The DOI matches its Crossref record; 44 of the 47 references it cites were found in a registry or an index.
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Abstract
Federated learning (FL), as a distributed machine learning setting, has received considerable attention in recent years. To alleviate privacy concerns, FL essentially promises that multiple parties jointly train the model by exchanging gradients rather than raw data. However, intrinsic privacy issue still exists in FL, e.g., user’s training samples could be revealed by solely inferring gradients. Moreover, the emerging poisoning attack also poses a crucial security threat to FL. In particular, due to the distributed nature of FL, malicious users may submit crafted gradients during the training process to undermine the integrity and availability of the model. Furthermore, there exists a contradiction in simultaneously addressing two issues, that is, privacy-preserving FL solutions are dedicated to ensuring gradients indistinguishability, whereas the defenses against poisoning attacks tend to remove outliers based on their similarity. To solve such a dilemma, in this paper, we aim to build a bridge between the two issues. Specifically, we present a privacy-enhanced FL (PEFL) framework that adopts homomorphic encryption as the underlying technology and provides the server with a channel to punish poisoners via the effective gradient data extraction of the logarithmic function. To the best of our knowledge, the PEFL is the first effort to efficiently detect the poisoning behaviors in FL under ciphertext. Detailed theoretical analyses illustrate the security and convergence properties of the scheme. Moreover, the experiments conducted on real-world datasets show that the PEFL can effectively defend against label-flipping and backdoor attacks, two representative poisoning attacks in FL.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To solve this problem, [38], [49], [51] used homomorphic encryption to evaluate the local model securely.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [51]
Citations
Cites
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Paillier, P. (2007) · Lecture Notes in Computer Science · doi:10.1007/3-540-48910-x_16 · Cited by 7,250
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
ADADELTA: An Adaptive Learning Rate Method
Zeiler, M. D. (2012) · arXiv · doi:10.48550/arxiv.1212.5701 · Cited by 5,322
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Pearson Correlation Coefficient
Benesty, J., Chen, J., Huang, Y. A., & Cohen, I. (2009) · Springer topics in signal processing · doi:10.1007/978-3-642-00296-0_5 · Cited by 3,540
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
On the momentum term in gradient descent learning algorithms
Ning Qian, A. (1999) · Neural Networks · doi:10.1016/s0893-6080(98)00116-6 · Cited by 2,318
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Cited by
Sorted by citations
Items 101–200 of 351
Reveal Your Images: Gradient Leakage Attack Against Unbiased Sampling-Based Secure Aggregation
Yang, Y., Ma, Z., Xiao, B., Liu, Y., Li, T., & Zhang, J. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3271432 · Cited by 16
“This observation is further corroborated by the effectiveness of gradient similarity-based backdoor or poison attack detection in FL [19], [24].”
BackgroundResultFedGAN: Federated diabetic retinopathy image generation
Kamran, H., Hussain, S. J., Latif, S., Soomro, I. A., Alnfiai, M. M., & Alotaibi, N. N. (2025) · PLoS ONE · doi:10.1371/journal.pone.0326579 · Cited by 14
“While prior work has established the feasibility of federated GAN training [46] and the value of pre-training for medical image generation [47], our approach uniquely combines these strategies to address the specific challenges of diabetic retinopathy imaging in a privacy-preserving manner.”
Defending Byzantine attacks in ensemble federated learning: A reputation-based phishing approach
Li, B., Wang, P., Shao, Z., Liu, A., Jiang, Y., & Li, Y. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2023.05.002 · Cited by 15
Auditable Federated Learning With Byzantine Robustness
Liang, Y., Li, Y., & Shin, B. (2023) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3266019 · Cited by 13
“The recent FL works [14], [15], [16], which attempt to defend against poisoning attacks while preserving privacy, use two curious-but-honest servers and assume that the servers do not collude with one another or clients.”
FedSIGN: A sign-based federated learning framework with privacy and robustness guarantees
Guo, Z., Xu, L., & Zhu, L. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103474 · Cited by 13
SPEFL: Efficient Security and Privacy-Enhanced Federated Learning Against Poisoning Attacks
Shen, L., Ke, Z., Shi, J., Zhang, X., Sun, Y., Zhao, J., Wang, X., & Zhao, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3339638 · Cited by 17
“In order to improve efficiency, some work makes tradeoffs in terms of privacy by revealing some intermediate values [25], [31] or in terms of effectiveness against poisoning attacks by utilizing relatively simple defenses [32].”
BackgroundMethodResultInfluentialBlockchain-Based Privacy-Preserving Federated Learning for Mobile Crowdsourcing
Ma, H., Huang, S., Guo, J., Lam, K., & Yang, T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3340630 · Cited by 14
“…the privacy preservation of FL, many schemes have been proposed, which are mainly based on DP technique [23], [24], [25], [26], [27], HE [28], [29], [30], [31], [32], [33], [34], [35], [36], secure multiparty computation (MPC) [37], [38], [39], [40], and masking-based approach [41], [42], [43].”
MethodZhang, F., Huang, H., Chen, Z., & Huang, Z. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110383 · Cited by 15
Self-citationDual-Server-Based Lightweight Privacy-Preserving Federated Learning
Zhong, L., Wang, L., Zhang, L., Domingo‐Ferrer, J., Xu, L., Wu, C., & Zhang, R. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3399534 · Cited by 14
“Therefore, dual-server based architectures are essential for FL, as they can greatly reduce the overall communication and computation costs of FL. Additionally, in recent years, the use of two servers in FL has become more prevalent, with approaches such as [15], [24] and [45] gaining popularity.”
BackgroundExploring Representational Similarity Analysis to Protect Federated Learning from Data Poisoning
Chen, G., Li, K., Abdelmoniem, A. M., & You, L. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589335.3651503 · Cited by 14
“To be specific, [9] proposes PEFL, which treats Median as a benchmark, calculates the Pearson Correlation Coefficient (PCC) between the benchmark and each gradient, and adjusts corresponding aggregation weight.”
InfluentialBADFL: Backdoor Attack Defense in Federated Learning From Local Model Perspective
Zhang, H., Li, X., Xu, M., Liu, X., Wu, T., Weng, J., & Deng, R. H. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3420778 · Cited by 13
“Many defenses have been proposed [9], [10], [11], [12], [13] with the general idea of malicious model detection followed by further eliminating the impact of malicious local weights on the global model.”
BackgroundMethodInfluentialSelf-citationDetection and Mitigation of Label-Flipping Attacks in FL Systems With KL Divergence
Zang, L., & Li, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3424188 · Cited by 15
“To achieve secure model aggregation, encryption techniques [13], [22], differential privacy methods [17], distributed consensus algorithms, and other approaches [3], [23] are usually employed to protect data privacy and model security.”
BackgroundMethodInfluentialBlockchain-Enabled Vehicle Lifecycle Management With Predictive Maintenance Using Federated Learning
Peelam, M. S., Shah, K., Chamola, V., & Sikdar, B. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3487874 · Cited by 14
“Collusion attacks, where multiple malicious participants coordinate to corrupt the federated learning process, can further undermine model accuracy [56].”
RobustPFL: Robust Personalized Federated Learning
Chen, G., Wang, W., Wu, Y., Li, C., Xu, G., Ji, S., Li, T., Shen, M., & Han, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3526840 · Cited by 18
“Due to the distributed nature of PFL, client-side and aggregator-side attacks can make the above two PFL system compromise models integrity [9] and availability [10], which places higher demands on robustness against attacks .”
Self-citationRobust and Verifiable Privacy Federated Learning
Lu, Z. G., Lu, S., Tang, X., & Wu, J. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3309273 · Cited by 16
“Existing state-of-the-art robust privacy federation learning, such as PEFL [19], ShieldFL [21], and fragmented federated learning (FFL) [15], can effectively resist poisoning attacks and ensure user privacy, but they only measure the direction of the gradient and lack a measure of the vector…”
BackgroundMethodInfluentialASIA: A Federated Boosting Tree Model Against Sequence Inference Attacks in Financial Networks
Kong, Y., Li, Z., & Jiang, C. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3428412 · Cited by 12
“There are some studies based on the HFL framework [22], [23], [24].”
BackgroundMethodMitigating Label Flipping Attacks in Malicious URL Detectors Using Ensemble Trees
Nowroozi, E., Jadalla, N., Ghelichkhani, S., & Jolfaei, A. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3447411 · Cited by 12
“In addition, other studies have explored poisoning attacks and developed defense methods such as K-LID [9] and PEFL [17].”
Bc²FL: Double-Layer Blockchain-Driven Federated Learning Framework for Agricultural IoT
Ding, Q., Yue, X., Zhang, Q., Xiong, Z., Chang, J., & Zheng, H. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3485208 · Cited by 12
“Also, Liu et al. [30] adopted homomorphic encryption as the underlying technology and use logarithmic function-based gradient data extraction to penalize malicious clients, though this approach cannot prevent malicious server behavior.”
Analysis of deep learning under adversarial attacks in hierarchical federated learning
Alqattan, D. S., Snåšel, V., Ranjan, R. K., & Ojha, V. (2025) · High-Confidence Computing · doi:10.1016/j.hcc.2025.100321 · Cited by 12
PriRoAgg: Achieving Robust Model Aggregation With Minimum Privacy Leakage for Federated Learning
Hou, S., Li, S., Jahani-Nezhad, T., & Caire, G. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3577498 · Cited by 14
“We note that the honest-but-curious (semi-honest) server setting is pervasively considered in previous works on secure and robust federated learning [23], [32], [33], [34], [36], [44], [47], [48], [71], [76].”
Blockchain-based privacy-preserving multi-tasks federated learning framework
Jia, Y., Xiong, L., Fan, Y., Liang, W., Xiong, N. N., & Xiao, F. (2024) · Connection Science · doi:10.1080/09540091.2023.2299103 · Cited by 12
“In 2021, Liu et al. (2021) proposed privacy enhanced federated learning scheme (PEFL), using HE technology, which can effectively resist two typical poisoning attacks in FL, label flipping and backdoor attacks.”
Byzantine-Robust and Privacy-Preserving Federated Learning With Irregular Participants
Chen, Y., Tan, W., Zhong, Y., Kang, Y., Yang, A., & Weng, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3434660 · Cited by 11
“Therefore, other studies [22], [23], [24], [25] have been proposed that address the issue of Byzantine attacks while also safeguarding the privacy of local models.”
BackgroundMethodSecuring Federated Learning: Approaches, Mechanisms and Opportunities
Moshawrab, M., Adda, M., Bouzouane, A., Ibrahim, H., & Raad, A. (2024) · Electronics · doi:10.3390/electronics13183675 · Cited by 12
A Data Poisoning Resistible and Privacy Protection Federated-Learning Mechanism for Ubiquitous IoT
Chen, G., Li, X., You, L., Abdelmoniem, A. M., Zhang, Y., & Yuen, C. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3514637 · Cited by 11
“For example, PEFL [45] is proposed, which protects data based on HE, and utilize the coordinate-wise medians of local gradients as a benchmark to assess the similarity of each local gradient to defend against both LFA and BA in IID situations; Similarly, beside HE which is used to protect data…”
InfluentialReinforcement Learning-Based Personalized Differentially Private Federated Learning
Lu, X., Liu, Z., Xiao, L., & Dai, H. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3515814 · Cited by 11
“Recently, blockchain, homomorphic encryption, secure aggregation, and trust formulation methods are used in FL to resist membership inference attacks [31], [32], [33], [34].”
TPFL: Privacy-preserving personalized federated learning mitigates model poisoning attacks
Zuo, S., Xie, Y., Yao, H., & Zhijie, K. (2025) · Information Sciences · doi:10.1016/j.ins.2025.121901 · Cited by 12
Sen, A., Heng, S., & Tan, S. C. (2025) · IEEE Access · doi:10.1109/access.2025.3593953 · Cited by 14
Intrusion detection framework based on homomorphic encryption in AMI network
Wang, J., Xia, Z., Chen, Y., Hu, C., & Yu, F. (2022) · Frontiers in Physics · doi:10.3389/fphy.2022.1102892 · Cited by 12
A Trojan Attack against Smart Grid Federated Learning and Countermeasures
Bondok, A. H., Badr, M. M., Mahmoud, M. M. E. A., El-Toukhy, A. T., Alsabaan, M., Amsaad, F., & Ibrahem, M. I. (2024) · IEEE Access · doi:10.1109/access.2024.3515099 · Cited by 10
Long-Term Client Selection for Federated Learning With Non-IID Data: A Truthful Auction Approach
Tan, J., Liu, Z., Guo, K., & Zhao, M. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3524389 · Cited by 10
“Moreover, with information asymmetry between the CS and MCs, MCs will want to get inordinate rewards by submitting no-real information, which has a great negative influence on the performance of the model [24].”
FedG2L: a privacy-preserving federated learning scheme base on “G2L” against poisoning attack
Xu, M., & Li, X. (2023) · Connection Science · doi:10.1080/09540091.2023.2197173 · Cited by 10
“…Levine & Feizi, 2020; Wen et al., 2021b) FL against poisoning attacks ✗ ✗ ✗ (Awan et al., 2021; Shejwalkar & Houmansadr, 2021; Sun et al., 2021) PEFL (Liu et al., 2021) ✗ ✗ ShiledFL (Ma et al., 2022) (Hou et al., 2021; Li et al., 2022; Yang et al., 2023) PBFL (Miao et al., 2022) ✗ ✗ Our…”
BackgroundInfluentialEdge server enhanced secure and privacy preserving federated learning
Xu, Y., Mao, Y., Li, J., Chen, X., & Wu, S. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110465 · Cited by 11
Privacy-Preserving Byzantine-Resilient Swarm Learning for E-Healthcare
Zhu, X., Lai, T., & Li, H. (2024) · Applied Sciences · doi:10.3390/app14125247 · Cited by 10
Self-citationSecuring One-Class Federated Learning Classifiers Against Trojan Attacks in Smart Grid
Bondok, A. H., Badr, M. M., Mahmoud, M. M. E. A., Alsabaan, M., Fouda, M. M., & Abdallah, M. M. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3481213 · Cited by 9
“The existing defenses designed for supervised models (such as [16], [17], [20], [21], and [43]) utilize clients’ model parameters across all layers to detect the malicious clients.”
DBFL: Dynamic Byzantine-Robust Privacy Preserving Federated Learning in Heterogeneous Data Scenario
Chen, X., Tian, Y., Wang, S., Yang, K., Zhao, W., & Xiong, J. (2025) · Information Sciences · doi:10.1016/j.ins.2024.121849 · Cited by 11
Ullah, I., Deng, X., Pei, X., Mushtaq, H., Uzair, M., & Qayyum, S. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111705 · Cited by 12
Ma, H., Li, Q., Zheng, Y., Zhang, Z., Liu, X., Gao, Y., Al-Sarawi, S. F., & Abbott, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103406 · Cited by 14
Self-citationMohammadi, S., Sinaei, S., Balador, A., & Flammini, F. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-7032-2_1 · Cited by 9
“The encrypted results can then be sent back to the devices for decryption and aggregation, allowing the model to be trained without ever exposing sensitive data [25].”
BackgroundEfficient and Privacy-Preserving Federated Learning with Irregular Users
Xu, J., Li, H., Zeng, J., & Hao, M. (2022) · International Conference on Communications · doi:10.1109/icc45855.2022.9839208 · Cited by 9
“Despite FL’s success, recent studies indicate that adversaries can still recover private information [5] [6] (e.g., sensitive training data) of target users from the local updates.”
BackgroundSelf-citationByzantine-Robust Hierarchical Aggregation for Cross-Device Federated Learning in Consumer IoT
Liu, J., Wu, Y., Wei, D., Sun, R. X., Xu, G., Liu, L., & Wu, C. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3450649 · Cited by 11
“To resist Byzantine attacks without leaking data privacy, Liu et al. [24] proposed the Privacy-Enhanced FL scheme (PEFL).”
Self-citationBRFL: A blockchain-based byzantine-robust federated learning model
Li, Y., Xia, C., Li, C., & Wang, T. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104995 · Cited by 9
Deng, Y., Guo, B., & Chen, S. (2025) · Electronics · doi:10.3390/electronics14020361 · Cited by 13
PDSA-FL: A Poisoning-Defense Secure Aggregation in Federated Learning
Huang, Z., Bi, Y., Zhang, K., Hu, B., Su, Z., Tai, C., & Luan, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3588324 · Cited by 8
“In [22], an FL mechanism PEFL, which combines dual servers and HE, is proposed.”
InfluentialRobust Federated Learning Against Data Poisoning Attacks: Prevention and Detection of Attacked Nodes
Ovi, P. R., & Gangopadhyay, A. (2025) · Electronics · doi:10.3390/electronics14152970 · Cited by 8
“Researchers have introduced an adaptive federated aggregation technique [35], which involved comparing gradients against medians and adjusting their weights accordingly.”
Han, J., Wang, L., Liu, Z., Qin, B., Zhang, K., & Li, W. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3595533 · Cited by 8
“Liu et al. [13] introduced a privacy-enhanced FL framework based on HE; this framework provides the server with a mechanism to penalize malicious clients by extracting gradient patterns from logarithmic functions, thereby defending against model poisoning attacks and improving robustness.”
Mitigation of a poisoning attack in federated learning by using historical distance detection
Shi, Z., Ding, X., Li, F., Chen, Y., & Li, C. (2022) · Annals of Telecommunications · doi:10.1007/s12243-022-00929-4 · Cited by 8
“We compare the functions of our privacy-preserving scheme with ZHWJH [29] and LLXCHL [30].”
ResultZhang, Y., Lu, Y., Liu, F., et al. (2024) · Information Sciences · doi:10.1016/j.ins.2024.121641 · Cited by 8
Byzantine-Resilient Secure Federated Learning on Low-Bandwidth Networks
Masuda, H., Kita, K., Koizumi, Y., Takemasa, J., & Hasegawa, T. (2023) · IEEE Access · doi:10.1109/access.2023.3277858 · Cited by 8
“Byzantine attacks [33], [34], [35], [36].”
Mali, B., Singh, P. K., & Mazumdar, N. (2024) · Security and Privacy · doi:10.1002/spy2.403 · Cited by 7
“24,25 Poisoning attacks in FL can be classified into two types: Data Poisoning Attacks and Model Poisoning Attacks .”
Aherrahrou, N., Tairi, H., & Aherrahrou, Z. (2024) · Briefings in Bioinformatics · doi:10.1093/bib/bbae356 · Cited by 7
“Poisoning attacks occur when an intruder attempts to embed malicious model updates [69], with which the attacker can corrupt the federated learning model’s integrity, leading to misleading results [70].”
BackgroundPoisoning Attack Mitigation for Privacy-Preserving Federated Learning-Based Energy Theft Detection
Srewa, M., Winfree, M. F., Ibrahem, M. I., Nabil, M., Lu, R., & Alsharif, A. (2024) · International Conference on Communications · doi:10.1109/icc51166.2024.10622191 · Cited by 7
“Although other research works [10], [11] address mitigating model poisoning attacks in other settings and applications, they rely on the impractical two non-colluding server assumption that is not suitable in several FL scenarios.”
BackgroundSelf-citationEdge-Assisted Label-Flipping Attack Detection in Federated Learning
Alotaibi, N., Felemban, M., & Mahmood, S. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3496872 · Cited by 9
“The authors in [15] introduced an innovative adaptive aggregation strategy that employs coordinate medians as a reference point and dynamically modifies the aggregation weights based on the similarity between each client’s gradient and this median benchmark.”
InfluentialDualGuard: Obfuscated Federated Learning With Two-Party Secure Robust Aggregation
Pan, H., Bao, H., Guan, M., Li, Z., Huang, C., & Dai, H. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3533087 · Cited by 7
“In FL, most schemes use gradient aggregation [10], [11], [22], [23], [24], [25], [26], [27].”
Ren, Y., Yang, Z., Feng, G., & Zhang, X. (2025) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2025.3540420 · Cited by 7
“Therefore, we consider that the poisoners will not choose to colludewiththeCS,andpriorworks[23],[24]haveallemployed suchasetting.”
InfluentialNiu, S., Kong, W., Chen, L., et al. (2025) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2025.104201 · Cited by 7
Cost-Efficient and Secure Federated Learning for Edge Computing
Zhang, Z., Wu, L., Wang, Z., Hu, J., Ma, C., & Liu, Q. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3590799 · Cited by 7
AMA: Adaptive Model Poisoning Attacks Towards Federated Learning
Wu, D., Guo, Q., Qi, Y., Qi, S., & Li, Q. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3594175 · Cited by 7
Flotilla: A scalable, modular and resilient federated learning framework for heterogeneous resources
Banerjee, R., Modi, P., Vyas, J., Abhijit, C. S., Chandrashekar, T., Marisetty, H. V., Gupta, M., & Simmhan, Y. L. (2025) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2025.105103 · Cited by 8
Blockchain-based fairness-enhanced federated learning scheme against label flipping attack
Jin, S., Li, Y., Chen, X., Li, R., & Shen, Z. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103580 · Cited by 7
EVFL-DCs: Enhancing verifiability of federated learning by double commitments based on blockchain
Wei, Q., Wu, X., Liu, Z., & Rao, G. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111097 · Cited by 6
ESFL: Accelerating Poisonous Model Detection in Privacy-Preserving Federated Learning
Zeng, H., Lou, J., Li, K., Wu, C., Xue, G., Luo, Y., Cheng, F., Zhao, W., & Li, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3541633 · Cited by 6
“In recent years, researchers generally introduce a pair of non-colluding servers to achieve secure interactive aggregation strategies [4], [5].”
InfluentialSecuring Federated Learning in IoT: A Survey of Attacks, Defenses, and Frameworks
Atia, O. B., Samara, M. A., Bennis, I., Gaber, J., Abouaïssa, A., & Lorenz, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600617 · Cited by 6
Ashwini, P., & Rout, R. R. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111656 · Cited by 6
Yu, J., Zhang, H., Xia, Q., Zou, Y., & Liu, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3623924 · Cited by 6
“Moreover, compared to other similar schemes [27], [28], [30], these schemes adopt homomorphic encryption in the client, which has a time overhead T ch .”
InfluentialMIGAN: A Privacy Leakage Evaluation Scheme for CIoT-Based Federated Learning Users
Xu, S., Xia, H., Xu, L., Zhang, R., & Hu, C. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3367494 · Cited by 6
“Although FL has efforts in protecting user data privacy [30] in CIoT (e.g., preventing external attackers from snooping on sensitive data), sensitive data is still at risk of privacy attacks [31].”
BackgroundFedSteg: Coverless Steganography‐Based Privacy‐Preserving Decentralized Federated Learning
Xu, M., & Lin, Y.-G. (2024) · IEEJ TRANSACTIONS ON ELECTRICAL AND ELECTRONIC ENGINEERING · doi:10.1002/tee.24085 · Cited by 6
“Liu et al. [18] proposed a privacy Enhanced FL (PEFL) framework, which uses Paillier homomorphic encryption as the underlying technology to ensure the integrity and availability of the global model, and uses the Pearson coefficient to measure the similarity between gradients, eliminate abnormal…”
MethodDecentralized Online Bandit Federated Learning Over Unbalanced Directed Networks
Gao, W., Zhao, Z., Wei, M., Yang, J., Zhang, X., & Li, J. (2024) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2024.3409755 · Cited by 6
“Additionally, most existing FL algorithms operate under the assumption that gradient information is available [16], [17], [18], [19].”
BackgroundMethodLow Complexity Byzantine-Resilient Federated Learning
Gouissem, A., Hassanein, S., Abualsaud, K., Yaacoub, E. E., Mabrok, M. A., Abdallah, M. M., Khattab, T. M., & Guizani, M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3482727 · Cited by 9
“For example, the authors in [28] proposed a new privacy-enhanced FL framework (PEFL) that uses homomorphic encryption to prevent malicious users from inferring memberships and protect users’ privacy.”
Sun, H., Zhang, Y., Zhuang, H., Li, J., Xu, Z., & Wu, L. (2024) · The Computer Journal · doi:10.1093/comjnl/bxae086 · Cited by 7
A Verifiable, Privacy-Preserving, and Poisoning Attack-Resilient Federated Learning Framework
Mbonu, W. E., Maple, C. R., Epiphaniou, G., & Panchev, C. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9040085 · Cited by 7
Privacy-Enhanced Data Fusion for Federated Learning Empowered Internet of Things
Lin, Q., Xu, K., Huang, Y., Yu, F., & Wang, X. (2022) · Mobile Information Systems · doi:10.1155/2022/3850246 · Cited by 6
“[8] proposed a federated learning scheme PEFL to mitigate poisoning attacks under privacy enhancement.”
BackgroundSecurePrivChain: A decentralized framework for securing the global model using cryptography
Sanam, K., Malik, S. U. R., Kanwal, T., & Adil, Z. U. I. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2022.12.032 · Cited by 6
Flag: A Framework for Lightweight Robust Secure Aggregation
Bangalore, L., Sereshgi, M. H. F., Hazay, C., & Venkitasubramaniam, M. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3595805 · Cited by 8
Robust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 17
EPCNN: Efficient and Practical Privacy-Preserving Convolutional Neural Network Inference
He, G., Ren, Y., Zhao, J., et al. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3534834 · Cited by 5
“We establish the Algorithm 6: Final Inference Decryption. security with a hybrid argument that leans on simulators [31].”
Zhu, X., & Li, H. (2025) · Applied Sciences · doi:10.3390/app15105472 · Cited by 8
Self-citationWei, Z., Wang, J., Zhao, Z., & Zhao, Z. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103345 · Cited by 8
Moyeen, M. A., Kaur, K., Agarwal, A., Manzano, S. R., Zaman, M., & Goel, N. (2025) · IEEE Access · doi:10.1109/access.2025.3592207 · Cited by 5
“Liu and colleagues [23] introduced an alternative method that leverages the Pearson correlation coefficient.”
FL-CDF: Collaborative Defense Framework for Backdoor Mitigation in Federated Learning
Zhang, H., Li, X., Miao, Y., Yuan, S., Zhu, M., Liu, X., & Deng, R. H. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3590175 · Cited by 5
“First, the server clusters clients into benign and malicious groups and then only aggregates the benign group [13], [14], [21].”
Self-citationWu, J., Luo, F., Sun, T., Wang, H., & Zhang, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3617070 · Cited by 7
“However, these schemes often suffer from inefficiency [19], [20], [21], [22], [23], [24], may still incur privacy leakages [22], [23], [24], [25], [26], [27], [28], [29], are not secure for secure multiparty computation (MPC) scenarios like PBFL applications [30], or rely on a fully trusted third…”
AntidoteFL: Enhancing defense against poisoning attacks in federated learning
Liu, Y., Zhang, H., Wang, M., Xie, Q., & Sun, Z. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111427 · Cited by 5
Resisting Poisoning Attacks in Federated Learning via Dual-Domain Distance and Trust Assessment
Wang, Z., Zhang, Z., Li, Z., Wu, Y. X., Liu, Y., Li, M., Li, X., Liu, Y., An, J., Liang, W., et al. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3589061 · Cited by 5
“Malicious participants can manipulate local models by altering parameters or modifying personal data, leading to model poisoning or data poisoning attacks [3].”
Pu, L., Gu, J., Lin, C., & Huang, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3597223 · Cited by 6
“Restrictions apply. correlation [46], and singular value decomposition-based anomaly detection [47].”
Self-citationA Privacy Robust Aggregation Method Based on Federated Learning in the IoT
Li, Q., Wang, X., & Ren, S. (2023) · Electronics · doi:10.3390/electronics12132951 · Cited by 6
A Federated Learning Based Privacy-Preserving Data Sharing Scheme for Internet of Vehicles
Wang, Y., Xiong, L., Niu, X., Wang, Y., & Liang, D. (2022) · Communications in computer and information science · doi:10.1007/978-981-19-8445-7_2 · Cited by 5
SurroFL: Sketch-Based Defense Against Poisoning in Privacy-Preserving Federated Learning
Kuang, Y., Liu, W., Han, L., Huang, J., Cao, P., & You, L. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3602453 · Cited by 4
“PEFL [38] is one of the earliest frameworks to integrate the encryption with filtering the gradients, effectively defending against the malicious updates while preserving the privacy.”
Robust Federated-Learning-Based Classifier for Smart Grid Power Quality Disturbances
Alsabaan, M., Elsayed, A., Bondok, A. H., Badr, M. M., Mahmoud, M. M. E. A., Alshawi, T. A., & Ibrahem, M. I. (2025) · Sensors · doi:10.3390/s25226880 · Cited by 4
“Prior research in domains other than PQD classification [34,45–47] has shown that when client data is independently and identically distributed (IID), the gradients computed by benign clients tend to be highly consistent.”
Efficient Byzantine-Robust Privacy-Preserving Federated Learning via Dimension Compression
Qin, X. R., Yang, X. S., & Tang, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3671104 · Cited by 5
“PEFL [20] uses a dual-server architecture with Paillier encryption and Pearson correlation coe ffi cients for Byzantine defense, but requires shared encryption keys, creating vulnerability to collusion.”
Algethami, W., Wu, G., Alshami, F., & Ali, M. A. (2026) · Information Sciences · doi:10.1016/j.ins.2026.123389 · Cited by 4
FedRec+: Enhancing Privacy and Addressing Heterogeneity in Federated Recommendation Systems
Wang, L., Wang, Z., Leng, X., et al. (2023) · Allerton Conference on Communication, Control, and Computing · doi:10.1109/allerton58177.2023.10313513 · Cited by 4
“However, this approach requires additional communication and storage costs between users, which can lead to privacy leakage issues [13].”
BackgroundGautam, V., Maheshwari, H., Tiwari, R. G., Agarwal, A. K., & Trivedi, N. K. (2023) · International Conference on Automation, Computing and Renewable Systems (ICACRS) · doi:10.1109/icacrs58579.2023.10405076 · Cited by 5
“An approach to improving network security and privacy was presented in [32].”
BackgroundFedMAR: A Privacy-Preserving and Robust Server-Side Multistage Federated Learning
Shi, L., Gao, Y., Chen, C., Huang, S., Zhao, J., Hu, X., & Leung, V. C. M. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600099 · Cited by 4
“In Byzantine-based methods, such as median aggregation [26], trimmed mean aggregation [27] and FedCorr [28], researchers aim at adjusting the aggregation strategies to eliminate the weights of poisoned participants.”
A Socio-Technical Feedback Loop for Responsible Military AI Life-Cycles from Governance to Operation
Heijnen, M., Schoonderwoerd, T., Neerincx, M. A., van der Waa, J., Kester, L. J. H. M., van Diggelen, J., & Elands, P. J. M. (2024) · Chapman & Hall/CRC eBooks · doi:10.1201/9781003410379-3 · Cited by 5
Bondok, A. H., Badr, M. M., Mahmoud, M. M. E. A., et al. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3599106 · Cited by 4
“However, following most works in the literature, such as [26], we consider the case where malicious attackers make up less than 50% of the data owners.”
CSFL: Cooperative Security Aware Federated Learning Model Using The Blockchain
Zhang, J., Ye, A., Chen, J., Zhang, Y., & Yang, W. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad060 · Cited by 4
Song, R., Wu, J., Pan, Q., Imran, M. A., Naser, N., Jones, R. K., & Verikoukis, C. V. (2023) · Globecom · doi:10.1109/globecom54140.2023.10437789 · Cited by 4
FedBC: An Efficient and Privacy-Preserving Federated Consensus Scheme
Xu, M., & Li, X. (2022) · Communications in computer and information science · doi:10.1007/978-981-19-7242-3_10 · Cited by 4
Blockchain-Based Fairness-Enhanced Federated Learning Scheme Against Data Poisoning Attack
Jin, S., Li, Y., Chen, X., Li, R., & Shen, Z. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-28124-2_31 · Cited by 4
Privacy-Preserving and Verifiable Personalized Federated Learning
Xie, D., & Li, D. (2025) · Symmetry · doi:10.3390/sym17030361 · Cited by 4
Mitigating Poisoning Attacks in Federated Learning Through Deep One-Class Classification
Zhang, A., Zhao, P., Lu, W., Zhou, Y., Zhang, W., & Zhang, G. (2025) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2025.3564476 · Cited by 3
“Existing research highlights the substantial risks associated with poisoning attacks in federated learning [3], [6], [7], [8], [9], [12].”
Influential
Metadata
- Authors
- Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R.
- Affiliations
- University of Electronic Science and Technology of China (CN)
- Nanyang Technological University (SG)
- China Electronics Technology Group Corporation (CN)
- University of New Brunswick (CA)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2021
- Volume
- 16
- Pages
- 4574-4588
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W3198262235
- Cited by
- 351
- References
- 47
- Citations by year
- 2026: 47 · 2025: 102 · 2024: 110 · 2023: 66 · 2022: 23 · 2021: 3
- FWCI
- 17.85
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Natural Science Foundation of China (62020106013, 61972454, 61802051, 61772121, 61728102)
- Sichuan Science and Technology Program (2020JDTD0007, 2020YFG0298)
- Chongqing Science and Technology Commission (cstc2018jcyjAX0703)
- Fundamental Research Funds for Chinese Central Universities (ZYGX2020ZB027)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, poisoning attacks, homomorphic encryption, gradient privacy, poisoning detection, label-flipping attacks, backdoor attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
