The DOI matches its Crossref record; 44 of the 47 references it cites were found in a registry or an index.
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Abstract
Federated learning (FL), as a distributed machine learning setting, has received considerable attention in recent years. To alleviate privacy concerns, FL essentially promises that multiple parties jointly train the model by exchanging gradients rather than raw data. However, intrinsic privacy issue still exists in FL, e.g., user’s training samples could be revealed by solely inferring gradients. Moreover, the emerging poisoning attack also poses a crucial security threat to FL. In particular, due to the distributed nature of FL, malicious users may submit crafted gradients during the training process to undermine the integrity and availability of the model. Furthermore, there exists a contradiction in simultaneously addressing two issues, that is, privacy-preserving FL solutions are dedicated to ensuring gradients indistinguishability, whereas the defenses against poisoning attacks tend to remove outliers based on their similarity. To solve such a dilemma, in this paper, we aim to build a bridge between the two issues. Specifically, we present a privacy-enhanced FL (PEFL) framework that adopts homomorphic encryption as the underlying technology and provides the server with a channel to punish poisoners via the effective gradient data extraction of the logarithmic function. To the best of our knowledge, the PEFL is the first effort to efficiently detect the poisoning behaviors in FL under ciphertext. Detailed theoretical analyses illustrate the security and convergence properties of the scheme. Moreover, the experiments conducted on real-world datasets show that the PEFL can effectively defend against label-flipping and backdoor attacks, two representative poisoning attacks in FL.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To solve this problem, [38], [49], [51] used homomorphic encryption to evaluate the local model securely.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [51]
Citations
Cites
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Paillier, P. (2007) · Lecture Notes in Computer Science · doi:10.1007/3-540-48910-x_16 · Cited by 7,250
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
ADADELTA: An Adaptive Learning Rate Method
Zeiler, M. D. (2012) · arXiv · doi:10.48550/arxiv.1212.5701 · Cited by 5,322
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Pearson Correlation Coefficient
Benesty, J., Chen, J., Huang, Y. A., & Cohen, I. (2009) · Springer topics in signal processing · doi:10.1007/978-3-642-00296-0_5 · Cited by 3,540
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
On the momentum term in gradient descent learning algorithms
Ning Qian, A. (1999) · Neural Networks · doi:10.1016/s0893-6080(98)00116-6 · Cited by 2,318
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Cited by
Sorted by citations
Items 301–351 of 351
A Privacy-Preserving Federated Learning Framework with Byzantine Robustness
Zhang, X., & Shen, G. (2024) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc64274.2024.00182
“PEEL [12] uses homomorphic encryption as the underlying technology, identifying malicious parameters through the Pearson coefficient to achieve robustness, but this introduces significant computational overhead.”
PARSIFAL: Private and Robust Sign Federated Learning
Lei, R., Wang, P., Zeng, J., Wang, C., Pei, H., & Zhao, J. (2025) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3711896.3737074
SAMK: Secure Aggregation for Federated Learning Under Multiple Keys With Low Communication Rounds
Guo, C., Li, L., Liu, X., Choo, K. R., & Liu, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3602908
Self-citationCao, L., Yuan, C., Li, X., et al. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3605044
“The primary privacy-preserving computation techniques currently in existence encompass trusted execution environments (TEEs) [14], cryptography [3], and differential privacy (DP) [4].”
BR-CPPFL: A Blockchain-Based Robust Clustered Privacy-Preserving Federated Learning System
Li, Y., Wang, X., Zhang, K., Zhang, B., Zheng, L., Ding, X., & Xu, Q. H. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3543-9_20
Secure federated learning with configurable reliability in heterogeneous edge computing
Liu, Y., Liang, Y., Zhang, R., & Zhou, Z. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111808
RDCBA-FEL: Robust Defense Against Colluded Backdoor Attacks in Federated Edge Learning
Zhang, P., Xu, L., Xu, C., Mei, L., & Liu, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3629550
“Secondly, the idea of existing defense strategies [5], [6], [8], [9], [12] is to detect and remove poisonous updates to defend against the attacks or adopt robust aggregation to mitigate the impact of poisonous updates.”
Wen, Y., Ai, L., Liu, G., Wei, J., & Zhao, W. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3629640
“Privacy-preserving Federated Learning (PPFL) [25], [26] is increasingly acknowledged as an essential method for enhanc-Authorized licensed use limited to the terms of the applicable license agreement with IEEE.”
How to Defend Against Large-Scale Model Poisoning Attacks in Federated Learning: A Vertical Solution
Wang, J., Wang, R., & Zhang, F. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3630175
“Existing defense mechanisms [14], [15], [16], [17], [18], [19], [20], [21] typically adopt a horizontal strategy (see Defini-tion 4.1) that aims to identify an optimal set of honest gradients for aggregation from all user submissions within the same communication round.”
InfluentialFedDefense: An Integrated Robust Defense Against Backdoor Attacks in Federated Learning
Chen, X. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11228847
“Backdoor attacks are more stealthy than normal poisoning attacks [3].”
Gonthina, S. S., Roy, S., Ahamed, S. F., et al. (2025) · International Conference on Software, Telecommunications and Computer Networks (SoftCOM) · doi:10.23919/softcom66362.2025.11197351
“A. Experimental Setup 1) Dataset Description: We selected MNIST as the primary dataset to enable reproducible and fair comparison with recent federated learning defenses against label-flipping attacks, including [12], [15], and [18].”
Secure and Trustworthy Federated Learning Framework via Hierarchical Sharding Blockchain
Wei, Z., Wang, J., Zhao, Z., Zhao, Z., & Li, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3639396
“To balance the privacy protection of model parameters and resistance to poisoning attacks, Liu et al. [26] proposed a privacy-enhanced FL framework named PEFL.”
From Heterogeneous Data to Secure Convergence: A Data-Centric Review of Federated LearningPreprint
Nguyen, H. Q., Bettinelli, M., Ghaffari, A., Benoît, A., Nguyen, T., Pirttikangas, S., & Lovén, L. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5856890
Sybil-aware adaptive defence framework for robust federated learning
Khedekar, D., Mahapatra, T., & Rajput, A. S. (2025) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2025.102157
A Defense Against Label Flipping Attacks in Federated Learning Using Output Layer Gradients
Yu, M., & Gong, B. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9849-3_36
Fed-WGCA: A Federated Learning Framework With Coordinate Attention and WGAN for Enhanced Performance
Liu, Y., Zhai, Y., Qu, B., Xue, H., & Liu, X. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3647709
“Third, DP injects carefully calibrated random noise into the data or model updates to prevent the leakage of private information [6], [23].”
Self-citationXiao, D., Tang, J., & Chen, L. (2025) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads67057.2025.11323165
“Liu et al. [12] highlighted that simultaneously detecting poisoning attacks and resisting inference attacks is a complex and challenging task.”
Liu, L., Wang, Y., Li, J., Zheng, M., Jiang, Z., Song, Y., & Liu, X. (2025) · IEEE International Conference on Bioinformatics and Biomedicine (BIBM) · doi:10.1109/bibm66473.2025.11356719
“However, most existing approaches [42]–[46] that combine FL with FHE generally rely on an honest key generation center, two non-colluding servers, or a trusted third party [47].”
Self-citationResearch on Privacy Protection and Anti-Poisoning Attack Methods Based on Federated Learning
张, 铁. (2026) · Computer Science and Application · doi:10.12677/csa.2026.162057
Accelerating Subgraph Matching Using Isolated Vertices and BFS Data Structures
Zhang, G., Ning, B., & Zhou, X. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-6426-2_25
RankFL: Robustness and Privacy-Preserving Federated Learning Scheme Against Poisoning Attacks
Chang, Y., Chen, Q., Luan, T. H., & Su, Z. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3672641
“These methods typically enable privacy-preserving operations such as cosine similarity computation [16], [17], normalization-based detection [18], or encrypted mean aggregation on blinded gradients [19].”
InfluentialIntégration de la Blockchain à l’Internet des Objets
Moudoud, H. (2022) · theses.fr (ABES) · doi:10.70675/1827dabfza012z4967z95fdz37a1359510f2
Secure collaborative management platform applied to IoT Networks
Atia, O. B. (2024) · theses.fr (ABES) · doi:10.70675/6c43d453z9fb0z4a37z8123z35304e4a31cc
Chen, L., Xiao, D., Zhang, M., et al. (2026) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2026.3682893
“The results are summarized in AMONG[19], [6], [20], [12], AND OUR WORK Table IV.”
InfluentialRen, F., Zhang, S., Chen, S., et al. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-23447-6_26
SecureTensor for federated learning with privacy preservation and communication efficiency
Wu, X., Lou, F., Chen, X., Chen, Y., Lan, T., & Wang, Z. (2026) · Neurocomputing · doi:10.1016/j.neucom.2026.133832
Miloudi, A., Laouid, A., Bounceur, A., Bouhamed, M. M., & Hammoudeh, M. (2025) · International Conference on Future Networks and Distributed Systems (ICFNDS) · doi:10.1145/3789692.3789788
“Privacy-Preserving Defenses : Frameworks like ShieldFL and PEFL integrate privacy-preserving encryption techniques (e.g., homomorphic encryption, secure aggregation) with model poisoning defenses, maintaining effectiveness even in heterogeneous data environments [13, 30, 33].”
Less is more: Clustering with adaptive probability for heterogeneous federated learning
Wei, Y., Zhao, S., Zhao, C., et al. (2026) · Knowledge-Based Systems · doi:10.1016/j.knosys.2026.116127
DDFL: dual defense against poisoning attacks in privacy-preserving federated learning
Guo, C., Tian, M., Li, X., Sun, H., & Jie, Y. (2026) · Neural Networks · doi:10.1016/j.neunet.2026.109095
Sustainability in Federated Learning
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_12
Guo, S., Sun, R. X., & Liu, J. (2026) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2026.3690685
“To address this, Liu et al. [29] proposed PEFL, which employs dual servers and homomorphic encryption for anomaly detection.”
FedSND: Federated Learning with Symmetric Noise Decentralized Orthogonal Encryption
Yang, C., Tan, W., Chen, Y., et al. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-23450-6_11
Physical Layer Authentication Enhanced Federated Learning for UAV With Intrinsic Security
Tong, Z., Wang, J., Liu, J., et al. (2026) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2026.3694574
“To address the aforementioned security threat, there are several cryptographic techniques in the data level such as authentication protocol [21], differential privacy [22], blockchain [23], and homomorphic encryption [24].”
FairRoP: Robust Client Selection Scheme for Fairness-Aware Federated Learning
Chen, D., Jiang, X., Trujillo-Rasúa, R., et al. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3696194
“Techniques such as Krum, MultiKrum [18], Bulyan [19], and Median [20], [21] identify and aggregate clean gradients by leveraging similarity measures, e ff ectively defending against untargeted poisoning attacks.”
InfluentialPBSFL: Privacy-Preserving and Byzantine-Resilient for Summoning Federated Learning
Chen, B., Ke, Y., Zhang, W., & Liu, J. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-00847-8
“We first introduce the following assumption, which is aligned with the rationale established in prior work (Liu et al. 2021).”
A Semi-Synchronous Federated Learning Scheme for Internet of Vehicles
Wei, L., Peng, D., Shi, L., et al. (2026) · International Conference on Intelligent Computing and Signal Processing (ICSP) · doi:10.1109/icsp69961.2026.11540866
“The FEEL [8] framework proposes a hierarchical FL scheme for Vehicular Ad-hoc Networks (VANETs), reducing communication overhead and protecting model updates through clustering and homomorphic encryption-based end-to-end training.”
Resilience of federated learning: perspectives on attacks and defenses
Raj, P. V. P., Gupta, A., & Das, S. K. (2026) · Elsevier eBooks · doi:10.1016/b978-0-44-344433-3.00016-2
SAFL: Enhanced Defense Against Poisoning Attacks in Privacy-Preserving Federated Learning
Lai, H., Chen, J., Wu, G., Liu, X., & Chen, C. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581500
“To address the requirements of PPFL, several schemes such as PBFL [7], ShieldFL [8], RFed [9], SPPFL [10], and PEFL [11] were proposed with distinct technical approaches to enhance security.”
Self-citationYazdinejad, A., Dehghantanha, A., & Srivastava, G. (2026) · Internet of Things · doi:10.1016/j.iot.2026.102022
LLM-Defender: Leveraging Large Language Models for Data Poisoning Protection in Federated Learning
Zhou, X., Chen, G., Guo, Z., et al. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2859-1_32
AFRWC: Adaptive Reputation-Weighted Consensus for Hierarchical Federated Learning at the Edge
Qayyum, T., Trabelsi, Z., Tariq, A., & Ali, M. (2026) · IEEE International Conference on Communications workshops · doi:10.1109/iccworkshops63917.2026.11586380
“Security raises further constraints: poisoning and misreporting can derail training unless robust reputations and penalties are integrated with privacy-preserving defenses [7], [8], [11].”
Mohammed, S., Alhadidi, D., & Ngom, A. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6040133
“Homomorphic encryption and MPC can also aggregate encrypted updates, but they introduce additional computational and communication overhead [100].”
Liu, C., Shen, H., Law, E. K. L., & Lam, C. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-9846-5_37
Liu, C., Shen, H., Law, E. K. L., & Lam, C. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-9846-5_29
Tuama, A. Y., Hasan, T. M., & Shakir, A. C. (2026) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2026.104608
Gu, C., Zhu, K., Hu, D., & Liu, Z. (2026) · Information Fusion · doi:10.1016/j.inffus.2026.104731
Privacy-Preserving and Byzantine-Robust Federated Learning With Mean-Constrained Secret Sharing
Zhu, G., Wu, L., & Liu, K. (2026) · IEEE Access · doi:10.1109/access.2026.3729203
“They can upload poisoned or backdoored model updates to degrade the global model’s performance [5], [6], [7].”
VERSA: A novel framework for verifiable and secure aggregation in Summoned Federated Learning
Chen, B., Ke, Y., Zhang, W., Xu, C., & Liu, C. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112750
Securing FL-Enabled NWDAF in Private 5G Networks Against Hybrid Attacks
Xiong, R., Xiong, M., Ren, Y. C., Ren, W., & Parr, G. P. (2026) · IEEE Transactions on Green Communications and Networking · doi:10.1109/tgcn.2026.3735240
“We evaluate the time consumption of our method compared with several state-of-the-art approaches, including PEFL [29], Nguyen and Thai [30], ShieldFL [31], and CKKS (Approximate HE) [47].”
RetFL: a privacy-preserving and traceable framework for robust federated learning
Huang, Y., Zhou, Z., Tian, Y., Chen, C., Luo, H., & Li, T. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-01301-5
“Many existing defenses rely on centralized coordination, full access to client updates, or trusted reference data Liu et al. (2021); Shejwalkar and Houmansadr (2021).”
RFLDefense: robust federated learning defense against targeted attacks
Shi, X., Gong, J., & He, Y. (2026) · Cybersecurity · doi:10.1186/s42400-026-00679-z
“…FL can protect data privacy to some extent, its distributed and decentralized nature also introduces new security challenges (Sun et al. 2021; Liu et al. 2021; Shejwalkar et al. 2022): adversaries may control a subset of client devices, local training data, or the optimization process, and…”
Metadata
- Authors
- Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R.
- Affiliations
- University of Electronic Science and Technology of China (CN)
- Nanyang Technological University (SG)
- China Electronics Technology Group Corporation (CN)
- University of New Brunswick (CA)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2021
- Volume
- 16
- Pages
- 4574-4588
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W3198262235
- Cited by
- 351
- References
- 47
- Citations by year
- 2026: 47 · 2025: 102 · 2024: 110 · 2023: 66 · 2022: 23 · 2021: 3
- FWCI
- 17.85
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Natural Science Foundation of China (62020106013, 61972454, 61802051, 61772121, 61728102)
- Sichuan Science and Technology Program (2020JDTD0007, 2020YFG0298)
- Chongqing Science and Technology Commission (cstc2018jcyjAX0703)
- Fundamental Research Funds for Chinese Central Universities (ZYGX2020ZB027)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, poisoning attacks, homomorphic encryption, gradient privacy, poisoning detection, label-flipping attacks, backdoor attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
