Pith. sign in

REVIEW 5 major objections 5 minor 39 references

Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A sliding-mode controller lets a federated-learning attacker steer the global model to any preset accuracy level.

desk verdict Novel SMC-based FL poisoning attack with impressive empirical coverage, but the proof only covers an idealized controller the implementation doesn't actually run. read the letter →

arxiv 2505.16403 v2 pith:XRAZROKN submitted 2025-05-22 cs.LG cs.SYeess.SY

Huazi Pan , Yanjun Zhang , Leo Yu Zhang , Scott Adams , Abbas Kouzani , Suiyang Khoo This is my paper · ORCID
classification cs.LGcs.SYeess.SY
keywords federatedlearningmodelpoisoningslidingmodecontrolcontrollableattackByzantine-robustaggregationfinite-timeconvergenceglobalaccuracymanipulationadversarialmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces FedSA, a poisoning attack that treats federated learning as a control system and applies sliding mode control to steer the global model toward a poisoned reference model. The claimed result is that with 10% of clients malicious, the attacker can make the global model's test accuracy converge to a predetermined value, such as 60% instead of 66%, while evading eight Byzantine-robust aggregation rules. Attack speed is a tunable parameter, and the target accuracy can be changed mid-run by adjusting a single constant without retraining a new reference model. The paper proves that the sliding surface is reached in finite time and that the error between the global and reference model converges exponentially to a chosen offset.

What carries the argument

The load-bearing objects are the sliding surface $$s_t = \int(\dot{e}_t + k e_t + C)\,dt + C_1$$ and the control law $$u_t = \left[\frac{dF_{AGR}}{dw'_{t,i}}\right]^{-1}\left[k e_t + \eta\,\mathrm{sign}(s_t) - \Theta_t + C\right],$$ where $e_t = \tilde{w} - w_t$ is the error between the target poisoned model and the global model, $k$ sets the exponential rate, $C$ sets the final offset, and $\Theta_t$ is the combined derivative of the benign clients' contributions to the aggregation. Setting $s_t = \dot{s}_t = 0$ gives $\dot{e}_t = -k e_t - C$, whose solution converges to $-C/k$. The term $\eta\,\mathrm{sign}(s_t)$ enforces finite-time reachability of the surface through a Lyapunov argument, while the inverse Jacobian and $\Theta_t$ terms are what make the malicious update act directly on the aggregate in the proof.

What would settle it

Run FedSA against coordinate-wise Median with randomized client participation and compare the measured global accuracy trajectory to the target: if the trajectory still converges to $-C/k$ when the attacker's $\Theta_t$ estimate is wrong, the guarantee must come from a mechanism other than the exact cancellation in the proof; if it does not converge, the theorem's premise is violated. A cleaner test is to set the aggregation rule to a non-differentiable function and check whether the finite-difference Jacobian approximation in Eq. (10) is actually invertible.

Watch

Extended reading notes

Core claim

The central claim is Theorem 1: under the control law in Eq. (10), the sliding surface $s_t$ reaches zero in finite time and stays there, and the error $e_t = \tilde{w} - w_t$ converges to $-C/k$ exponentially fast. Since the adversary can choose the constant $C$, this fixes the steady-state global model at $w_t = \tilde{w} + C/k$, which the paper equates with a chosen test accuracy. The paper further claims that FedSA reaches this target with fewer malicious clients than prior flexible attacks, that its convergence speed is controlled by the gain $k$, and that it stays stealthy enough to pass Median, Trimmed Mean, Norm-Bounding, Bulyan, Mkrum, FLTrust, CC, and DNC in the reported experiments.

Load-bearing premise

The finite-time convergence guarantee in Theorem 1 requires the attacker to know or accurately estimate $\Theta_t$, the combined derivative of the benign clients' contributions, and the inverse Jacobian of the aggregation rule, even though the threat model says the adversary is unaware of the aggregation rule.

Editorial extensions

If this is right

  • An attacker with only 10% of clients can drive a federated model's test accuracy to any preset value, including near random guessing, rather than merely causing a denial of service.
  • Because the target is set by the constant $C$, the attacker can change the objective mid-training without constructing a new poisoned reference model.
  • The convergence speed is a free parameter $k$: larger $k$ reaches the target faster, giving the attacker a dial to trade stealth against speed.
  • The theoretical guarantee of finite-time reachability plus exponential convergence distinguishes FedSA from earlier model-replacement attacks that offer only heuristic convergence.
  • Ablation results indicate the attack remains effective as the malicious fraction drops to 5%, as client count grows to 200, and across Non-IID data splits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If FedSA works as claimed, defenses that filter statistically outlying updates are attacking the wrong axis: the attack's stealth comes from staying inside the benign distribution, not from being small in norm.
  • The finite-difference approximation of the aggregation Jacobian is questionable for non-differentiable rules such as Median or Krum, so the empirical success may be carried more by the sign term and the reaching phase than by exact inverse-Jacobian compensation.
  • A defender who randomizes client participation or injects noise into benign updates would break the exact cancellation of $\Theta_t$ on which the proof relies; testing FedSA under such perturbation is a direct extension of the paper's theory.
  • The same sliding-surface formalism could be redirected from global accuracy degradation to targeted misclassification or backdoor insertion, since the error is defined on model parameters rather than on accuracy itself.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes FedSA, a poisoning attack against federated learning that uses sliding mode control to steer the global model toward a pre-defined accuracy target. The attack is formulated as a continuous-time control problem: malicious clients choose local models so that the aggregated global model tracks a reference model with adjustable offset. The authors prove a finite-time convergence theorem for the sliding surface and exponential convergence of the tracking error, and they support the method with extensive experiments on CIFAR10, MNIST, and Tiny ImageNet against nine aggregation rules, reporting that FedSA reaches target accuracies with small errors and outperforms LIE, Min-Max, Min-Sum, and FMPA.

Significance. If the theoretical guarantee were valid for the implemented algorithm, this would be a noteworthy contribution: it would give an attacker the ability to set a federated model's test accuracy to a chosen value with only 10% malicious clients while evading several Byzantine-robust aggregation rules. The paper is also useful for its breadth of empirical evaluation and for raising the question of controllable, non-DoS poisoning attacks. However, I find that the central guarantee is not established for the actual attack: the proof cancels a term that the implementation does not compute, the finite-difference approximation of the AGR Jacobian is not a partial derivative and has no error bound, and the analysis is continuous-time while the algorithm operates in discrete FL rounds. The target accuracy, moreover, is achieved by tuning the parameter C rather than by an a priori mapping from desired accuracy to C. These issues are load-bearing for the paper's main claim.

major comments (5)
  1. [Sec. 3.2, Eq. (10); Supp.-1.1] The proof of Theorem 1 in Supp.-1.1 cancels the term Theta_t exactly (Eqs. (14)-(17)), but Algorithm 1 does not compute or estimate Theta_t, and Sec. 3.1 states that the adversary is unaware of the AGR rules. The text only says that dFAGR/dw' can be approximated by finite differences; it gives no estimator or error bound for Theta_t. For non-differentiable AGRs such as Median, Krum, and Bulyan, the partial Jacobian in Eq. (10) does not exist (or is zero almost everywhere), so the inverse in Eq. (10) is undefined. Consequently, the controller actually implemented in the experiments is different from the one that Theorem 1 proves, and the finite-time/exponential-convergence guarantee does not transfer to the experimental results, including the Median rows of Table 1.
  2. [Sec. 3.2, finite-difference formula] The finite-difference approximation for dFAGR/dw' is written as lim_{Delta w' -> 0} (F_AGR(t) - F_AGR(t - Delta t)) / Delta w'. This is not a partial derivative with respect to w'; it is a time-difference ratio divided by a parameter change, and it is dimensionally inconsistent as stated. No finite-difference step size or error bound is provided, so the approximation error in the inversion step of Eq. (10) is uncontrolled. Because this approximation is used by default in the experiments, the size of the discrepancy between the theoretical controller and the implemented one is unknown.
  3. [Theorem 1; Sec. 3.2; Algorithm 1] Theorem 1 is proved in continuous time for the ODE dynamics w' = u_t, while the FL system in Sec. 2.1 and Algorithm 1 operate in discrete communication rounds with local SGD updates and a global learning rate eta. The proof uses derivatives with respect to time, but no discretization analysis, sampling-time bound, or relationship between the continuous-time finite-time guarantee and the round index t is given. The experimental convergence curves therefore do not follow from Theorem 1 without additional arguments.
  4. [Sec. 4.1; Remark 2] The claimed 'performance guarantee' is weakened by the way target accuracies are obtained. In Sec. 4.1, the reference model has one accuracy (e.g., 60% for CIFAR10) and other objectives are 'set by adjusting C'; but the paper provides no mapping from C to test accuracy and no procedure for choosing C a priori. The reported |delta| values are therefore the outcome of fitting C (and k) to the target, not of a parameter-free prediction. To support the guarantee, the authors should either give a calibration method for C from the desired accuracy or report the sensitivity of the final accuracy to C.
  5. [Sec. 3.2, Eq. (10); Supp.-1.1, Remark 1] The supplement's Remark 1 suggests an alternative control law u_t = [dFAGR/dw']^{-1} [eta sign(s_t)] that omits the term Theta_t. If this simplified law is what was actually used in the experiments, then the proof of Theorem 1 does not apply to it at all: the derivation in Eqs. (14)-(17) relies on the exact cancellation of Theta_t, which cannot occur in the simplified law unless Theta_t is zero. The manuscript should state which control law was implemented and supply a matching proof, including the case where Theta_t is treated as a disturbance.
minor comments (5)
  1. [Remark 1, Sec. 3.2] The solution of e_t-dot = -k e_t - C is e_t = (e_0 + C/k)e^{-kt} - C/k, not e_t = 1/k * e^{-kt} - C/k as written; the current formula omits the initial condition and the e_0 term.
  2. [Sec. 3.2 and Supp.-1.1] Notation is inconsistent: Eq. (10) uses eta for the switching gain, while the proof in Supp.-1.1 uses alpha and eta_1 with eta = eta_1 + delta; the relationship between these constants is never stated, and the superscript in Eq. (16) (eta^1) appears to be a typo.
  3. [Table 1, Tiny ImageNet, Target Acc 45%] The entry '53.20 (18.2256.37 (25.27)' in the FedAvg row is malformed and should be split into separate Min-Sum and FMPA columns; as printed it is unreadable.
  4. [Sec. 4.1] The sentence 'as it is the benchmark setting in the literature of positioning attacks against FL' should read 'poisoning attacks'; 'positioning' is a typo.
  5. [Sec. 4.2] The 'stealth' claim is not directly measured: no detection rate, distance-to-benign-update metric, or robustness test against a defense that actively filters outliers is reported; the evasion claim rests only on the final accuracy staying close to the target, which does not by itself establish stealth.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the sliding-mode convergence is a constructive controller-synthesis result, and C is an attacker-chosen setpoint rather than a fitted prediction input.

full rationale

FedSA is a controller-synthesis paper, not a paper that fits a parameter to data and then predicts the same data. The sliding surface in Eq. (9), st = ∫(ėt + ket + C)dt + C1, is deliberately designed so that st = 0 gives ėt = -ket - C, whose solution converges to et = -C/k exponentially. Theorem 1 then supplies the standard two-part sliding-mode argument: a reachability proof via the Lyapunov function Vt = (1/2)st^2 and the sliding-phase dynamics. The exponential convergence to -C/k is therefore a designed property proved from the control law, not an independently discovered prediction that has been smuggled into the assumptions. The constant C is an attacker-chosen objective parameter, analogous to a setpoint in a controller, and the reported δ values measure tracking error for that specified target; the paper does not claim that Theorem 1 predicts test accuracy from C. The only self-citation that is load-bearing in the proof is the finite-time stability theorem of Khoo et al. 2009, but that is an independent published mathematical result that does not assume the FedSA conclusion, so it is real evidence and does not constitute circularity. There is a genuine validity gap: Eq. (10) requires knowledge or estimation of Θt and the inverse Jacobian of the aggregation rule, while Sec. 3.1 says the adversary is unaware of AGR rules and the finite-difference approximation shown is questionable for non-differentiable AGRs such as Median and Bulyan. That is a correctness and threat-model mismatch, but it is not a circular derivation: the proof does not hide the target result inside its assumptions. No circular step can be exhibited from the paper's equations, so the circularity score is 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on one fitted offset C that maps to target accuracy, several undisclosed hyperparameters (k, eta, C1, finite-difference step), and three strong modeling axioms: continuous-time FL dynamics, invertible differentiable aggregation, and exact knowledge or cancellation of benign update derivatives. The reference model is itself a fitted object selected by early stopping. No new physical or algorithmic entity is postulated beyond the standard sliding surface construction.

free parameters (6)
  • C = not disclosed; tuned per target accuracy
    C shifts the final error et to -C/k and is 'adjusted' in Sec. 4.1 to hit each target accuracy. No formula maps C to test accuracy.
  • k = ablation uses 2, 10, 20; default not stated
    k controls exponential convergence speed of et; the paper gives no default value for the main experiments.
  • eta = not disclosed
    The reaching gain in Eq. (10) must be positive and large enough; its value is never reported.
  • C1 = any constant; not specified
    Initial sliding surface value in Eq. (9); the paper says it can be any constant, so its choice is unspecified.
  • finite-difference step delta_w' = not disclosed
    Used to approximate dFAGR/dw' in the implementation; the step size is never reported.
  • reference model w_tilde = early-stopped model, selected per target accuracy
    The poisoned reference model is obtained by early stopping to exhibit the target accuracy; it is a data-dependent fitted object.
assumptions (5)
  • domain assumption The FL global model evolves as a continuous-time first-order system w_dot_t = u_t (Eq. 6).
    Real FL is discrete round-based; the control law and proof are formulated in continuous time, so the finite-time convergence guarantee may not transfer to the implemented discrete updates.
  • domain assumption The aggregation rule FAGR is differentiable and its Jacobian with respect to each malicious model is invertible (Theorem 1).
    Eq. (10) inverts dFAGR/dw'_{t,i}; many AGRs (Median, Trmean, Krum) are non-smooth or non-invertible, and the paper only says the derivative can be approximated by finite differences.
  • ad hoc to paper The attacker can compute or cancel the benign contribution Theta_t in Eq. (10).
    The adversary cannot observe benign clients' local training dynamics; without Theta_t the sliding-mode cancellation in Supp.-1.1 fails, yet the paper gives no method or error analysis for estimating it.
  • ad hoc to paper Choosing C shifts the final model parameters such that test accuracy reaches a preset target (Remark 2, Sec. 4.1).
    No relationship between parameter-space offset C/k and test accuracy is derived; C is adjusted empirically to hit each target accuracy.
  • standard math Finite-time stability theorem from Khoo et al. 2009 applies to the Lyapunov function V_t.
    Standard SMC result; acceptable as background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach." pith.science (2026). https://pith.science/paper/XRAZROKN

@misc{pith2026250516403,
  author       = {Pith},
  title        = {Pith review of: Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XRAZROKN}},
  note         = {Machine review of arXiv:2505.16403}
}
read the original abstract

Manipulation of local training data and local updates, i.e., the poisoning attack, is the main threat arising from the collaborative nature of the federated learning (FL) paradigm. Most existing poisoning attacks aim to manipulate local data/models in a way that causes denial-of-service (DoS) issues. In this paper, we introduce a novel attack method, named Federated Learning Sliding Attack (FedSA) scheme, aiming at precisely introducing the extent of poisoning in a subtle controlled manner. It operates with a predefined objective, such as reducing global model's prediction accuracy by 10%. FedSA integrates robust nonlinear control-Sliding Mode Control (SMC) theory with model poisoning attacks. It can manipulate the updates from malicious clients to drive the global model towards a compromised state, achieving this at a controlled and inconspicuous rate. Additionally, leveraging the robust control properties of FedSA allows precise control over the convergence bounds, enabling the attacker to set the global accuracy of the poisoned model to any desired level. Experimental results demonstrate that FedSA can accurately achieve a predefined global accuracy with fewer malicious clients while maintaining a high level of stealth and adjustable learning rates.

Figures

Figures reproduced from arXiv: 2505.16403 by the authors.

Figure 1
Figure 1. Convergence of st. Adversary’s Goal. For a FL classification task, the goal of a flexible MPA is to steer the global model wt = FAGR{w{t,1}, w{t,2}, ..., w{t,m}, ..., w{t,N}}, which would otherwise converge to the global optimum without attack, to￾ward a subpar reference model w˜. This reference model can be obtained through early stopping, say using the criterion that w˜ exhibits a 10% reduction in accuracy. As dep… view at source ↗
Figure 2
Figure 2. The comparison of existing attacks and our attack. The [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. illustrates the process of our FedSA. The derivative of st is s˙t = ˙et + ket + C, which is written at the top of the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 5
Figure 5. Figure 5: Ablation Study Results. Impact of the number of clients. In our experiments, 50 clients are participated in federated learning. We also evalu￾ated our model with an increasing number of clients, includ￾ing 100, 150, and 200 on CIFAR10 dataset with target accu￾racy 60%.…
Figure 4
Figure 4. Figure 4: Comparison of FMPA and FedSA against various AGRs [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 11
Figure 11. Figure 11: The results on MNIST against various AGRs with [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 6
Figure 6. Figure 6: Comparison figures on MNIST under 90%, 85% and 80%. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Comparison of different degree of Non-IID on CIFAR10. [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Comparison of different proportion of malicious clients on [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 11
Figure 11. Figure 11: Comparison figures on CIFAR10 under different attack [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Comparison figures on Tiny ImageNet under different [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 34 canonical work pages

  1. [1]

    Robust control of continuum robots using Cosserat rod theory.Mechanism and Machine Theory, 131:48–61, January

    [Alqumsan et al., 2019] Ahmad Abu Alqumsan, Suiyang Khoo, and Michael Norton. Robust control of continuum robots using Cosserat rod theory.Mechanism and Machine Theory, 131:48–61, January

    work page 2019

  2. [4]

    Ana- lyzing Federated Learning through an Adversarial Lens, November

    [Bhagoji et al., 2019] Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Ana- lyzing Federated Learning through an Adversarial Lens, November

    work page 2019

  3. [5]

    Analyzing Federated Learning through an Adversarial Lens

    arXiv:1811.12470. [Blanchard et al., 2017] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In Advances in Neural Information Processing Systems, volume

    work page Pith review arXiv 2017

  4. [10]

    Park, and Li Ma

    [Fang et al., 2021] Liandi Fang, Shihong Ding, Ju H. Park, and Li Ma. Adaptive Fuzzy Control for Stochastic High-Order Nonlinear Systems With Output Constraints. IEEE Transactions on Fuzzy Systems , 29(9):2635–2646, September

    work page 2021

  5. [12]

    In terms of running time, FedSA takes more time due to its more complex optimization process

    According to the Table 2, our attack FedSA can reach to different attack objectives even for the lowest random guess- ing accuracy without being noticed. In terms of running time, FedSA takes more time due to its more complex optimization process. Under identical experimental settings (CIFAR10, AlexNet, 50 clients, against Mkrum), the time to convergence ...

    work page 2023

  6. [16]

    [Khoo et al., 2009] Suiyang Khoo, Lihua Xie, and Zhihong Man

    arXiv:2012.13995. [Khoo et al., 2009] Suiyang Khoo, Lihua Xie, and Zhihong Man. Robust finite-time consensus tracking algorithm for multirobot systems. IEEE/ASME Transactions on Mecha- tronics, 14(2):219–228, April

    arXiv 2012

  7. [17]

    Finite-time stabilization of stochas- tic nonlinear systems in strict-feedback form

    [Khoo et al., 2013] Suiyang Khoo, Juliang Yin, Zhihong Man, and Xinghuo Yu. Finite-time stabilization of stochas- tic nonlinear systems in strict-feedback form. Automatica, 49(5):1403–1410,

    work page 2013

  8. [19]

    Tiny imagenet visual recognition challenge

    [Le and Yang, 2015] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3,

    2015

Show all 39 references
  1. [21]

    [Mahloujifar et al., 2019] Saeed Mahloujifar, Mohammad Mahmoody, and Ameer Mohammed

    Conference Name: IEEE Transactions on Industrial Informatics. [Mahloujifar et al., 2019] Saeed Mahloujifar, Mohammad Mahmoody, and Ameer Mohammed. Universal Multi- Party Poisoning Attacks. In Proceedings of the 36th Inter- national Conference on Machine Learning , pages 4274–

    2019

  2. [22]

    Communication-Efficient Learning of Deep Networks from Decentralized Data

    [McMahan et al., 2017] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Ar- cas. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th Inter- national Conference on Artificial Intelligence and Statis...

    2017

  3. [23]

    The Hidden Vulnerabil- ity of Distributed Learning in Byzantium, July

    [Mhamdi et al., 2018] El Mahdi El Mhamdi, Rachid Guer- raoui, and S ´ebastien Rouault. The Hidden Vulnerabil- ity of Distributed Learning in Byzantium, July

    2018

  4. [24]

    [Mu˜noz-Gonz´alez et al., 2017] Luis Mu ˜noz-Gonz´alez, Bat- tista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C

    arXiv:1802.07927. [Mu˜noz-Gonz´alez et al., 2017] Luis Mu ˜noz-Gonz´alez, Bat- tista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. To- wards Poisoning of Deep Learning Algorithms with Back- gradient Optimization. In Proceedings of th...

    2017 arXiv

  5. [25]

    Manipulating the Byzantine: Optimiz- ing Model Poisoning Attacks and Defenses for Federated Learning

    [Shejwalkar and Houmansadr, 2021] Virat Shejwalkar and Amir Houmansadr. Manipulating the Byzantine: Optimiz- ing Model Poisoning Attacks and Defenses for Federated Learning. In Proceedings 2021 Network and Distributed System Security Symposium,

    2021

  6. [26]

    Better Together: Attaining the Triad of Byzantine-robust Federated Learning via Lo- cal Update Amplification

    [Shen et al., 2022] Liyue Shen, Yanjun Zhang, Jingwei Wang, and Guangdong Bai. Better Together: Attaining the Triad of Byzantine-robust Federated Learning via Lo- cal Update Amplification. In Proceedings of the 38th An- nual Computer Security Applications Conference , pages 20...

    2022

  7. [27]

    [Sun et al., 2019] Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H

    ACM. [Sun et al., 2019] Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMa- han. Can You Really Backdoor Federated Learning?, December

    2019

  8. [28]

    [Xie et al., 2020] Cong Xie, Oluwasanmi Koyejo, and In- dranil Gupta

    arXiv:1911.07963. [Xie et al., 2020] Cong Xie, Oluwasanmi Koyejo, and In- dranil Gupta. Fall of Empires: Breaking Byzantine- tolerant SGD by Inner Product Manipulation. In Proceed- ings of The 35th Uncertainty in Artificial Intelligence Con- ference, pages 261–270. PMLR, August

    1911 arXiv

  9. [29]

    Learning feature pyramids for human pose estimation

    [Yang et al., 2017] Wei Yang, Shuang Li, Wanli Ouyang, Hongsheng Li, and Xiaogang Wang. Learning feature pyramids for human pose estimation. In 2017 IEEE Inter- national Conference on Computer Vision (ICCV) . IEEE, October

    2017

  10. [30]

    Finite-time stability and instability of stochastic nonlinear systems

    [Yin et al., 2011] Juliang Yin, Suiyang Khoo, Zhihong Man, and Xinghuo Yu. Finite-time stability and instability of stochastic nonlinear systems. Automatica, 47(12):2671– 2677,

    2011

  11. [32]

    [Young et al., 1999] K.D

    arXiv:1803.01498. [Young et al., 1999] K.D. Young, V .I. Utkin, and U. Oz- guner. A control engineer’s guide to sliding mode con- trol. IEEE Transactions on Control Systems Technology , 7(3):328–342, May

    1999 arXiv

  12. [34]

    En- abling privacy-preserving sharing of genomic data for gwass in decentralized networks

    [Zhang et al., 2019] Yanjun Zhang, Xin Zhao, Xue Li, Mingyang Zhong, Caitlin Curtis, and Chen Chen. En- abling privacy-preserving sharing of genomic data for gwass in decentralized networks. In Proceedings of the Twelfth ACM International Conference on Web Search and Data Mini...

    2019

  13. [35]

    Privcoll: Practical privacy-preserving collaborative machine learn- ing

    [Zhang et al., 2020] Yanjun Zhang, Guangdong Bai, Xue Li, Caitlin Curtis, Chen Chen, and Ryan KL Ko. Privcoll: Practical privacy-preserving collaborative machine learn- ing. In European Symposium on Research in Computer Security, pages 399–418. Springer,

    2020

  14. [36]

    A survey on federated learn- ing

    [Zhang et al., 2021] Chen Zhang, Yu Xie, Hang Bai, Bin Yu, Weihong Li, and Yuan Gao. A survey on federated learn- ing. Knowledge-Based Systems, 216:106775, March

    2021

  15. [37]

    Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning

    [Zhang et al., 2023] Hangtao Zhang, Zeming Yao, Leo Zhang, Shengshan Hu, Chao Chen, Alan Liew, and Zhetao Li. Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning. In Proceedings of the Thirty-Second International Joint Con-...

    2023

  16. [38]

    1.1 The proof of Theorem 1 The proof of Theorem 1 is introduced below: Proof. Defining a Lyapunov function (or energy function) Vt = 1 2 s2 t (11) and differentiating Vt with respect to time, we have ˙Vt = st ˙st (12) = st(− dFAGR(.) dw′ {t,i} ˙w′ {t,i} − Θt + ket + C). (13) U...

    2009

  17. [39]

    Datasets • CIFAR10 [Krizhevsky, 2009]

    2 Experiment Evaluation 2.1 Datasets, Attacks and Defenses In this section, we give details of our experiments settings. Datasets • CIFAR10 [Krizhevsky, 2009]. It is an image database with 60,000 colour images of 32 * 32 size in 10 classes equally, and it is divided into train...

    2009

  18. [1999]

    Terminal Sliding Mode Control – An Overview

    [Yu et al., 2021] Xinghuo Yu, Yong Feng, and Zhihong Man. Terminal Sliding Mode Control – An Overview. IEEE Open Journal of the Industrial Electronics Society , 2:36– 52,

    2021

  19. [2009]

    The MNIST Database of Handwrit- ten Digit Images for Machine Learning Research [Best of the Web]

    [Deng, 2012] Li Deng. The MNIST Database of Handwrit- ten Digit Images for Machine Learning Research [Best of the Web]. IEEE Signal Processing Magazine, 29(6):141– 142, November

    2012

  20. [2011]

    Byzantine-Robust Dis- tributed Learning: Towards Optimal Statistical Rates, February

    [Yin et al., 2021] Dong Yin, Yudong Chen, Kannan Ram- chandran, and Peter Bartlett. Byzantine-Robust Dis- tributed Learning: Towards Optimal Statistical Rates, February

    2021

  21. [2012]

    [Fang et al., 2020] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong

    Conference Name: IEEE Signal Processing Magazine. [Fang et al., 2020] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local Model Poisoning Attacks to Byzantine-Robust Federated Learning. pages 1605–1622,

    2020

  22. [2013]

    Krizhevsky

    [Krizhevsky, 2009] A. Krizhevsky. Learning Multiple Lay- ers of Features from Tiny Images

    2009

  23. [2015]

    DSP-Based Sliding-Mode Control for Electromagnetic-Levitation Precise-Position System

    [Lee et al., 2013] Jeng-Dao Lee, Suiyang Khoo, and Zhi-Bin Wang. DSP-Based Sliding-Mode Control for Electromagnetic-Levitation Precise-Position System. IEEE Transactions on Industrial Informatics , 9(2):817– 827, May

    2013

  24. [2017]

    FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping, April

    [Cao et al., 2022] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping, April

    2022

  25. [2018]

    [Jebreel and Domingo-Ferrer, 2023] Najeeb Moharram Je- breel and Josep Domingo-Ferrer

    ISSN: 2375-1207. [Jebreel and Domingo-Ferrer, 2023] Najeeb Moharram Je- breel and Josep Domingo-Ferrer. FL-defender: Combating targeted attacks in federated learning. Knowledge-Based Systems, 260:110178,

    2023

  26. [2019]

    How To Backdoor Federated Learning

    [Bagdasaryan et al., 2020] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How To Backdoor Federated Learning. In Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, pages 2938–2948. PMLR, June

    2020

  27. [2020]

    A Little Is Enough: Circumventing De- fenses For Distributed Learning

    [Baruch et al., 2019] Gilad Baruch, Moran Baruch, and Yoav Goldberg. A Little Is Enough: Circumventing De- fenses For Distributed Learning. In Advances in Neural Information Processing Systems , volume

    2019

  28. [2021]

    Agramplifier: Defending federated learning against poisoning attacks through local update amplifica- tion

    [Gong et al., 2024] Zirui Gong, Liyue Shen, Yanjun Zhang, Leo Yu Zhang, Jingwei Wang, Guangdong Bai, and Yong Xiang. Agramplifier: Defending federated learning against poisoning attacks through local update amplifica- tion. IEEE Transactions on Information Forensics and Se- cu...

    2024

  29. [2023]

    Learning from History for Byzan- tine Robust Optimization, June

    [Karimireddy et al., 2021] Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from History for Byzan- tine Robust Optimization, June

    2021

  30. [2024]

    Not all edges are equally robust: Evaluating the robustness of ranking-based federated learning

    [Gong et al., 2025] Zirui Gong, Yanjun Zhang, Leo Yu Zhang, Zhaoxi Zhang, Yong Xiang, and Shirui Pan. Not all edges are equally robust: Evaluating the robustness of ranking-based federated learning. In 2025 IEEE Sympo- sium on Security and Privacy (SP),

    2025

  31. [2025]

    Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

    [Jagielski et al., 2018] Matthew Jagielski, Alina Oprea, Bat- tista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning. In 2018 IEEE Symposium on Security and Privacy (SP) , pages 19–35, May

    2018

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.