The DOI matches its Crossref record; 51 of the 51 references it cites were found in a registry or an index; none of the 23 sources its claims cite is checked for support yet.
Deep Model Poisoning Attack on Federated Learning
Open accessAbstract
Federated learning is a novel distributed learning framework, which enables thousands of participants to collaboratively construct a deep learning model. In order to protect confidentiality of the training data, the shared information between server and participants are only limited to model parameters. However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters. In this paper, we perform systematic investigation for such threats in federated learning and propose a novel optimization-based model poisoning attack. Different from existing methods, we primarily focus on the effectiveness, persistence and stealth of attacks. Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
The paper proposes an optimization-based model poisoning attack for federated learning that injects poisoning neurons into redundant network space and uses alternating minimization with regularization to improve effectiveness, persistence, and stealth. Experiments on MNIST and CIFAR-10 show high attack success rates and bypass of Krum and norm-bounded defenses.
Key findings
- The proposed attack achieves over 90% attack success rate on CIFAR-10 in the multiple-shot scenario, higher than the backdoor attack in [4]; it also achieves over 90% attack success rate on MNIST against the norm-bounded defense.
- In the single-shot scenario, the attack success rate of [4] drops dramatically, while the proposed attack falls slowly and retains higher main-task accuracy, indicating mitigation of catastrophic forgetting.
- The attack bypasses two defenses: Krum [16] and the norm-bounded defense [22]; Krum rejects the model update in some rounds, but the adversary still maintains high adversarial-task accuracy when not selected.
- Weight update distributions show malicious clients’ layer0, layer1, and layer3 differ from benign clients’, while layer2 is similar; the all-layer distribution is similar because layer2 has the most neurons.
Methods
- Threat model: a single non-colluding malicious client in federated learning can directly modify local model updates but cannot control aggregation or know benign participants’ local training; the goal is targeted misclassification while preserving test accuracy.
- Attack design: alternating minimization of a main task (clean data plus regularization to make malicious updates similar to benign updates) and an adversarial task (poisoning data plus Hessian-based structural regularization to avoid neurons important to the main task), then boosting the malicious update by factor n/η.
- Experiments: MNIST and CIFAR-10 with non-I.I.D. distributions, 10,000 test images, LetNet and ResNet, |S_t|/N of 10/20 and 10/50, internal epochs 5 and 10, |D_p| = 100; comparisons against backdoor attack [4] and model poisoning [8], and defenses [16,22].
Limitations
- Stated: time constraints greatly limit exploration; the malicious client must compute the Hessian matrix, which is non-trivial and time consuming, and a possible defense is to drop clients that cannot reply on time.
- Stated: future work is needed to explore additional attacks and efficient mechanisms (e.g., meta-learning) for finding neurons to inject adversarial tasks.
- Evident: evaluation is limited to MNIST and CIFAR-10 with specific architectures and parameters; effectiveness and persistence experiments assume the malicious client is selected each round; no real-world deployment or broader dataset evaluation is reported.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
30 Own interpretation · 19 Not checked yet · 5 Own result · 3 No basis given
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The accuracy of main task increases when we set hyperparameter ρ 2 = 0, as shown in Figure 4.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Figure 5 illustrates that the proposed deep model poisoning attack has the capability to retain a high attack success rate over a long period of aggregation.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
None of the sources cited for this claim have been checked yet.
In the paper
“Furthermore, the deep model poisoning attack has better performance than other competing approaches [4,8].”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
- Not checked yetcites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“When it comes to the CIFAR-10, one can conclude from Figure 6b that the attack success rate for proposed is higher than that of [4]'s attack.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Even though the attack method proposed in [8] is claimed to be stealthy when D p = 1, it is vulnerable when the malicious client uses a large poisoning dataset (e.g., D p = 100 in our experiment).”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Nevertheless, when the poisoning model is not selected by Krum, the adversary can still maintain high accuracy for adversarial task.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Extensive evaluation results empirically demonstrated that our proposed attack strategy outperformed the backdoor attacks by significantly improving performance in effectiveness, persistence, and robustness.”
§ Deep Model Poisoning Attack on Federated Learning > 5. Conclusions
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“and, (2) retains a higher accuracy for the main task on the testing dataset.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 14
- Probably not a substantial claim. 9
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The malicious clients' layer0, layer1, and layer3 are different from benign clients', and only layer2 is similar to benign clients', as reported in Figure 7a-d.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“The proposed attack algorithm outperforms [4]' attack in two aspects: (1) the attack success rate falls down slowly, which means that the proposed attack is effective in mitigating catastrophic forgetting of adversarial task;”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Even for the large dataset like CIFAR-10, the proposed model poisoning attack can achieve over 90% attack success rate for adversarial task, which is higher than that of [4].”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Because Krum is effective in detecting aberrant models, the model update of proposed method is rejected in some rounds.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our proposed deep model poisoning attack can bypass norm bounded defense method and achieves over 90% attack success rate for MNIST, as reported in Figure 6a.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“While our preliminary results show some promise of mitigation, much more work is clearly needed to explore additional attacks.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The malicious client should compute the Hessian matrix during the preparation of an attack, which is non-trivial and time consuming.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The main reason behind this phenomenon is that the constraint regularization term in Equation (3) tends to update neurons not”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“In one variable function, since second derivative measures curvature of loss function, the second derivative can find the optimization direction of stochastic gradient descent (SGD).”
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
What the sources say
- Not checked yetcites [39] Williams, 1992, A fast algorithm for active contours and curvature estimation, CVGIP Image Underst. source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”
§ Deep Model Poisoning Attack on Federated Learning > 5. Conclusions
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
- Rests on an assumption: Only a small fraction of the clients' updates will be selected each round.
In the paper
“However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters.”
- Also stated in: § 1. Introduction · hedged
“Because the clients can fully control their private data and arbitrarily modify their local model, the malicious clients may leverage adversarial algorithm to perform targeted attack (e.g., backdoor attack [4][5][6], model poisoning attack [7][8][9] and data poisoning attack [10,11]), or untargeted attack (e.g., Byzantine failures [9,12]) and untargeted attack [13][14][15].”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
What the sources say
- Not checked yetcites [7][8][9]
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § 1. Introduction · hedged
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because the proposed attack method is persistent enough to keep its attack effect (See Figure 5), the attacker can still maintain a high attack success rate, even though it is detected by Byzantine-robust central server.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Rests on an assumption: The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.
In the paper
“While, the authors of [22] proposed a norm bounded defense method, which clips model updates using a threshold M:”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [22] Sun, Z., Kairouz, P., Suresh, A.T., and McMahan, H.B. (2019). Can You Really Backdoor Federated Learning?. arXiv.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The authors of [16] proposed the robust aggregation rule referred to as Krum.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because the proposed attack methods do not rely on other clients' model updates, our method still effective in this scenario.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In summary, both alternating minimization and constrained regularization increase the stealth of a poisoning attack.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Time constraint greatly limits the amount of exploration that is possible in both the proposed attack mechanisms and further adaptive attacks.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“It should be noted that those redundant neurons are important for poisoning attack, while they have less correlation to the main task of federated learning.”
§ Deep Model Poisoning Attack on Federated Learning > 1. Introduction
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Besides, alternating minimization makes it easy for the adversary to extract malicious model update ∆ p , which means that we only need to boost a small part of weights.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
In the paper
“With the concern of information leakage, secure federated learning [45] is popular among the community.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [17] Yin, D., Chen, Y., Kannan, R., and Bartlett, P. (2018, January 10–15). Byzantine-robust distributed learning: Towards optimal statistical rates. Proceedings of the 35th International Conference on Machine Learning, Stockholm, Sweden.
- Not checked yetcites [44] Cao, X., Fang, M., Liu, J., and Gong, N.Z. (2020). FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. arXiv. source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Those new techniques use the cryptography paradigm to encrypt model updates.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The authors state this as an assumption.
The attacker cannot control the aggregation algorithm nor has knowledge of benign participants' local training.
“The attacker cannot control the aggregation algorithm, which is used to combine participants' model updates into the shared global model, nor does it have any knowledge of the benign participants' local training.”
The authors state this as an assumption.
The malicious client is non-colluding and has no partner to exchange information.
“We assume a non-colluding malicious client, where the adversary has no partner to exchange any information.”
The paper relies on this without support.
Catastrophic forgetting is an inevitable feature of neural network models when trained sequentially on multiple tasks.
“catastrophic forgetting is an inevitable feature of neural network models, specifically when the network is trained sequentially on multiple tasks.”
The authors state this as an assumption.
The attacker can directly influence the weights of the joint model and train in any way that benefits the attack.
“as defined in standard federated learning framework, the attacker can directly influence the weights of the joint model and train in any way that benefits the attack (e.g., adopting alternating minimization training strategy, introducing adversarial task).”
The authors state this as an assumption.
The malicious client is selected by the central server each round.
“In this experiment, the malicious client is assumed to be selected each round”
“We make the assumption that the malicious client is selected by central server each round in order to evaluate the effectiveness and persistence of attack.”
The paper relies on this without support.
Only a small fraction of the clients' updates will be selected each round.
“Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”
The paper relies on this without support.
The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.
“The main idea behind the Byzantine-robust defense method is to detect abnormal weight updates and reject those models.”
The paper relies on this without support.
Adversarial techniques (e.g., backdoor, adversarial example) try to infer the model by creating a misleading minima.
“The adversarial techniques (e.g., backdoor, adversarial example) try to inference the model by creating a misleading minima.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“A widely used strategy is alternating minimization [28], [33].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“The alternating minimization approach decouples the poisoning attack target from the stealthiness target.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
“The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”
§ Deep Model Poisoning Attack on Federated Learning > References
“44. He, K.; Zhang, X.; Ren, S.; Sun, J. Deep residual learning for image recognition.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.1. Dataset and Experiment Setup
“For network architecture, we choose LetNet [42] and ResNet [43] for MNIST and CIFAR-10, respectively.”
§ Deep Model Poisoning Attack on Federated Learning > References
“43. Zbontar, J.; LeCun, Y. Stereo matching by training a convolutional neural network to compare image patches.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.1. Dataset and Experiment Setup
“For network architecture, we choose LetNet [42] and ResNet [43] for MNIST and CIFAR-10, respectively.”
§ Deep Model Poisoning Attack on Federated Learning > References
“42. Zenke, F.; Poole, B.; Ganguli, S. Continual Learning Through Synaptic Intelligence.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“This phenomenon is investigated in some previous continual learning studies (e.g., [35][36][37][38]), and it can be used in our adversarial training.”
§ Deep Model Poisoning Attack on Federated Learning > References
“35. Mhamdi, E.M.E.; Guerraoui, R.; Rouault, S. The Hidden Vulnerability of Distributed Learning in Byzantium.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“For each step i, the adversarial task's objective function is first minimized starting from Θ (when i = 1, Θ = G t ) using Equation ( 2), and then minimized with Equation (3).”
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“where ρ 1 is a hyperparameter, L M means Cross-entropy loss for main task, and ∆ t ben denotes benign clients' averaged model updates.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > Acknowledgements
“This work was supported in part by the Natural Science Foundation of China under Grant 61803135 and Grant 61702150, and in part by the Key Research and Development Plan Project of Zhejiang Province under Grant 2017C01065.”
§ Deep Model Poisoning Attack on Federated Learning > Funding
“Funding: This research received no external funding.”
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Overcoming catastrophic forgetting in neural networks
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., et al. (2017) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.1611835114 · Cited by 7,899
Advances and Open Problems in Federated Learning
Kairouz, P., McMahan, H. B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A. N., Bonawitz, K., Charles, Z., Cormode, G., Cummings, R., et al. (2019) · arXiv · doi:10.48550/arxiv.1912.04977 · Cited by 7,857
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210
Federated Learning: Strategies for Improving Communication Efficiency
Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016) · arXiv · doi:10.48550/arxiv.1610.05492 · Cited by 3,766
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Continual Learning Through Synaptic Intelligence
Zenke, F., Poole, B., & Ganguli, S. (2017) · arXiv · doi:10.48550/arxiv.1703.04200 · Cited by 1,784
Research works printed but not linked: 1
- Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S. (2018, January 3–8). Model poisoning attacks in federated learning. Proceedings of the Workshop on Security in Machine Learning (SecML), Collocated with the 32nd Conference on Neural Information Processing Systems (NeurIPS’18), Montréal, QC, Canada.
Cited by
Sorted by citations
Federated Learning in Edge Computing: A Systematic Survey
Abreha, H. G., Hayajneh, M., & Serhani, M. A. (2022) · Sensors · doi:10.3390/s22020450 · Cited by 384
The Emerging Threat of Ai-driven Cyber Attacks: A Review
Guembe, B., Azeta, A., Misra, S., Osamor, V. C., Fernandez-Sanz, L., & Pospelova, V. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2037254 · Cited by 267
Federated learning: Overview, strategies, applications, tools and future directions
Yürdem, B., Kuzlu, M., Güllü, M. K., Çatak, F. Ö., & Tabassum, M. (2024) · Heliyon · doi:10.1016/j.heliyon.2024.e38137 · Cited by 342
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212
Ferrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
Nguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130
Lal, S., Rehman, S. U., Shah, J. H., Meraj, T., Rauf, H. T., Damaševičius, R., Mohammed, M. A., & Abdulkareem, K. H. (2021) · Sensors · doi:10.3390/s21113922 · Cited by 134
A Survey on Securing Federated Learning: Analysis of Applications, Attacks, Challenges, and Trends
Neto, H. N. C., Hribar, J., Dusparić, I., Mattos, D. M. F., & Fernandes, N. C. (2023) · IEEE Access · doi:10.1109/access.2023.3269980 · Cited by 114
Security of federated learning with IoT systems: Issues, limitations, challenges, and solutions
Yaacoub, J.-P. A., Noura, H., & Salman, O. (2023) · Internet of Things and Cyber-Physical Systems · doi:10.1016/j.iotcps.2023.04.001 · Cited by 106
CBRFL: A framework for Committee-based Byzantine-Resilient Federated Learning
Xu, G., Lei, L., Mao, Y., Li, Z., Chen, X., & Zhang, K. (2025) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2025.104165 · Cited by 86
3DFed: Adaptive and Extensible Framework for Covert Backdoor Attack in Federated Learning
Li, H., Ye, Q., Hu, H., Li, J., Wang, L., Fang, C., & Shi, J. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179401 · Cited by 84
A robust analysis of adversarial attacks on federated learning environments
Nair, A. K., Raj, E. D., & Sahoo, J. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103723 · Cited by 70
Anomaly detection and defense techniques in federated learning: a comprehensive review
Zhang, C., Yang, S., Mao, L., & Ning, H. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10796-1 · Cited by 73
A survey of security threats in federated learning
Feng, Y., Guo, Y., Hou, Y., Wu, Y., Lao, M., Yu, T., & Liu, G. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-024-01664-0 · Cited by 70
Self-citationBlika, A., Palmos, S., Doukas, G. S., Lamprou, V., Pelekis, S., Kontoulis, M., Ntanos, C., & Askounis, D. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3449563 · Cited by 82
Badjie, B., Cecílio, J., & Casimiro, A. (2024) · ACM Computing Surveys · doi:10.1145/3691625 · Cited by 73
A Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy
Manzoor, H. U., Shabbir, A., Chen, A., Flynn, D., & Zoha, A. (2024) · Future Internet · doi:10.3390/fi16100374 · Cited by 58
Federated learning attack surface: taxonomy, cyber defences, challenges, and future directions
Qammar, A., Ding, J., & Ning, H. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10098-w · Cited by 58
A comprehensive review of federated learning for COVID‐19 detection
Naz, S., Phan, K. T., & Chen, Y. P. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22777 · Cited by 59
Dynamic defense against byzantine poisoning attacks in federated learning
Rodríguez-Barroso, N., Martínez‐Cámara, E., Luzón, M. V., & Herrera, F. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.03.003 · Cited by 71
Nawshin, F., Gad, R., Ünal, D., Al-Ali, A. K., & Suganthan, P. N. (2024) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2024.109233 · Cited by 56
Privacy-Enhancing Technologies in Federated Learning for the Internet of Healthcare Things: A Survey
Mosaiyebzadeh, F., Pouriyeh, S., Parizi, R. M., Sheng, Q. Z., Han, M., Zhao, L., Sannino, G., Ranieri, C. M., Ueyama, J., & Batista, D. M. (2023) · Electronics · doi:10.3390/electronics12122703 · Cited by 51
Zhang, P., Hong, Y., Kumar, N., Alazab, M., Alshehri, M. D., & Jiang, C. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3116037 · Cited by 46
Two-phase Defense Against Poisoning Attacks on Federated Learning-based Intrusion Detection
Lai, Y., Lin, J.-Y., Lin, Y., Hwang, R., Lin, P.-C., Wu, H.-K., & Chen, C.-K. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103205 · Cited by 53
Shi, H. H., Fang, L., Chen, X., Gu, C., Ma, K., Zhang, X., Zhang, Z., Gu, J., & Lim, E. G. (2024) · IET Smart Grid · doi:10.1049/stg2.12191 · Cited by 52
DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning
Hossain, M. T., Islam, S., Badsha, S., & Shen, H. (2021) · 2021 17th International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn53354.2021.00038 · Cited by 44
Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Survey
Wang, Z., Kang, Q., Zhang, X., & Hu, Q. (2022) · 2022 IEEE Wireless Communications and Networking Conference (WCNC) · doi:10.1109/wcnc51071.2022.9771619 · Cited by 41
A review on client-server attacks and defenses in federated learning
Sharma, A., & Marchang, N. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103801 · Cited by 46
Rodríguez-Barroso, N., Martínez-Cámara, E., Luzón, M. V., & Herrera, F. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.108588 · Cited by 38
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38
Gupta, K., Saxena, D., Gupta, R., Kumar, J., & Singh, A. K. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.111519 · Cited by 35
Majeed, A., Zhang, X., & Hwang, S. O. (2022) · Big Data and Cognitive Computing · doi:10.3390/bdcc6040127 · Cited by 37
AI-Driven Solutions for Social Engineering Attacks: Detection, Prevention, and Response
Fakhouri, H. N., Alhadidi, B., Omar, K., Makhadmeh, S. N., Hamad, F. F., & Halalsheh, N. Z. (2024) · International Conference on Cyber Resilience (ICCR) · doi:10.1109/iccr61006.2024.10533010 · Cited by 29
Gupta, M., Kumar, M., & Dhir, R. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100685 · Cited by 27
Suppressing Poisoning Attacks on Federated Learning for Medical Imaging
Alkhunaizi, N., Kamzolov, D., Takáč, M., & Nandakumar, K. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-16452-1_64 · Cited by 25
Impact of Aggregation Function Randomization against Model Poisoning in Federated Learning
Nabavirazavi, S., Taheri, R., Shojafar, M., & Iyengar, S. S. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00043 · Cited by 25
NSPFL: A Novel Secure and Privacy-Preserving Federated Learning With Data Integrity Auditing
Zhang, Z., & Li, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3379852 · Cited by 22
Zhang, H., Yao, Z., Zhang, L. Y., Hu, S., Chen, C., Liew, A. W., & Li, Z. (2023) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2023/508 · Cited by 26
Mun, H., Han, K., Yeun, H. K., Damiani, E., Puthal, D., Kim, T., & Yeun, C. Y. (2024) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3456852 · Cited by 21
Almutairi, S., & Barnawi, A. (2024) · Results in Engineering · doi:10.1016/j.rineng.2024.103295 · Cited by 21
Defending against model poisoning attack in federated learning: A variance-minimization approach
Xu, H., & Shu, T. (2024) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2024.103744 · Cited by 20
Zhao, X., Bai, X., Sun, G., & Yan, Z. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3531117 · Cited by 17
Attacking-Distance-Aware Attack: Semi-targeted Model Poisoning on Federated Learning
Sun, Y., Ochiai, H., & Sakuma, J. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3280155 · Cited by 19
Manzoor, H. U., Khan, A. R., Sher, T., Ahmad, W., & Zoha, A. (2023) · IEEE International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC) · doi:10.1109/pimrc56721.2023.10293950 · Cited by 16
FedCSD: A Federated Learning Based Approach for Code-Smell Detection
Alawadi, S., Alkharabsheh, K., Alkhabbas, F., Kebande, V. R., Awaysheh, F. M., Palomba, F., & Awad, M. (2024) · IEEE Access · doi:10.1109/access.2024.3380167 · Cited by 17
Marulli, F., Balzanella, A., Campanile, L., Iacono, M., & Mastroianni, M. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534377 · Cited by 16
Hardware Security in the Connected World
Chatterjee, D., Maitra, S., Mishra, N., Shukla, S., & Mukhopadhyay, D. (2025) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.70034 · Cited by 15
A security-friendly privacy-preserving solution for federated learning
Karakoç, F., Karaçay, L., Çomak, P., Gülen, U., Fuladi, R., & Soykan, E. Ü. (2023) · Computer Communications · doi:10.1016/j.comcom.2023.05.004 · Cited by 17
Vertical Federated Unlearning on the Logistic Regression Model
Deng, Z., Han, Z., Ma, C., Ding, M., Yuan, L., Ge, C., & Liu, Z. (2023) · Electronics · doi:10.3390/electronics12143182 · Cited by 15
Liberti, F., Berardi, D., & Martini, B. (2024) · Applied Sciences · doi:10.3390/app14188490 · Cited by 15
Privacy Issues, Attacks, Countermeasures and Open Problems in Federated Learning: A Survey
Guembe, B., Misra, S., & Azeta, A. A. (2024) · Applied Artificial Intelligence · doi:10.1080/08839514.2024.2410504 · Cited by 21
Zhang, F., Huang, H., Chen, Z., & Huang, Z. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110383 · Cited by 15
Dual-domain based backdoor attack against federated learning
Li, G., Chang, R., Wang, Y., & Wang, C. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.129424 · Cited by 13
Non trust detection of decentralized federated learning based on historical gradient
Chen, Y., Li, L., & Gao, W. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.105888 · Cited by 13
Vertical Federated Unlearning via Backdoor Certification
Han, M., Zhu, T., Zhang, L., Huo, H., & Zhou, W. (2025) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2025.3536312 · Cited by 12
Surveying federated learning approaches through a multi-criteria categorization
Caruccio, L., Cimino, G., Deufemia, V., Iuliano, G., & Stanzione, R. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16050-0 · Cited by 11
Privacy preserving federated learning with convolutional variational bottlenecks
Scheliga, D., Mäder, P., & Seeland, M. (2025) · Cybersecurity · doi:10.1186/s42400-024-00295-9 · Cited by 14
An Ontological Knowledge Base of Poisoning Attacks on Deep Neural Networks
Altoub, M., Alqurashi, F. A., Yiğitcanlar, T., Corchado, J. M., & Mehmood, R. (2022) · Applied Sciences · doi:10.3390/app122111053 · Cited by 13
A Survey of Security Protection Methods for Deep Learning Model
Peng, H., Bao, S., & Li, L. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3314398 · Cited by 11
Blockchain federated learning with sparsity for IoMT devices
Ba, A. F., Yingchi, M., Muhammad, A. U., Samuel, O., Muazu, T., & Kumshe, U. M. M. (2024) · Cluster Computing · doi:10.1007/s10586-024-04810-y · Cited by 11
DPAD: Data Poisoning Attack Defense Mechanism for federated learning-based system
Basak, S., & Chatterjee, K. (2024) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2024.109893 · Cited by 16
Ieropoulos, V., Anthi, E., Spyridopoulos, T., Burnap, P., Mavromatis, I., Khan, A., & Carnelli, P. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104127 · Cited by 11
Research of Federated Learning Application Methods and Social Responsibility
Yang, S., Zheng, W., Xie, M., & Zhang, X. (2022) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2022.3225688 · Cited by 10
Federated learning secure model: A framework for malicious clients detection
Kolasa, D., Pilch, K., & Mazurczyk, W. (2024) · SoftwareX · doi:10.1016/j.softx.2024.101765 · Cited by 12
Wang, X., Zhang, H., Bilal, A., Long, H., & Liu, X. (2023) · Electronics · doi:10.3390/electronics12051190 · Cited by 9
RecAD: Towards A Unified Library for Recommender Attack and Defense
Wang, C., Ye, J., Wang, W., Gao, C., Feng, F., & He, X. (2023) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3604915.3609490 · Cited by 9
Hassan, S. M. U. H. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4652028 · Cited by 9
Exploring Adversarial Graph Autoencoders to Manipulate Federated Learning in The Internet of Things
Li, K., Yuan, X., Zheng, J., Ni, W., & Guizani, M. (2023) · 2023 International Wireless Communications and Mobile Computing (IWCMC) · doi:10.1109/iwcmc58020.2023.10183217 · Cited by 8
Nguyen, T., Nguyen, A. D., Nguyen, T.-H., Wong, K., Pham, H., Nguyen, T. T., & Nguyen, P. L. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191655 · Cited by 10
Alnajar, O., & Barnawi, A. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109712 · Cited by 8
Using Anomaly Detection to Detect Poisoning Attacks in Federated Learning ApplicationsPreprint
Raza, A., Tran, K. P., Koehl, L., Li, S., & Tran, K. D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4811423 · Cited by 8
RoPe-Door: Toward Robust and Persistent Backdoor Data Poisoning Attacks in Federated Learning
Liu, Y., Chang, S., Li, D., Shi, S., & Li, B. (2024) · IEEE Network · doi:10.1109/mnet.2024.3486228 · Cited by 7
Kaushal, V., & Sharma, S. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02339-z · Cited by 9
Zhang, G., Liu, H., Yang, B. T., & Feng, S. (2024) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01794-9 · Cited by 7
Rezaie, H., Taheri, R., Nowroozi, E., Hajizadeh, M., Shiaeles, S. N., & Bauschert, T. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2025.3644477 · Cited by 11
Fair and Robust Federated Learning via Decentralized and Adaptive Aggregation based on Blockchain
Du, B., Wang, H., Yuxuan, L., Zhao, J., Ma, Y., & Huang, R. (2024) · ACM Transactions on Sensor Networks · doi:10.1145/3673656 · Cited by 6
Federated Learning-Based Asthma Prediction Model in Children
Ekpo, R. H., Osamor, V. C., & Azeta, A. A. (2024) · International Conference on Science, Engineering and Business for Driving Sustainable Development Goals (SEB4SDG) · doi:10.1109/seb4sdg60871.2024.10629888 · Cited by 6
Can We Trust the Similarity Measurement in Federated Learning?
Wang, Z., Hu, Q., Zou, X., Hu, P., & Cheng, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3516567 · Cited by 6
Security Issues and Solutions in Federate Learning Under IoT Critical Infrastructure
Jalali, N. A., & Chen, H. (2022) · Wireless Personal Communications · doi:10.1007/s11277-022-10107-3 · Cited by 6
SecurePrivChain: A decentralized framework for securing the global model using cryptography
Sanam, K., Malik, S. U. R., Kanwal, T., & Adil, Z. U. I. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2022.12.032 · Cited by 6
Bayesian Optimization-Driven Adversarial Poisoning Attacks Against Distributed Learning
Aristodemou, M., Liu, X., Lambotharan, S., & AsSadhan, B. (2023) · IEEE Access · doi:10.1109/access.2023.3304541 · Cited by 6
Saxena, D., Gupta, K., Gupta, R., Kumar, J., & Singh, A. K. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4500554 · Cited by 6
FLARE: A Backdoor Attack to Federated Learning with Refined Evasion
Wang, Q., Wu, Y., Xuan, H., & Wu, H. (2024) · Mathematics · doi:10.3390/math12233751 · Cited by 5
Self-citationUndermining Federated Learning Accuracy in EdgeIoT via Variational Graph Auto-Encoders
Li, K., Hu, S., Wu, B., Zou, S., Ni, W., & Dressler, F. (2025) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc65282.2025.11059509 · Cited by 5
A survey of adversarial attacks on machine learning
Yerlikaya, F. A., & Bahtıyar, Ş. (2026) · Neurocomputing · doi:10.1016/j.neucom.2025.132573 · Cited by 5
SoK: Systematizing Attack Studies in Federated Learning – From Sparseness to Completeness
Sharma, G., Chamikara, M. A. P., Chhetri, M. B., & Chen, Y. P. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3590328 · Cited by 6
TIMPANY—deTectIon of Model Poisoning Attacks usiNg accuracY
Sameen, M., & Hwang, S. O. (2021) · IEEE Access · doi:10.1109/access.2021.3118926 · Cited by 5
Abdulqadder, I. H., Aziz, I. T., & Zou, D. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110841 · Cited by 6
Mitigating Poisoning Attacks in Federated Learning
Ganjoo, R., Ganjoo, M., & Patil, M. (2022) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-981-16-7167-8_50 · Cited by 5
Privacy attack in federated learning is not easy: an experimental study
Zhu, H., Huang, L., & Xie, Z. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-025-02009-1 · Cited by 6
Joint Layer Selection and Differential Privacy Design for Federated Learning Over Wireless Networks
Ding, Y., Shang, W., Yang, Y., Ding, W., & Shikh‐Bahaei, M. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3452549 · Cited by 5
Label Flipping Attacks on Federated Learning: GAN-Based Poisoning and Countermeasures
Abdullah, M., Bapu, V., Akash, K. A., Khan, A. H., & Bhargavi, M. S. (2024) · International Conference on Data Science and Network Security (ICDSNS) · doi:10.1109/icdsns62112.2024.10690919 · Cited by 4
Zhang, W., Li, Y., An, L., Wan, B., & Wang, X. (2024) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3678571 · Cited by 6
Arı, İ., Balkan, K., Pirbhulal, S., & Abie, H. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825993 · Cited by 4
Almutairi, S., & Barnawi, A. (2025) · IEEE Access · doi:10.1109/access.2025.3584948 · Cited by 4
Maabreh, M., Darwish, O., Karajeh, O., & Tashtoush, Y. M. (2022) · International Arab Conference on Information Technology (ACIT) · doi:10.1109/acit57182.2022.9994126 · Cited by 4
SPoiL: Sybil-Based Untargeted Data Poisoning Attacks in Federated Learning
Lian, Z., Zhang, C., Nan, K., & Su, C. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-39828-5_13 · Cited by 4
Chain-AAFL: Chained Adversarial-Aware Federated Learning Framework
Ge, L., He, X., Wang, G., & Yu, J. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-87571-8_21 · Cited by 4
Backdoor Attack to Giant Model in Fragment-Sharing Federated Learning
Qi, S., Ma, H., Zou, Y., Yuan, Y., Xie, Z., Li, P., & Cheng, X. (2024) · Big Data Mining and Analytics · doi:10.26599/bdma.2024.9020035 · Cited by 3
Backdoor Federated Learning by Poisoning Key Parameters
Song, X., Li, H., Hu, K., & Zai, G. (2024) · Electronics · doi:10.3390/electronics14010129 · Cited by 3
Metadata
- Authors
- Zhou, X., Xu, M., Wu, Y., & Zheng, N.
- Affiliations
- Hangzhou Dianzi University (CN)
- Corresponding author
- Xu, Ming
- Venue
- Future Internet
- Publisher
- MDPI AG
- Published
- 2021-03-14
- Volume
- 13
- Issue
- 3
- Pages
- 73
- ISSN
- 1999-5903 (ISSN-L)
- OpenAlex
- W3136620885
- Semantic Scholar
- 1bdb7429302500aa559c4e1653543802365abc47
- Cited by
- 170
- References
- 43
- Citations by year
- 2026: 18 · 2025: 38 · 2024: 51 · 2023: 40 · 2022: 15 · 2021: 8
- FWCI
- 10.08
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Future Internet (publishedVersion, cc-by)
- RePEc: Research Papers in Economics (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Natural Science Foundation of China; Key Research and Development Plan Project of Zhejiang Province (61803135, 61702150; 2017C01065)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, model poisoning, deep learning, attack stealth, attack success rate, defense evasion, data confidentiality
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
