The DOI matches its Crossref record; 51 of the 51 references it cites were found in a registry or an index; none of the 23 sources its claims cite is checked for support yet.
Deep Model Poisoning Attack on Federated Learning
Open accessAbstract
Federated learning is a novel distributed learning framework, which enables thousands of participants to collaboratively construct a deep learning model. In order to protect confidentiality of the training data, the shared information between server and participants are only limited to model parameters. However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters. In this paper, we perform systematic investigation for such threats in federated learning and propose a novel optimization-based model poisoning attack. Different from existing methods, we primarily focus on the effectiveness, persistence and stealth of attacks. Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
The paper proposes an optimization-based model poisoning attack for federated learning that injects poisoning neurons into redundant network space and uses alternating minimization with regularization to improve effectiveness, persistence, and stealth. Experiments on MNIST and CIFAR-10 show high attack success rates and bypass of Krum and norm-bounded defenses.
Key findings
- The proposed attack achieves over 90% attack success rate on CIFAR-10 in the multiple-shot scenario, higher than the backdoor attack in [4]; it also achieves over 90% attack success rate on MNIST against the norm-bounded defense.
- In the single-shot scenario, the attack success rate of [4] drops dramatically, while the proposed attack falls slowly and retains higher main-task accuracy, indicating mitigation of catastrophic forgetting.
- The attack bypasses two defenses: Krum [16] and the norm-bounded defense [22]; Krum rejects the model update in some rounds, but the adversary still maintains high adversarial-task accuracy when not selected.
- Weight update distributions show malicious clients’ layer0, layer1, and layer3 differ from benign clients’, while layer2 is similar; the all-layer distribution is similar because layer2 has the most neurons.
Methods
- Threat model: a single non-colluding malicious client in federated learning can directly modify local model updates but cannot control aggregation or know benign participants’ local training; the goal is targeted misclassification while preserving test accuracy.
- Attack design: alternating minimization of a main task (clean data plus regularization to make malicious updates similar to benign updates) and an adversarial task (poisoning data plus Hessian-based structural regularization to avoid neurons important to the main task), then boosting the malicious update by factor n/η.
- Experiments: MNIST and CIFAR-10 with non-I.I.D. distributions, 10,000 test images, LetNet and ResNet, |S_t|/N of 10/20 and 10/50, internal epochs 5 and 10, |D_p| = 100; comparisons against backdoor attack [4] and model poisoning [8], and defenses [16,22].
Limitations
- Stated: time constraints greatly limit exploration; the malicious client must compute the Hessian matrix, which is non-trivial and time consuming, and a possible defense is to drop clients that cannot reply on time.
- Stated: future work is needed to explore additional attacks and efficient mechanisms (e.g., meta-learning) for finding neurons to inject adversarial tasks.
- Evident: evaluation is limited to MNIST and CIFAR-10 with specific architectures and parameters; effectiveness and persistence experiments assume the malicious client is selected each round; no real-world deployment or broader dataset evaluation is reported.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
30 Own interpretation · 19 Not checked yet · 5 Own result · 3 No basis given
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The accuracy of main task increases when we set hyperparameter ρ 2 = 0, as shown in Figure 4.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Figure 5 illustrates that the proposed deep model poisoning attack has the capability to retain a high attack success rate over a long period of aggregation.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
None of the sources cited for this claim have been checked yet.
In the paper
“Furthermore, the deep model poisoning attack has better performance than other competing approaches [4,8].”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
- Not checked yetcites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“When it comes to the CIFAR-10, one can conclude from Figure 6b that the attack success rate for proposed is higher than that of [4]'s attack.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Even though the attack method proposed in [8] is claimed to be stealthy when D p = 1, it is vulnerable when the malicious client uses a large poisoning dataset (e.g., D p = 100 in our experiment).”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [8] Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9–15). Analyzing Federated Learning through an Adversarial Lens. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Nevertheless, when the poisoning model is not selected by Krum, the adversary can still maintain high accuracy for adversarial task.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Extensive evaluation results empirically demonstrated that our proposed attack strategy outperformed the backdoor attacks by significantly improving performance in effectiveness, persistence, and robustness.”
§ Deep Model Poisoning Attack on Federated Learning > 5. Conclusions
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“and, (2) retains a higher accuracy for the main task on the testing dataset.”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Numerical experiments demonstrate that the proposed method can not only achieve high attack success rate, but it is also stealthy enough to bypass two existing defense methods.”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- It may state two separate claims as one. 14
- Probably not a substantial claim. 9
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The malicious clients' layer0, layer1, and layer3 are different from benign clients', and only layer2 is similar to benign clients', as reported in Figure 7a-d.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“The proposed attack algorithm outperforms [4]' attack in two aspects: (1) the attack success rate falls down slowly, which means that the proposed attack is effective in mitigating catastrophic forgetting of adversarial task;”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Even for the large dataset like CIFAR-10, the proposed model poisoning attack can achieve over 90% attack success rate for adversarial task, which is higher than that of [4].”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
What the sources say
- Not checked yetcites [4] Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26–28). How To Backdoor Federated Learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, Palermo, Italy.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
In the paper
“Because Krum is effective in detecting aberrant models, the model update of proposed method is rejected in some rounds.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our proposed deep model poisoning attack can bypass norm bounded defense method and achieves over 90% attack success rate for MNIST, as reported in Figure 6a.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: The malicious client is selected by the central server each round.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“While our preliminary results show some promise of mitigation, much more work is clearly needed to explore additional attacks.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The malicious client should compute the Hessian matrix during the preparation of an attack, which is non-trivial and time consuming.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The main reason behind this phenomenon is that the constraint regularization term in Equation (3) tends to update neurons not”
§ Deep Model Poisoning Attack on Federated Learning > 4.2. Effectiveness and Persistence of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“In one variable function, since second derivative measures curvature of loss function, the second derivative can find the optimization direction of stochastic gradient descent (SGD).”
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
What the sources say
- Not checked yetcites [39] Williams, 1992, A fast algorithm for active contours and curvature estimation, CVGIP Image Underst. source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”
§ Deep Model Poisoning Attack on Federated Learning > 5. Conclusions
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
- Rests on an assumption: Only a small fraction of the clients' updates will be selected each round.
In the paper
“However, this setting is vulnerable to model poisoning attack, since the participants have permission to modify the model parameters.”
- Also stated in: § 1. Introduction · hedged
“Because the clients can fully control their private data and arbitrarily modify their local model, the malicious clients may leverage adversarial algorithm to perform targeted attack (e.g., backdoor attack [4][5][6], model poisoning attack [7][8][9] and data poisoning attack [10,11]), or untargeted attack (e.g., Byzantine failures [9,12]) and untargeted attack [13][14][15].”
§ Deep Model Poisoning Attack on Federated Learning > Abstract
What the sources say
- Not checked yetcites [7][8][9]
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Also stated in: § 1. Introduction · hedged
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because the proposed attack method is persistent enough to keep its attack effect (See Figure 5), the attacker can still maintain a high attack success rate, even though it is detected by Byzantine-robust central server.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Rests on an assumption: The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.
In the paper
“While, the authors of [22] proposed a norm bounded defense method, which clips model updates using a threshold M:”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [22] Sun, Z., Kairouz, P., Suresh, A.T., and McMahan, H.B. (2019). Can You Really Backdoor Federated Learning?. arXiv.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“The authors of [16] proposed the robust aggregation rule referred to as Krum.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
What the sources say
- Not checked yetcites [16] Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., and Stainer, J. (2017, January 4–9). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because the proposed attack methods do not rely on other clients' model updates, our method still effective in this scenario.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In summary, both alternating minimization and constrained regularization increase the stealth of a poisoning attack.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Time constraint greatly limits the amount of exploration that is possible in both the proposed attack mechanisms and further adaptive attacks.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“It should be noted that those redundant neurons are important for poisoning attack, while they have less correlation to the main task of federated learning.”
§ Deep Model Poisoning Attack on Federated Learning > 1. Introduction
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Besides, alternating minimization makes it easy for the adversary to extract malicious model update ∆ p , which means that we only need to boost a small part of weights.”
§ Deep Model Poisoning Attack on Federated Learning > 4.3. Stealth of Attack
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
In the paper
“With the concern of information leakage, secure federated learning [45] is popular among the community.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [17] Yin, D., Chen, Y., Kannan, R., and Bartlett, P. (2018, January 10–15). Byzantine-robust distributed learning: Towards optimal statistical rates. Proceedings of the 35th International Conference on Machine Learning, Stockholm, Sweden.
- Not checked yetcites [44] Cao, X., Fang, M., Liu, J., and Gong, N.Z. (2020). FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. arXiv. source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Those new techniques use the cryptography paradigm to encrypt model updates.”
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
What the sources say
- Not checked yetcites [45] Cao, X., Jia, J., and Gong, N.Z. (2021). Provably Secure Federated Learning against Malicious Clients. arXiv. source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The authors state this as an assumption.
The attacker cannot control the aggregation algorithm nor has knowledge of benign participants' local training.
“The attacker cannot control the aggregation algorithm, which is used to combine participants' model updates into the shared global model, nor does it have any knowledge of the benign participants' local training.”
The authors state this as an assumption.
The malicious client is non-colluding and has no partner to exchange information.
“We assume a non-colluding malicious client, where the adversary has no partner to exchange any information.”
The paper relies on this without support.
Catastrophic forgetting is an inevitable feature of neural network models when trained sequentially on multiple tasks.
“catastrophic forgetting is an inevitable feature of neural network models, specifically when the network is trained sequentially on multiple tasks.”
The authors state this as an assumption.
The attacker can directly influence the weights of the joint model and train in any way that benefits the attack.
“as defined in standard federated learning framework, the attacker can directly influence the weights of the joint model and train in any way that benefits the attack (e.g., adopting alternating minimization training strategy, introducing adversarial task).”
The authors state this as an assumption.
The malicious client is selected by the central server each round.
“In this experiment, the malicious client is assumed to be selected each round”
“We make the assumption that the malicious client is selected by central server each round in order to evaluate the effectiveness and persistence of attack.”
The paper relies on this without support.
Only a small fraction of the clients' updates will be selected each round.
“Because only a small fraction of the clients' updates will be selected each round, the effectiveness, persistence, and stealth is becoming more challenging for model poisoning attack in federated learning.”
The paper relies on this without support.
The main idea behind Byzantine-robust defense methods is to detect abnormal weight updates and reject those models.
“The main idea behind the Byzantine-robust defense method is to detect abnormal weight updates and reject those models.”
The paper relies on this without support.
Adversarial techniques (e.g., backdoor, adversarial example) try to infer the model by creating a misleading minima.
“The adversarial techniques (e.g., backdoor, adversarial example) try to inference the model by creating a misleading minima.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Moreover, this method can resist catastrophic forgetting in neural networks.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“However, the biggest problem with this approach is that malicious clients need to compute the Hessian matrix during preparing an attack, which is non-trivial and time-consuming.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“However, model poisoning attacks tend to work better in practice because they can directly modify local model parameters [11], [23], [33], [40].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“Moreover, Xingchen et al. [33] proposed an optimizationbased model poisoning attack method.They injected malicious neurons into the neural network's redundant space using the objective function's regularization term.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“A widely used strategy is alternating minimization [28], [33].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“They can implement a more stealthy and persistent poisoning attack using these redundant neurons, which requires the ability to modify the model parameters directly.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“First, Xingchen et al. [33] found that only a tiny fraction of neurons were changed during the training phase, while most neurons were close to zero.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
In the citing paper
“The alternating minimization approach decouples the poisoning attack target from the stealthiness target.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [33]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.4. Discussion and Next Steps
“The machine learning community recently proposed several new federated learning methods that were claimed to be robust against Byzantine failures [17,44] of certain client devices.”
§ Deep Model Poisoning Attack on Federated Learning > References
“44. He, K.; Zhang, X.; Ren, S.; Sun, J. Deep residual learning for image recognition.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.1. Dataset and Experiment Setup
“For network architecture, we choose LetNet [42] and ResNet [43] for MNIST and CIFAR-10, respectively.”
§ Deep Model Poisoning Attack on Federated Learning > References
“43. Zbontar, J.; LeCun, Y. Stereo matching by training a convolutional neural network to compare image patches.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 4.1. Dataset and Experiment Setup
“For network architecture, we choose LetNet [42] and ResNet [43] for MNIST and CIFAR-10, respectively.”
§ Deep Model Poisoning Attack on Federated Learning > References
“42. Zenke, F.; Poole, B.; Ganguli, S. Continual Learning Through Synaptic Intelligence.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“This phenomenon is investigated in some previous continual learning studies (e.g., [35][36][37][38]), and it can be used in our adversarial training.”
§ Deep Model Poisoning Attack on Federated Learning > References
“35. Mhamdi, E.M.E.; Guerraoui, R.; Rouault, S. The Hidden Vulnerability of Distributed Learning in Byzantium.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“For each step i, the adversarial task's objective function is first minimized starting from Θ (when i = 1, Θ = G t ) using Equation ( 2), and then minimized with Equation (3).”
§ Deep Model Poisoning Attack on Federated Learning > 3.4. Optimization-Based Model Poisoning Attack
“where ρ 1 is a hyperparameter, L M means Cross-entropy loss for main task, and ∆ t ben denotes benign clients' averaged model updates.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Deep Model Poisoning Attack on Federated Learning > Acknowledgements
“This work was supported in part by the Natural Science Foundation of China under Grant 61803135 and Grant 61702150, and in part by the Key Research and Development Plan Project of Zhejiang Province under Grant 2017C01065.”
§ Deep Model Poisoning Attack on Federated Learning > Funding
“Funding: This research received no external funding.”
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Overcoming catastrophic forgetting in neural networks
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., et al. (2017) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.1611835114 · Cited by 7,899
Advances and Open Problems in Federated Learning
Kairouz, P., McMahan, H. B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A. N., Bonawitz, K., Charles, Z., Cormode, G., Cummings, R., et al. (2019) · arXiv · doi:10.48550/arxiv.1912.04977 · Cited by 7,857
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210
Federated Learning: Strategies for Improving Communication Efficiency
Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016) · arXiv · doi:10.48550/arxiv.1610.05492 · Cited by 3,766
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Continual Learning Through Synaptic Intelligence
Zenke, F., Poole, B., & Ganguli, S. (2017) · arXiv · doi:10.48550/arxiv.1703.04200 · Cited by 1,784
Research works printed but not linked: 1
- Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S. (2018, January 3–8). Model poisoning attacks in federated learning. Proceedings of the Workshop on Security in Machine Learning (SecML), Collocated with the 32nd Conference on Neural Information Processing Systems (NeurIPS’18), Montréal, QC, Canada.
Cited by
Sorted by citations
Federated Learning in Edge Computing: A Systematic Survey
Abreha, H. G., Hayajneh, M., & Serhani, M. A. (2022) · Sensors · doi:10.3390/s22020450 · Cited by 384
The Emerging Threat of Ai-driven Cyber Attacks: A Review
Guembe, B., Azeta, A., Misra, S., Osamor, V. C., Fernandez-Sanz, L., & Pospelova, V. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2037254 · Cited by 267
Federated learning: Overview, strategies, applications, tools and future directions
Yürdem, B., Kuzlu, M., Güllü, M. K., Çatak, F. Ö., & Tabassum, M. (2024) · Heliyon · doi:10.1016/j.heliyon.2024.e38137 · Cited by 342
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212
Ferrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
Metadata
- Authors
- Zhou, X., Xu, M., Wu, Y., & Zheng, N.
- Affiliations
- Hangzhou Dianzi University (CN)
- Corresponding author
- Xu, Ming
- Venue
- Future Internet
- Publisher
- MDPI AG
- Published
- 2021-03-14
- Volume
- 13
- Issue
- 3
- Pages
- 73
- ISSN
- 1999-5903 (ISSN-L)
- OpenAlex
- W3136620885
- Semantic Scholar
- 1bdb7429302500aa559c4e1653543802365abc47
- Cited by
- 170
- References
- 43
- Citations by year
- 2026: 18 · 2025: 38 · 2024: 51 · 2023: 40 · 2022: 15 · 2021: 8
- FWCI
- 10.08
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Future Internet (publishedVersion, cc-by)
- RePEc: Research Papers in Economics (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Natural Science Foundation of China; Key Research and Development Plan Project of Zhejiang Province (61803135, 61702150; 2017C01065)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, model poisoning, deep learning, attack stealth, attack success rate, defense evasion, data confidentiality
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
