The DOI matches its Crossref record; 39 of the 39 references it cites were found in a registry or an index.
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Abstract
Privacy-Preserving Federated Learning (PPFL) is an emerging secure distributed learning paradigm that aggregates user-trained local gradients into a federated model through a cryptographic protocol. Unfortunately, PPFL is vulnerable to model poisoning attacks launched by a Byzantine adversary, who crafts malicious local gradients to harm the accuracy of the federated model. To resist model poisoning attacks, existing defense strategies focus on identifying suspicious local gradients over plaintexts. However, the Byzantine adversary submits encrypted poisonous gradients to circumvent existing defense strategies in PPFL, resulting in encrypted model poisoning. To address the issue, in this paper we design a privacy-preserving defense strategy using two-trapdoor homomorphic encryption (referred to as ShieldFL), which can resist encrypted model poisoning without compromising privacy in PPFL. Specially, we first present the secure cosine similarity method aiming to measure the distance between two encrypted gradients. Then, we propose the Byzantine-tolerance aggregation using cosine similarity, which can achieve robustness for both Independently Identically Distribution (IID) and non-IID data. Extensive evaluations on three benchmark datasets (i.e.,MNIST, KDDCup99, and Amazon) show that ShieldFL outperforms existing defense strategies. Especially, ShieldFL can achieve 30%-80% accuracy improvement to defend two state-of-the-art model poisoning attacks in both non-IID and IID settings.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To solve this problem, [38], [49], [51] used homomorphic encryption to evaluate the local model securely.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [38]
Citations
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Federated Learning with Non-IID Data
Zhao, Y., Li, M., Lai, L., Suda, N., Civin, D., & Chandra, V. (2018) · arXiv · doi:10.48550/arxiv.1806.00582 · Cited by 2,077
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
On the Convergence of FedAvg on Non-IID Data
Li, X., Huang, K., Yang, W., Wang, S., & Zhang, Z. (2019) · arXiv · doi:10.48550/arxiv.1907.02189 · Cited by 1,575
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
(2017) · neural information processing systems · Cited by 1,413
Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
Yin, D., Chen, Y., Ramchandran, K., & Bartlett, P. (2018) · arXiv · doi:10.48550/arxiv.1803.01498 · Cited by 1,130
Optimizing Federated Learning on Non-IID Data with Reinforcement Learning
Wang, H., Kaplan, Z., Niu, D., & Li, B. (2020) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom41043.2020.9155494 · Cited by 1,054
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning
Wang, Z., Song, M., Zhang, Z., Song, Y., Wang, Q., & Qi, H. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737416 · Cited by 881
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
Personalized Cross-Silo Federated Learning on Non-IID Data
Huang, Y., Chu, L., Zhou, Z., Wang, L., Liu, J., Pei, J., & Zhang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16960 · Cited by 749
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703
Sharemind: A Framework for Fast Privacy-Preserving Computations
Bogdanov, D., Laur, S., & Willemson, J. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-88313-5_13 · Cited by 698
The Hidden Vulnerability of Distributed Learning in Byzantium
Mhamdi, E. M. E., Guerraoui, R., & Rouault, S. (2018) · arXiv · doi:10.48550/arxiv.1802.07927 · Cited by 648
MP-SPDZ: A Versatile Framework for Multi-Party Computation
Keller, M. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417872 · Cited by 524
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 472
The EU General Data Protection Regulation (GDPR): European Regulation that has a Global Impact
Goddard, M. (2017) · International Journal of Market Research · doi:10.2501/ijmr-2017-050 · Cited by 458
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351
The Limitations of Federated Learning in Sybil Settings
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2020) · Recent Advances in Intrusion Detection · Cited by 265
An Efficient Privacy-Preserving Outsourced Calculation Toolkit With Multiple Keys
Liu, X., Deng, R. H., Choo, K. R., & Weng, J. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2016.2573770 · Cited by 263
Self-citationAnalyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 262
Unleashing the Tiger: Inference Attacks on Split Learning
Pasquini, D., Ateniese, G., & Bernaschi, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485259 · Cited by 190
Efficient and Privacy-Preserving Outsourced Calculation of Rational Numbers
Liu, X., Choo, K. R., Deng, R. H., Lu, R., & Weng, J. (2016) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2016.2536601 · Cited by 187
Self-citationEfficient Public-Key Cryptosystems Provably Secure Against Active Adversaries
Paillier, P., & Pointcheval, D. (1999) · Lecture notes in computer science · doi:10.1007/978-3-540-48000-6_14 · Cited by 159
Helen: Maliciously Secure Coopetitive Learning for Linear Models
Zheng, W., Popa, R. A., Gonzalez, J. E., & Stoica, I. G. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00045 · Cited by 150
Provably Secure Federated Learning against Malicious Clients
Cao, X., Jia, J., & Gong, N. Z. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i8.16849 · Cited by 141
BAYHENN: Combining Bayesian Deep Learning and Homomorphic Encryption for Secure DNN Inference
Xie, P., Wu, B., & Sun, G. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/671 · Cited by 50
Mitigating the Backdoor Attack by Federated Filters for Industrial IoT Applications
Hou, B., Gao, J., Guo, X., Baker, T., Zhang, Y., Wen, Y., & Liu, Z. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3112100 · Cited by 49
The Bit Security of Paillier’s Encryption Scheme and Its Applications
Catalano, D., Gennaro, R., & Howgrave-Graham, N. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44987-6_15 · Cited by 43
Exploring Image Reconstruction Attack in Deep Learning Computation Offloading
Oh, H., & Lee, Y. (2019) · doi:10.1145/3325413.3329791 · Cited by 18
Secure Cosine Similarity Computation with Malicious Adversaries
Yang, D., Xu, B., Yang, B., & Wang, J. (2013) · Lecture notes in electrical engineering · doi:10.1007/978-1-4614-6154-8_52 · Cited by 7
Research works printed but not linked: 4
- Shen, AUROR: Defending against poisoning attacks in collaborative deep learning systems, 508
- LeCun, 1998, MNIST Database
- 1999, KDD Cup 1999 Data
- 2003, Amazon Networks
Cited by
Sorted by citations
A robust privacy-preserving federated learning model against model poisoning attacks
Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., & Parizi, R. M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3420126 · Cited by 380
Domain generalization for rotating machinery fault diagnosis: A survey
Xiao, Y., Shao, H., Yan, S., Wang, J., Peng, Y., & Liu, B. (2024) · Advanced Engineering Informatics · doi:10.1016/j.aei.2024.103063 · Cited by 249
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212
Self-citationXie, Q., Jiang, S., Jiang, L., Huang, Y., Zhao, Z., Khan, S., Dai, W., Liu, Z., & Wu, K. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3382875 · Cited by 222
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Metadata
- Authors
- Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H.
- Affiliations
- Xidian University (CN)
- University of Oregon (US)
- Singapore Management University (SG)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2022
- Volume
- 17
- Pages
- 1639-1654
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W4226047321
- Cited by
- 371
- References
- 39
- Citations by year
- 2026: 98 · 2025: 123 · 2024: 94 · 2023: 50 · 2022: 6
- FWCI
- 22.45
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- Singapore Management University Institutional Knowledge (InK) (Singapore Management University) (submittedVersion)
- Funders
- National Key Research and Development Program of China (2021YFB3101100)
- Foundation for Innovative Research Groups of the National Natural Science Foundation of China (62121001)
- National Natural Science Foundation of China (62072361, U1804263, 62072352)
- Key Research and Development Program of Shaanxi Province (2019ZDLGY12-04, 2020ZDLGY09-06)
- Fundamental Research Funds for the Central Universities (JB211505)
- Guangxi Key Laboratory of Cryptography and Information Security (GCIS201917)
- Guangxi Key Laboratory of Trusted Software (KX202028)
- Ripple University Blockchain Research Initiative
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, model poisoning, Byzantine attacks, gradient aggregation, non-IID data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
