Robust Federated Learning for Ubiquitous Computing through Mitigation of Edge-Case Backdoor Attacks
Open accessAbstract
Federated Learning (FL) allows several data owners to train a joint model without sharing their training data. Such a paradigm is useful for better privacy in many ubiquitous computing systems. However, FL is vulnerable to poisoning attacks, where malicious participants attempt to inject a backdoor task in the model at training time, along with the main task that the model was initially trained for. Recent works show that FL is particularly vulnerable to edge-case backdoors introduced by data points with unusual out-of-distribution features. Such attacks are among the most difficult to counter, and today's FL defense mechanisms usually fail to tackle them. In this paper, we present ARMOR, a defense mechanism that leverages adversarial learning to uncover edge-case backdoors. In contrast to most of existing FL defenses, ARMOR does not require real data samples and is compatible with secure aggregation, thus, providing better FL privacy protection. ARMOR relies on GANs (Generative Adversarial Networks) to extract data features from model updates, and uses the generated samples to test the activation of potential edge-case backdoors in the model. Our experimental evaluations with three widely used datasets and neural networks show that ARMOR can tackle edge-case backdoors with 95% resilience against attacks, and without hurting model quality.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Defense during the aggregation phase can use a robust aggregator based on statistical methods that calculates statistical features of model updates, including average and median, and selects one or more participants as reference to detect malicious updates.
“defenders design a robust aggregator based on statistical methods [194], [208]. By calculating the statistical features of model updates, including average and median, one or more participants are selected as the reference to detect the malicious updates [193], [209].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [208]
The defender at the post-aggregation stage can handle model poisoning backdoor attacks, including model replacement backdoor attack and weight scaling backdoor attack.
“The defender at this stage can well handle the model poisoning backdoor attacks, including model replacement backdoor attack [37], [208], [223] and weight scaling backdoor attack [38], [194].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [208]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
Conditional Generative Adversarial Nets
Mirza, M., & Osindero, S. (2014) · arXiv · doi:10.48550/arxiv.1411.1784 · Cited by 8,863 · see citing works
Proceedings of the 25th international conference on Machine learning - ICML '08
(2008) · doi:10.1145/1390156 · Cited by 6,865 · see citing works
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Xiao, H., Rasul, K., & Vollgraf, R. (2017) · arXiv · doi:10.48550/arxiv.1708.07747 · Cited by 6,108 · see citing works
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · see citing works
The future of digital health with federated learning
Rieke, N., Hancox, J., Li, W., Milletarì, F., Roth, H. R., Albarqouni, S., Bakas, S., Galtier, M. N., Landman, B. A., Maier-Hein, K., et al. (2020) · npj Digital Medicine · doi:10.1038/s41746-020-00323-1 · Cited by 3,119 · cited 1× · see citing works
“adopted in several thriving ubiquitous computing applications such as healthcare [40], self-driving cars [51], home automation [25], next-word prediction [49], etc.”
BackgroundNasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760 · see citing works
Measuring the Effects of Non-Identical Data Distribution for Federated Visual ClassificationPreprint
Hsu, T., Qi, & Brown, M. (2019) · arXiv.org · doi:10.48550/arxiv.1909.06335 · Cited by 1,757 · see citing works
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
Federated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning
Shejwalkar, V., & Houmansadr, A. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24498 · Cited by 615 · see citing works
Federated Learning with Personalization LayersPreprint
Arivazhagan, M. G., Aggarwal, V., Singh, A. K., & Choudhary, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.00818 · Cited by 595 · see citing works
LOGAN: Membership Inference Attacks Against Generative Models
Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0008 · Cited by 433 · see citing works
Kull, M., Filho, T. M. S., & Flach, P. A. (2017) · Cited by 404 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
BaFFLe: Backdoor Detection via Feedback-based Federated Learning
Andreina, S., Marson, G. A., Mollering, H., & Karame, G. (2021) · 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs51616.2021.00086 · Cited by 205 · see citing works
Generalized Byzantine-tolerant SGDPreprint
Xie, C., Koyejo, O. O., & Gupta, I. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.10116 · Cited by 172 · see citing works
Rewriting a Deep Generative Model
Bau, D., Liu, S., Tongzhou, W., Zhu, J.-Y., & Torralba, A. B. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58452-8_21 · Cited by 86 · see citing works
End-to-End Federated Learning for Autonomous Driving Vehicles
Zhang, H., Bosch, J., & Olsson, H. H. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9533808 · Cited by 84 · see citing works
Chaudhary, A., Kolhe, S., & Kamal, R. (2016) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2016.03.026 · Cited by 65 · see citing works
Learning ECOC Code Matrix for Multiclass Classification with Application to Glaucoma Diagnosis
Bai, X., Niwas, S. I., Lin, W., Ju, B., Kwoh, C. K., Wang, L., Sng, C. C. A., Aquino, M. C., & Chew, P. T. K. (2016) · Journal of Medical Systems · doi:10.1007/s10916-016-0436-2 · Cited by 52 · see citing works
Byzantine-Robust Learning on Heterogeneous Datasets via BucketingPreprint
Karimireddy, S. P., He, L., & Jaggi, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.09365 · Cited by 42 · see citing works
Lloyd, G. R., Brereton, R. G., Faria, R., & Duncan, J. C. (2007) · Journal of Chemical Information and Modeling · doi:10.1021/ci700019q · Cited by 34 · see citing works
Latent Space Oddity: on the Curvature of Deep Generative ModelsPreprint
Arvanitidis, G., Hansen, L. K., & Hauberg, S. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.11379 · Cited by 24 · see citing works
Improving the Speed and Quality of GAN by Adversarial TrainingPreprint
Zhong, J., Liu, X., & Hsieh, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.03364 · Cited by 12 · see citing works
Dalgic, O. O., Wu, H., Erenay, F. S., Sır, M. Y., Özaltın, O. Y., Crum, B. A., & Pasupathy, K. S. (2021) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2021.103895 · Cited by 9 · see citing works
Improving response time of home IoT services in federated learning
Hwang, D., Mun, H., & Lee, Y. (2022) · ACM Symposium on Applied Computing · doi:10.1145/3477314.3508380 · Cited by 9 · see citing works
Predictive analytics for spam email classification using machine learning techniques
Kumar, P. (2020) · International Journal of Computer Applications in Technology · doi:10.1504/ijcat.2020.111844 · Cited by 7 · see citing works
Rethinking conditional GAN training: An approach using geometrically structured latent manifoldsPreprint
Ramasinghe, S., Farazi, M. R., Khan, S. H., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.13055 · Cited by 2 · see citing works
Applied Federated Learning: Improving Google Keyboard Query Suggestions
Yang, T., Andrew, G., Eichner, H., Sun, H., Li, W., Kong, N., Ramage, D., & Beaufays, F. (2018) · arXiv · doi:10.48550/arxiv.1812.02903
Flagged first, then by citations
Research works printed but not linked: 13
- Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How To Backdoor Federated Learning. In The 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, 26-28 August 2020, Online [Palermo, Sicily, Italy] (Proceedings of Machine Learning Research, Vol. 108), Silvia Chiappa and Roberto Calandra (Eds.). PMLR, Palermo, Sicily, Italy, 2938-2948. http://proceedings.mlr.press/v108/bagdasaryan20a.html
- Gilad Baruch, Moran Baruch, and Yoav Goldberg. 2019. A Little Is Enough: Circumventing Defenses For Distributed Learning. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019,, Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d'Alché-Buc, Emily B. Fox, and Roman Garnett (Eds.). NIPS, Vancouver, BC, Canada, 8632-8642. https://proceedings.neurips.cc/paper/2019/hash/ec1c59141046cd1866bbbcdfb6ae31d4-Abstract.html
- Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Pro- cessing Systems 2017, December 4-9, 2017,, Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett (Eds.). NIPS, Long Beach, CA, USA, 119-129. https://proceedings.neurips.cc/paper/2017/hash/ f4b9ec30ad9f68f89b29639786cb62ef-Abstract.html
- Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2020. Local Model Poisoning Attacks to Byzantine-Robust Federated Learning. In 29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020, Srdjan Capkun and Franziska Roesner (Eds.). USENIX Association, Virtual, 1605-1622. https://www.usenix.org/conference/usenixsecurity20/presentation/fang
- Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. 2020. The Limitations of Federated Learning in Sybil Settings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020). USENIX, San Sebastian. https://www.usenix.org/conference/ raid2020/presentation/fung
- Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. 2014. Generative Adversarial Nets. In Annual Conference on Neural Information Processing Systems (NeurIPS 2014). NIPS, Montreal, Canada. https://proceedings.neurips.cc/paper/2014/hash/5ca3e9b122f61f8f06494c97b1afccf3-Abstract.html
- H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. 2018. Learning Differentially Private Recurrent Language Models. In 6th International Conference on Learning Representations, ICLR 2018. OpenReview.net, Vancouver, BC, Canada,. https: //openreview.net/forum?id=BJ0hF1Z0b
- Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. 2019. PyTorch: An Imperative Style, High-Performance Deep Learning Library. In Advances in Neural Information Processing Systems (NeurIPS 2019). NIPS, Vancouver Convention Centre, CA.
- Venkata Krishna Pillutla, Sham M. Kakade, and Zaïd Harchaoui. 2019. Robust Aggregation for Federated Learning. CoRR abs/1912.13445 (2019). arXiv:1912.13445 http://arxiv.org/abs/1912.13445 · arXiv
- Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. Data Poisoning Attacks Against Federated Learning Systems. In 25th European Symposium on Research in Computer Security, (ESORICS 2020).
- Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris S. Papailiopoulos. 2020. Attack of the Tails: Yes, You Really Can Backdoor Federated Learning. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, Hugo Larochelle, Marc'Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin (Eds.). NIPS, virtual. https://proceedings.neurips.cc/paper/2020/hash/ b8ffa41d4e492f0fad2f13e29e1762eb-Abstract.html
- Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dimitris S. Papailiopoulos, and Yasaman Khazaeni. 2020. Federated Learning with Matched Averaging. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, Addis Ababa, Ethiopia. https://openreview.net/forum?id=BkluqlSFDS
- Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 80), Jennifer Dy and Andreas Krause (Eds.). PMLR, Stockholm, Sweden, 5650-5659. https://proceedings.mlr.press/v80/yin18a.html
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“Considering the fact that the aggregator, which simply combines the received updates, is vulnerable to being poisoned, defenders design a robust aggregator based on statistical methods [194], [208].”
BackgroundMethodUddin, M. P., Xiang, Y., Hasan, M., Bai, J., Zhao, Y., & Gao, L. (2025) · ACM Computing Surveys · doi:10.1145/3727643 · Cited by 94 · see citing works
Device Selection and Resource Allocation With Semi-Supervised Method for Federated Edge Learning
Hu, R., Yuan, H., Tan, D., & Wang, Z. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3504271 · Cited by 8 · see citing works
Towards Scalable Resilient Federated Learning: A Fully Decentralised Approach
Lacour, D. D., Lacoste, M., Mario Südholt, B., & Traoré, J. (2023) · IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomworkshops56833.2023.10150295 · Cited by 6 · see citing works
Real-Time Encrypted Emotion Recognition Using Homomorphic Encryption
Cha, G., Park, D., Choi, Y., Park, E., & Lee, J.-W. (2025) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3770633 · Cited by 5 · see citing works
Wu, Y., Chen, J., Lei, T., Jia-hua, Y., & Hossain, M. S. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.06.022 · Cited by 4 · see citing works
Zhang, W., Li, Y., An, L., Wan, B., & Wang, X. (2024) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3678571 · Cited by 4 · see citing works
Neural network shuffling for secure and private federated learning
Lee, K., Jin, J., Kim, S., Park, J., & Ko, J. (2026) · Internet of Things · doi:10.1016/j.iot.2026.102091 · Cited by 2 · see citing works
Robust and Privacy-Preserving Federated Learning
Elhattab, F. (2023) · doi:10.70675/062161c5z9cdez4465z92bezb97b4a23cb36 · Cited by 1 · see citing works
Self-citationUnfair Trojan: Targeted Backdoor Attacks Against Model Fairness
Furth, N., Khreishah, A. A., Liu, G., Phan, N., & Jararweh, Y. (2024) · Springer optimization and its applications · doi:10.1007/978-3-031-58923-2_5
Edge Cases: The boundary between social and technical approaches to safety assurancePreprint
Rae, A. J., Alexander, R., & Habli, I. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5955479
- Authors
- Elhattab, F., Bouchenak, S., Talbi, R., & Nitu, V.
- Affiliations
- Laboratoire d'Informatique en Images et Systèmes d'Information (FR)
- Centre National de la Recherche Scientifique (FR)
- Venue
- Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies
- Published
- 2022-12-21
- Volume
- 6
- Issue
- 4
- Pages
- 1-27
- ISSN
- 2474-9567 (ISSN-L)
- OpenAlex
- W4315630926
- Cited by
- 11
- References
- 22
- Citations by year
- 2026: 1 · 2025: 3 · 2024: 5 · 2023: 2
- FWCI
- 0.82
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies (publishedVersion)
- HAL (submittedVersion)
- Funders
- Agence Nationale de la Recherche (ANR-17-LCV2-0014, 0014-01, ANR-17)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- federated learning, backdoor attacks, poisoning attacks, adversarial learning, generative adversarial networks, secure aggregation, privacy preservation, armor, out-of-distribution data, attack detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
