A robust privacy-preserving federated learning model against model poisoning attacks
Abstract
Although federated learning offers a level of privacy by aggregating user data without direct access, it remains inherently vulnerable to various attacks, including poisoning attacks where malicious actors submit gradients that reduce model accuracy. In addressing model poisoning attacks, existing defense strategies primarily concentrate on detecting suspicious local gradients over plaintext. However, detecting non-independent and identically distributed encrypted gradients poses significant challenges for existing methods. Moreover, tackling computational complexity and communication overhead becomes crucial in privacy-preserving federated learning, particularly in the context of encrypted gradients. To address these concerns, we propose a robust privacy-preserving federated learning model resilient against model poisoning attacks without sacrificing accuracy. Our approach introduces an internal auditor that evaluates encrypted gradient similarity and distribution to differentiate between benign and malicious gradients, employing a Gaussian Mixture Model and Mahalanobis Distance for byzantine-tolerant aggregation. The proposed model utilizes Additive Homomorphic Encryption to ensure confidentiality while minimizing computational and communication overhead. Our model demonstrates superior performance in accuracy and privacy compared to existing strategies and encryption techniques, such as Fully Homomorphic Encryption and Two-Trapdoor Homomorphic Encryption. The proposed model effectively addresses the challenge of detecting maliciously encrypted non-independent and identically distributed gradients with low computational and communication overhead.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Robust aggregation methods evaluate model updates for anomalies before they are integrated into the global model.
“Another promising technique is robust aggregation methods, where model updates are evaluated for anomalies before being integrated into the global model [72,73].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
Defense techniques such as adversarial training, where the model is pre-trained with adversarial samples, have displayed promise.
“Defense techniques such as adversarial training, where the model is pre-trained with adversarial samples, have displayed promise.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In targeted poisoning attacks, malicious contributors corrupt the model to misidentify specific data, which could be used to target certain diseases or demographic groups.
“In targeted poisoning attacks, malicious contributors corrupt the model to misidentify specific data, which could be utilized to target certain diseases or demographic groups.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
This technique uses statistical approaches to filter irregularities in model updates, maintaining robustness even with a certain degree of compromised participants.
“Designed to prevent malicious model updates from impacting the global model, this technique uses statistical approaches to filter irregularities in model updates, maintaining robustness even with a certain degree of compromised participants [72].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
Data manipulation attacks are crucial threats in federated learning, particularly in healthcare.
“Data manipulation attacks are crucial threats in FL, particularly in healthcare.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
Untargeted poisoning aims to degrade model efficiency globally, risking patient results over the board.
“Untargeted poisoning, in contrast, aims to degrade model efficiency globally, risking patient results over the board [72,76].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
Cites
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936 · see citing works
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
Verifynet: Secure and verifiable federated learning
Xu, G., Li, H., Liu, S., Yang, K., & Lin, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2929409 · Cited by 839 · see citing works
Personalized Cross-Silo Federated Learning on Non-IID Data
Huang, Y., Chu, L., Zhou, Z., Wang, L., Liu, J., Pei, J., & Zhang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16960 · Cited by 749 · see citing works
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371 · see citing works
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351 · cited 8× · see citing works
“Model poisoning adversaries manipulate user input by submitting poisonous updates to local models to create arbitrary deviance from correct trends [3].”
BackgroundMethodInfluentialPrivacy-Preserving Collaborative Deep Learning With Unreliable Participants
Zhao, L., Wang, Q., Zou, Q., Zhang, Y., & Chen, Y. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2939713 · Cited by 210 · see citing works
Privacy-Preserving Federated Deep Learning with Irregular Users
Xu, G., Li, H., Zhang, Y., Xu, S., Ning, J., & Deng, R. H. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3005909 · Cited by 168 · see citing works
POSEIDON: Privacy-Preserving Federated Neural Network Learning
Sav, S., Pyrgelis, A., Troncoso-Pastoriza, J. R., Froelicher, D., Bossuat, J.-P., Sousa, J. S., & Hubaux, J.-P. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24119 · Cited by 162 · see citing works
ELSA: Secure Aggregation for Federated Learning with Malicious Actors
Rathee, M., Shen, C., Wagh, S., & Popa, R. A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179468 · Cited by 117 · see citing works
AP2FL: Auditable Privacy-Preserving Federated Learning Framework for Electronics in Healthcare
Yazdinejad, A., Dehghantanha, A., & Srivastava, G. (2024) · IEEE transactions on consumer electronics · doi:10.1109/tce.2023.3318509 · Cited by 117 · see citing works
Self-citationYazdinejad, A., Dehghantanha, A., Srivastava, G., Karimipour, H., & Parizi, R. M. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103088 · Cited by 115 · see citing works
Self-citationRoFL: Robustness of Secure Federated Learning
Lycklama, H., Burkhalter, L., Viand, A., Küchler, N., & Hithnawi, A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179400 · Cited by 114 · see citing works
Data Quality Detection Mechanism Against Label Flipping Attacks in Federated Learning
Jiang, Y., Zhang, W., & Chen, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3249568 · Cited by 98 · see citing works
Enabling Execution Assurance of Federated Learning at Untrusted Participants
Zhang, X., Li, F., Zhang, Z., Li, Q. L., Wang, C., & Wu, J. (2020) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom41043.2020.9155414 · Cited by 93 · see citing works
Privacy-Preserving Federated Learning via Functional Encryption, Revisited
Chang, Y., Zhang, K., Gong, J., & Qian, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3255171 · Cited by 93 · see citing works
Byzantine-Resilient Decentralized Stochastic Gradient Descent
Guo, S., Zhang, T., Yu, H., Xie, X., Ma, L., Xiang, T., & Liu, Y. (2021) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2021.3116976 · Cited by 86 · see citing works
SafeFL: MPC-friendly Framework for Private and Robust Federated Learning
Gehlhar, T., Marx, F., Schneider, T. H., Suresh, A., Wehrle, T., & Yalame, H. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00012 · Cited by 60 · see citing works
Prio+: Privacy Preserving Aggregate Statistics via Boolean Shares
Addanki, S., Garbe, K., Jaffe, E., Ostrovsky, R., & Polychroniadou, A. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-14791-3_23 · Cited by 56 · see citing works
Gaussian mixture model with feature selection: An embedded approach
Fu, Y., Liu, X., Sarkar, S., & Wu, T. (2020) · Computers & Industrial Engineering · doi:10.1016/j.cie.2020.107000 · Cited by 55 · see citing works
Privacy-Preserving Implicit Authentication Protocol Using Cosine Similarity for Internet of Things
Wei, F., Vijayakumar, P., Kumar, N., Zhang, R., & Cheng, Q. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3031486 · Cited by 55 · see citing works
Hu, Y., Zheng, J., Jiang, S., Yang, S., Zou, J., & Wang, R. (2023) · IEEE Transactions on Evolutionary Computation · doi:10.1109/tevc.2023.3253850 · Cited by 53 · see citing works
Privacy-preserving Decentralized Federated Learning over Time-varying Communication Graph
Lu, Y., Yu, Z., & Suri, N. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3591354 · Cited by 32 · see citing works
Encrypted images-based reversible data hiding in Paillier cryptosystem
Jiang, C., & Pang, Y. (2019) · Multimedia Tools and Applications · doi:10.1007/s11042-019-07874-w · Cited by 21 · see citing works
Hercules: Boosting the Performance of Privacy-Preserving Federated Learning
Xu, G., Han, X., Xu, S., Zhang, T., Li, H., Huang, X., & Deng, R. H. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3218793 · Cited by 21 · see citing works
Efficient and privacy-preserving tree-based inference via additive homomorphic encryption
Zhao, J., Zhu, H., Wang, F., Lu, R., & Li, H. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119480 · Cited by 21 · see citing works
Paillier cryptosystem enhancement for Homomorphic Encryption technique
Mohammed, S. J., & Taha, D. B. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16301-0 · Cited by 20 · see citing works
Privacy-Preserving Federated Recurrent Neural Networks
Sav, S., Diaa, A., Pyrgelis, A., Bossuat, J.-P., & Hubaux, J. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0122 · Cited by 10 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Abbas, S. R., Abbas, Z., Zahir, A., & Lee, S. W. (2024) · Healthcare · doi:10.3390/healthcare12242587 · Cited by 228 · see citing works
Albshaier, L., Almarri, S., & Albuali, A. A. (2025) · Electronics · doi:10.3390/electronics14051019 · Cited by 150 · see citing works
Saheed, Y. K., Omole, A. I., & Sabit, M. O. (2025) · Sensors International · doi:10.1016/j.sintl.2024.100297 · Cited by 88 · see citing works
Ghazal, T. M., Islam, S., Hasan, M. K., Abu-Shareha, A. A., Mokhtar, U. A., Khan, M. A., Baili, J., Saeed, A. Q., Bhatt, M. W., & Ahmad, M. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3572629 · Cited by 70 · see citing works
“A privacy-preserving FL model suggested by Yazdinejad et al. [38] uses an internal auditor with Gaussian Mixture Model (GMM) and Mahalanobis Distance to detect harmful encrypted gradients and AHE for secrecy achieves higher accuracy with lower computational and communication overhead on benchmark…”
A survey of security threats in federated learning
Feng, Y., Guo, Y., Hou, Y., Wu, Y., Lao, M., Yu, T., & Liu, G. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-024-01664-0 · Cited by 70 · see citing works
“However, further research has shown that federated learning also faces numerous security risks [11–15] like backdoor attacks, adversarial attacks, and Byzantine attacks.”
Dehghantanha, A., Yazdinejad, A., & Parizi, R. M. (2023) · doi:10.1145/3689933.3690832 · Cited by 39 · see citing works
“Early AI applications in cybersecurity involved basic anomaly detection, where systems learned to identify deviations from standard network behaviors [39].”
Self-citationAlansary, S. A., Ayyad, S. M., Talaat, F. M., & Saafan, M. M. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02556-6 · Cited by 49 · see citing works
“Destabilizing the model undermines the model’s generalization ability as well as its capability to detect zero-day attacks accurately [193, 194].”
Cheng, Y., Zhang, W., Zhang, Z., Kang, J., Xu, Q. M., Wang, S., & Niyato, D. T. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3529487 · Cited by 37 · see citing works
“As an emerging distributed machine learning paradigm, various related aspects of FL have been advanced in the fields of model aggregation [43], [44], [45], applications [46], [47], [48], privacy and security [49], [50], [51], and more.”
Auto-CIDS: An Autonomous Intrusion Detection System for Vehicular Networks
Sorkhpour, M., Yazdinejad, A., & Dehghantanha, A. (2023) · doi:10.1145/3689933.3690837 · Cited by 37 · see citing works
“Recent works [16], [10], [28], [11] have revealed vulnerabilities in automotive communication systems, especially the CAN bus.”
Self-citationMachine Learning for Blockchain and IoT Systems in Smart Cities: A Survey
Dritsas, E., & Τρίγκα, Μ. (2024) · Future Internet · doi:10.3390/fi16090324 · Cited by 34 · see citing works
The paradigm of digital health: AI applications and transformative trends
Rashid, Z., Ahmed, H., Nadeem, N., Zafar, S. B., & Yousaf, M. Z. (2025) · Neural Computing and Applications · doi:10.1007/s00521-025-11081-0 · Cited by 37 · see citing works
“Algorithmic bias can be mitigated through regular audits and more sophisticated algorithms that detect disparities in AI outputs, which is particularly important in the underrepresented demographic groups [211].”
Haider, Z. A., Zeb, A., Rahman, T., Singh, S. K., Akram, R., Arishi, A., & Ullah, I. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111484 · Cited by 39 · see citing works
Aledhari, M., Razzak, R., Rahouti, M., Yazdinejad, A., Parizi, R. M., Qolomany, B., Guizani, M., Qadir, J., & Al‐Fuqaha, A. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104352 · Cited by 31 · see citing works
Self-citationEnhancing Heart Disease Prediction with Federated Learning and Blockchain Integration
Otoum, Y., Hu, C., Said, E. H., & Nayak, A. R. (2024) · Future Internet · doi:10.3390/fi16100372 · Cited by 30 · see citing works
“Federated learning solves the conflict between data privacy and model performance, allowing institutions to collaboratively enhance their models without sharing sensitive data [1,2].”
Yazdinejad, A., & Kong, J. D. (2026) · Royal Society Open Science · doi:10.1098/rsos.250959 · Cited by 28 · see citing works
Self-citationDib, O. (2025) · Results in Engineering · doi:10.1016/j.rineng.2025.105456 · Cited by 31 · see citing works
Gulzar, Q., & Mustafa, K. (2025) · Scientific Reports · doi:10.1038/s41598-025-89650-5 · Cited by 29 · see citing works
“These approaches will ensure promising, robust, and resilient security solutions in securing such ICS 35,63,64 settings from advanced cyber-attacks.”
Integrating machine learning with electrochemical sensors for intelligent food safety monitoring
Aaryashree, & Devi, A. (2025) · Artificial Intelligence Chemistry · doi:10.1016/j.aichem.2025.100105 · Cited by 25 · see citing works
Eren, H., Karaduman, Ö., & Gençoğlu, M. T. (2025) · Applied Sciences · doi:10.3390/app15158704 · Cited by 28 · see citing works
Secure cloud computing: leveraging GNN and leader K-means for intrusion detection optimization
Dugyala, R., Chithaluru, P., Ramchander, M., Kumar, S., V, Yadav, A., Yadav, N. S., AbdElminaam, D. S., & Alsekait, D. M. (2024) · Scientific Reports · doi:10.1038/s41598-024-81442-7 · Cited by 23 · see citing works
Qian, J., Zheng, M., Yu, Y., Zhou, C., & Miao, D. (2024) · Information Sciences · doi:10.1016/j.ins.2024.121316 · Cited by 24 · see citing works
A Survey on Energy-Efficient Design for Federated Learning over Wireless Networks
Dang, X.-T., Vu, B., Nguyen, Q.-S., Tran, T.-D., Eom, J.-S., & Shin, O. (2024) · Energies · doi:10.3390/en17246485 · Cited by 26 · see citing works
Kumar, A., Maulik, A., & Chinmaya, K. A. (2025) · IETE Technical Review · doi:10.1080/02564602.2025.2522083 · Cited by 21 · see citing works
“Security is another critical issue, as FEDL is susceptible to adversarial threats such as model poisoning and inference leakage [190].”
ATD Learning: A secure, smart, and decentralised learning method for big data environments
Alzubaidi, L., Jebur, S. A., Jaber, T. A., Mohammed, M. A., Alwzwazy, H. A., Saihood, A., Gammulle, H., Santamaría, J., Duan, Y., Fookes, C., et al. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.102953 · Cited by 25 · see citing works
Anjum, M., Dutta, A. K., Elrashidi, A. M., Shahab, S., Aldrees, A., Shaikh, Z. A., & Aljohani, A. A. (2025) · Scientific Reports · doi:10.1038/s41598-025-10826-0 · Cited by 20 · see citing works
A Survey on Model-heterogeneous Federated Learning: Problems, Methods, and Prospects
Fan, B., Jiang, S., Su, X. J., Tarkoma, S., & Hui, P. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825769 · Cited by 25 · see citing works
“An adversary might reverse-engineer the raw data from model information, as both weights and gradients are derived from the input data through specific matrix operations [44].”
BackgroundBackdoor attacks and defense mechanisms in federated learning: A survey
Li, Z., Lan, J., Yan, Z., & Erol Gelenbe, A. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103248 · Cited by 19 · see citing works
Soomro, I. A., Rehman, H. U., Hussain, S. J., Iqbal, A., Khalid, W., & Yu, H. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3647642 · Cited by 19 · see citing works
“Yazdinejad et al. [60] proposed an internal auditing mechanism utilizing GMM and MD with additive homomorphic encryption (AHE) to detect malicious encrypted gradients while minimizing computational overhead.”
Nandhini, S., Rajeswari, A., & Shanker, N. R. (2024) · Journal of Cloud Computing Advances Systems and Applications · doi:10.1186/s13677-024-00722-9 · Cited by 17 · see citing works
Singh, J. P., Aqsa, A., Ghani, I., Sonani, R., & Govindarajan, V. (2025) · Future Internet · doi:10.3390/fi17080345 · Cited by 16 · see citing works
Ahmad, S. Z., & Qamar, F. (2024) · Scientific Reports · doi:10.1038/s41598-024-78262-0 · Cited by 16 · see citing works
Chowa, S. S., Bhuiyan, M. R. I., Tahosin, M. S., Karim, A., Montaha, S., Hassan, M. M., Shah, M. A., & Azam, S. (2025) · Scientific Reports · doi:10.1038/s41598-024-83972-6 · Cited by 15 · see citing works
“Moreover, PHE encryption provides strong protection against inference and model reconstruction attacks 49 .”
Symbiotic Federated Learning for Giant AI Threat Detection in 6G-IoT Infrastructures
Nazari, H., Yazdinejad, A., Dehghantanha, A., Zarrinkalam, F., & Srivastava, G. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3595872 · Cited by 14 · see citing works
“This is acceptable in managed industrial environments, but can be mitigated through: 1) Threshold cryptography for distributed trust [22].”
InfluentialSelf-citationNazari, H., Yazdinejad, A., Dehghantanha, A., Zarrinkalam, F., & Srivastava, G. (2023) · doi:10.1145/3689933.3690836 · Cited by 14 · see citing works
“These switches are tasked with forwarding network flow data for APT detection analysis via the OpenFlow protocol, enabling real-time data processing and autonomous anomaly detection [36].”
Self-citationPriRoAgg: Achieving Robust Model Aggregation With Minimum Privacy Leakage for Federated Learning
Hou, S., Li, S., Jahani-Nezhad, T., & Caire, G. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3577498 · Cited by 13 · see citing works
“Several studies have endeavored to tackle this issue [21], [30], [31], [32], [33], [34], [35], [36], [47], [48], [71].”
InfluentialMultimodal large language models for medical image diagnosis: Challenges and opportunities
Zhang, A., Zhao, E., Wang, R., Zhang, X., Wang, J., & Chen, E. (2025) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2025.104895 · Cited by 14 · see citing works
A privacy-preserving federated learning approach for airline upgrade optimization
Chen, S., & Huang, Y. (2024) · Journal of Air Transport Management · doi:10.1016/j.jairtraman.2024.102693 · Cited by 13 · see citing works
Analysis of deep learning under adversarial attacks in hierarchical federated learning
Alqattan, D. S., Snåšel, V., Ranjan, R. K., & Ojha, V. (2025) · High-Confidence Computing · doi:10.1016/j.hcc.2025.100321 · Cited by 12 · see citing works
AI in Medical Questionnaires: Scoping Review
Luo, X., Li, Y. L., Xu, J., Zheng, Z., Ying, F., & Huang, G. (2025) · Journal of Medical Internet Research · doi:10.2196/72398 · Cited by 14 · see citing works
“Federated learning has emerged as an innovative approach to protect data privacy, allowing AI models to learn from distributed datasets without centralized data sharing, thereby mitigating the risk of data breaches [146].”
Ha, J., El Azzaoui, A., & Park, J. H. (2025) · Sensors · doi:10.3390/s25030788 · Cited by 13 · see citing works
“Abbas Yazdinejad et al. [22] introduced an FL model designed to counteract model poisoning attacks using Gaussian Mixture Models (GMM) and Mahalanobis Distance (MD) for anomaly detection in gradient updates, coupled with Additive Homomorphic Encryption (AHE) for data confidentiality.”
InfluentialPan, Y., Su, Z., Wang, Y., Zhou, J., & Mahmoud, M. M. E. A. (2025) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3524834 · Cited by 11 · see citing works
“Yazdinejad et al. facilitated Byzantine-tolerantaggregationbyemployingtheGaussianMix-tureModelandMahalanobisdistance,withadditiveHEpro-tectingparticipants’privacyduringtraining[22].”
Sanjalawe, Y. K., Al-E’mari, S., Alqurashi, T., Alharbi, Z. H., Makhadmeh, S. N., & Alsharaiah, M. A. (2025) · PeerJ Computer Science · doi:10.7717/peerj-cs.3281 · Cited by 11 · see citing works
Yu, H., Ma, C., Liu, M., Du, T., Ding, M., Xiang, T., Ji, S., & Liu, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3639985 · Cited by 11 · see citing works
“FL is increasingly recognized for its vulnerability to back-door attacks [31], [57], [59], which pose a significant security concern.”
Guan, M., Bao, H., Li, Z., Pan, H., Huang, C., & Dai, H. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103304 · Cited by 11 · see citing works
Xu, J., Zhang, C., Jin, L., & Su, C. (2025) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp5030037 · Cited by 11 · see citing works
DeSA: Decentralized Secure Aggregation for Federated Learning in Zero-Trust D2D Networks
Wang, L., Lu, Z., Li, M., Wang, J., Gai, K., & Chen, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3658996 · Cited by 10 · see citing works
Akhtar, M. M., Alasmari, S. A., Haidar, S. K. W., & Alzubaidi, A. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01894-6 · Cited by 10 · see citing works
Role-based federated learning exploiting IPFS for privacy enhancement in IoT environment
Kim, H., Heo, G., & Doh, I. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111200 · Cited by 10 · see citing works
Rezaie, H., Taheri, R., Shojafar, M., & Foh, C. H. (2025) · Neural Computing and Applications · doi:10.1007/s00521-025-11385-1 · Cited by 10 · see citing works
“Backdoor attacks, on the other hand, discreetly implant triggers within the data, causing the model to produce incorrect outputs when those triggers are activated under certain conditions [12, 28, 31].”
Blockchain Based Secure Federated Learning With Local Differential Privacy and Incentivization
Chaudhury, S. D., Morreddigari, L. R., Varun, M., Sengupta, T., Chakraborty, S., Sural, S., Vaidya, J. S., & Atluri, V. (2024) · IEEE Transactions on Privacy · doi:10.1109/tp.2024.3487819 · Cited by 9 · see citing works
“However, the standard implementations of FL are susceptible to various kinds of security and privacy attacks, such as data [4] and model poisoning [5], [6], interference [7] and Byzantine attacks [8], model extraction attacks [9], evasion attacks [10], etc.”
A blockchain-based secure data sharing scheme with efficient attribute revocation
Li, S., Niu, K., & Wu, B. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103309 · Cited by 9 · see citing works
PBTMS: A Blockchain-Based Privacy-Preserving System for Reliable and Efficient E-Commerce
Zhang, R., Li, Y., & Fang, L. (2025) · Electronics · doi:10.3390/electronics14061177 · Cited by 9 · see citing works
Baligodugula, V. V., & Amsaad, F. (2025) · Electronics · doi:10.3390/electronics14061218 · Cited by 9 · see citing works
“IoT devices can contribute to improved services while protecting user behavior data [28].”
EAFL: Edge-Assisted Federated Learning for real-time disease prediction using privacy-preserving AI
Rawas, S., & Samala, A. D. (2025) · Iran Journal of Computer Science · doi:10.1007/s42044-025-00251-x · Cited by 9 · see citing works
“DP ensures that no single data point has a significant influence on the final model, preventing potential privacy breaches [25].”
Liu, H., Guo, C., Ma, Y., & Wang, Y. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.127409 · Cited by 9 · see citing works
EARVP: Efficient Aggregation for Federated Learning With Robustness, Verifiability, and Privacy
Yan, C., Lu, X., Lió, P., & Hui, P. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3576008 · Cited by 9 · see citing works
“At the same time, due to the lack of trusted authority, honest clients cannot verify aggregation integrity in the robust aggregation architecture with privacy protection [6], [19], [20], [21].”
Alzahrani, A. I. A. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07682-0 · Cited by 9 · see citing works
“However, that does not seriously affect performance [20].”
Ullah, I., Deng, X., Pei, X., Mushtaq, H., Uzair, M., & Qayyum, S. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111705 · Cited by 9 · see citing works
Jabbar, A., Huang, J., Jabbar, M. K., & Mahmood, T. (2025) · Results in Engineering · doi:10.1016/j.rineng.2025.107203 · Cited by 9 · see citing works
Kumar, B. V. R., Gupta, S., Dwivedi, R., Alsekait, D. M., AbdElminaam, D. S., & Kilickaya, O. (2026) · Scientific Reports · doi:10.1038/s41598-026-37802-6 · Cited by 9 · see citing works
“Yazdinejad et al. 20 implemented a resilient privacy-preserving FL approach for model poisoning attack mitigation.”
Network Intrusion Detection Based on Deep Belief Network Broad Equalization Learning System
Deng, M., Sun, C., Kan, Y., Xu, H., Zhou, X., & Fan, S. (2024) · Electronics · doi:10.3390/electronics13153014 · Cited by 9 · see citing works
Enforcing Differential Privacy in Federated Learning via Long-Term Contribution Incentives
Tang, X., Peng, L., Weng, Y., Shen, M., Zhu, L., & Deng, R. H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3550777 · Cited by 8 · see citing works
“Yazdinejad et al. [27] proposed a privacy-preserving FL model utilizing additive PHE and an internal auditor leveraging Gaussian Mixture Models and Mahalanobis Distance to e ff ectively di ff erentiate between benign and malicious encrypted gradients.”
Naresh, V. S., & Ayyappa, D. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104084 · Cited by 8 · see citing works
Bai, Y., Wang, Y., Xu, X., Yang, Y., Batool, H., Iqbal, Z., & Xu, J. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111430 · Cited by 8 · see citing works
Ren, Y., Yang, Z., Feng, G., & Zhang, X. (2025) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2025.3540420 · Cited by 7 · see citing works
“…et al. introduce an internal auditor that evaluates encrypted gradient similarity and distribution to differentiate between benign and malicious gradients, employing a Gaussian Mixture Model and Mahalanobis Distance for byzantine-tolerant aggregation to improve the accuracy of the model [22].”
TinyML strategies for privacy-preserving and cyber threat multi-classification in edge-IoT networks
Haddouti, S. E., & Lazraq, W. (2025) · Computing · doi:10.1007/s00607-025-01522-y · Cited by 7 · see citing works
“The authors of [18] introduce a privacy-preserving federated learning model that resists model poisoning attacks by integrating an internal auditor.”
Wahed, M. K. Y. A. (2025) · Journal of Information & Knowledge Management · doi:10.1142/s021964922550073x · Cited by 7 · see citing works
Adaptive-Personalised Federated Deep Learning for Privacy-Aware NAFLD Screening
Veeravalli, S. D., Patil, P. A., Porwal, T., Karwande, V. S., Budhewar, A. S., & Nanche, B. M. (2025) · International Conference on Innovations in Intelligent Systems: Advancements in Computing, Communication, and Cybersecurity (ISAC3) · doi:10.1109/isac364032.2025.11156569 · Cited by 7 · see citing works
“Consequently, this approach is well-known, extensively utilized, and considered a standard for federated learning [24].”
Interplay of ML and blockchain for secure Internet of Military Vehicles communication underlying 5G
Sojitra, M., Jadav, N. K., Gupta, R., Patel, U. R., Patel, J. B., Tanwar, S., Pau, G., Alqahtani, F. H., & Tolba, A. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.103968 · Cited by 7 · see citing works
Apak, S., Değim, İ. T., & Zahertar, S. (2026) · Neural Computing and Applications · doi:10.1007/s00521-025-11828-9 · Cited by 7 · see citing works
“Other privacy-preserving solutions integrate secure aggregation and anomaly filtering to defend against model poisoning in sensitive contexts [ 25 ].”
Benameur, R., & Dahane, A. (2025) · Cluster Computing · doi:10.1007/s10586-024-05091-1 · Cited by 7 · see citing works
“We will conduct a comparative analysis of the CKKS scheme against other leading methods from the literature, including Additive Homomorphic Encryption and Two-Trapdoor Homomor-phic Encryption [36, 37].”
Weng, J., Luo, Z., & Li, S. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3563820 · Cited by 6 · see citing works
“The primary objective of targeted attacks is to learn an adversarial perturbation δ for an input image x with the aim of misleading deep models into predicting a specific target class t .”
Decentralized IoMT Architecture for Privacy-Preserving Remote Patient Monitoring
Yin, L., Du, X., Cheng, Y., Li, J., Tong, N., & Li, F. (2025) · IEEE Sensors Journal · doi:10.1109/jsen.2025.3575941 · Cited by 6 · see citing works
“Ryu et al. [29], Lin et al. [30], and Yazdinejad et al. [31] use multiparty collaboration and secure multiparty computation (MPC) to ensure model privacy.”
LVSA: Lightweight and verifiable secure aggregation for federated learning
Li, G., Zhang, Z., & Du, R. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.130712 · Cited by 6 · see citing works
Kumar, G., Elicherla, S. L. R., Saxena, S., Swamy, K. A., Ashwini, P., & Kumar, U. P. (2025) · e-Prime - Advances in Electrical Engineering Electronics and Energy · doi:10.1016/j.prime.2025.101057 · Cited by 6 · see citing works
Mao, J., Wei, Z., Li, B., Zhang, R., & Song, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3602226 · Cited by 6 · see citing works
“For instance, to defend against model poisoning attacks, Ma et al. [18] proposed ShieldFL, a defense using homomorphic encryption to identify malicious encrypted gradients, while Yazdinejad et al. [19] developed a model with an internal auditor using statistical methods for the same purpose.”
Privacy-by-design AIoT vision for intelligent urban environments
Ivanovska, M., Kreft, J., Štruc, V., & Perš, J. (2025) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2025.103586 · Cited by 6 · see citing works
Liu, X., Sun, H., Sun, N., Jia, B., & Xiao, D. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.131931 · Cited by 6 · see citing works
Verma, R., & Jailia, M. (2025) · Journal of Cloud Computing Advances Systems and Applications · doi:10.1186/s13677-025-00797-y · Cited by 6 · see citing works
“Federated learning systems are highly susceptible to poisoning attacks where adversarial clients submit manipulated model updates to degrade global performance [42].”
Blockchain-enabled identity management for IoT: a multi-layered defense against adversarial AI
Usama, M., Aziz, A., Alasbali, N. A., Alturki, N. M., Hanif, M. U., & Rehman, M. U. (2026) · Scientific Reports · doi:10.1038/s41598-026-35208-y · Cited by 6 · see citing works
PriFFT: Privacy-Preserving Federated Fine-Tuning of Large Language Models via Hybrid Secret Sharing
You, Z., Dong, X., Cheng, K., Mu, X., Fu, J., Ma, S., Qu, Q., & Shen, Y. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3661572 · Cited by 6 · see citing works
“Abbas et al. present an HE-based privacy-preserving FL against model poisoning attacks with an internal auditor and Byzantine-tolerant gradient aggregation [23].”
Semantic-Aware Federated Blockage Prediction (SFBP) in Vision-Aided Next-Generation Wireless Network
Khan, A. R., Manzoor, H. U., Rais, R. N. B., Hussain, S., Mohjazi, L., Imran, M. A., & Zoha, A. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3525338 · Cited by 6 · see citing works
“Recent studies have explored these challenges in different applications, highlighting the need for robust aggregation mechanisms and adaptive strategies to ensure reliable performance [16], [17].”
Alamer, A. M. A., & Basudan, S. (2025) · IEEE Access · doi:10.1109/access.2025.3545786 · Cited by 6 · see citing works
“Schemes such as RPPFL in [39] face difficulties in distinguishing the local trained model on non-IID data, primarily due to the inherent challenge of differentiating between poisonous and benign gradients in the presence of divergence.”
InfluentialA Verifiable, Privacy-Preserving, and Poisoning Attack-Resilient Federated Learning Framework
Mbonu, W. E., Maple, C. R., Epiphaniou, G., & Panchev, C. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9040085 · Cited by 6 · see citing works
Verma, P., O’Shea, D., Newe, T., Mehta, N., Bharot, N., & Breslin, J. G. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07292-w · Cited by 6 · see citing works
Kokate, S., & Shrawankar, U. N. (2025) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.70139 · Cited by 7 · see citing works
“A strong privacy-preserving FL (PPFL) model that is resistant to model poisoning assaults without compromising accuracy was suggested by Yazdinejad et al. [34] in order to alleviate the issues.”
Agarwal, U., Rishiwal, V., Yadav, M., & Yadav, P. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-025-01994-x · Cited by 5 · see citing works
Undermining Federated Learning Accuracy in EdgeIoT via Variational Graph Auto-Encoders
Li, K., Hu, S., Wu, B., Zou, S., Ni, W., & Dressler, F. (2025) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc65282.2025.11059509 · Cited by 5 · see citing works
“The malicious device is either a manipulated benign IoT device or an attacker, aiming to minimize the training accuracy of federated learning [19].”
Attentive neural processes based on reliable inferences for industrial equipment anomaly detection
Huang, Y., Yang, B. Y., Wang, S., Xie, K., Wang, Y., Yi, L., & Dong, N. (2025) · Computers in Industry · doi:10.1016/j.compind.2025.104331 · Cited by 5 · see citing works
Benfriha, S., Labraoui, N., Salameh, H. B., & Bensaid, R. (2025) · Cluster Computing · doi:10.1007/s10586-025-05188-1 · Cited by 5 · see citing works
“Yazdinejad et al. [28] presented a robust privacy-preserving FDL model designed to resist model poisoning attacks without compromising accuracy.”
Jin, C., Wang, J., Lu, W. D., Luo, C., Liu, J., Chen, G., & Zhai, Z. (2025) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-025-00256-3 · Cited by 5 · see citing works
“To further enhance privacy, Yazdinejad et al. (2024) incorporated differential privacy mechanisms to secure model parameters on edge devices in beyond-5G networks.”
Wu, J., Luo, F., Sun, T., Wang, H., & Zhang, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3617070 · Cited by 7 · see citing works
“To improve scalability, more recent works [30], [31], [32] adopt single-key CKKS [39], where all users encrypt their data under a shared key.”
InfluentialSumayli, M., & Anubi, O. M. (2026) · IEEE Access · doi:10.1109/access.2026.3653933 · Cited by 5 · see citing works
“This decentralized approach significantly reduces privacy risks, mitigates communication overhead, and improves system robustness against data breaches [20].”
Sharma, N. A., Kumar, K. N. P., Khorshed, M. T., Ali, A. B. M. S., Khalid, H. M., Muyeen, S. M., & Jose, L. (2024) · Information · doi:10.3390/info15090558 · Cited by 5 · see citing works
SensFL: Privacy-Preserving Vertical Federated Learning with Sensitive Regularization
Cai, B., Zhang, C., Liu, Z., Xu, X., Hu, F., Dai, J., & Wang, W. (2024) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2024.055596 · Cited by 5 · see citing works
VIFL: vulnerability identification using federated learning in the internet of things systems
Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., Tari, Z., & Zomaya, A. Y. (2024) · Computing · doi:10.1007/s00607-024-01365-z · Cited by 5 · see citing works
“However, FL-based vulnerability identification still faces three key challenges [9–11]: data heterogeneity (statistical heterogeneity), system heterogeneity, and ensuring the reasonable level of privacy guarantee when the FL used to train ML models on data containing sensitive informationn.”
A Model of Encrypted Network Traffic Classification that Trades Off Accuracy and Efficiency
Yu, L., Yuan, J., Zheng, J., & Yang, N. (2024) · Journal of Network and Systems Management · doi:10.1007/s10922-024-09892-y · Cited by 5 · see citing works
“A strong privacy-preserving federated learning model that can withstand model poisoning attacks without compromising accuracy has been proposed by Yazdinejad et al. [67] to overcome these problems.”
Feature engineering based intelligent intrusion detection system for IoT network security
Sadhwani, S., Sriwastawa, A., Muthalagu, R., & Pawar, P. M. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-025-02631-y · Cited by 5 · see citing works
“In recent years, access to computer systems has risen dramatically and intruders have found several ways to hide their identities with ease [15, 33].”
Shen, C., Zhang, W., Zhou, T., Zhang, Y., & Zhang, L. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.054434 · Cited by 5 · see citing works
Privacy-Preserving Multilayer Community Detection via Federated Learning
Ma, S., Xu, X.-K., & Xiao, J. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3493967 · Cited by 5 · see citing works
“Yazdinejad et al. [42] proposed a framework that utilizes the Gaussian mixture model and marginal distance for Byzantine fault-tolerant aggregation to effectively deal with non-IID.”
- Authors
- Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., & Parizi, R. M.
- Affiliations
- University of Guelph (CA)
- University of Calgary (CA)
- Brandon University (CA)
- Kennesaw State University (US)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2024
- Volume
- 19
- Pages
- 6693-6708
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W4400076000
- Cited by
- 380
- References
- 30
- Citations by year
- 2026: 139 · 2025: 205 · 2024: 33 · 2023: 3
- FWCI
- 55.64
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, model poisoning, additive homomorphic encryption, Gaussian mixture model, Mahalanobis distance, communication overhead
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
