacy-Preserving AI (Federated Learning) for Digital Forensics
Iyengar, S. S., Nabavirazavi, S., Hariprasad, Y., Prasad, H. B., & Mohan, C. K. (2025) · Signals and communication technology · doi:10.1007/978-3-031-89327-8_5 · Cited by 18
Evaluating Security and Robustness for Split Federated Learning Against Poisoning Attacks
Wu, X., Yuan, H., Li, X., Ni, J., & Lu, R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3490861 · Cited by 17
Self-citationSoomro, I. A., Rehman, H. U., Hussain, S. J., Iqbal, A., Khalid, W., & Yu, H. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3647642 · Cited by 19
“This limitation ensures a fair comparison with [42], [43], [17], [45], and [46], but also sets the stage for future research to extend our model to these more intricate threats, including various collusion scenarios and auditor threats.”
Privacy-Preserving and Poisoning-Defending Federated Learning in Fog Computing
Li, Y., Zhang, S., Chang, Y. Z., Xu, G., & Li, H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3302795 · Cited by 19
“For addressing both poisoning attacks and privacy protection in FL, two recent works [10], [11] have been proposed, respectively, based on the technologies of DP [10] and 2PC-MPC [11].”
BackgroundMethodSelf-citationSF-CABD: Secure Byzantine fault tolerance federated learning on Non-IID data
Lin, X., Li, Y., Xie, X., Ding, Y., Wu, X., & Ge, C. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111851 · Cited by 18
Gautam, V., Kaur, G., Malik, M., Pawar, A., Singh, A., Singh, K. K., Askar, S., & Abouhawwash, M. (2024) · IEEE Access · doi:10.1109/access.2024.3523257 · Cited by 17
“An algorithm was proposed in [32] to address the issue of data heterogeneity of data spread across the network.”
FlexibleFL: Mitigating poisoning attacks with contributions in cloud-edge federated learning systems
Zhao, Y., Cao, Y., Zhang, J., Huang, H., & Liu, Y. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120350 · Cited by 18
Privacy-preserving federated learning compatible with robust aggregators
Alebouyeh, Z., & Bidgoly, A. J. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.110078 · Cited by 19
BPS-FL: Blockchain-Based Privacy-Preserving and Secure Federated Learning
Yu, J., Yao, H., Ouyang, K., Cao, X., & Zhang, L. (2024) · Big Data Mining and Analytics · doi:10.26599/bdma.2024.9020053 · Cited by 16
A Novel Blockchain-Assisted Aggregation Scheme for Federated Learning in IoT Networks
Liu, Z., Zheng, K., Hou, L., Yang, H., & Yang, K. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3277463 · Cited by 15
“[34] proposed a privacy-enhanced FL framework based on homomorphic encryption, but the framework increased the load on the module that deployed the global model.”
BackgroundZeng, P., Liu, A., Xiong, N. N., Zhang, S., & Dong, M. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3298814 · Cited by 15
“The other is to identify the reliability of IEDs when employing IEDs and select the trusted IEDs training model to obtain the trusted global model [3], [4].”
BackgroundMethodInfluentialPBFL: Privacy-Preserving and Byzantine-Robust Federated-Learning-Empowered Industry 4.0
Li, W., Fan, K., Yang, K., Yang, Y., & Li, H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3315226 · Cited by 15
“Therefore, some works [13], [27], [28], [29] further ensure local data confidentiality with 2PC techniques.”
BackgroundMethodResultInfluentialSelf-citationElZemity, A., & Arief, B. (2024) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics62450.2024.00072 · Cited by 16
Metadata
- Authors
- Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R.
- Affiliations
- University of Electronic Science and Technology of China (CN)
- Nanyang Technological University (SG)
- China Electronics Technology Group Corporation (CN)
- University of New Brunswick (CA)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2021
- Volume
- 16
- Pages
- 4574-4588
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W3198262235
- Cited by
- 351
- References
- 47
- Citations by year
- 2026: 47 · 2025: 102 · 2024: 110 · 2023: 66 · 2022: 23 · 2021: 3
- FWCI
- 17.85
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Natural Science Foundation of China (62020106013, 61972454, 61802051, 61772121, 61728102)
- Sichuan Science and Technology Program (2020JDTD0007, 2020YFG0298)
- Chongqing Science and Technology Commission (cstc2018jcyjAX0703)
- Fundamental Research Funds for Chinese Central Universities (ZYGX2020ZB027)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, poisoning attacks, homomorphic encryption, gradient privacy, poisoning detection, label-flipping attacks, backdoor attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
