CoChat
Sign Up
Cited by 999Privacy-Preserving Technologies in DataAdversarial Robustness in Machine LearningCryptography and Data Security

FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

Open access
Cao, Xiaoyu, Fang, Minghong, Liu, Jia, Gong, Neil Zhenqiang·2021·Proceedings 2021 Network and Distributed System Security Symposium
DOI 10.14722/ndss.2021.24434
Open this paper in CoChat — free account

Abstract

Byzantine-robust federated learning aims to enable a service provider to learn an accurate global model when a bounded number of clients are malicious. The key idea of existing Byzantine-robust federated learning methods is that the service provider performs statistical analysis among the clients' local model updates and removes suspicious ones, before aggregating them to update the global model. However, malicious clients can still corrupt the global models in these methods via sending carefully crafted local model updates to the service provider. The fundamental reason is that there is no root of trust in existing federated learning methods. In this work, we bridge the gap via proposing FLTrust, a new federated learning method in which the service provider itself bootstraps trust. In particular, the service provider itself collects a clean small training dataset (called root dataset) for the learning task and the service provider maintains a model (called server model) based on it to bootstrap trust. In each iteration, the service provider first assigns a trust score to each local model update from the clients, where a local model update has a lower trust score if its direction deviates more from the direction of the server model update. Then, the service provider normalizes the magnitudes of the local model updates such that they lie in the same hyper-sphere as the server model update in the vector space. Our normalization limits the impact of malicious local model updates with large magnitudes. Finally, the service provider computes the average of the normalized local model updates weighted by their trust scores as a global model update, which is used to update the global model. Our extensive evaluations on six datasets from different domains show that our FLTrust is secure against both existing attacks and strong adaptive attacks.

AI snapshot

Written from the paper’s full text.

TL;DR

FLTrust is a Byzantine-robust federated learning method in which the server bootstraps trust using a small clean root dataset and a server model, then weights and normalizes client updates before aggregation. Across six datasets, it defends against existing and adaptive poisoning attacks while matching FedAvg accuracy under no attacks.

Key findings

  • On MNIST-0.1, a CNN global model trained with FLTrust had a testing error rate of 0.04 under all evaluated attacks, while the Krum attack increased Krum’s testing error rate from 0.10 to 0.90.
  • Using a root dataset with less than 100 examples, FLTrust under adaptive attacks with 40%–60% malicious clients still trained global models as accurate as FedAvg under no attacks; for MNIST-0.1 with 60% malicious clients, FLTrust’s testing error rate was 0.04, the same as FedAvg under no attacks.
  • FLTrust substantially reduced Scaling attack success rates: at most 0.03 across the six datasets, whereas FedAvg’s attack success rates were always high.
  • FLTrust tolerated up to 90% malicious clients under existing and adaptive attacks while achieving testing error rates similar to FedAvg without attacks; Scaling attack success rates remained close to 0 when up to 95% of clients were malicious.

Methods

  • FLTrust has the server collect a clean small root dataset and maintain a server model; in each iteration it computes a server model update, assigns each client update a trust score equal to the ReLU-clipped cosine similarity with the server update, normalizes each client update to the server update’s magnitude, and aggregates the normalized updates weighted by trust scores.
  • Evaluation used six datasets: MNIST-0.1, MNIST-0.5, Fashion-MNIST, CIFAR-10, CH-MNIST, and Human Activity Recognition; models included CNN, logistic regression, and ResNet20; attacks included label flipping, Krum attack, Trim attack, Scaling attack, and an adaptive attack optimized for FLTrust.
  • Comparisons were against FedAvg, Krum, Trim-mean, and Median; default settings included 100 clients except HAR (30) and CH-MNIST (40), 20% malicious clients, and a root dataset of 100 examples; analysis used testing error rate and attack success rate, plus a formal security analysis under stated assumptions.

Limitations

  • The paper states FLTrust requires a clean root dataset and may not be robust against a poisoned root dataset, though it argues a service provider can collect a small clean one at low cost.
  • The paper states that stronger local model poisoning attacks to FLTrust may exist and leaves them for future work; it also notes FLTrust works well only when the root dataset distribution does not diverge too much from the overall training data distribution.
  • Evident from the text: the formal guarantee relies on assumptions including strong convexity, Lipschitz continuity, and sub-exponential gradient bounds, and uses settings such as \(R_l=1\) and \(\beta=1\); the empirical evaluation is limited to the six datasets and specified attack/model configurations.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.14722/ndss.2021.24434

Cites

52 of 52 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 27 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    A CNN global model learnt using FLTrust has a testing error rate of 0.04 under all evaluated attacks on MNIST-0.1.

    “For instance, a CNN global model learnt using FLTrust has a testing error rate of 0.04 under all the evaluated attacks on MNIST-0.1.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The root dataset is clean from poisoning.
    • The authors state this as an assumption: The attacker does not compromise the server.
  • Findingown data

    Even when 60% of the clients are malicious and collude with each other, FLTrust can still learn a CNN global model with testing error rate 0.04 for MNIST-0.1.

    “For instance, even when 60% of the clients are malicious and collude with each other, FLTrust can still learn a CNN global model with testing error rate 0.04 for MNIST-0.1.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The root dataset is clean from poisoning.
    • The authors state this as an assumption: The attacker does not compromise the server.
    • The authors state this as an assumption: The attacker can perform adaptive attacks to FLTrust.
  • Findingown data
    § FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

    FLTrust is robust against adaptive attacks.

    “Our extensive evaluations on six datasets from different domains show that our FLTrust is secure against both existing attacks and strong adaptive attacks.”
    • Also stated in: § I. INTRODUCTION · plain
      “Our empirical results show that FLTrust is still robust against such adaptive attacks.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The root dataset is clean from poisoning.
    • The authors state this as an assumption: The attacker does not compromise the server.
    • The authors state this as an assumption: The attacker can perform adaptive attacks to FLTrust.
  • Findingown data

    The attack success rates for FLTrust are at most 0.03.

    “Specifically, the attack success rates for FLTrust are at most 0.03.”
    Quote in the paperSubstantial claim
  • Findingown data

    FLTrust under attacks achieves similar testing error rates to FedAvg under no attacks.

    “Our results show that FLTrust under attacks achieves similar testing error rates to FedAvg under no attacks.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The root dataset is clean from poisoning.
    • The authors state this as an assumption: The attacker does not compromise the server.
  • May combine two claims. 19
  • The quote only partly states this claim. 2
  • Classified as probably not a substantial claim. 15

  • May combine two claims.

    Findingown data

    The attack success rates for FedAvg are always high on the six datasets, and they are also high for the existing Byzantine-robust FL methods on multiple datasets.

    “On the contrary, the attack success rates for FedAvg are always high on the six datasets, and they are also high for the existing Byzantine-robust FL methods on multiple datasets”
    Quote in the paperSubstantial claim

  • The quote only partly states this claim.

    Findingreasoning

    Under Assumptions 1-3 and with R_l=1 and β=1, for an arbitrary number of malicious clients, the difference between the global model learnt by FLTrust and the optimal global model w* under no attacks is bounded by (1-ρ)^t ||w_0 - w*|| + 12α∆1/ρ with probability at least 1-δ, where ρ, ∆1, ∆2 are defined as in Theorem 1.

    “Suppose Assumption 1-3 hold and FLTrust uses R l = 1 and β = 1.For an arbitrary number of malicious clients, the difference between the global model learnt by FLTrust and the optimal global model w * under no attacks is bounded.”
    • Also stated in: § D. Formal Security Analysis · plain
      “w t -w * ≤ (1 -ρ) t w 0 -w * + 12α∆ 1 /ρ,”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The expected loss function F(w) is µ-strongly convex and differentiable over the space Θ with L-Lipschitz continuous gradient.
    • The authors state this as an assumption: The empirical loss function f(D,w) is L1-Lipschitz probabilistically.
    • The authors state this as an assumption: The gradient of the empirical loss function ∇f(D,w*) at the optimal global model w* is sub-exponential with parameters σ1 and γ1.
    • The authors state this as an assumption: The parameter space Θ is constrained such that ||w - w*|| ≤ r√d for any w ∈ Θ.

  • May combine two claims.

    Findingnone given

    Compared to FedAvg, the extra computation incurred to the server by FLTrust includes computing a server model update, computing the trust scores, and normalizing the local model updates, which are negligible for the powerful server.

    “compared to FedAvg, the extra computation incurred to the server by FLTrust includes computing a server model update, computing the trust scores, and normalizing the local model updates, which are negligible for the powerful server.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    The Scaling attack may decrease the testing error rates in some cases.

    “One interesting observation is that the Scaling attack may decrease the testing error rates in some cases.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingown data

    HAR has unbalanced local training data on clients: the maximum number of training examples on a client is 409, the minimum number is 281, and the mean is 343.

    “We note that HAR has unbalanced local training data on clients: the maximum number of training examples on a client is 409, the minimum number is 281, and the mean is 343.”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingown data

    Under no attack, FLTrust has testing error rates similar to FedAvg.

    “First, when there is no attack, our FLTrust has testing error rates similar to FedAvg, achieving the fidelity goal.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    For MNIST-0.1 (MNIST-0.5, Fashion-MNIST, CIFAR-10, HAR, or CH-MNIST), FLTrust under adaptive attacks with over 60% (over 40%, up to 60%, up to 60%, up to 40%, or over 40%) of malicious clients can still achieve testing error rates similar to FedAvg under no attack.

    “Specifically, for MNIST-0.1 (MNIST-0.5,Fashion-MNIST, CIFAR-10, HAR, or CH-MNIST), FLTrust under adaptive attacks with over 60% (over 40%, up to 60%, up to 60%, up to 40%, or over 40%) of malicious clients can still achieve testing error rates similar to FedAvg under no attack.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    When the bias probability is no more than 0.4 for MNIST-0.5, the testing error rates of FLTrust under attacks are at most 0.08, compared to 0.05 when the bias probability is 0.1.

    “For instance, when the bias probability is no more than 0.4 for MNIST-0.5, the testing error rates of FLTrust under attacks are at most 0.08, compared to 0.05 when the bias probability is 0.1.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Under Krum attack, the testing error rate of the global model learnt by Krum increases to 0.90 when only 10% of the clients are malicious, while the testing error rates of the global models learnt by Trim-mean and Median become larger than 0.85 when the fraction of malicious clients reaches 40%.

    “For instance, under Krum attack, the testing error rate of the global model learnt by Krum increases to 0.90 when only 10% of the clients are malicious, while the testing error rates of the global models learnt by Trim-mean and Median become larger than 0.85 when the fraction of malicious clients reaches 40%.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Existing methods cannot defend against the Krum attack, Trim attack, and/or our adaptive attack, i.e., their corresponding testing error rates are large.

    “However, they cannot defend against the Krum attack, Trim attack, and/or our adaptive attack, i.e., their corresponding testing error rates are large.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    FLTrust under these attacks still achieves testing error rates similar to FedAvg without attacks when up to 90% of the clients are malicious, while the attack success rates of the Scaling attacks for FLTrust are still close to 0 when up to 95% of the clients are malicious.

    “Specifically, FLTrust under these attacks still achieves testing error rates similar to FedAvg without attacks when up to 90% of the clients are malicious, while the attack success rates of the Scaling attacks for FLTrust are still close to 0 when up to 95% of the clients are malicious.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    FLTrust under attacks achieves testing error rates similar to FedAvg under no attacks, while the attack success rates of the Scaling attacks are close to 0 for FLTrust.

    “Specifically, FLTrust under attacks achieves testing error rates similar to FedAvg under no attacks, while the attack success rates of the Scaling attacks are close to 0 for FLTrust.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    FLTrust is accurate and robust when the bias probability is not too large.

    “We observe that FLTrust is accurate and robust when the bias probability is not too large.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    Under Assumption 2, for any δ ∈ (0,1) and any w ∈ Θ, with ∆1 = √(2σ1(d log 6 + log(3/δ))/|D0|) and ∆3 = √(2σ2(d log 6 + log(3/δ))/|D0|), if ∆1 ≤ σ1^2/γ1 and ∆3 ≤ σ2^2/γ2, then Pr{||(1/|D0|)Σ_{i∈D0} ∇f(Xi,w*) - ∇F(w*)|| ≥ 2∆1} ≤ δ/3 and Pr{||(1/|D0|)Σ_{i∈D0} ∇h(Xi,w) - E[h(X,w)]|| ≥ 2∆3||w-w*||} ≤ δ/3.

    “Pr 1 |D 0 | Xi∈D0 ∇f (X i , w * ) -∇F (w * ) ≥ 2∆ 1 ≤ δ 3 , Pr 1 |D 0 | Xi∈D0 ∇h(X i , w) -E [h(X, w)] ≥ 2∆ 3 w -w * ≤ δ 3 .”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [40]

      Not checked in the free run.

    • cites [12]

      Not checked in the free run.

    • cites [39]

      Not checked in the free run.

    • The authors state this as an assumption: Assumption 2 holds.

  • May combine two claims.

    Findingown data

    When the root dataset has 100 training examples, the testing error rates of FLTrust under attacks are similar to that of FedAvg without attacks, and the attack success rate of the Scaling attack is close to 0.

    “Specifically, when the root dataset has 100 training examples, the testing error rates of FLTrust under attacks are similar to that of FedAvg without attacks, and the attack success rate of the Scaling attack is close to 0.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Clients often have non-IID local training data in federated learning.

    “One characteristic of FL is that clients often have non-IID local training data [22], [28].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [22]

      Not checked in the free run.

    • cites [28]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A zeroth-order method [13], [33] is a standard method to solve optimization problems with computationally intractable objective functions.

    “Therefore, we leverage a zeroth-order method [13], [33] to compute the gradient, which is a standard method to solve such optimization problems with computationally intractable objective functions.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [13]

      Not checked in the free run.

    • cites [33]

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data

    FLTrust achieves the robustness goal, while existing FL methods do not.

    “Second, our FLTrust achieves the robustness goal, while existing FL methods do not.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    In each iteration of FL, the attacker aims to change the global model update the most along the opposite direction of the global model update under no attacks, by carefully crafting the local model updates on the malicious clients.

    “Specifically, in each iteration of FL, the attacker aims to change the global model update the most along the opposite direction of the global model update under no attacks, by carefully crafting the local model updates on the malicious clients.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    FLTrust's aggregation rule can be rewritten as g = ||g0|| sum_i ReLU(c_i)/sum_j ReLU(c_j) e_i, where e_i is the unit vector of g_i.

    “Then, our aggregation rule in Equation ( 4) can be rewritten as follows: g = ||g 0 || n i=1 ReLU (c i ) n j=1 ReLU (c j ) e i .(7)”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Trim-mean can tolerate less than 50% of malicious clients.

    “In other words, Trim-mean can tolerate less than 50% of malicious clients.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [48]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Directly computing the gradient ∇e_i h is impractical because it involves a Jacobian matrix of e_i.

    “Since the gradient ∇ e i h involves a Jacobian matrix of e i , it is not practical to directly compute the gradient.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data

    Treating the server model update as a local model update with a trust score of 1 may negatively impact the global model because the root dataset is small and may not have the same distribution as the training data, reducing the contributions of benign clients' local model updates.

    “However, such variant may negatively impact the global model because the root dataset is small and may not have the same distribution as the training data, but the server model update derived from it has a trust score of 1, reducing the contributions of the benign clients' local model updates (see our experimental results in Section VI-B).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning
    § FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

    Existing Byzantine-robust federated learning methods have no root of trust, so from the service provider's perspective every client could be malicious.

    “The fundamental reason is that there is no root of trust in existing federated learning methods, i.e., from the service provider's perspective, every client could be malicious.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Existing Byzantine-robust FL methods exclude some local model updates when aggregating them as the global model update, while FLTrust considers all of them with the help of the root dataset.

    “This is because existing Byzantinerobust FL methods exclude some local model updates when aggregating them as the global model update, while FLTrust considers all of them with the help of the root dataset.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    In the setting where R_l = 1, only the combined learning rate α•β influences FLTrust.

    “We note that in our setting where R l = 1, only the combined learning rate α•β influences FLTrust.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Because FLTrust only requires a small root dataset, a service provider can collect a clean root dataset by itself with a small cost.

    “However, since FLTrust only requires a small root dataset, a service provider can collect a clean one by itself with a small cost, e.g., asking its employees to generate and manually label a clean root dataset.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    In fault-tolerant computing, clients communicate with each other to compute results, while in federated learning, clients only communicate with a cloud server.

    “However, conventional fault-tolerant computing and federated learning have the following key difference: the clients communicate with each other to compute results in fault-tolerant computing [6], while clients only communicate with a cloud server in federated learning.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [6]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Fang et al. [15] also proposed to use a root dataset (they called it validation dataset).

    “Fang et al. [15] also proposed to use a root dataset (they called it validation dataset).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15]

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation

    We use the root dataset in a way different from Fang et al. [15]: they use it to remove potentially malicious local model updates in each iteration, while we use it to assign trust scores to clients and normalize local model updates.

    “In particular, they use the root dataset to remove potentially malicious local model updates in each iteration, while we use it to assign trust scores to clients and normalize local model updates.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [15]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Fault-tolerant computing aims to remain functional when there are malicious clients.

    “Fault-tolerant computing [6] aims to remain functional when there are malicious clients.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [6]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Fang et al. applied the framework to optimize local model poisoning attacks for Krum (called Krum attack) as well as Trim-mean and Median (called Trim attack).

    “Fang et al. applied the framework to optimize local model poisoning attacks for Krum (called Krum attack) as well as Trim-mean and Median (called Trim attack).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Fang et al.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Given a combined learning rate, one can always set β = 1 and let α be the combined learning rate.

    “Therefore, given a combined learning rate, we can always set β = 1 and let α be the combined learning rate.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Fang et al. formulates the framework based on local models, which is equivalent to formulating the framework based on local model updates.

    “Fang et al. formulates the framework based on local models, which is equivalent to formulating the framework based on local model updates.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Fang et al.

      Not checked in the free run.

34 of 34

  • The authors state this as an assumption.

    The root dataset is clean from poisoning.

    “We require the root dataset to be clean from poisoning.”

  • The authors state this as an assumption.

    The attacker does not compromise the server.

    “However, the attacker does not compromise the server.”

  • The authors state this as an assumption.

    The server does not have access to the raw local training data on the clients and does not know the number of malicious clients.

    “The server does not have access to the raw local training data on the clients, and the server does not know the number of malicious clients.”

  • The authors state this as an assumption.

    The server has full access to the global model as well as the local model updates from all clients in each iteration.

    “However, the server has full access to the global model as well as the local model updates from all clients in each iteration.”

  • The authors state this as an assumption.

    The attacker controls some malicious clients, which can be fake clients injected by the attacker or genuine ones compromised by the attacker.

    “Specifically, an attacker controls some malicious clients, which can be fake clients injected by the attacker or genuine ones compromised by the attacker.”

  • The authors state this as an assumption.

    The malicious clients can send arbitrary local model updates to the server in each iteration of the FL training process.

    “The malicious clients can send arbitrary local model updates to the server in each iteration of the FL training process.”

  • The authors state this as an assumption.

    The attacker has partial knowledge about an FL system: local training data and local model updates on the malicious clients, loss function, and learning rate.

    “Typically, an attacker has the following partial knowledge about an FL system: local training data and local model updates on the malicious clients, loss function, and learning rate.”

  • The authors state this as an assumption.

    The attacker can perform adaptive attacks to FLTrust.

    “Moreover, the attacker can perform adaptive attacks to FLTrust, which we discuss in Section V.”

  • The authors state this as an assumption.

    The expected loss function F(w) is µ-strongly convex and differentiable over the space Θ with L-Lipschitz continuous gradient.

    “Assumption 1.The expected loss function F (w) is µ-strongly convex and differentiable over the space Θ with L-Lipschitz continuous gradient.”

  • The authors state this as an assumption.

    The empirical loss function f(D,w) is L1-Lipschitz probabilistically.

    “Moreover, the empirical loss function f (D, w) is L 1 -Lipschitz probabilistically.”

  • The authors state this as an assumption.

    The gradient of the empirical loss function ∇f(D,w*) at the optimal global model w* is sub-exponential with parameters σ1 and γ1.

    “Assumption 2. The gradient of the empirical loss function ∇f (D, w * ) at the optimal global model w * is bounded.Moreover, the gradient difference h(D, w) = ∇f (D, w) -∇f (D, w * ) for any w ∈ Θ is bounded.Specifically, there exist positive constants σ 1 and γ 1 such that for any unit vector v, ∇f (D, w * ), v is sub-exponential with σ 1 and γ 1”

  • The authors state this as an assumption.

    The first m clients are malicious.

    “Assuming the first m clients are malicious.”

  • The authors state this as an assumption.

    The service provider can collect a representative root dataset that has the same distribution as the overall training data distribution of the learning task (Case I).

    “Case I. We assume the service provider can collect a representative root dataset for the learning task, i.e., the root dataset has the same distribution as the overall training data distribution of the learning task.”

  • The authors state this as an assumption.

    The root dataset has a distribution different from the overall training data distribution, biased towards a certain class (Case II).

    “Case II.We assume the root dataset has a distribution different from the overall training data distribution of the learning task.In particular, we assume the root dataset is biased towards a certain class.”

  • The authors state this as an assumption.

    The parameter space Θ is constrained such that ||w - w*|| ≤ r√d for any w ∈ Θ.

    “r is some positive number such that ww * ≤ r √ d for any w ∈ Θ (i.e., the parameter space Θ is constrained).”

  • The authors state this as an assumption.

    The attacker knows that FLTrust is used to learn the global model.

    “When an attacker knows our FLTrust is used to learn the global model, the attacker can adapt its attacks to FLTrust.”

  • The authors state this as an assumption.

    Each client's local training dataset D_i and the root dataset D0 are sampled independently from the distribution X.

    “Assumption 3 . Each client's local training dataset D i (i = 1, 2, • • • , n) and the root dataset D 0 are sampled independently from the distribution X .”

  • The authors state this as an assumption.

    Assumption 1 holds.

    “Assume Assumption 1 holds.”

  • The authors state this as an assumption.

    Assumption 2 holds.

    “Suppose Assumption 2 holds.”

  • The authors state this as an assumption.

    The adaptive attacker has full knowledge about the FL system when solving the optimization problem.

    “We consider a strong adaptive attacker who has full knowledge about the FL system when solving the optimization problem.”
20 of 20

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Statistical methods such as Euclidean distance, cosine similarity, k-means, and Pearson correlation coefficient can be used to measure differences between benign and malicious models.

    “The first one is a similarity-based malicious model detection algorithm, which considers that statistical methods (such as euclidean distance [40], [52], cosine similarity [37], [38], k-means [46], Pearson correlation coefficient [49], [51], etc.) can be used to measure the differences between benign and malicious models [36], [80].”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [40]

  • The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.

    “The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”

    From Deep Model Poisoning Attack on Federated Learning (2021) · cites this paper as [44]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • HAR client training counts exceed the stated training split

    Minor

    With 10,299 examples across 30 clients, using 75% for training yields about 7,724 training examples in total. The stated minimum of 281 training examples per client would require at least 8,430; the reported mean of 343 would require about 10,290.

  • Local model updates have the opposite sign from the gradients

    Minor

    The paper defines a local model update as the new model minus the current model. Under its stated SGD step, setting β = 1 makes that update the negative of the gradient, not the gradient as claimed in the appendix. This also reverses the direction of the stated global update.

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. B. I. Rubinstein, B. Nelson, L. Huang, A. D. Joseph, S.-h. Lau, S. Rao, N. Taft, and J. Tygar, "Antidote: understanding and defending against poisoning of anomaly detectors," in ACM IMC, 2009.
  2. C. Xie, S. Koyejo, and I. Gupta, "Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance," in ICML, 2019, pp. 6893- 6901.

Cited by

Sorted by citations

Related

Authors
Cao, X., Fang, M., Liu, J., & Gong, N. Z.
Affiliations
  • Duke University (US)
  • The Ohio State University (US)
ORCID
Venue
Proceedings 2021 Network and Distributed System Security Symposium
Publisher
Internet Society
Published
2021
DOI
10.14722/ndss.2021.24434
OpenAlex
W3138597937
Cited by
999
References
47
Citations by year
2026: 238 · 2025: 314 · 2024: 240 · 2023: 134 · 2022: 52 · 2021: 19 · 2020: 2
FWCI
50.96
Type
conference paper
Language
en
Open access
Licence
public-domain
Locations
  • Network and Distributed System Security Symposium (publishedVersion, public-domain)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
National Science Foundation (1943226, 1937786, 2110252)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
Keywords
malicious clients, trust score, adaptive attacks, global model aggregation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review