Pith. sign in

REVIEW 4 major objections 4 minor 45 references

Maximizing Uncertainty for Federated learning via Bayesian Optimisation-based Model Poisoning

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Poisoning just a few first-layer neurons can halve the confidence of a federated model, and re-selecting those neurons each round is claimed to be provably stronger than fixed-neuron poisoning.

desk verdict The attack idea and experiments are worth a look, but Section V-C's proof is invalid and Contribution 2 falls with it; the paper deserves a serious referee for the empirical core, not a desk reject. read the letter →

arxiv 2501.08002 v2 pith:K7W7AIB2 submitted 2025-01-14 cs.LG cs.AIcs.CV

Marios Aristodemou , Xiaolan Liu , Yuan Wang , Konstantinos G. Kyriakopoulos , Sangarapillai Lambotharan , Qingsong Wei This is my paper · ORCID
classification cs.LGcs.AIcs.CV
keywords federatedlearningmodelpoisoningattackuncertaintymaximizationBayesianoptimisationtrustregionKLdivergenceadversarialmachineeffectiveness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning is meant to keep raw data private, but the paper argues that a malicious participant can still destabilize the shared model by changing only a small set of weights in the first hidden layer. The proposed attack, Delphi, maximizes the KL divergence between the model's predictive distribution and a deliberately uncertain target distribution, using Bayesian optimisation (Delphi-BO) or least-squares trust-region optimisation (Delphi-LSTR) to find poisoned weights. The paper claims a mathematical upper bound on attack effectiveness for FedAvg and uses it to argue that re-selecting the most sensitive neurons each round is provably more effective than poisoning a fixed neuron set. If the attack works as claimed, uncertainty-aware poisoning is a practical threat that standard robust aggregation such as Krum does not fully remove.

What carries the argument

The load-bearing machinery is a small set of first-hidden-layer neurons chosen by the L2 norm of their gradients; the KL-divergence objective that pushes predictions toward a fixed uncertain target; and two optimisers that search over those weights, Bayesian optimisation with a Gaussian-process surrogate and Matern kernel plus q-expected improvement, and least-squares trust-region optimisation. The proof machinery is the effectiveness measure $\rho$ and the attempt to bound it via Eq. (17), which is what carries the paper's claim that dynamic neuron selection is provably stronger than fixed-neuron manipulation.

What would settle it

Compute the left side of Eq. (17) directly from logged FedAvg weights during a Delphi-BO run; if $\frac{1}{A}\sum_{a=N+1}^{K}\|w_t-w_t^a\|^2$ exceeds $\epsilon^2(3N/A+4)$ for the paper's own $\epsilon$ values at any round, the claimed bound is false. A second check is purely algebraic: expand the squared norm of a vector sum in Eqs. (29)-(32); the derivation replaces it with a sum of scalar squares, which is not valid for vectors.

Watch

Extended reading notes

Core claim

The central claim is that uncertainty can serve as a direct attack objective in federated learning, and that the first hidden layer is a sufficient place to apply it. Delphi-BO models the mapping from selected neuron weights to output uncertainty as a Gaussian process, proposes new weights through an expected-improvement acquisition function, and re-selects the highest-sensitivity neurons each round; the reported experiments show mean predictive confidence dropping by about half. The mathematical analysis defines attack effectiveness as $\rho = \frac{1}{c}\cdot\frac{1}{A}\sum_{a=N+1}^{K}\|w_t - w_t^a\|^2$ and derives the bound $\rho \le \frac{1}{c}\epsilon^2(3N/A+4)$, where $c$ is mean predictive confidence and $\epsilon$ is expected perturbation. On this basis the paper concludes that dynamic neuron selection scores higher attack effectiveness than fixed-neuron manipulation.

Load-bearing premise

The announced bound depends on replacing the realized vector sums in the averaging step with a scalar lower bound $\epsilon$; if that replacement is not legitimate, the proof that dynamic neuron selection is more effective than fixed-neuron poisoning does not go through.

Editorial extensions

If this is right

  • If the bound holds, an attacker's per-client perturbation must grow when the number of malicious clients $A$ is small relative to benign clients $N$, so the ratio $N/A$ governs how hard poisoning is.
  • Dynamic re-selection of sensitive neurons each round is claimed more effective than fixed-neuron poisoning, so defenses that screen static outlier weights may miss this attack.
  • Since Delphi-BO outperforms Delphi-LSTR in the reported settings, black-box search over weights is a more dangerous tool for this objective than the white-box trust-region approach.
  • The attack also lowers predictive confidence under Krum, so Byzantine-robust aggregation alone is not a complete defense against uncertainty-maximizing poisoning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension left implicit is that the proof's dependence on the aggregation term gives a template for comparing other aggregators: re-deriving the bound for each would show how quickly $\rho$ can grow under different aggregation rules.
  • A testable extension is to vary the target distribution $Z$: moving the target closer to uniform should increase induced uncertainty but also make the poisoned model easier to detect, giving a trade-off curve.
  • Because the attack operates on a few first-layer neurons, pruning or freezing early-layer weights could be tested as a cheap defense; the paper does not explore this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Delphi, a model-poisoning attack on federated learning that manipulates a small set of neurons in the first hidden layer of each malicious client's model. The poisoned weights are found either by a trust-region least-squares solver (Delphi-LSTR) or by Bayesian optimization (Delphi-BO), with the objective of minimizing the KL divergence between the predictive distribution and a target distribution Z with peak probability 0.25. The authors compare fixed versus dynamically selected neuron sets and report experiments on CIFAR-10 and CIFAR-100 under FedAvg and Krum, using IID and imbalanced data partitions. The advertised theoretical contribution is an upper bound on attack effectiveness, rho <= (1/c) epsilon^2(3N/A + 4), which is claimed to prove that dynamic-neuron Delphi-BO is more effective than fixed-neuron manipulation.

Significance. The problem of quantifying how model-poisoning attacks degrade predictive uncertainty in federated learning is relevant, and the experimental setup is reasonable: the authors evaluate two optimizers, two aggregators, two datasets, and both IID and imbalanced distributions, and they state that code is available. If the bound and proof were valid, contribution 2 would be a useful addition to the model-poisoning literature. However, the proof in Section V-C contains load-bearing algebraic and probabilistic errors, and the plotted 'upper bound' in Figs. 6 and 7 is tuned per experiment by choosing epsilon separately for each setting. Moreover, the empirical results in Fig. 5 for the imbalanced case show the fixed scheme having more impact than dynamic selection, which contradicts the universal superiority claim. The central theoretical claim therefore collapses, and the manuscript reduces to an empirical attack study whose headline theorem is unsupported.

major comments (4)
  1. [V-C, Eqs. (25)-(33)] The derivation of Eq. (17) is invalid. Equation (25) defines epsilon only through a lower bound on the expectation of the average perturbation, but Eq. (31) replaces the realized squared term (1/(N+A) sum delta)^2 with epsilon^2; this relies on the identity E[X^2] = E[X]^2 and converts a lower bound on a first moment into an upper bound on a realized second moment, neither of which is valid. In addition, Eq. (29) expands a squared norm ||u+v||^2 as scalar squares plus a cross term without the correct N+A scaling, and no constraint is imposed on individual deviations ||delta||. Under the stated assumptions, the average-disruption term in Eq. (16) is unbounded while the epsilon condition can still hold, so Eq. (17) is not proven and, as stated, is false.
  2. [V-C and Contribution 2] Even if Eq. (17) were a valid upper bound, it cannot establish the paper's Contribution 2 that the dynamic-neuron scheme 'scores a higher attack effectiveness' than the fixed-set scheme. An upper bound on rho does not imply that rho for one algorithm exceeds rho for another; one would need a lower bound or a direct comparison. The text in Section V-C contains no such argument.
  3. [VI-D, Figs. 6-7] The empirical 'upper bounds' in Figs. 6 and 7 are fitted rather than predicted. In Section VI-D, the expected perturbation is set separately for the dynamic and fixed schemes and for the IID and imbalanced settings (epsilon = 0.2 versus 0.1 and 0.125), so the line epsilon^2(3N/A + 4) is chosen to sit above the observed curves already. This does not test Eq. (17); it only rearranges the chosen epsilon values and is therefore circular as evidence for the bound.
  4. [VI-C, Fig. 5] The claim that dynamic selection is always more effective is contradicted by the paper's own results. For the imbalanced-data experiment, the text states that the fixed neuron selection scheme has more impact on the global model than the DS scheme, and Fig. 5 shows the fixed scheme causing a larger reduction in mean predictive confidence in that setting. This direct evidence against the universal claim needs to be reconciled with Contribution 2, or that contribution must be substantially weakened.
minor comments (4)
  1. [Throughout] There are numerous typos that should be corrected, for example 'Concequently', 'candindate', 'subistiuted', 'traspose', 'Dephi' in the contributions list, and 'beingn users' in Section VI-E.
  2. [III-C and V-A] The notation is overloaded: in Eq. (5), delta_w is used both as the minimization variable and as the constraint magnitude ||w_{t+1} - w_t||_1, and in Eq. (16) the symbol rho is introduced while c is later reused informally; distinct symbols would improve clarity.
  3. [IV-B] The Bayesian optimization implementation details are incomplete: the number of BO iterations T, the qEI sampling parameters, the bounds l and u used for the trust-region method, and the exact criterion for selecting the 'most significant neurons' beyond the L2 gradient norm are not specified, which limits reproducibility despite the code link.
  4. [V-A] The relationship between the mean predictive confidence c in Eq. (16) and the KL-divergence objective minimized by the attacker is never formalized; stating this dependence explicitly would help connect the theoretical quantity rho to the attack objective.

Circularity Check

2 steps flagged · score 6.0 of 10

The claimed proof of Contribution 2 reduces the attack-effectiveness upper bound to a per-experiment input epsilon; the bound plotted in Figs. 6 and 7 is an input choice, not a derived prediction.

  1. self definitional [Section V-C, Eqs. (25)-(33), especially Eq. (31)]
    "Based on the property E[X 2] = E[X]2, we substitute the term ( 1 N +A PK a=N +1 δ)2 with the expected pertrubation ϵ as defined in the eq. (25)"

    Equation (25) defines epsilon only as a lower bound on a first moment: E[1/(N+A)\sum\delta] >= epsilon. Equation (31) then replaces the realized squared term (1/(N+A)\sum\delta)^2 by epsilon^2, conflating a lower bound with the value of a squared quantity. The final bound Eq. (17) is therefore an algebraic rearrangement of the same epsilon that was introduced as an input, rather than a derived consequence of attack mechanics. Because epsilon is later assigned different values for fixed versus dynamic neurons and for IID versus imbalanced settings, Eq. (17) has no independent predictive content: the bound is fixed by the chosen epsilon and the constants 1/c and (3N/A+4).

  2. fitted input called prediction [Section VI-D, Figs. 6 and 7]
    "In the equation (17), there are two terms that we can consider as constant throughout the process. This is the term 3N A + 4 which is equal to 10, and the second term is the expected perturbation which is ϵ = 0 .2 and ϵ2 = 0 .04 for DS neuron selection and ϵ = 0.1 and ϵ2 = 0.01 for fixed neuron selection in IID and ϵ = 0.125 and ϵ2 = 0.015 in Imbalanced data distribution. Also, in Fig. 6 and Fig. 7, we have plotted the expected upper bound if the objective function has been minimised completely with the predictive confidence at 0.25."

    The plotted 'expected upper bound' is computed from per-condition epsilon values that are selected separately for the dynamic scheme, the fixed IID scheme, and the fixed imbalanced scheme. Since Eq. (17) is exactly rho <= (1/c) epsilon^2 (3N/A + 4), and c is fixed at 0.25, the height of the plotted line is completely determined by these epsilon assignments. The observed comparison between dynamic and fixed neuron selection in Figs. 6 and 7 is therefore not a test of a first-principles prediction: the bound is placed by construction, and the claim that dynamic searching 'scores a higher attack effectiveness' is not derivable from this tuned upper bound.

full rationale

The empirical Delphi attack, including the BO and LSTR optimizers and the fixed-versus-dynamic neuron comparison, is a genuine experimental study and is not circular. The circularity is confined to the theoretical 'mathematical proof' of Contribution 2. In Section V-C, the paper derives Eq. (17) by substituting epsilon^2 for the realized squared average perturbation, even though Eq. (25) defines epsilon only as a lower bound on the expected perturbation. That substitution, together with the false property E[X^2]=E[X]^2, makes the supposed upper bound an algebraic function of the chosen epsilon rather than a bound obtained from attack mechanics. Section VI-D then assigns different epsilon values to each scheme and data split, so the bound lines in Figs. 6 and 7 are effectively selected to sit above the observed curves. Consequently, the headline result that dynamic neuron selection is provably more effective than fixed neuron selection is not supported by the derivation; the bound is an input choice, not a prediction. The score is 6 because the paper's central theoretical claim and its plotted upper-bound 'prediction' reduce by construction to the per-experiment epsilon inputs, while the empirical attack evaluation itself retains independent content.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims rest on hand-chosen quantities, most importantly ε, which is assigned per scenario to make the bound plot work. No new physical or architectural entities are introduced.

free parameters (5)
  • Expected perturbation ε = 0.2 (DS), 0.1 (fixed IID), 0.125 (imbalanced)
    Chosen per experiment in Section VI-D to plot the attack-effectiveness bound; not derived from the attack or measured.
  • Target distribution peak probability Z = 0.25
    Set by hand in Eq. (5); for CIFAR100 this is much larger than 1/100, so Z is not a high-entropy distribution.
  • Number of manipulated neurons = 5 or 10
    Experiment hyperparameter that affects attack strength and is varied in Section VI-B.
  • Matern kernel smoothness and length scale = ν=2.5, ρ=1
    Set in Section IV-B.1; common defaults but chosen by hand with no sensitivity study.
  • Loss threshold for attack activation = 1.5
    Algorithms 1 and 2 only start poisoning once loss is below 1.5; no sensitivity analysis is provided.
assumptions (4)
  • domain assumption The attacker can directly replace first-hidden-layer weights of its local model and remain undetected in early training rounds.
    Threat model in Section III-B; if the server used stronger anomaly detection, the attack could fail.
  • domain assumption Uncertainty induced by the first hidden layer is a smooth low-dimensional function of the few manipulated neuron weights, so BO and trust region can optimise it.
    Section IV assumes a black-box function between layer parameters and uncertainty without evidence for smoothness or low effective dimension.
  • ad hoc to paper The expected perturbation lower bound ε in Eq. (25) can be used as an upper-bound constant in Eq. (17).
    Section V-C; an expectation lower bound does not imply a realization upper bound, and the proof depends on this.
  • ad hoc to paper The target distribution Z with peak probability 0.25 represents the maximally uncertain output distribution.
    Section III-C Eq. (5); for CIFAR100 this distribution has low entropy, so minimizing DKL toward it is not the same as maximizing uncertainty.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Maximizing Uncertainty for Federated learning via Bayesian Optimisation-based Model Poisoning." pith.science (2026). https://pith.science/paper/K7W7AIB2

@misc{pith2026250108002,
  author       = {Pith},
  title        = {Pith review of: Maximizing Uncertainty for Federated learning via Bayesian Optimisation-based Model Poisoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/K7W7AIB2}},
  note         = {Machine review of arXiv:2501.08002}
}
read the original abstract

As we transition from Narrow Artificial Intelligence towards Artificial Super Intelligence, users are increasingly concerned about their privacy and the trustworthiness of machine learning (ML) technology. A common denominator for the metrics of trustworthiness is the quantification of uncertainty inherent in DL algorithms, and specifically in the model parameters, input data, and model predictions. One of the common approaches to address privacy-related issues in DL is to adopt distributed learning such as federated learning (FL), where private raw data is not shared among users. Despite the privacy-preserving mechanisms in FL, it still faces challenges in trustworthiness. Specifically, the malicious users, during training, can systematically create malicious model parameters to compromise the models predictive and generative capabilities, resulting in high uncertainty about their reliability. To demonstrate malicious behaviour, we propose a novel model poisoning attack method named Delphi which aims to maximise the uncertainty of the global model output. We achieve this by taking advantage of the relationship between the uncertainty and the model parameters of the first hidden layer of the local model. Delphi employs two types of optimisation , Bayesian Optimisation and Least Squares Trust Region, to search for the optimal poisoned model parameters, named as Delphi-BO and Delphi-LSTR. We quantify the uncertainty using the KL Divergence to minimise the distance of the predictive probability distribution towards an uncertain distribution of model output. Furthermore, we establish a mathematical proof for the attack effectiveness demonstrated in FL. Numerical results demonstrate that Delphi-BO induces a higher amount of uncertainty than Delphi-LSTR highlighting vulnerability of FL systems to model poisoning attacks.

Figures

Figures reproduced from arXiv: 2501.08002 by the authors.

Figure 1
Figure 1. A Federated Learning system, where there is [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Comparison between Bayesian Optimisation and Least [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Comparison between Bayesian Optimisation and Least [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Comparison of manipulating with fixed and dynamic [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 6
Figure 6. Figure 6: Attack effectiveness for Delphi-BO in the context of [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 5
Figure 5. Figure 5: Comparison of manipulating a fixed or dynamic set of [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 9
Figure 9. Figure 9: Comparison of Krum in Imbalanced data distribution [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 8
Figure 8. Figure 8: Comparison of Krum in IID data distribution [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 33 canonical work pages

  1. [16]

    Bayesian optimisation-driven adversarial poisoning attacks against distributed learning,

    M. Aristodemou, X. Liu, S. Lambotharan, and B. AsSadhan, “Bayesian optimisation-driven adversarial poisoning attacks against distributed learning,” IEEE Access, pp. 1–1, 2023

    work page 2023

  2. [1]

    GPT-4, AGI, and the hunt for superintelligence,

    G. Zorpette, “GPT-4, AGI, and the hunt for superintelligence,” IEEE Spectrum, Jul. 2023. [Online]. Available: https://spectrum.ieee.org/ superintelligence-christoph-koch-gpt4

    work page 2023

  3. [2]

    Artificial intelligence act: MEPs adopt landmark law,

    European Parliament, “Artificial intelligence act: MEPs adopt landmark law,” Mar. 2024. [On- line]. Available: https://www.europarl.europa.eu/news/en/press-room/ 20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law

    work page 2024

  4. [3]

    A systematic review of trustworthy and explainable artificial intelligence in healthcare: Assessment of quality, bias risk, and data fusion,

    A. Albahri et al. , “A systematic review of trustworthy and explainable artificial intelligence in healthcare: Assessment of quality, bias risk, and data fusion,” Information Fusion, vol. 96, pp. 156–191, Aug. 2023

    work page 2023

  5. [4]

    Towards calibrated and scalable uncertainty representations for neural networks,

    N. Seedat and C. Kanan, “Towards calibrated and scalable uncertainty representations for neural networks,” 2019

    work page 2019

  6. [5]

    Understanding measures of uncertainty for adversarial example detection,

    L. Smith and Y . Gal, “Understanding measures of uncertainty for adversarial example detection,” 2018. TRANSACTIONS ON INFORMATION ON FORENSICS AND SECURITY , ACCEPTED FOR PUBLICATION 13

    work page 2018

  7. [6]

    The need for uncertainty quantification in machine-assisted medical decision making,

    E. Begoli, T. Bhattacharya, and D. Kusnezov, “The need for uncertainty quantification in machine-assisted medical decision making,” Nature Machine Intelligence, vol. 1, no. 1, pp. 20–23, 2019

    work page 2019

  8. [7]

    Federated learning in mobile edge networks: A comprehensive survey,

    W. Y . B. Lim, N. C. Luong, D. T. Hoang, Y . Jiao, Y .-C. Liang, Q. Yang, D. Niyato, and C. Miao, “Federated learning in mobile edge networks: A comprehensive survey,” IEEE Communications Surveys & Tutorials , vol. 22, no. 3, pp. 2031–2063, 2020

    2020

Show all 45 references
  1. [8]

    Towards personalized federated learning,

    A. Z. Tan, H. Yu, L. Cui, and Q. Yang, “Towards personalized federated learning,” IEEE Transactions on Neural Networks and Learning Systems, pp. 1–17, 2022

    2022

  2. [9]

    An aggregation-free federated learning for tackling data heterogeneity,

    Y . Wang, H. Fu, R. Kanagavelu, Q. Wei, Y . Liu, and R. S. M. Goh, “An aggregation-free federated learning for tackling data heterogeneity,” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 26 233–26 242, Jun. 2024

    2024

  3. [10]

    FedHealth: A federated transfer learning framework for wearable healthcare,

    Y . Chen, X. Qin, J. Wang, C. Yu, and W. Gao, “FedHealth: A federated transfer learning framework for wearable healthcare,” IEEE Intelligent Systems, vol. 35, no. 4, pp. 83–93, 2020

    2020

  4. [11]

    Wireless distributed learning: A new hybrid split and federated learning approach,

    X. Liu, Y . Deng, and T. Mahmoodi, “Wireless distributed learning: A new hybrid split and federated learning approach,” IEEE Transactions on Wireless Communications, vol. 22, no. 4, pp. 2650–2665, Apr. 2023

    2023

  5. [12]

    Communication-efficient federated learning and permissioned blockchain for digital twin edge networks,

    Y . Lu, X. Huang, K. Zhang, S. Maharjan, and Y . Zhang, “Communication-efficient federated learning and permissioned blockchain for digital twin edge networks,” IEEE Internet of Things Journal, vol. 8, no. 4, pp. 2276–2288, 2021

    2021

  6. [13]

    Wild patterns: Ten years after the rise of adversarial machine learning,

    B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,” Pattern Recognition , vol. 84, pp. 317– 331, 2018

    2018

  7. [14]

    Investigation of deep learning architectures and features for adversarial machine learning attacks in modulation classifications,

    M. Aristodemou , S. Lambotharan, G. Zheng, and L. Aristodemou, “Investigation of deep learning architectures and features for adversarial machine learning attacks in modulation classifications,” in 2022 IEEE 14th Image, Video, and Multidimensional Signal Processing Workshop (I...

    2022

  8. [15]

    Evidential classification for defending against adversarial examples in radio signal classification,

    M. Beechey, S. Lambotharan, and K. G. Kyriakopoulos, “Evidential classification for defending against adversarial examples in radio signal classification,” Information Fusion, vol. 92, pp. 115–126, Mar. 2023

    2023

  9. [17]

    Local model poisoning attacks to Byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-robust federated learning,” in 29th USENIX Security Sym- posium, 2020, pp. 1605–1622

    2020

  10. [18]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” 2017

    2017

  11. [19]

    TrustFed: A framework for fair and trustworthy cross-device federated learning in IIoT,

    M. H. u. Rehman, A. M. Dirir, K. Salah, E. Damiani, and D. Svetinovic, “TrustFed: A framework for fair and trustworthy cross-device federated learning in IIoT,” IEEE Transactions on Industrial Informatics , vol. 17, no. 12, pp. 8485–8494, Dec. 2021

    2021

  12. [20]

    Distributed intelligence in wireless networks,

    X. Liu, J. Yu, Y . Liu, Y . Gao, T. Mahmoodi, S. Lambotharan, and D. H.- K. Tsang, “Distributed intelligence in wireless networks,” IEEE Open Journal of the Communications Society , vol. 4, pp. 1001–1039, 2023

    2023

  13. [21]

    MPAF: Model poisoning attacks to federated learning based on fake clients,

    X. Cao and N. Z. Gong, “MPAF: Model poisoning attacks to federated learning based on fake clients,” in Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition Workshops , Jun. 2022, pp. 3396–3404

    2022

  14. [22]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,” in Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  15. [23]

    Data poisoning attacks on federated learning by using adversarial samples,

    L. Shi, Z. Chen, Y . Shi, G. Zhao, L. Wei, Y . Tao, and Y . Gao, “Data poisoning attacks on federated learning by using adversarial samples,” in 2022 International Conference on Computer Engineering and Artificial Intelligence, Jul. 2022, pp. 158–162

    2022

  16. [24]

    Data-agnostic model poisoning against federated learning: A graph autoencoder approach,

    K. Li, J. Zheng, X. Yuan, W. Ni, O. B. Akan, and H. V . Poor, “Data-agnostic model poisoning against federated learning: A graph autoencoder approach,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 3465–3480, Feb. 2024

    2024

  17. [25]

    Hidden trigger backdoor attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” Proceedings of the AAAI Conference on Artificial Intelligence , vol. 34, no. 7, pp. 11 957–11 965, 2020

    2020

  18. [26]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” arXiv preprint arXiv:1807.00459 , 2019

    2019 arXiv

  19. [27]

    Ditto: Fair and robust feder- ated learning through personalization,

    T. Li, S. Hu, A. Beirami, and V . Smith, “Ditto: Fair and robust feder- ated learning through personalization,” arXiv preprint arXiv:2012.04221, 2021

    2012 arXiv

  20. [28]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in Network and Distributed System Security Symposium , 2021

    2021

  21. [29]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfel- low, and R. Fergus, “Intriguing properties of neural networks,” in 2nd International Conference on Learning Representations , 2014

    2014

  22. [30]

    Coun- termeasures against adversarial examples in radio signal classification,

    L. Zhang, S. Lambotharan, G. Zheng, B. AsSadhan, and F. Roli, “Coun- termeasures against adversarial examples in radio signal classification,” IEEE Wireless Communications Letters , vol. 10, no. 8, pp. 1830–1834, Aug. 2021

    2021

  23. [31]

    Learn- ing differentially private recurrent language models,

    H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, “Learn- ing differentially private recurrent language models,” arXiv preprint arXiv:1710.06963, Oct. 2017

    2017 arXiv

  24. [32]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Ad- vances in Neural Information Processing Systems , vol. 30, 2017

    2017

  25. [33]

    A subspace, interior, and con- jugate gradient method for large-scale bound-constrained minimization problems,

    M. A. Branch, T. F. Coleman, and Y . Li, “A subspace, interior, and con- jugate gradient method for large-scale bound-constrained minimization problems,” SIAM Journal on Scientific Computing , vol. 21, no. 1, pp. 1–23, 1999

    1999

  26. [34]

    An interior trust region approach for nonlinear minimization subject to bounds,

    T. F. Coleman and Y . Li, “An interior trust region approach for nonlinear minimization subject to bounds,” SIAM Journal on Optimization , vol. 6, no. 2, pp. 418–445, 1996

    1996

  27. [35]

    Efficient global optimization of expensive black-box functions,

    D. R. Jones, M. Schonlau, and W. J. Welch, “Efficient global optimization of expensive black-box functions,” Journal of Global Optimization , vol. 13, no. 4, pp. 455–492, Dec. 1998

    1998

  28. [36]

    Practical Bayesian optimiza- tion of machine learning algorithms,

    J. Snoek, H. Larochelle, and R. P. Adams, “Practical Bayesian optimiza- tion of machine learning algorithms,” arXiv preprint arXiv:1206.2944 , Jun. 2012

    2012 arXiv

  29. [37]

    A tutorial on Bayesian optimization,

    P. I. Frazier, “A tutorial on Bayesian optimization,” arXiv preprint arXiv:1807.02811, Jul. 2018

    2018 arXiv

  30. [38]

    K. P. Murphy, Probabilistic Machine Learning: Advanced Topics. Cam- bridge, MA: MIT Press, 2023

    2023

  31. [39]

    Scalable Bayesian opti- mization using deep neural networks,

    J. Snoek, O. Rippel, K. Swersky, R. Kiros, N. Satish, N. Sundaram, M. M. A. Patwary, Prabhat, and R. P. Adams, “Scalable Bayesian opti- mization using deep neural networks,” arXiv preprint arXiv:1502.05700, Feb. 2015

    2015 arXiv

  32. [40]

    Lifelong Bayesian optimization,

    Y . Zhang, J. Jordon, A. M. Alaa, and M. van der Schaar, “Lifelong Bayesian optimization,” arXiv preprint arXiv:1905.12280 , May 2019

    1905 arXiv

  33. [41]

    The reparameterization trick for acquisition functions,

    J. T. Wilson, R. Moriconi, F. Hutter, and M. P. Deisenroth, “The reparameterization trick for acquisition functions,” arXiv preprint arXiv:1712.00424, Dec. 2017

    2017 arXiv

  34. [42]

    Auto-encoding variational Bayes,

    D. P. Kingma and M. Welling, “Auto-encoding variational Bayes,” arXiv preprint arXiv:1312.6114, Dec. 2013

    2013 arXiv

  35. [43]

    Pfllib: Personalized federated learning algorithm library,

    J. Zhang, Y . Liu, Y . Hua, H. Wang, T. Song, Z. Xue, R. Ma, and J. Cao, “Pfllib: Personalized federated learning algorithm library,” arXiv preprint arXiv:2312.04992, 2023

    2023 arXiv

  36. [44]

    ImageNet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “ImageNet classification with deep convolutional neural networks,” Communications of the ACM , vol. 60, no. 6, pp. 84–90, May 2017. Marios Aristodemou received the MEng Systems Engineering degree from Loughborough University, U.K ...

    2017

  37. [2005]

    His research interests include decentralized computing, federated learning, privacy- preserving AI and Blockchain

    He is a Group Manager and Principal Scientist at the Institute of High Performance Computing, A*STAR, Singapore. His research interests include decentralized computing, federated learning, privacy- preserving AI and Blockchain. He is a senior member of the IEEE

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.