The DOI matches its Crossref record; 34 of the 34 references it cites were found in a registry or an index.
A Robust Privacy-Preserving Federated Learning Model Against Model Poisoning Attacks
Abstract
Although federated learning offers a level of privacy by aggregating user data without direct access, it remains inherently vulnerable to various attacks, including poisoning attacks where malicious actors submit gradients that reduce model accuracy. In addressing model poisoning attacks, existing defense strategies primarily concentrate on detecting suspicious local gradients over plaintext. However, detecting non-independent and identically distributed encrypted gradients poses significant challenges for existing methods. Moreover, tackling computational complexity and communication overhead becomes crucial in privacy-preserving federated learning, particularly in the context of encrypted gradients. To address these concerns, we propose a robust privacy-preserving federated learning model resilient against model poisoning attacks without sacrificing accuracy. Our approach introduces an internal auditor that evaluates encrypted gradient similarity and distribution to differentiate between benign and malicious gradients, employing a Gaussian Mixture Model and Mahalanobis Distance for byzantine-tolerant aggregation. The proposed model utilizes Additive Homomorphic Encryption to ensure confidentiality while minimizing computational and communication overhead. Our model demonstrates superior performance in accuracy and privacy compared to existing strategies and encryption techniques, such as Fully Homomorphic Encryption and Two-Trapdoor Homomorphic Encryption. The proposed model effectively addresses the challenge of detecting maliciously encrypted non-independent and identically distributed gradients with low computational and communication overhead.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Another promising technique is robust aggregation methods, where model updates are evaluated for anomalies before being integrated into the global model [72,73].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In the citing paper
“Defense techniques such as adversarial training, where the model is pre-trained with adversarial samples, have displayed promise.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In the citing paper
“In targeted poisoning attacks, malicious contributors corrupt the model to misidentify specific data, which could be utilized to target certain diseases or demographic groups.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In the citing paper
“Designed to prevent malicious model updates from impacting the global model, this technique uses statistical approaches to filter irregularities in model updates, maintaining robustness even with a certain degree of compromised participants [72].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In the citing paper
“Data manipulation attacks are crucial threats in FL, particularly in healthcare.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
In the citing paper
“Untargeted poisoning, in contrast, aims to degrade model efficiency globally, risking patient results over the board [72,76].”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [72]
Citations
Cites
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936
On the Convergence of FedAvg on Non-IID Data
Li, X., Huang, K., Yang, W., Wang, S., & Zhang, Z. (2019) · arXiv · doi:10.48550/arxiv.1907.02189 · Cited by 1,575
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Verifynet: Secure and verifiable federated learning
Xu, G., Li, H., Liu, S., Yang, K., & Lin, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2929409 · Cited by 839
Personalized Cross-Silo Federated Learning on Non-IID Data
Huang, Y., Chu, L., Zhou, Z., Wang, L., Liu, J., Pei, J., & Zhang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16960 · Cited by 749
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351 · cited 8×
“Model poisoning adversaries manipulate user input by submitting poisonous updates to local models to create arbitrary deviance from correct trends [3].”
BackgroundMethodInfluentialPrivacy-Preserving Collaborative Deep Learning With Unreliable Participants
Zhao, L., Wang, Q., Zou, Q., Zhang, Y., & Chen, Y. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2939713 · Cited by 215
Privacy-Preserving Federated Deep Learning with Irregular Users
Xu, G., Li, H., Zhang, Y., Xu, S., Ning, J., & Deng, R. H. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3005909 · Cited by 172
POSEIDON: Privacy-Preserving Federated Neural Network Learning
Sav, S., Pyrgelis, A., Troncoso-Pastoriza, J. R., Froelicher, D., Bossuat, J.-P., Sousa, J. S., & Hubaux, J.-P. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24119 · Cited by 162
RoFL: Robustness of Secure Federated Learning
Lycklama, H., Burkhalter, L., Viand, A., Küchler, N., & Hithnawi, A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179400 · Cited by 145
ELSA: Secure Aggregation for Federated Learning with Malicious Actors
Rathee, M., Shen, C., Wagh, S., & Popa, R. A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179468 · Cited by 133
AP2FL: Auditable Privacy-Preserving Federated Learning Framework for Electronics in Healthcare
Yazdinejad, A., Dehghantanha, A., & Srivastava, G. (2024) · IEEE transactions on consumer electronics · doi:10.1109/tce.2023.3318509 · Cited by 117
Self-citationYazdinejad, A., Dehghantanha, A., Srivastava, G., Karimipour, H., & Parizi, R. M. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103088 · Cited by 115
Self-citationData Quality Detection Mechanism Against Label Flipping Attacks in Federated Learning
Jiang, Y., Zhang, W., & Chen, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3249568 · Cited by 102
Enabling Execution Assurance of Federated Learning at Untrusted Participants
Zhang, X., Li, F., Zhang, Z., Li, Q. L., Wang, C., & Wu, J. (2020) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom41043.2020.9155414 · Cited by 95
Privacy-Preserving Federated Learning via Functional Encryption, Revisited
Chang, Y., Zhang, K., Gong, J., & Qian, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3255171 · Cited by 93
Byzantine-Resilient Decentralized Stochastic Gradient Descent
Guo, S., Zhang, T., Yu, H., Xie, X., Ma, L., Xiang, T., & Liu, Y. (2021) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2021.3116976 · Cited by 86
SafeFL: MPC-friendly Framework for Private and Robust Federated Learning
Gehlhar, T., Marx, F., Schneider, T. H., Suresh, A., Wehrle, T., & Yalame, H. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00012 · Cited by 60
Prio+: Privacy Preserving Aggregate Statistics via Boolean Shares
Addanki, S., Garbe, K., Jaffe, E., Ostrovsky, R., & Polychroniadou, A. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-14791-3_23 · Cited by 56
Gaussian mixture model with feature selection: An embedded approach
Fu, Y., Liu, X., Sarkar, S., & Wu, T. (2020) · Computers & Industrial Engineering · doi:10.1016/j.cie.2020.107000 · Cited by 55
Privacy-Preserving Implicit Authentication Protocol Using Cosine Similarity for Internet of Things
Wei, F., Vijayakumar, P., Kumar, N., Zhang, R., & Cheng, Q. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3031486 · Cited by 55
Hu, Y., Zheng, J., Jiang, S., Yang, S., Zou, J., & Wang, R. (2023) · IEEE Transactions on Evolutionary Computation · doi:10.1109/tevc.2023.3253850 · Cited by 53
Privacy-preserving Decentralized Federated Learning over Time-varying Communication Graph
Lu, Y., Yu, Z., & Suri, N. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3591354 · Cited by 32
Distributed Momentum for Byzantine-resilient LearningPreprint
El-Mhamdi, E.-M., Guerraoui, R., & Rouault, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.00010 · Cited by 31
Hercules: Boosting the Performance of Privacy-Preserving Federated Learning
Xu, G., Han, X., Xu, S., Zhang, T., Li, H., Huang, X., & Deng, R. H. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3218793 · Cited by 26
Encrypted images-based reversible data hiding in Paillier cryptosystem
Jiang, C., & Pang, Y. (2019) · Multimedia Tools and Applications · doi:10.1007/s11042-019-07874-w · Cited by 21
Efficient and privacy-preserving tree-based inference via additive homomorphic encryption
Zhao, J., Zhu, H., Wang, F., Lu, R., & Li, H. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119480 · Cited by 21
Paillier cryptosystem enhancement for Homomorphic Encryption technique
Mohammed, S. J., & Taha, D. B. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16301-0 · Cited by 20
Protecting Data from all Parties: Combining FHE and DP in Federated LearningPreprint
Sébert, A. G., Sirdey, R., Stan, O., & Gouy‐Pailler, C. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2205.04330 · Cited by 18
Privacy-Preserving Federated Recurrent Neural Networks
Sav, S., Diaa, A., Pyrgelis, A., Bossuat, J.-P., & Hubaux, J. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0122 · Cited by 17
Privacy-preserving Decentralized Deep Learning with Multiparty Homomorphic Encryption
Xu, G., Li, G., Guo, S., Zhang, T., & Li, H. (2022) · arXiv · doi:10.48550/arxiv.2207.04604
Research works printed but not linked: 12
- Bhagoji, Analyzing federated learning through an adversarial lens, 634
- Fung, The limitations of federated learning in Sybil settings, 301
- Fang, Local model poisoning attacks to Byzantine-robust federated learning, 1623
- Mozaffari, Every vote counts: Ranking-based training of federated learning to resist poisoning attacks, 1721
- Blanchard, Machine learning with adversaries: Byzantine tolerant gradient descent, 30, 118
- El Mhamdi, The hidden vulnerability of distributed learning in Byzantium, 3521
- Xie, DBA: Distributed backdoor attacks against federated learning
- Bell, ACORN: Input validation for secure aggregation, 4805
- Shen, AUROR: Defending against poisoning attacks in collaborative deep learning systems, 508
- 2023, Availability With Redundancy
- Goodfellow, 2016, Deep Learning
- 2016, Paillier Cryptosystem
Cited by
Sorted by citations
Abbas, S. R., Abbas, Z., Zahir, A., & Lee, S. W. (2024) · Healthcare · doi:10.3390/healthcare12242587 · Cited by 228
Albshaier, L., Almarri, S., & Albuali, A. (2025) · Electronics · doi:10.3390/electronics14051019 · Cited by 164
Saheed, Y. K., Omole, A. I., & Sabit, M. O. (2025) · Sensors International · doi:10.1016/j.sintl.2024.100297 · Cited by 88
Ghazal, T. M., Islam, S., Hasan, M. K., Abu-Shareha, A. A., Mokhtar, U. A., Khan, M. A., Baili, J., Saeed, A. Q., Bhatt, M. W., & Ahmad, M. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2025.3572629 · Cited by 70
“A privacy-preserving FL model suggested by Yazdinejad et al. [38] uses an internal auditor with Gaussian Mixture Model (GMM) and Mahalanobis Distance to detect harmful encrypted gradients and AHE for secrecy achieves higher accuracy with lower computational and communication overhead on benchmark…”
A survey of security threats in federated learning
Feng, Y., Guo, Y., Hou, Y., Wu, Y., Lao, M., Yu, T., & Liu, G. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-024-01664-0 · Cited by 70
“However, further research has shown that federated learning also faces numerous security risks [11–15] like backdoor attacks, adversarial attacks, and Byzantine attacks.”
Metadata
- Authors
- Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., & Parizi, R. M.
- Affiliations
- University of Guelph (CA)
- University of Calgary (CA)
- Brandon University (CA)
- Kennesaw State University (US)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2024
- Volume
- 19
- Pages
- 6693-6708
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W4400076000
- Cited by
- 380
- References
- 30
- Citations by year
- 2026: 139 · 2025: 205 · 2024: 33
- FWCI
- 55.64
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- privacy-preserving federated learning, model poisoning, additive homomorphic encryption, Gaussian mixture model, Mahalanobis distance, communication overhead
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
