CoChat
Sign Up
Cited by 170Adversarial Robustness in Machine LearningPrivacy-Preserving Technologies in DataDigital Media Forensic Detection

Deep Model Poisoning Attack on Federated Learning

Open access
Zhou, Xingchen, Xu, Ming, Wu, Yiming, Zheng, Ning·2021·Future Internet
DOI 10.3390/fi13030073
Open this paper in CoChat — free accountOpen PDF

Abstract

Federated learning is a novel distributed learning framework, which enables thousands of participants to collaboratively construct a deep learning model. In order to protect confidentiality of the training data, the shared information between server and participants are only limited to model parameters. However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters. In this paper, we perform systematic investigation for such threats in federated learning and propose a novel optimization-based model poisoning attack. Different from existing methods, we primarily focus on the effectiveness, persistence and stealth of attacks. Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper proposes an optimization-based model poisoning attack for federated learning that injects poisoning neurons into redundant network space and uses alternating minimization with regularization to improve effectiveness, persistence, and stealth. Experiments on MNIST and CIFAR-10 show high attack success rates and bypass of Krum and norm-bounded defenses.

Key findings

  • The proposed attack achieves over 90% attack success rate on CIFAR-10 in the multiple-shot scenario, higher than the backdoor attack in [4]; it also achieves over 90% attack success rate on MNIST against the norm-bounded defense.
  • In the single-shot scenario, the attack success rate of [4] drops dramatically, while the proposed attack falls slowly and retains higher main-task accuracy, indicating mitigation of catastrophic forgetting.
  • The attack bypasses two defenses: Krum [16] and the norm-bounded defense [22]; Krum rejects the model update in some rounds, but the adversary still maintains high adversarial-task accuracy when not selected.
  • Weight update distributions show malicious clients’ layer0, layer1, and layer3 differ from benign clients’, while layer2 is similar; the all-layer distribution is similar because layer2 has the most neurons.

Methods

  • Threat model: a single non-colluding malicious client in federated learning can directly modify local model updates but cannot control aggregation or know benign participants’ local training; the goal is targeted misclassification while preserving test accuracy.
  • Attack design: alternating minimization of a main task (clean data plus regularization to make malicious updates similar to benign updates) and an adversarial task (poisoning data plus Hessian-based structural regularization to avoid neurons important to the main task), then boosting the malicious update by factor n/η.
  • Experiments: MNIST and CIFAR-10 with non-I.I.D. distributions, 10,000 test images, LetNet and ResNet, |S_t|/N of 10/20 and 10/50, internal epochs 5 and 10, |D_p| = 100; comparisons against backdoor attack [4] and model poisoning [8], and defenses [16,22].

Limitations

  • Stated: time constraints greatly limit exploration; the malicious client must compute the Hessian matrix, which is non-trivial and time consuming, and a possible defense is to drop clients that cannot reply on time.
  • Stated: future work is needed to explore additional attacks and efficient mechanisms (e.g., meta-learning) for finding neurons to inject adversarial tasks.
  • Evident: evaluation is limited to MNIST and CIFAR-10 with specific architectures and parameters; effectiveness and persistence experiments assume the malicious client is selected each round; no real-world deployment or broader dataset evaluation is reported.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.3390/fi13030073

Cites

49 of 49 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 23 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning

    The accuracy of the main task increases when the hyperparameter ρ2 is set to 0.

    “The accuracy of main task increases when we set hyperparameter ρ 2 = 0, as shown in Figure 4.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The malicious client is selected by the central server each round.
  • Findingreasoning

    The proposed deep model poisoning attack can retain a high attack success rate over a long period of aggregation in the single-shot attack scenario.

    “Figure 5 illustrates that the proposed deep model poisoning attack has the capability to retain a high attack success rate over a long period of aggregation.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The malicious client is selected by the central server each round.
  • Findingcitation

    The deep model poisoning attack has better performance than other competing approaches [4,8].

    “Furthermore, the deep model poisoning attack has better performance than other competing approaches [4,8].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.

      Not checked in the free run.

    • cites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.
  • Findingown data

    On CIFAR-10, the attack success rate of the proposed attack is higher than that of [4]'s attack.

    “When it comes to the CIFAR-10, one can conclude from Figure 6b that the attack success rate for proposed is higher than that of [4]'s attack.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.
  • Findingown data

    The attack method proposed in [8] is vulnerable when the malicious client uses a large poisoning dataset (e.g., Dp = 100).

    “Even though the attack method proposed in [8] is claimed to be stealthy when D p = 1, it is vulnerable when the malicious client uses a large poisoning dataset (e.g., D p = 100 in our experiment).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.
  • May combine two claims. 14
  • Classified as probably not a substantial claim. 9

  • May combine two claims.

    Findingown data

    For the first four layers, the malicious clients' weight update distributions in layer0, layer1, and layer3 are different from benign clients', and only layer2 is similar to benign clients'.

    “The malicious clients' layer0, layer1, and layer3 are different from benign clients', and only layer2 is similar to benign clients', as reported in Figure 7a-d.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The malicious client is selected by the central server each round.

  • May combine two claims.

    Findingown data

    The proposed attack algorithm's attack success rate falls down slowly, indicating it is effective in mitigating catastrophic forgetting of the adversarial task.

    “The proposed attack algorithm outperforms [4]' attack in two aspects: (1) the attack success rate falls down slowly, which means that the proposed attack is effective in mitigating catastrophic forgetting of adversarial task;”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.

  • May combine two claims.

    Findingown data

    On CIFAR-10, the proposed model poisoning attack achieves over 90% attack success rate for the adversarial task, higher than that of the backdoor attack [4].

    “Even for the large dataset like CIFAR-10, the proposed model poisoning attack can achieve over 90% attack success rate for adversarial task, which is higher than that of [4].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.

  • May combine two claims.

    Findingcitation

    Krum is effective in detecting aberrant models, and the model update of the proposed method is rejected in some rounds.

    “Because Krum is effective in detecting aberrant models, the model update of proposed method is rejected in some rounds.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.

      Not checked in the free run.

    • The authors state this as an assumption: The malicious client is selected by the central server each round.

  • May combine two claims.

    Findingown data

    The proposed deep model poisoning attack can bypass the norm bounded defense method and achieves over 90% attack success rate for MNIST.

    “Our proposed deep model poisoning attack can bypass norm bounded defense method and achieves over 90% attack success rate for MNIST, as reported in Figure 6a.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The malicious client is selected by the central server each round.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Findingreasoning

    Our preliminary results show some promise of mitigation.

    “While our preliminary results show some promise of mitigation, much more work is clearly needed to explore additional attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given

    The malicious client must compute the Hessian matrix during attack preparation, which is non-trivial and time consuming.

    “The malicious client should compute the Hessian matrix during the preparation of an attack, which is non-trivial and time consuming.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The constraint regularization term in Equation (3) tends to update neurons not important to the main task, which explains why main task accuracy increases when ρ2=0.

    “The main reason behind this phenomenon is that the constraint regularization term in Equation (3) tends to update neurons not”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    The second derivative measures curvature of the loss function and can find the optimization direction of stochastic gradient descent (SGD).

    “In one variable function, since second derivative measures curvature of loss function, the second derivative can find the optimization direction of stochastic gradient descent (SGD).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [39] Williams, 1992, A fast algorithm for active contours and curvature estimation, CVGIP Image Underst. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    The effectiveness, persistence, and stealth of model poisoning attacks in federated learning is challenging because only a small fraction of clients' updates are selected each round.

    “Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Only a small fraction of the clients' updates will be selected each round.

  • May combine two claims.

    Premisereasoning

    Federated learning is vulnerable to model poisoning attacks because participants can modify model parameters.

    “However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters.”
    • Also stated in: § 1. Introduction · hedged
      “Because the clients can fully control their private data and arbitrarily modify their local model, the malicious clients may leverage adversarial algorithm to perform targeted attack (e.g., backdoor attack [4][5][6], model poisoning attack [7][8][9] and data poisoning attack [10,11]), or untargeted attack (e.g., Byzantine failures [9,12]) and untargeted attack [13][14][15].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [7][8][9]

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data

    The proposed attack method is persistent enough to keep its attack effect, so the attacker can still maintain a high attack success rate even if detected by a Byzantine-robust central server.

    “Because the proposed attack method is persistent enough to keep its attack effect (See Figure 5), the attacker can still maintain a high attack success rate, even though it is detected by Byzantine-robust central server.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The authors of [22] proposed a norm bounded defense method that clips model updates using a threshold M.

    “While, the authors of [22] proposed a norm bounded defense method, which clips model updates using a threshold M:”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [22] Sun, Z., Kairouz, P., Suresh, A.T., and McMahan, H.B. (2019). Can You Really Backdoor Federated Learning?. arXiv.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The authors of [16] proposed the robust aggregation rule Krum.

    “The authors of [16] proposed the robust aggregation rule referred to as Krum.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning

    Because the proposed attack methods do not rely on other clients' model updates, the method is still effective in secure federated learning where model updates are encrypted.

    “Because the proposed attack methods do not rely on other clients' model updates, our method still effective in this scenario.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Both alternating minimization and constrained regularization increase the stealth of a poisoning attack.

    “In summary, both alternating minimization and constrained regularization increase the stealth of a poisoning attack.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Time constraint greatly limits the amount of exploration possible in both the proposed attack mechanisms and further adaptive attacks.

    “Time constraint greatly limits the amount of exploration that is possible in both the proposed attack mechanisms and further adaptive attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Redundant neurons are important for poisoning attack while having less correlation to the main task of federated learning.

    “It should be noted that those redundant neurons are important for poisoning attack, while they have less correlation to the main task of federated learning.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Alternating minimization makes it easy for the adversary to extract the malicious model update Δp, meaning only a small part of weights needs to be boosted.

    “Besides, alternating minimization makes it easy for the adversary to extract malicious model update ∆ p , which means that we only need to boost a small part of weights.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Secure federated learning [45] is popular among the community due to concerns about information leakage.

    “With the concern of information leakage, secure federated learning [45] is popular among the community.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.

    “The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [17] Yin, D., Chen, Y., Kannan, R., and Bartlett, P. (2018, January 10–15). Byzantine-robust distributed learning: Towards optimal statistical rates. Proceedings of the 35th International Conference on Machine Learning, Stockholm, Sweden.

      Not checked in the free run.

    • cites [44] Cao, X., Fang, M., Liu, J., and Gong, N.Z. (2020). FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. arXiv. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Those new secure federated learning techniques use the cryptography paradigm to encrypt model updates.

    “Those new techniques use the cryptography paradigm to encrypt model updates.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source

      Not checked in the free run.

22 of 22

  • The authors state this as an assumption.

    The attacker cannot control the aggregation algorithm nor has knowledge of benign participants' local training.

    “The attacker cannot control the aggregation algorithm, which is used to combine participants' model updates into the shared global model, nor does it have any knowledge of the benign participants' local training.”

  • The authors state this as an assumption.

    The malicious client is non-colluding and has no partner to exchange information.

    “We assume a non-colluding malicious client, where the adversary has no partner to exchange any information.”

  • The paper relies on this without support.

    Catastrophic forgetting is an inevitable feature of neural network models when trained sequentially on multiple tasks.

    “catastrophic forgetting is an inevitable feature of neural network models, specifically when the network is trained sequentially on multiple tasks.”

  • The authors state this as an assumption.

    The attacker can directly influence the weights of the joint model and train in any way that benefits the attack.

    “as defined in standard federated learning framework, the attacker can directly influence the weights of the joint model and train in any way that benefits the attack (e.g., adopting alternating minimization training strategy, introducing adversarial task).”

  • The authors state this as an assumption.

    The malicious client is selected by the central server each round.

    “In this experiment, the malicious client is assumed to be selected each round”
    “We make the assumption that the malicious client is selected by central server each round in order to evaluate the effectiveness and persistence of attack.”

  • The paper relies on this without support.

    Only a small fraction of the clients' updates will be selected each round.

    “Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”

  • The paper relies on this without support.

    The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.

    “The main idea behind the Byzantine-robust defense method is to detect abnormal weight updates and reject those models.”

  • The paper relies on this without support.

    Adversarial techniques (e.g., backdoor, adversarial example) try to infer the model by creating a misleading minima.

    “The adversarial techniques (e.g., backdoor, adversarial example) try to inference the model by creating a misleading minima.”
8 of 8

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The optimization-based model poisoning attack method can resist catastrophic forgetting in neural networks.

    “Moreover, this method can resist catastrophic forgetting in neural networks.”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]

  • The biggest problem with the optimization-based model poisoning attack approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.

    “However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]

  • Model poisoning attacks tend to be more effective in practice than data poisoning attacks because they can directly modify local model parameters.

    “However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]

  • Xingchen et al. proposed an optimization-based model poisoning attack method that injects malicious neurons into the neural network's redundant space using the objective function's regularization term.

    “Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]

  • Alternating minimization is a widely used stealth strategy for poisoning attacks.

    “A widely used strategy is alternating minimization [28], [33].”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Byzantine-robust methods citation points to a ResNet paper

    Minor

    The discussion cites [44] as a Byzantine-robust federated learning method, but reference [44] is "Deep residual learning for image recognition."

  • ResNet citation points to a stereo-matching paper

    Minor

    The experiment setup cites [43] for ResNet, but [43] is a paper on stereo matching. The reference list instead gives the deep residual learning paper as [44].

  • LetNet citation points to a continual-learning paper

    Minor

    The experiment setup cites reference [42] for LetNet, but [42] is titled "Continual Learning Through Synaptic Intelligence."

  • Continual-learning citation points to a Byzantine-learning paper

    Minor

    Reference [35] is included among examples of continual-learning studies, but its listed title concerns a vulnerability of distributed learning in Byzantium.

  • Equation (2) is assigned to the wrong task

    Minor

    The model-update procedure calls Equation (2) the adversarial-task objective, but the paper identifies its loss as belonging to the main task; Equation (3) is presented as the adversarial-task objective.

  • Funding statement conflicts with acknowledged grants

    Minor

    The acknowledgments say the work was supported by two grants and a provincial project, while the funding section says the research received no external funding.

6 of 6

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S. (2018, January 3–8). Model poisoning attacks in federated learning. Proceedings of the Workshop on Security in Machine Learning (SecML), Collocated with the 32nd Conference on Neural Information Processing Systems (NeurIPS’18), Montréal, QC, Canada.

Cited by

Sorted by citations

Related

Authors
Zhou, X., Xu, M., Wu, Y., & Zheng, N.
Affiliations
Hangzhou Dianzi University (CN)
Corresponding author
Xu, Ming
ORCID
Venue
Future Internet
Publisher
MDPI AG
Published
2021-03-14
Volume
13
Issue
3
Pages
73
ISSN
1999-5903 (ISSN-L)
DOI
10.3390/fi13030073
OpenAlex
W3136620885
Semantic Scholar
1bdb7429302500aa559c4e1653543802365abc47
Cited by
170
References
43
Citations by year
2026: 18 · 2025: 38 · 2024: 51 · 2023: 40 · 2022: 15 · 2021: 8
FWCI
10.08
Type
journal article
Language
en
Open access
Licence
Locations
  • Future Internet (publishedVersion, cc-by)
  • RePEc: Research Papers in Economics (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
Natural Science Foundation of China; Key Research and Development Plan Project of Zhejiang Province (61803135, 61702150; 2017C01065)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
federated learning, model poisoning, deep learning, attack stealth, attack success rate, defense evasion, data confidentiality

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review