Pith. sign in

REVIEW 2 major objections 5 minor 43 references

Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning

T0 review · 2 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DDFed claims that federated learning can be made both private and poisoning-resistant inside the existing single-server topology, by pairing fully homomorphic encryption with encrypted cosine-similarity scoring and majority-vote client…

desk verdict A genuinely new single-server combination of FHE secure aggregation and cosine-based poisoning defense, but the privacy half is broken as written: the shared perturbation in Eq. (4) is cancelable by any malicious client, so the DP claim is vacuous. read the letter →

arxiv 2502.05547 v1 pith:O6RR7F5O submitted 2025-02-08 cs.CR cs.AI

Runhua Xu , Shiqi Gao , Chao Li , James Joshi , Jianxin Li This is my paper · ORCID
classification cs.CRcs.AI
keywords federatedlearningmodelpoisoningattacksfullyhomomorphicencryptionsecureaggregationByzantine-robustanomalydetectiondifferentialprivacyencryptedsimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that a federated learning system can be simultaneously privacy-preserving and robust to model poisoning without changing the standard single-server, many-client topology. The proposed DDFed framework encrypts local updates with fully homomorphic encryption, performs cosine-similarity anomaly detection on the ciphertexts, and lets clients decrypt and vote on which updates to trust, after which the server does weighted secure aggregation. The authors also add a clipping step to counter attacks that similarity filtering alone misses. If the claim holds, privacy and robustness to malicious clients would no longer be a forced trade-off or require a second non-colluding server, which is the practical bottleneck in prior dual-defense schemes.

What carries the argument

The load-bearing mechanism is the encrypted cosine-similarity filter with client-side selection. Clients pre-normalize their local updates so that cosine similarity reduces to an inner product, which fully homomorphic encryption can evaluate; the server computes, per client, $\langle \llbracket \mathbf{W}_i^{(t)} / \lVert \mathbf{W}_i^{(t)} \rVert_2 \rrbracket + \Delta^{(t)}, \llbracket \mathbf{W}_G^{(t-1)} / \lVert \mathbf{W}_G^{(t-1)} \rVert_2 \rrbracket \rangle$ over ciphertexts of the extracted last layer. The encrypted score vector is sent to every client, each client decrypts and thresholds it, and the server takes a majority vote over the submitted selection lists to decide which updates enter the weighted secure aggregation. The perturbation $\Delta^{(t)}$ is the designated differential-privacy device for hiding similarity scores from malicious (Byzantine) clients, and a clipping step after aggregation is the device that makes the defense hold against scaling-type attacks.

What would settle it

Run the protocol with a corrupted client that decrypts its own similarity score, uses its own normalized update and the public global model to reconstruct the server's common perturbation, subtracts it from the other clients' scores, and measures whether the residuals reveal information about benign updates; if they do, the differential-privacy claim is false. A direct sensitivity calculation for the normalized-update inner product, which the paper's appendix never supplies, would also settle whether the stated Gaussian parameters establish any concrete $(\varepsilon,\delta)$ guarantee.

Watch

Extended reading notes

Core claim

The central claim, as the authors present it, is that the conflict between secure aggregation and anomaly detection can be dissolved by moving the two operations FHE cannot do—division and comparison—away from the aggregation server. Clients normalize updates before encryption, so the server only needs encrypted inner products; clients decrypt the resulting encrypted similarity scores and perform the threshold comparison locally. A majority vote over the clients' selection lists then gives the server a trusted aggregation group without revealing any update in plaintext. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under IPM, scaling, and ALIE attacks, in both cross-device and cross-silo settings, are used to support the claim that DDFed keeps accuracy close to the no-attack baseline and that the privacy noise does not degrade the aggregated model.

Load-bearing premise

The whole privacy guarantee rests on the assumption that one shared noise value added by the server to every encrypted update can hide each client's similarity score from a malicious fellow client; if a malicious client can compute its own score in plaintext and subtract that shared noise, the claimed protection collapses.

Editorial extensions

If this is right

  • A single aggregation server can hide all model updates from itself and still filter poisoned updates, so deployments no longer need a non-colluding two-server assumption.
  • The protocol preserves the standard federated learning topology and adds no new participant roles, so the framework can be adopted by changing the protocol rather than the deployment architecture.
  • Similarity-based defenses can be made privacy-preserving by moving normalization to the client and the selection threshold to a majority vote among clients, which is DDFed's main design pattern.
  • At attacker ratios below 0.5, the reported defense keeps model accuracy near the unattacked baseline across the tested attacks and datasets, with roughly a 20 percent increase in per-round time cost.
  • Because the differential-privacy noise touches only the similarity scores and not the aggregated weights, model utility is not reduced by the privacy mechanism in the reported settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same encrypted inner-product filter could express other inner-product-based robust aggregation rules, such as Krum-style geometric selection, without revealing plaintext updates, as long as the scoring step stays linear.
  • A natural hardening step is per-client Gaussian noise with a proven sensitivity bound, since a single shared perturbation is removable by any client that knows its own plaintext score.
  • The design uses one shared FHE key that lets every client decrypt the global model, so a threshold-decryption or key-sharing variant would be needed before the scheme fits settings where clients do not trust each other symmetrically.
  • An unstated stress test is an adaptive poisoning attack in which malicious clients know the majority-vote threshold and tune their updates to stay just above it; the paper's evaluation uses fixed attack recipes rather than such tailored ones.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes DDFed, a federated learning framework that combines fully homomorphic encryption (FHE)-based secure aggregation with a two-phase anomaly detection mechanism for encrypted model updates. The server computes encrypted cosine-similarity scores between normalized local updates and the previous global model, adds Gaussian perturbation intended to provide differential privacy for the decrypted scores, and asks clients to decrypt and vote on the set of trustworthy clients. The final aggregation uses FedAvg-style weights over the voted set, plus a clipping step by benign clients. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 compare DDFed with several robust aggregation baselines under IPM, scaling, and ALIE poisoning attacks, reporting strong defense accuracy and modest overhead.

Significance. If the claimed guarantees held, DDFed would be a meaningful advance: it promises simultaneous privacy and Byzantine robustness in a single-server FL topology without non-colluding servers or three-party computation. The experimental evaluation is thorough on the poisoning side, with public datasets, multiple attacks, ablations on attacker ratio, client count, and epsilon, and the code is made available. However, the privacy half of the contribution is not established: the perturbation in Eq. (4) is common to all clients and can be canceled by any malicious client, and the appendix's DP analysis omits the required sensitivity calculation. Since the paper's headline claim is the simultaneous dual defense, the unsupported privacy guarantee is load-bearing.

major comments (2)
  1. [§3.2, Eq. (4)] The server adds a single perturbation vector Δ(t) to every client's encrypted normalized update before computing the inner product with the previous global model. Because the decrypted score list is returned to all clients, any malicious client C_j can compute its own true score s_j = <u_j, v> from its plaintext normalized update u_j and the publicly available (decrypted) global model v, observe its noisy score s'_j, and recover n = s'_j - s_j. Subtracting n from every other s'_i recovers each benign client's exact cosine similarity, contradicting the privacy claim in §3.3 and Appendix A.3.2. The perturbation must be client-specific, or the protocol must prevent clients from seeing the full score list, for the Byzantine-client privacy argument to have any force.
  2. [Appendix A.3.2] The differential privacy analysis never specifies the function f whose sensitivity Δ_f must be bounded. Equation (7) defines σ in terms of Δ_f, but no bound is derived for the normalized last-layer inner product, and no adjacent-dataset relation is stated. As a result, the paper provides no concrete (ε, δ) guarantee for any participant. The sentence 'By adding Gaussian noise, each client's similarity score computation adheres to (ε, δ)-differential privacy' is asserted, not derived.
minor comments (5)
  1. [Abstract and Section 2] The text contains typographical errors ('offen', 'we proposes', 'DDF ed', 'SCALINE' in Tables 4 and 5, 'ALE' in Table 3 caption) that should be corrected.
  2. [Eq. (3)] Equation (3) is expressed as if the norm operations are applied to ciphertexts; since normalization is done by clients in plaintext, the notation should be clarified to avoid suggesting FHE supports division.
  3. [Section 4.1] The non-IID parameter q is mentioned but never defined; please define it or cite its source.
  4. [Algorithm 1] Line 8 returns a model M(m)_G that is never defined; presumably this is W(T)_G.
  5. [Section 4] The paper does not report any privacy evaluation (e.g., measured epsilon, attack experiments on score inference); the privacy claim is supported only by the flawed analysis in Appendix A.3.2.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: DDFed's defense is evaluated against external attacks, its core contribution is explicitly privacy-enabling of an existing similarity defense, and the main DP gap is an unsupported soundness claim rather than a derivation that reduces to its own inputs.

full rationale

Walking the derivation chain, the core pipeline is assembled from external building blocks rather than from the paper's own conclusions. The cosine-similarity detection (Eq. 2) and its normalization rewrite (Eq. 3) are standard; the FHE aggregation is standard CKKS; the anomaly-selection threshold is the mean of the decrypted similarity scores; and the experiments are compared against independent attacks (IPM, SCALING, ALIE) on public datasets. No parameter is fitted to the defended accuracy numbers and then reported as a prediction. The self-citations ([2], [35], [36]) appear only as background on privacy risks and existing secure-aggregation primitives; they do not carry the load-bearing argument. The paper also explicitly states that its core contribution is not a new poisoning defense but adding privacy features to existing server-side similarity defenses, so the 'renaming known result' pattern does not apply. The one serious gap is the DP analysis in Appendix A.3.2: it asserts (epsilon, delta)-DP for the similarity scores after adding noise in Eq. (4), but never bounds the sensitivity Delta_f, and Eq. (4) adds a single common Delta(t) to every client's encrypted update. That makes the Byzantine-client privacy claim unsupported, since a malicious client could recover its own true score and cancel the common inner-product noise. This is a soundness defect, not a circularity: the privacy conclusion is not equivalent to its input by construction, and the poisoning-defense experiments stand independently. Score 1.0 reflects the absence of circular derivation while acknowledging this unresolved privacy-support gap and the background self-citations.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central privacy claim rests on cryptographic assumptions (CKKS security and correctness), an unproven DP calibration, and the honest-but-curious non-colluding server assumption. The poisoning defense rests on the majority-benign assumption and on the empirical claim that last-layer cosine similarity separates poisoned updates.

free parameters (4)
  • DP budget epsilon = 0.01 (default)
    Chosen by hand as the default privacy budget for the Gaussian perturbation; the paper does not derive a required value and the claims depend on it.
  • DP sensitivity Delta_f = not specified
    Required by Eq. (7) to set sigma, but never bounded for the released cosine scores, so the DP guarantee is not actually instantiated.
  • DP delta = not specified
    Appears in the Gaussian mechanism formula but no numerical value is given in the experiments.
  • clipping bound = not specified
    Post-aggregation clipping is introduced to resist scaling attacks, but the norm bound is never stated, making the defense not fully reproducible.
assumptions (5)
  • standard math The FHE scheme CKKS provides correct enough arithmetic on encrypted real numbers, and its semantic security hides plaintext updates from the server.
    Used throughout Section 3.2 for secure aggregation and secure inner products; not proven in the paper, treated as a cryptographic primitive.
  • domain assumption The aggregation server is honest-but-curious and does not collude with malicious clients.
    Section 3.1 threat model; if the server colludes with a malicious client, that client's shared secret key can decrypt any client update sent to the server.
  • domain assumption Fewer than half of clients are malicious and all benign clients follow the protocol and honestly report their filtered groups.
    Section 3.1 and 'Feedback-driven Collaborative Selection'; the majority-vote defense collapses at r_attack >= 0.5.
  • domain assumption The last layer of local model weights captures label distribution, so cosine similarity of last layers is a sufficient poisoning signal.
    Section 3.2, based on observation in [38]; no independent verification in this paper.
  • ad hoc to paper Adding Gaussian noise in the encrypted domain does not change the plaintext similarity scores beyond the intended DP noise.
    Appendix A.3.3 admits this is not proven and only supports it with a simulated experiment; the common-noise construction is shown flawed in this review.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/O6RR7F5O

@misc{pith2026250205547,
  author       = {Pith},
  title        = {Pith review of: Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/O6RR7F5O}},
  note         = {Machine review of arXiv:2502.05547}
}
read the original abstract

Federated learning (FL) is inherently susceptible to privacy breaches and poisoning attacks. To tackle these challenges, researchers have separately devised secure aggregation mechanisms to protect data privacy and robust aggregation methods that withstand poisoning attacks. However, simultaneously addressing both concerns is challenging; secure aggregation facilitates poisoning attacks as most anomaly detection techniques require access to unencrypted local model updates, which are obscured by secure aggregation. Few recent efforts to simultaneously tackle both challenges offen depend on impractical assumption of non-colluding two-server setups that disrupt FL's topology, or three-party computation which introduces scalability issues, complicating deployment and application. To overcome this dilemma, this paper introduce a Dual Defense Federated learning (DDFed) framework. DDFed simultaneously boosts privacy protection and mitigates poisoning attacks, without introducing new participant roles or disrupting the existing FL topology. DDFed initially leverages cutting-edge fully homomorphic encryption (FHE) to securely aggregate model updates, without the impractical requirement for non-colluding two-server setups and ensures strong privacy protection. Additionally, we proposes a unique two-phase anomaly detection mechanism for encrypted model updates, featuring secure similarity computation and feedback-driven collaborative selection, with additional measures to prevent potential privacy breaches from Byzantine clients incorporated into the detection process. We conducted extensive experiments on various model poisoning attacks and FL scenarios, including both cross-device and cross-silo FL. Experiments on publicly available datasets demonstrate that DDFed successfully protects model privacy and effectively defends against model poisoning threats.

Figures

Figures reproduced from arXiv: 2502.05547 by the authors.

Figure 1
Figure 1. Overview of DDFed framework and illustration of a single round DDFed training. only the corrupted client subset will also initiate model poisoning attacks to undermine the global model. 3.2 Framework Details Objective of DDFed. DDFed is designed to bolster privacy protection and mitigate model poisoning attacks seamlessly within the existing FL framework. Unlike existing private and robust approaches [39, 13, 16, 43… view at source ↗
Figure 2
Figure 2. Comparison of defense effectiveness across various defense approaches, evaluated on [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Comparison of DDFed effectiveness across different attack ratios, evaluated on MNIST (top) and FMNIST (bottom), under IPM attack (left), ALIE attack (middle), and SCALING attack (right). 0 20 40 60 80 100 FL training round 0 25 50 75 100 test accuracy attack start mnist dataset, IPM attack clients=10 clients=50 clients=100 0 20 40 60 80 100 FL training round 0 20 40 60 80 test accuracy attack start fmnist dataset, I… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of DDFed effectiveness across different client numbers, evaluated on MNIST (top) and FMNIST (bottom), under IPM attack (left), ALIE attack (middle), and SCALING attack (right). performance. Note that DDFed remains robust even when attackers target the system…
Figure 5
Figure 5. Figure 5: Impact of hyper-parameter ϵ of differential privacy based perturbation at secure similarity computation phase, evaluated on MNIST (left) and FMNIST (right), under IPM attack. 9 [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Impact of hyper-parameter ϵ of differential privacy based perturbation at secure similarity computation phase with client number 100, evaluated on MNIST (left) and FMNIST (right), under IPM attack [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 38 canonical work pages

  1. [38]

    D. N. Yaldiz, T. Zhang, and S. Avestimehr. Secure federated learning against model poisoning attacks via client filtering. In ICLR 2023 Workshop on Backdoor Attacks and Defenses in Machine Learning, 2023

    work page 2023

  2. [1]

    Bagdasaryan, A

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov. How to backdoor federated learning. In International conference on artificial intelligence and statistics, pages 2938–2948. PMLR, 2020

    work page 2020

  3. [2]

    Baracaldo and R

    N. Baracaldo and R. Xu. Protecting against data leakage in federated learning: What approach should you choose? In Federated Learning: A Comprehensive Overview of Methods and Applications, pages 281–312. Springer, 2022

    work page 2022

  4. [3]

    Baruch, M

    G. Baruch, M. Baruch, and Y . Goldberg. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019

    work page 2019

  5. [4]

    Benaissa, B

    A. Benaissa, B. Retiat, B. Cebere, and A. E. Belfedhal. Tenseal: A library for encrypted tensor operations using homomorphic encryption, 2021

    work page 2021

  6. [5]

    Blanchard, E

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017

    work page 2017

  7. [6]

    Bonawitz, V

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017. 10

    work page 2017

  8. [7]

    X. Cao, M. Fang, J. Liu, and N. Z. Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In ISOC Network and Distributed System Security Symposium (NDSS), 2021

    work page 2021

Show all 43 references
  1. [8]

    J. H. Cheon, A. Kim, M. Kim, and Y . Song. Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology–ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-...

    2017

  2. [9]

    C. Dong, J. Weng, M. Li, J.-N. Liu, Z. Liu, Y . Cheng, and S. Yu. Privacy-preserving and byzantine-robust federated learning. IEEE Transactions on Dependable and Secure Computing, 2023

    2023

  3. [10]

    M. Fang, X. Cao, J. Jia, and N. Gong. Local model poisoning attacks to {Byzantine-Robust} federated learning. In 29th USENIX security symposium (USENIX Security 20), pages 1605– 1622, 2020

    2020

  4. [11]

    Geiping, H

    J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems, 33:16937–16947, 2020

    2020

  5. [12]

    H. Guo, H. Wang, T. Song, Y . H. R. Ma, X. Jin, Z. Xue, and H. Guan. Siren+: Robust federated learning with proactive alarming and differential privacy. IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  6. [13]

    M. T. Hossain, S. Islam, S. Badsha, and H. Shen. Desmp: Differential privacy-exploited stealthy model poisoning attacks in federated learning. In 2021 17th International Conference on Mobility, Sensing and Networking (MSN), pages 167–174. IEEE, 2021

    2021

  7. [14]

    Huang, S

    Y . Huang, S. Gupta, Z. Song, K. Li, and S. Arora. Evaluating gradient inversion attacks and defenses in federated learning. Advances in Neural Information Processing Systems, 34:7232– 7241, 2021

    2021

  8. [15]

    Huang, G

    Y . Huang, G. Yang, H. Zhou, H. Dai, D. Yuan, and S. Yu. Vppfl: A verifiable privacy-preserving federated learning scheme against poisoning attacks. Computers & Security, 136:103562, 2024

    2024

  9. [16]

    Jiang, Y

    Y . Jiang, Y . Li, Y . Zhou, and X. Zheng. Mitigating sybil attacks on differential privacy based federated learning. arXiv preprint arXiv:2010.10572, 2020

    2010 arXiv

  10. [17]

    Kairouz, H

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings, et al. Advances and open problems in federated learning. Foundations and trends® in machine learning, 14(1–2):1–210, 2021

    2021

  11. [18]

    Konecn`y, H

    J. Konecn`y, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 8, 2016

    2016 arXiv

  12. [19]

    LeCun, C

    Y . LeCun, C. Cortes, and C. J. Burges. Mnist handwritten digit database.http://yann.lecun. com/exdb/mnist, 2010

    2010

  13. [20]

    X. Li, X. Yang, Z. Zhou, and R. Lu. Efficiently achieving privacy preservation and poisoning attack resistance in federated learning. IEEE Transactions on Information Forensics and Security, 2024

    2024

  14. [21]

    C. Liu, S. Chakraborty, and D. Verma. Secure model fusion for distributed learning using partial homomorphic encryption. In Policy-Based Autonomic Data Governance, pages 154–179. Springer, 2019

    2019

  15. [22]

    X. Liu, H. Li, G. Xu, Z. Chen, X. Huang, and R. Lu. Privacy-enhanced federated learning against poisoning adversaries. IEEE Transactions on Information Forensics and Security , 16:4574–4588, 2021

    2021

  16. [23]

    Z. Ma, J. Ma, Y . Miao, Y . Li, and R. H. Deng. Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Transactions on Information Forensics and Security, 17:1639–1654, 2022. 11

    2022

  17. [24]

    M. Nasr, R. Shokri, and A. Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019

    2019

  18. [25]

    T. D. Nguyen, P. Rieger, R. De Viti, H. Chen, B. B. Brandenburg, H. Yalame, H. Möllering, H. Fereidooni, S. Marchal, M. Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security 22), pages 1415–1432, 2022

    2022

  19. [26]

    Pillutla, S

    K. Pillutla, S. M. Kakade, and Z. Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70:1142–1154, 2022

    2022

  20. [27]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership inference attacks against machine learning models. In IEEE S&P’17, pages 3–18. IEEE, 2017

    2017

  21. [28]

    J. Sun, A. Li, L. DiValentin, A. Hassanzadeh, Y . Chen, and H. Li. Fl-wbc: Enhancing robustness against model poisoning attacks in federated learning from a client perspective. Advances in Neural Information Processing Systems, 34:12613–12624, 2021

    2021

  22. [29]

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    1911 arXiv

  23. [30]

    Truex, N

    S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y . Zhou. A hybrid approach to privacy-preserving federated learning. In ACM AISec’19, pages 1–11, 2019

    2019

  24. [31]

    S. Wang, J. Hayase, G. Fanti, and S. Oh. Towards a defense against federated backdoor attacks under continuous training. Transactions on Machine Learning Research, 2022

    2022

  25. [32]

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V . Poor. Federated learning with differential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security, 15:3454–3469, 2020

    2020

  26. [33]

    H. Xiao, K. Rasul, and R. V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  27. [34]

    C. Xie, O. Koyejo, and I. Gupta. Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation. In Uncertainty in Artificial Intelligence, pages 261–270. PMLR, 2020

    2020

  28. [35]

    R. Xu, N. Baracaldo, Y . Zhou, A. Anwar, S. Kadhe, and H. Ludwig. Detrust-fl: Privacy- preserving federated learning in decentralized trust setting. In 2022 IEEE 15th International Conference on Cloud Computing (CLOUD), pages 417–426. IEEE, 2022

    2022

  29. [36]

    R. Xu, N. Baracaldo, Y . Zhou, A. Anwar, and H. Ludwig. Hybridalpha: An efficient approach for privacy-preserving federated learning. In ACM AISec’19, pages 13–23, 2019

    2019

  30. [37]

    Xu and L

    X. Xu and L. Lyu. A reputation mechanism is all you need: Collaborative fairness and adversarial robustness in federated learning. arXiv preprint arXiv:2011.10464, 2020

    2011 arXiv

  31. [39]

    M. Yang, H. Cheng, F. Chen, X. Liu, M. Wang, and X. Li. Model poisoning attack in differential privacy-based federated learning. Information Sciences, 630:158–172, 2023

    2023

  32. [40]

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pages 5650–5659. Pmlr, 2018

    2018

  33. [41]

    Zhang, S

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu. Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning. In USENIX ATC’20), pages 493–506, 2020

    2020

  34. [42]

    Zhang, G

    K. Zhang, G. Tao, Q. Xu, S. Cheng, S. An, Y . Liu, S. Feng, G. Shen, P.-Y . Chen, S. Ma, et al. Flip: A provable defense framework for backdoor mitigation in federated learning. In The Eleventh International Conference on Learning Representations, 2022

    2022

  35. [43]

    Zhang, J

    Z. Zhang, J. Li, S. Yu, and C. Makaya. Safelearning: Secure aggregation in federated learning with backdoor detectability. IEEE Transactions on Information Forensics and Security, 2023. 12 A Appendix A.1 DDFed Algorithm Algorithm 1: DDFed Training Input: clients {C1, ...,Cm}, ...

    2023

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.