Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

SMTFL: Secure Model Training to Untrusted Participants in Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SMTFL claims federated learning can resist gradient-inversion and poisoning attacks without any trusted participant, using dynamic three-client groups, group-performance scoring, and consensus-decrypted unlearning.

desk verdict A genuinely novel combination of privacy and poisoning defenses, but the detection rule that carries the paper is self-defeating as written, so the reported 95% localization rates are unreproducible. read the letter →

arxiv 2502.02038 v2 pith:3SZBK4LT submitted 2025-02-04 cs.CR cs.DC

Zhihui Zhao , Xiaorong Dong , Yimo Ren , Jianhua Wang , Dan Yu , Hongsong Zhu , Yongle Chen This is my paper · ORCID
classification cs.CRcs.DC
keywords federatedlearningsecureaggregationgradientinversionattackpoisoningmaliciousclientdetectionunlearningthresholdencryptionuntrustedparticipants
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning normally has to choose between protecting client gradients with noise or encryption and defending the global model against poisoned updates; SMTFL claims to do both with no trusted participant. The scheme groups clients into dynamic triples, splits one client's gradient into two shares that hide the other gradients in the group, and sends only a combined group gradient to the server. Malicious clients are found by watching whether a group's aggregated gradient degrades the global model's performance, with clients accumulating negative scores until they pass a threshold and are removed. Each client's gradient history is encrypted and stored, and decryption requires consensus from many clients, after which a federated-unlearning step cancels the poisoner's contribution from the model. If the evaluation results hold, an FL system can keep training data private and the model correct even when the server and every client are curious or hostile.

What carries the argument

The load-bearing mechanism is a dynamic group of exactly three clients acting as a mutual-checking unit. Within each triple, one client's gradient is split into two shares, and the other group members add their own gradients plus per-client negotiated perturbations, so the combined group gradient hides every individual gradient from every other participant while the server, knowing the perturbations, recovers only the group sum. The same triple then receives a unified performance-based score from the server's measurement of global-model accuracy change, and the cumulative score decides expulsion; threshold-encrypted storage of gradient shares, based on Shamir secret sharing with decryption requiring a threshold number of shares, plus a federated-unlearning correction is what lets the system erase a convicted client's historical influence.

What would settle it

Run SMTFL exactly as specified but give the server no labeled evaluation data, then attempt label-flipping and random-update poisoning; if malicious clients are still located with the claimed accuracy, the performance-change mechanism is not the active ingredient, and if they are not, the unspecified oracle is confirmed as the load-bearing assumption.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes a secure-aggregation and poisoning-defense protocol for federated learning in which no participant—server or client—is trusted. Confidentiality comes not from noise or homomorphic encryption but from arranging clients in groups of three: one client's gradient is split, each group member receives an obfuscated share, and a single group gradient reaches the server, while the server's per-client perturbations let it recover only the sum. Integrity comes from evaluating each group by the global model's performance change after its gradient is applied; a group that causes a drop beyond a threshold gets negative scores, and a client whose cumulative score falls below a preset threshold is expelled. The paper further claims that the stored encrypted gradients of an expelled client can be decrypted under majority consensus and removed through federated unlearning, so model accuracy returns roughly to its pre-attack level. Across four image datasets and two models, it reports over 95 percent accuracy in locating malicious clients with honest-client false positives within 5 percent, under label-flipping, random-update, and PGD poisoning as well as gradient-inversion attacks.

Load-bearing premise

The whole malicious-client detection mechanism assumes the server can measure the global model's performance on labeled evaluation data after every epoch, but the paper never states where that labeled data comes from, who supplies it, or how the performance thresholds are set; without that performance oracle, no group can even be scored.

Editorial extensions

If this is right

  • Federated learning can be run with a semi-honest server and malicious clients simultaneously, closing a gap left by defenses that assume either a trusted server or a trusted majority of clients.
  • Because gradients are protected by splitting and regrouping rather than by noise, the global model need not pay the accuracy cost typical of differential-privacy defenses.
  • The server needs no public or clean dataset per client, removing a common requirement of poisoning defenses that bootstrap trust from server-held data.
  • A convicted client's past contributions are retroactively canceled from the model via stored encrypted gradients and federated unlearning, not merely ignored in future rounds.
  • Grouped aggregation changes training dynamics slightly, and the paper's measurements indicate comparable or slightly improved convergence relative to individual-client uploads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the rational-collusion argument depends on each client valuing its own gradient secrecy above the gain from exposing a peer; a formal game-theoretic treatment or an adversarial client that accepts self-exposure would stress this premise.
  • Inference: performance-based group scoring will struggle whenever the server lacks a trustworthy labeled evaluation set; in practice the labeled data used to compute performance must come from somewhere, and its source is left unspecified, so a deployment would need a separate validation set.
  • Inference: the unlearning correction subtracts gradients as if the global gradient were a linear sum; with non-convex models and multi-step local updates, the actual influence of a poisoner may not cancel cleanly, so the restoration claim should be tested on models where updates interact nonlinearly.
  • Inference: the group-of-three design suggests a tunable trade-off between privacy and detection granularity; larger groups would hide gradients better but coarsen the blame assigned by performance scoring, so an extension could make group size adaptive to collusion risk.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. SMTFL proposes a federated learning scheme that claims to protect gradient privacy and detect malicious clients without any trusted participant. Clients are grouped in triples and their gradients are split or masked locally so that no single client or the server can recover an individual gradient. To detect poisoning, the server evaluates the impact of each group's aggregated gradient on global model accuracy, assigns per-epoch scores to the group members, and removes clients whose cumulative score falls below a threshold. Detected poisoning gradients are then decrypted via threshold encryption and removed from the global model using federated unlearning. The paper reports over 95% malicious-client localization accuracy, a false positive rate below 5%, and near-restoration of model accuracy on four datasets and two models.

Significance. If the claims held, SMTFL would be a practical contribution to federated learning security: it addresses both gradient inversion and poisoning attacks without trusted participants, avoids noise injection, and avoids complex cryptographic aggregation. The paper has useful elements: experiments on four datasets, a comparison table with related work, and measurements of encryption/storage overhead. However, the central detection rule in Section IV-B is internally inconsistent and, as written, would remove all clients in the first epoch, making the headline claims impossible to reproduce. The paper also leaves unspecified the labeled evaluation data needed to measure global model performance. Until these load-bearing issues are resolved, the significance of the contribution is not established.

major comments (5)
  1. [Section IV-B, Eqs. (4)-(5), Table II, Table IV] The detection rule is internally inconsistent and self-defeating. The three per-epoch scores are -1 (degradation), 0 (neutral), and -1 (improvement); with threeva=6, after the first epoch every client has evai in {-1, 0}, both of which are strictly less than 6, so the condition evai < threeva removes every client immediately. Even if the third bullet's -1 is corrected to the +1 mentioned later in the same section, a neutral client with evai=0 still satisfies 0 < 6. The reported detection rates in Table IV (e.g., 100% at threeva=6) therefore cannot be produced by the stated algorithm. This is a load-bearing inconsistency that invalidates the paper's central empirical claim.
  2. [Section IV-B and Section III] The detection mechanism requires the server to measure Prek, the global model's performance, each epoch, but the paper never specifies the labeled evaluation data used for this measurement, its size, or who holds it. The threat model and Table VI explicitly state that SMTFL requires no clean data on the server ('Clean data in server ×'), so it is unclear whether the server has any data on which to measure accuracy. Without this performance oracle, the scoring rule cannot be instantiated, and the experimental results cannot be reproduced. The authors should either state the validation-set assumption explicitly or modify the threat model.
  3. [Section V, Lemma 2] The proof is not a formal security argument and is partially circular. For poisoning, it says 'the group's gradients will not be integrated into the global model' based on the Section IV-B rule, but the rule only assigns scores after the group gradient has been aggregated and its effect on the global model has been observed; Section IV-C even acknowledges that poisoning gradients are integrated before detection. For collusion, the deterrence argument assumes a semi-honest client values hiding its own gradient from the other colluders more than it values learning the target gradient; this is an unstated payoff assumption, not a consequence of the protocol. A precise adversary model or a game-theoretic statement is needed.
  4. [Section IV-C, Eq. (9)] The federated unlearning formula is underspecified. The weight omega_{c_j_mali} is never defined, and k is used as the epoch index throughout the paper but here denotes the number of malicious clients; the denominator m-k also mixes the total number of clients with the number of malicious clients. Without a definition of omega and consistent notation, the claim that the global model is 'nearly restored to its pre-attack state' is not supported by a well-defined update rule.
  5. [Section IV-B and Table II] The threshold tau for the allowable performance change is never assigned a value, although the scoring rule depends critically on comparing Prek-1 - Prek with tau. Table II lists threeva but not tau, and Section VI does not report tau for any experiment. This omission makes the detection experiments irreproducible even after the scoring-sign issue is fixed.
minor comments (5)
  1. [Abstract] The word 'aviods' in the abstract is a typo and should be 'avoids'.
  2. [Section IV-B, third bullet] The assignment of -1 in the performance-improvement scenario contradicts the immediately preceding sentence, which says no poisoning attack event is detected, and also contradicts the later note that assigning evak_i = 1 helps mitigate false positives. These statements need to be reconciled.
  3. [Section IV-C, Eq. (7) and surrounding text] There are several typos and grammatical errors in this subsection, including 'Dataci_decryed' (should be 'Dataci_decrypted') and 'these clients has cooperating with cmali'. Please proofread carefully.
  4. [Section VI-B, Table III] The 'Stage' column in Table III is empty, and the table caption does not explain how the rows are grouped by attack method; the reader has to infer the attack type from the row labels. The table should be restructured or annotated.
  5. [Fig. 5 caption] The caption refers to panels (A)-(D) and to the four transmission stages {g1_A, g2_A+epsilon_A, gA2_B, gA,B,C}, but the figure itself is not described in enough detail for the reader to map the reconstructed images to these stages.

Circularity Check

1 steps flagged · score 2.0 of 10

Minor circularity in Lemma 2's poisoning-collusion proof; the central evaluation is self-contained and not circular.

  1. other [Section V, Lemma 2 proof (security analysis)]
    "Regarding poisoning attacks, SMTFL decides whether to aggregate the group gradient based on its impact on the global model. In a group of clients, if two or more clients launch poisoning attacks, the incorrect gradients will dominate the direction of the group's gradients, thus decreasing the global model's performance. Based on the rule in Section IV-B, the group's gradients will not be integrated into the global model. Therefore, no client will collude."

    The second half of Lemma 2 concludes that no client will collude to poison by relying on the Section IV-B rejection rule: it assumes two or more poisoners necessarily make the group gradient degrade performance, that the degradation is detected, and that the group gradient is therefore excluded. That is exactly the defense's correctness claim the lemma is supposed to establish. The proof reduces to 'collusion fails because detection works,' with no independent evidence for detection effectiveness, so the conclusion is already contained in the premise. This is a circular security argument rather than a derivation. It does not affect the paper's empirical accuracy tables, which are independent measurements on public benchmarks, but it weakens the formal security claim.

full rationale

SMTFL's central claims are empirical: the abstract's >95% malicious-client localization and <5% false-positive rates are measured on MNIST, FMNIST, EMNIST and CIFAR-10, not derived from first principles. The detection rule (Section IV-B) is a heuristic scoring mechanism; the threshold threeva and performance-change threshold τ are tuned hyperparameters, so reporting results under different settings in Table IV is parameter selection rather than fitting a parameter and renaming it a prediction. Self-citations [3], [20] appear only as background motivation for edge-device threats and are not load-bearing. The security lemmas are mostly constructive descriptions of the protocol. The only notable circularity is in Lemma 2's poisoning-collusion part, which assumes the Section IV-B detection rule works in order to prove that no client will collude. Separately, the score/threshold definition in Section IV-B is internally inconsistent as written (evai < threeva with threeva=6 and scores in {-1,0,1} would flag every client after the first epoch), but that is a correctness/reproducibility problem, not a circularity. Overall the paper does not reduce a predicted quantity to its own input; score 2 reflects one minor circular proof step with an otherwise self-contained evaluation.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on four tunable parameters (tau, threeva, omega, groupn) and five unstated or informal assumptions. The most critical is the server's access to labeled evaluation data, which is necessary for every detection decision. The rationality-based collusion resistance is asserted rather than proven, and the unlearning formula is heuristic with an undefined weight. These are not standard math axioms; they are domain assumptions or ad hoc choices that materially affect the reported performance.

free parameters (4)
  • tau (performance change threshold) = Not specified in the paper.
    The detection rule in Section IV-B requires a threshold tau on |Prek - Prek-1| to decide whether a performance change is suspicious. The paper never reports its value or how it is chosen, yet the detection results depend on it.
  • threeva (evaluation threshold for malicious score) = Default 6, tested values 4-9 (Table IV).
    The cumulative evaluation score evai is compared to threeva to declare a client malicious. The paper tunes this threshold across datasets and reports results at threeva = 6, which yields the best trade-off between detection and false positives.
  • omega (weight in unlearning formula) = Undefined.
    Equation (9) subtracts the sum of malicious gradients weighted by omega from the global gradient. The omega is never defined or estimated, making the unlearning step ambiguous and likely a hand-tuned factor.
  • groupn (group size) = 3
    The paper justifies groupn = 3 in Section IV-A as a reasonable compromise between privacy and auditability. This is a design choice that directly affects security properties and is not derived from a formal analysis.
assumptions (5)
  • domain assumption The server has access to labeled data to measure global model performance change after each epoch.
    In Section IV-B, the detection rule compares Prek and Prek-1. The paper does not specify which data the server uses to compute these performance numbers, nor how it obtains labels. This is an unstated, load-bearing assumption.
  • ad hoc to paper Clients are rational and will not collude if colluding risks exposing their own gradients.
    In Section III and Lemma 2, the paper posits that semi-honest clients avoid collusion because the 'checks and balances' design could expose them. The proof is flawed: one colluding party (cC) can expose others without exposing itself, so the rationality argument does not hold.
  • standard math Shamir threshold secret sharing is secure and the Lagrange interpolation recovers the secret with at least t shares.
    Section II-C reviews threshold encryption based on Shamir's scheme (Eq. 6 and Eq. 8). This is a standard cryptographic primitive that the paper relies on for gradient storage.
  • domain assumption Federated unlearning can be approximated by subtracting weighted historical gradients from the global model (Eq. 9).
    Section IV-C uses Eq. 9 to invalidate poisoning gradients. This is a heuristic formula, not a proven unlearning method, and the weight omega is undefined. The paper cites federated unlearning literature but does not show that Eq. 9 achieves the claimed restoration.
  • ad hoc to paper A group gradient that causes a significant performance drop implies that all members of the group are potentially malicious.
    The uniform evaluation rule in Section IV-B assigns the same score to every client in a group based on the group gradient's impact. This assumes guilt by association without justification, and the paper acknowledges it can penalize honest clients.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SMTFL: Secure Model Training to Untrusted Participants in Federated Learning." pith.science (2026). https://pith.science/paper/3SZBK4LT

@misc{pith2026250202038,
  author       = {Pith},
  title        = {Pith review of: SMTFL: Secure Model Training to Untrusted Participants in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3SZBK4LT}},
  note         = {Machine review of arXiv:2502.02038}
}
read the original abstract

Federated learning is an essential distributed model training technique. However, threats such as gradient inversion attacks and poisoning attacks pose significant risks to the privacy of training data and the model correctness. We propose a novel approach called SMTFL to achieve secure model training in federated learning without relying on trusted participants. To safeguard gradients privacy against gradient inversion attacks, clients are dynamically grouped, allowing one client's gradient to be divided to obfuscate the gradients of other clients within the group. This method incorporates checks and balances to reduce the collusion for inferring specific client data. To detect poisoning attacks from malicious clients, we assess the impact of aggregated gradients on the global model's performance, enabling effective identification and exclusion of malicious clients. Each client's gradients are encrypted and stored, with decryption collectively managed by all clients. The detected poisoning gradients are invalidated from the global model through a unlearning method. We present a practical secure aggregation scheme, which does not require trusted participants, avoids the performance degradation associated with traditional noise-injection, and aviods complex cryptographic operations during gradient aggregation. Evaluation results are encouraging based on four datasets and two models: SMTFL is effective against poisoning attacks and gradient inversion attacks, achieving an accuracy rate of over 95% in locating malicious clients, while keeping the false positive rate for honest clients within 5%. The model accuracy is also nearly restored to its pre-attack state when SMTFL is deployed.

Figures

Figures reproduced from arXiv: 2502.02038 by the authors.

Figure 1
Figure 1. The focused FL security issues in this paper [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The framework of SMTFL clients for the (k + 1)-th epoch. Every ci and sa attempt to access the g k j of cj to infer the data dcj (j ∈ [1, m]). Furthermore, ∃ malicious ci compromises the global model through uploading incorrect local gradients (e.g., inverting gradient direction). That is, the performance gap exceeds the accuracy threshold δ between the actual and ideal global model. In this paper, a designed scheme… view at source ↗
Figure 3
Figure 3. The illustration of gradient aggregation in one group [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The generation and distribution of secret shares [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Effectiveness of SMTFL in defense against gradient [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: The model accuracy after deploying SMTFL ( [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: The trend of the number of clients participating in the FL system across different [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: The trend of model accuracy with respect to the number [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SearchEyes: Towards Frontier Multimodal Deep Search Intelligence via Search World Simulation

    cs.AI 2026-07 unverdicted novelty 6.0 of 10

    SearchEyes unifies multimodal search-agent training via Perception-Knowledge Chains on Wikidata5M and Hop-Anchored Policy Optimization, claiming a 6.2-point average gain over the strongest open-source baseline on six ...

Reference graph

Works this paper leans on

50 extracted references · 34 canonical work pages · cited by 1 Pith paper

  1. [1]

    A survey on federated learning,

    C. Zhang, Y . Xie, H. Bai et al. , “A survey on federated learning,” Knowledge-Based Systems, vol. 216, p. 106775, 2021

    work page 2021

  2. [2]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Dong et al. , “A survey of large language models,” arXiv preprint arXiv:2303.18223, 2023

    arXiv 2023

  3. [3]

    Feashare: Feature sharing for computation correctness in edge preprocessing,

    Z. Zhao, H. Bin, H. Li, N. Yu, H. Zhu, and L. Sun, “Feashare: Feature sharing for computation correctness in edge preprocessing,” IEEE Transactions on Mobile Computing , 2024

    work page 2024

  4. [4]

    Semi-asynchronous online federated crowdsourcing,

    X. Kang, G. Yu, Q. Li et al. , “Semi-asynchronous online federated crowdsourcing,” in 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 2024, pp. 4180–4193

    work page 2024

  5. [5]

    Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning,

    J. Li, A. S. Rakin, X. Chen, Z. He, D. Fan, and C. Chakrabarti, “Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 194–10 202

    2022

  6. [6]

    Label-only model inversion attacks via knowledge transfer,

    B.-N. Nguyen, K. Chandrasegaran, M. Abdollahzadeh, and N.-M. M. Cheung, “Label-only model inversion attacks via knowledge transfer,” Advances in Neural Information Processing Systems , vol. 36, 2024

    work page 2024

  7. [7]

    Agic: Approximate gradient inversion attack on federated learning,

    J. Xu, C. Hong, J. Huang et al., “Agic: Approximate gradient inversion attack on federated learning,” in 2022 41st International Symposium on Reliable Distributed Systems (SRDS) , 2022, pp. 12–22

    work page 2022

  8. [8]

    Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,

    Y . Wan, Y . Qu, W. Ni, Y . Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, 2024

    work page 2024

Show all 50 references
  1. [9]

    Mpaf: Model poisoning attacks to federated learning based on fake clients,

    X. Cao and N. Z. Gong, “Mpaf: Model poisoning attacks to federated learning based on fake clients,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 3396–3404

    2022

  2. [10]

    Safelearn: Secure aggregation for private federated learning,

    H. Fereidooni, S. Marchal, M. Miettinen et al. , “Safelearn: Secure aggregation for private federated learning,” in 2021 IEEE Security and Privacy Workshops (SPW), 2021, pp. 56–62

    2021

  3. [11]

    Efficient and privacy-preserving feature importance-based vertical federated learning,

    A. Li, J. Huang, J. Jia, H. Peng, L. Zhang, L. A. Tuan, H. Yu, and X.-Y . Li, “Efficient and privacy-preserving feature importance-based vertical federated learning,” IEEE Transactions on Mobile Computing , vol. 23, no. 6, pp. 7238–7255, 2024

    2024

  4. [12]

    Ldp-fed: Federated learning with local differential privacy,

    S. Truex, L. Liu, K.-H. Chow et al., “Ldp-fed: Federated learning with local differential privacy,” inProceedings of the third ACM international workshop on edge systems, analytics and networking , 2020, pp. 61–66

    2020

  5. [13]

    Random gradient masking as a defensive measure to deep leakage in federated learning,

    J. Kim and S. Park, “Random gradient masking as a defensive measure to deep leakage in federated learning,” arXiv:2408.08430, 2024

    2024 arXiv

  6. [14]

    Fltrust: Byzantine- robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine- robust federated learning via trust bootstrapping,” arXiv preprint arXiv:2012.13995, 2020

    2012 arXiv

  7. [15]

    Defending against back- doors in federated learning with robust learning rate,

    M. S. Ozdayi, M. Kantarcioglu, and Y . R. Gel, “Defending against back- doors in federated learning with robust learning rate,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 10, 2021, pp. 9268–9276

    2021

  8. [16]

    Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning,

    X. Lyu, Y . Han, W. Wang, J. Liu, B. Wang, J. Liu, and X. Zhang, “Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 7, 2023, pp. 9020–9028

    2023

  9. [17]

    Roseagg: Robust defense against targeted collusion attacks in federated learning,

    H. Yang, W. Xi, Y . Shen, and et.al, “Roseagg: Robust defense against targeted collusion attacks in federated learning,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 2951–2966, 2024

    2024

  10. [18]

    Eiffel: Ensuring integrity for federated learning,

    A. Roy Chowdhury, C. Guo, Jha et al. , “Eiffel: Ensuring integrity for federated learning,” in Proceedings of ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2535–2549

    2022

  11. [19]

    A survey on federated unlearning: Challenges, methods, and future directions,

    Z. Liu, Y . Jiang, J. Shen, M. Peng, K.-Y . Lam, X. Yuan, and X. Liu, “A survey on federated unlearning: Challenges, methods, and future directions,” ACM Computing Surveys , vol. 57, no. 1, pp. 1–38, 2024

    2024

  12. [20]

    Detection and incentive: A tampering detection mechanism for object detection in edge computing,

    Z. Zhao, Y . Zeng, J. Wang, H. Li, H. Zhu, and L. Sun, “Detection and incentive: A tampering detection mechanism for object detection in edge computing,” in 2022 41st International Symposium on Reliable Distributed Systems (SRDS) . IEEE, 2022, pp. 166–177

    2022

  13. [21]

    Heterogeneous federated knowledge graph embedding learning and unlearning,

    X. Zhu, G. Li, and W. Hu, “Heterogeneous federated knowledge graph embedding learning and unlearning,” in Proceedings of the ACM web conference 2023, 2023, pp. 2444–2454

    2023

  14. [22]

    Revfrf: Enabling cross-domain random forest training with revocable federated learning,

    Y . Liu, Z. Ma, Y . Yang, X. Liu, J. Ma, and K. Ren, “Revfrf: Enabling cross-domain random forest training with revocable federated learning,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 6, pp. 3671–3685, 2021

    2021

  15. [23]

    Verifi: Towards verifiable federated unlearning,

    X. Gao, X. Ma, J. Wang, Y . Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Verifi: Towards verifiable federated unlearning,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  16. [24]

    Federated un- learning: How to efficiently erase a client in fl?

    A. Halimi, S. Kadhe, A. Rawat, and N. Baracaldo, “Federated un- learning: How to efficiently erase a client in fl?” arXiv preprint arXiv:2207.05521, 2022

    2022 arXiv

  17. [25]

    A blockchain-based shamir’s threshold cryptography scheme for data protection in industrial internet of things settings,

    K. Yu, L. Tan, C. Yang, K.-K. R. Choo, A. K. Bashir, J. J. Rodrigues, and T. Sato, “A blockchain-based shamir’s threshold cryptography scheme for data protection in industrial internet of things settings,”IEEE Internet of Things Journal , vol. 9, no. 11, pp. 8154–8167, 2021

    2021

  18. [26]

    Edge computing: Vision and chal- lenges,

    W. Shi, J. Cao, Q. Zhang et al. , “Edge computing: Vision and chal- lenges,” IEEE internet of things journal , vol. 3, no. 5, pp. 637–646, 2016

    2016

  19. [27]

    Gradient-based learning applied to document recognition,

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  20. [28]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  21. [29]

    Emnist: Extending mnist to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. van Schaik, “Emnist: Extending mnist to handwritten letters,” in 2017 International Joint Conference on Neural Networks (IJCNN) , 2017, pp. 2921–2926

    2017

  22. [30]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  23. [31]

    {FLAME}: Taming backdoors in federated learning,

    T. D. Nguyen, P. Rieger, R. De Viti et al. , “ {FLAME}: Taming backdoors in federated learning,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 1415–1432

    2022

  24. [32]

    Ppfl: Privacy-preserving federated learning with trusted execution environments,

    F. Mo, H. Haddadi, K. Katevas et al., “Ppfl: Privacy-preserving federated learning with trusted execution environments,” in Proceedings of the 19th annual international conference on mobile systems, applications, and services, 2021, pp. 94–108

    2021

  25. [33]

    Baybfed: Bayesian backdoor defense for federated learning,

    K. Kumari, P. Rieger, H. Fereidooni, M. Jadliwala, and A.-R. Sadeghi, “Baybfed: Bayesian backdoor defense for federated learning,” 2023. [Online]. Available: https://arxiv.org/abs/2301.09508

    2023 arXiv

  26. [34]

    Byzantine-robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” 2021. [Online]. Available: https://arxiv.org/abs/1803.01498 14

    2021 arXiv

  27. [35]

    Federated learning: Strategies for improving communication efficiency,

    J. Kone ˇcný, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” 2017. [Online]. Available: https://arxiv.org/abs/1610.05492

    2017 arXiv

  28. [36]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  29. [37]

    Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,

    P. Rieger, T. D. Nguyen, M. Miettinen, and A.-R. Sadeghi, “Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,” arXiv preprint arXiv:2201.00763 , 2022

    2022 arXiv

  30. [38]

    Freqfed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning,

    H. Fereidooni, A. Pegoraro, P. Rieger et al. , “Freqfed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning,” arXiv preprint arXiv:2312.04432 , 2023

    2023 arXiv

  31. [39]

    Auror: Defending against poisoning attacks in collaborative deep learning systems,

    S. Shen, S. Tople, and P. Saxena, “Auror: Defending against poisoning attacks in collaborative deep learning systems,” inProceedings of annual conference on computer security applications , 2016, pp. 508–519

    2016

  32. [40]

    Towards deep learning models resistant to adversarial attacks,

    A. M ˛ adry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” stat, vol. 1050, no. 9, 2017

    2017

  33. [41]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” 2019. [Online]. Available: https://arxiv.org/abs/1906.08935

    2019 arXiv

  34. [42]

    Fedrecover: Recovering from poisoning attacks in federated learning using historical information,

    X. Cao, J. Jia, Z. Zhang, and N. Z. Gong, “Fedrecover: Recovering from poisoning attacks in federated learning using historical information,” in IEEE Symposium on Security and Privacy. IEEE, 2023, pp. 1366–1383

    2023

  35. [43]

    Flairs: Fpga-accelerated inference-resistant & secure federated learning,

    H. Li, P. Rieger, S. Zeitouni, S. Picek, and A.-R. Sadeghi, “Flairs: Fpga-accelerated inference-resistant & secure federated learning,” in 2023 33rd International Conference on Field-Programmable Logic and Applications (FPL), 2023, pp. 271–276

    2023

  36. [44]

    Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy,

    M. Naseri, J. Hayes, and E. D. Cristofaro, “Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy,” CoRR, 2020

    2020

  37. [45]

    The limitations of federated learning in sybil settings,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “The limitations of federated learning in sybil settings,” in 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020) , 2020, pp. 301–316

    2020

  38. [46]

    Baffle: Backdoor de- tection via feedback-based federated learning,

    S. Andreina, G. Marson, H. Möllering et al. , “Baffle: Backdoor de- tection via feedback-based federated learning,” in IEEE International Conference on Distributed Computing Systems , 2021, pp. 852–863

    2021

  39. [47]

    Learn- ing differentially private language models without losing accuracy,

    H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, “Learn- ing differentially private language models without losing accuracy,” http://arxiv.org/abs/1710.06963

    arXiv

  40. [48]

    Machine learning with adversaries: byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: byzantine tolerant gradient descent,” in Pro- ceedings of the 31st International Conference on Neural Information Processing Systems, ser. NIPS’17, 2017, p. 118–128

    2017

  41. [49]

    Eluding secure aggregation in federated learning via model inconsistency,

    D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in federated learning via model inconsistency,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2429–2443

    2022

  42. [50]

    Holodeck: Language guided generation of 3d embodied ai environments,

    Y . Yang, F.-Y . Sun, L. Weihs et al. , “Holodeck: Language guided generation of 3d embodied ai environments,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 16 227–16 237

    2024

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.