Pith. sign in

REVIEW 3 major objections 4 minor 59 references

FedThief lets malicious federated-learning clients degrade the global model while privately building a better ensemble model.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

FedThief lets malicious federated learning clients poison the global model while training a private ensemble model that outperforms it.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Worth a serious look because the self-centered threat model is genuinely new, but the headline advantage metric is confounded by the missing benign-ensemble baseline. the 3 major comments →

arxiv 2509.00540 v1 pith:RHL3I4IH submitted 2025-08-30 cs.LG cs.CR

FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learning

Xiangyu Zhang , Mang Ye This is my paper
classification cs.LG cs.CR
keywords federated learningByzantine attackself-centered attackmodel poisoningknowledge distillationensemble learningadversarial machine learning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces a new attack paradigm, Self-Centered Federated Learning (SCFL), in which malicious clients in federated learning are not satisfied with merely disrupting the shared model: they also want their own private model to beat everyone else's. The authors argue that existing Byzantine attack research assumes attackers sabotage at their own cost, which does not match real-world competitors who are utility-maximizing. They propose FedThief, a dual-model framework: one model crafts poisoned updates for upload, while another is privately optimized with an ensemble that fuses local knowledge, global updates, and a corrective error model. The central claim is that FedThief lets attackers degrade the global model while maintaining or improving their own private accuracy, creating an asymmetric advantage quantified by the metric Delta_mal = Acce - Accg. If correct, this expands the federated-learning threat model from pure disruption to self-centered, utility-driven adversaries.

Core claim

FedThief establishes a new class of federated-learning attack in which the same malicious client simultaneously harms the shared global model and improves its own private model. The attack preserves the strength of a chosen Byzantine attack by using a dedicated malicious model solely to generate poisoned gradients, while a separate private model is trained through divergence-aware ensemble optimization. The ensemble combines three information sources: the private model's local knowledge, the poisoned global trajectory carried by the malicious model, and an error model that simulates the global degradation. A logistic-regression ensemble head is trained on a held-out local validation set, the

What carries the argument

The central mechanism is the divergence-aware ensemble optimization combined with a dual-model architecture. Each malicious client maintains four models: a private model optimized for local accuracy, a malicious model that produces the poisoned gradient, an error model that mimics the global model's degradation, and an ensemble head—a multinomial logistic regression over the logits of the other three models. The ensemble heads from all malicious clients are averaged to form a global ensemble classifier (Eq. 20), which acts as a consensus soft teacher for knowledge distillation into the private model via KL divergence, balanced with cross-entropy loss (Eq. 23). This lets the attacker extract

Load-bearing premise

The framework assumes malicious clients know the full set of colluding clients and can coordinate by sharing their ensemble heads to form the global ensemble teacher in Eq. (20), which requires a covert or pre-arranged communication channel that the server cannot detect or disrupt.

What would settle it

Deploy FedThief in a federation with exactly one malicious client, where the ensemble teacher in Eq. (20) degenerates to a single local head; if the private model no longer consistently outperforms the degraded global model, the private-benefit claim depends on adversarial collusion rather than the ensemble mechanism alone. Alternatively, intercept or block the out-of-band sharing of ensemble heads between clients; if Acce then falls to or below Accg, the central advantage is falsified.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If FedThief is correct, federated-learning defenses must handle adversaries that both poison the shared model and privately benefit, not just disrupt it.
  • Malicious clients can achieve private accuracy near the clean global baseline even when the global model is degraded by more than 20 percentage points at 40% malicious participation.
  • The approach is agnostic to the attack vector: it works with gradient-based Byzantine attacks (LIE, MinSum, FedGhost) and with label-flipping data poisoning, suggesting broad applicability.
  • The advantage holds across a range of robust aggregators (Bulyan, Multi-Krum, Trimmed-Mean, Median) as well as standard FedAvg and FedProx, implying the private benefit is not easily removed by existing defenses.
  • Because only the malicious model is used to craft uploaded gradients, FedThief preserves the underlying attack's global degradation while adding private optimization, making the adversary strictly better off.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The collusion requirement in Eq. (20)—malicious clients must know each other and share ensemble heads—is a natural point to test single-adversary settings; if one attacker cannot form the consensus teacher, the private benefit may weaken substantially.
  • This threat model generalizes beyond image classification: any competitive federation (finance, healthcare, industry consortia) where participants have both collaborative and rival incentives could host such self-centered attacks, so the paper implicitly argues that robust aggregation alone is insufficient.
  • A testable extension is to detect the divergence pattern itself: since the private model is deliberately kept close to but not identical with the global trajectory, monitoring per-client update consistency across rounds, or checking for coordinated ensemble-head submissions, could expose FedThief.
  • The paper's assumption that local validation data is representative enough to train the ensemble head suggests a boundary case: with highly imbalanced or extremely sparse non-IID data, the private gain may vanish; this is a concrete setting where the attack's effectiveness could collapse.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces Self-Centered Federated Learning (SCFL), an attack paradigm in which malicious FL clients aim both to degrade the global model and to obtain a private model that outperforms it. The proposed framework, FedThief, maintains a private model, a malicious model used to craft poisoned gradients, an error model, and an ensemble head trained on a local validation split. After each round, malicious clients aggregate their ensemble heads into a consensus teacher (Eq. 20) and distill its soft targets into the private model via a combined CE+KD loss (Eqs. 21-23). Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under LIE, MinSum, FedGhost, and label-flipping attacks report accuracy of the global model versus the malicious ensemble, quantified by Δ_mal = Acc_e - Acc_g (Eq. 25). The paper claims that FedThief both degrades the global model and gives attackers a significant private-model advantage.

Significance. If validated, the SCFL paradigm would expand the FL threat model from pure disruption to utility-driven, self-centered adversaries, which is a timely and important direction. The paper is clearly written, the algorithmic decomposition is plausible, and the evaluation is broad in terms of attacks (LIE, MinSum, FedGhost, label flipping), defenses (FedAvg, FedProx, Bulyan, Multi-Krum, Trimmed-Mean, Median), and component ablations (λ, v, temperature, ensemble constituents). The framework's separation of attack execution from private-model optimization is a sensible design. However, the central empirical claim of private benefit is currently confounded: Δ_mal compares the attacker's multi-model ensemble against a global model that the attackers themselves have degraded. Without a benign-ensemble control, the measured advantage may be an artifact of ensembling and knowledge distillation rather than a benefit derived from poisoning. The significance of the work rests on resolving this confound.

major comments (3)
  1. [§III.D, Eq. (20)] The central metric Δ_mal = Acc_e − Acc_g is defined relative to the global model that the attackers deliberately poison. The reported positive Δ_mal therefore does not demonstrate that the attacker gains relative to a system without poisoning. Table II shows that Acc_e typically stays below the clean global baseline gAcc_g (e.g., CIFAR-10/FedAvg/LIE α=0.4: Acc_e=52.24 vs. gAcc_g=61.28). The claim that FedThief 'harming others to benefit oneself' requires a control condition in which the identical ensemble/KD pipeline is run without poisoning (e.g., β=0 in Eq. 13) or against a non-degraded global model. Table V shows that the ensemble alone can contribute several points on CIFAR-10, so this confound is not negligible. Please add such a control and report Acc_e in that condition; if Acc_e is comparable to or higher than the poisoned-case ensemble, the self-benefit claim must be substantial
  2. [§IV.A and §V] The consensus teacher L^{t+1} is formed by averaging the malicious clients' ensemble heads, which requires attackers to know the full set K_m and to share their logistic regression heads through some covert channel. This is a load-bearing assumption: if coordination is unavailable or detected, the KD step that transfers ensemble knowledge to the private model cannot be formed. The paper does not analyze the cost, detectability, or failure modes of this collusion. At minimum, please discuss how the malicious clients discover K_m and communicate heads without being detected by the server, or provide a variant that uses only the local ensemble head as teacher and compare its performance.
  3. [§IV.C.1] Section IV.A states 'All datasets are evenly and independently partitioned—i.e., under IID settings—without data heterogeneity,' and all reported experiments appear to be IID. However, the Conclusion claims the framework was evaluated 'under varying levels of data heterogeneity.' This is an internal inconsistency that overstates the empirical scope. Either add non-IID experiments (e.g., Dirichlet partitions) or revise the conclusion to explicitly limit the claims to IID settings. Also, §IV.C.1 claims that 'attack degradation on the global model is identical' with and without FedThief, but Table II only reports Acc_g for FedThief and does not include a standalone-attack baseline (e.g., LIE without the ensemble/KD machinery). Please provide such a baseline or weaken the claim.
minor comments (4)
  1. [Eq. (24)] The implementation sets distillation temperature τ=3.0, but Eq. (22) defines P and Q as plain softmax outputs without temperature. Please include the softened softmax with τ in the equation, otherwise the formal description disagrees with the experiments.
  2. [Algorithm 1] Eq. (24) uses θ^{t+1}_p on both sides; the right-hand side should be θ^t_p. Please correct this transposed superscript.
  3. [General] Algorithm 1 lists 'the server's aggregation' as a step inside the client's attack execution. The algorithm should stop after uploading the poisoned gradient; the aggregation step belongs to the server environment.
  4. [General] Several typos and formatting issues: 'As shown in1' and 'as shown in2' in §III, 'Model Accurancy' in Fig. 3, inconsistent use of 'FASHION' vs. 'Fashion-MNIST', and garbled characters in Fig. 4 axis labels. Please proofread and regenerate figures.

Circularity Check

0 steps flagged

No significant circularity: the central claims are empirical; the main concern is a missing control condition, not a derivation-level circularity.

full rationale

FedThief's central claims are empirical measurements, not derived predictions. The malicious advantage metric Δmal = Acce − Accg (Eq. 25) is a definition used to report measured accuracies, not a fitted parameter or a quantity forced by construction. The paper even reports negative Δmal in several configurations (e.g., MNIST/Bulyan −0.04, Multi-Krum −0.18, Trimmed-mean −0.39), showing the sign is not tautological. The strongest concern, raised in the reader's take, is the absence of a benign-ensemble control: Acce is measured on a multi-model ensemble with a validation-trained logistic head and knowledge distillation, while Accg is a single global model deliberately degraded by the same attackers. This is a legitimate experimental-design confound (does the benefit come from poisoning or merely from ensembling?), but it is not circularity under the required standard: Acce and Accg are independently measured, and no equation in the paper reduces to an input by construction. The framework's assumption that malicious clients collude (sharing gradients and ensemble heads, Eq. 17 and Eq. 20) is an explicitly stated threat-model assumption, not a circular step. Self-citations in the paper are background references and are not load-bearing; no uniqueness theorem or prior same-author result is invoked to force the framework. The Discussion openly acknowledges limitations such as sensitivity to private-data quality, again consistent with empirical claims rather than a derivation. Overall, the paper's logic is self-contained at the level it claims; the missing benign-ensemble baseline is a correctness/validity concern, not circularity.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 1 invented entities

The central claim depends on a set of tuned hyperparameters (lambda, tau, v, beta, local epochs) and on the structural assumption that malicious clients can coordinate by sharing ensemble heads. The error model is an algorithmic construct with empirical support from the ablation study.

free parameters (5)
  • lambda (loss trade-off) = 0.5
    Chosen via ablation on CIFAR-10 (Fig. 5); balances cross-entropy and knowledge distillation losses in Eq. (23).
  • tau (distillation temperature) = 3.0
    Tuned via ablation on CIFAR-10 (Table VI); softens teacher logits for knowledge distillation.
  • v (validation partition ratio) = 5
    Chosen via ablation (Table IV); controls the train/validation split of the attacker's local dataset.
  • beta (attack perturbation magnitude) = not reported
    Scale of the Byzantine perturbation in Eq. (13); the actual values used for LIE, MinSum, and FedGhost are not specified in the paper.
  • local epochs = 2 (MNIST/FASHION), 4 (CIFAR-10)
    Set in implementation details (Section IV.A.5) without reported sensitivity analysis.
axioms (4)
  • domain assumption Local data is IID-partitioned across clients
    Section IV.A.1 explicitly states all datasets are evenly and independently partitioned under IID settings; the Conclusion claims robustness to varying data heterogeneity without non-IID experiments.
  • domain assumption Malicious clients know the set Km and can share ensemble heads
    Eq. (20) averages ensemble heads across all malicious clients, implying a covert communication channel or prearranged collusion among attackers.
  • domain assumption Server aggregation follows FedAvg or one of the listed robust rules
    Eq. (14) assumes an Aggregate function; experiments cover FedAvg, FedProx, Bulyan, Multi-Krum, Trimmed-Mean, and Median, but not all possible aggregation schemes.
  • domain assumption Attackers can train a logistic regression head on a local validation split
    Section III.D depends on Dval_k being representative enough to learn ensemble weights; the paper acknowledges in the Discussion that sparse or imbalanced data could reduce knowledge transfer.
invented entities (1)
  • error model theta_e independent evidence
    purpose: Simulates global model degradation by being updated with the poisoned gradient (Eq. 18), providing a corrective or counterfactual signal for the ensemble.
    Ablation in Table V shows adding theta_e improves ensemble accuracy on Fashion-MNIST and CIFAR-10, so it has empirical support within the paper.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learning." pith.science (2026). https://pith.science/paper/RHL3I4IH

@misc{pith2026250900540,
  author       = {Pith},
  title        = {Pith review of: FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RHL3I4IH}},
  note         = {Machine review of arXiv:2509.00540}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In federated learning, participants' uploaded model updates cannot be directly verified, leaving the system vulnerable to malicious attacks. Existing attack strategies have adversaries upload tampered model updates to degrade the global model's performance. However, attackers also degrade their own private models, gaining no advantage. In real-world scenarios, attackers are driven by self-centered motives: their goal is to gain a competitive advantage by developing a model that outperforms those of other participants, not merely to cause disruption. In this paper, we study a novel Self-Centered Federated Learning (SCFL) attack paradigm, in which attackers not only degrade the performance of the global model through attacks but also enhance their own models within the federated learning process. We propose a framework named FedThief, which degrades the performance of the global model by uploading modified content during the upload stage. At the same time, it enhances the private model's performance through divergence-aware ensemble techniques, where "divergence" quantifies the deviation between private and global models, that integrate global updates and local knowledge. Extensive experiments show that our method effectively degrades the global model performance while allowing the attacker to obtain an ensemble model that significantly outperforms the global model.

Figures

Figures reproduced from arXiv: 2509.00540 by Mang Ye, Xiangyu Zhang.

Figure 1
Figure 1. Figure 1: Framework of Self-Centered Federated Learning. (A) Ideal State of Federated Learning: Multiple clients sharing corresponding feedback collectively train a high-performance model; (B) Federated Learning Under Attack: Malicious clients upload incorrect content to degrade the global model, but they do not benefit themselves; (C) Self-Centered Federated Learning: Malicious clients upload incorrect parameters a… view at source ↗
Figure 2
Figure 2. Figure 2: Framework of the proposed FedThief approach.Each malicious client maintains a private model for local training and a malicious model for adversarial attacks. The private dataset is divided into training and validation subsets. During training, both models learn from the training set, where the malicious model generates manipulated gradients that are uploaded to the server. After receiving the global update… view at source ↗
Figure 3
Figure 3. Figure 3: Accuracy evolution of malicious ensembles vs. global model under the LIE attack on CIFAR-10, with malicious ratios [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Expected accuracy for malicious and benign clients under the [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Performance under different settings of loss balance factor [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

59 extracted references · 55 canonical work pages

  1. [1]

    Machine learning on big data: Opportunities and challenges,

    L. Zhou, S. Pan, J. Wang, and A. V . Vasilakos, “Machine learning on big data: Opportunities and challenges,” Neurocomputing, vol. 237, pp. 350–361, 2017. 1

    work page 2017

  2. [2]

    Personalized federated learning with model-contrastive learning for multi-modal user modeling in human-centric metaverse,

    X. Zhou, Q. Yang, X. Zheng, W. Liang, I. Kevin, K. Wang, J. Ma, Y . Pan, and Q. Jin, “Personalized federated learning with model-contrastive learning for multi-modal user modeling in human-centric metaverse,” IEEE Journal on Selected Areas in Communications , vol. 42, no. 4, pp. 817–831, 2024. 1

    work page 2024

  3. [3]

    Can: Leveraging clients as navigators for generative replay in federated continual learning,

    X. Rong, J. Zhang, K. He, and M. Ye, “Can: Leveraging clients as navigators for generative replay in federated continual learning,” in Forty-second International Conference on Machine Learning . 1

    work page

  4. [4]

    Boosting adversarial transferability via relative feature importance- aware attacks,

    J.-W. Li, W.-Z. Shao, Y .-B. Sun, L.-Q. Wang, Q. Ge, and L. Xiao, “Boosting adversarial transferability via relative feature importance- aware attacks,” IEEE Transactions on Information Forensics and Se- curity, 2025. 1

    work page 2025

  5. [5]

    Challenges in data collection in real-world environments for activity recognition,

    P. Lameski, A. Dimitrievski, E. Zdravevski, V . Trajkovik, and S. Ko- ceski, “Challenges in data collection in real-world environments for activity recognition,” in IEEE EUROCON 2019-18th International Con- ference on Smart Technologies . IEEE, 2019, pp. 1–5. 1

    work page 2019

  6. [6]

    Text- based person search without parallel image-text data,

    Y . Bai, J. Wang, M. Cao, C. Chen, Z. Cao, L. Nie, and M. Zhang, “Text- based person search without parallel image-text data,” in Proceedings of the 31st ACM International Conference on Multimedia , 2023, pp. 757–767. 1

    work page 2023

  7. [7]

    Trustworthy and fair federated learning via reputation-based consensus and adaptive incentives,

    M. M. Rashid, Y . Xiang, M. P. Uddin, J. Tang, K. Sood, and L. Gao, “Trustworthy and fair federated learning via reputation-based consensus and adaptive incentives,” IEEE Transactions on Information Forensics and Security, 2025. 1

    work page 2025

  8. [8]

    Communication-efficient federated learning via knowledge distillation,

    C. Wu, F. Wu, L. Lyu, Y . Huang, and X. Xie, “Communication-efficient federated learning via knowledge distillation,” Nature communications, vol. 13, no. 1, p. 2032, 2022. 1

    work page 2032

  9. [9]

    Medical internet of things and big data in healthcare,

    D. V . Dimitrov, “Medical internet of things and big data in healthcare,” Healthcare informatics research, vol. 22, no. 3, pp. 156–163, 2016. 1

    work page 2016

  10. [10]

    The impact of gdpr on global technology development,

    H. Li, L. Yu, and W. He, “The impact of gdpr on global technology development,” pp. 1–6, 2019. 1

    work page 2019

  11. [11]

    Beyond the hipaa privacy rule: enhancing privacy, improving health through research,

    L. O. Gostin, L. A. Levit, and S. J. Nass, “Beyond the hipaa privacy rule: enhancing privacy, improving health through research,” 2009. 1

    work page 2009

  12. [12]

    Split-fed learning: A deep dive into methods, innovations and future prospects for data privacy and efficiency in decentralized machine learning,

    G. S. Hukkeri, R. Goudar, G. Dhananjaya, V . N. Rathod, and S. Ankalaki, “Split-fed learning: A deep dive into methods, innovations and future prospects for data privacy and efficiency in decentralized machine learning,” IEEE Access, 2025. 1

    work page 2025

  13. [13]

    The federation strikes back: A survey of federated learning privacy attacks, defenses, applications, and policy landscape,

    J. Zhao, S. Bagchi, S. Avestimehr, K. Chan, S. Chaterji, D. Dimitriadis, J. Li, N. Li, A. Nourian, and H. Roth, “The federation strikes back: A survey of federated learning privacy attacks, defenses, applications, and policy landscape,” ACM Computing Surveys , vol. 57, no. 9, pp. 1–37,

    work page

  14. [14]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–

    work page 2017

  15. [15]

    A survey on federated learning,

    C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,” Knowledge-Based Systems , vol. 216, p. 106775,

    work page

  16. [16]

    Federated learning with long-tailed data via representation unification and classifier rectification,

    W. Huang, Y . Liu, M. Ye, J. Chen, and B. Du, “Federated learning with long-tailed data via representation unification and classifier rectification,” IEEE Transactions on Information Forensics and Security , 2024. 1, 7

    work page 2024

  17. [17]

    Client selection in federated learning: Principles, challenges, and opportunities,

    L. Fu, H. Zhang, G. Gao, M. Zhang, and X. Liu, “Client selection in federated learning: Principles, challenges, and opportunities,” IEEE Internet of Things Journal , 2023. 1

    work page 2023

  18. [18]

    Robust federated learning with noisy and het- erogeneous clients,

    X. Fang and M. Ye, “Robust federated learning with noisy and het- erogeneous clients,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 072–10 081. 1

    work page 2022

  19. [19]

    A robust privacy-preserving federated learning model against model poisoning attacks,

    A. Yazdinejad, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi, “A robust privacy-preserving federated learning model against model poisoning attacks,” IEEE Transactions on Information Forensics and Security, 2024. 1

    work page 2024

  20. [20]

    Byzantine-robust decentralized federated learning,

    M. Fang, Z. Zhang, Hairi, P. Khanduri, J. Liu, S. Lu, Y . Liu, and N. Gong, “Byzantine-robust decentralized federated learning,” in Pro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2874–2888. 1

    work page 2024

  21. [21]

    A review of federated learning methods in heterogeneous scenarios,

    J. Pei, W. Liu, J. Li, L. Wang, and C. Liu, “A review of federated learning methods in heterogeneous scenarios,” IEEE Transactions on Consumer Electronics, 2024. 1

    work page 2024

  22. [22]

    Model aggregation techniques in federated learning: A comprehensive survey,

    P. Qi, D. Chiaro, A. Guzzo, M. Ianni, G. Fortino, and F. Piccialli, “Model aggregation techniques in federated learning: A comprehensive survey,” Future Generation Computer Systems , vol. 150, pp. 272–293, 2024. 1 12

    work page 2024

  23. [23]

    Heterogeneous feder- ated learning: State-of-the-art and research challenges,

    M. Ye, X. Fang, B. Du, P. C. Yuen, and D. Tao, “Heterogeneous feder- ated learning: State-of-the-art and research challenges,” ACM Computing Surveys, vol. 56, no. 3, pp. 1–44, 2023. 1

    work page 2023

  24. [24]

    Challenges and future directions of secure federated learning: a survey,

    K. Zhang, X. Song, C. Zhang, and S. Yu, “Challenges and future directions of secure federated learning: a survey,” Frontiers of computer science, vol. 16, pp. 1–8, 2022. 1

    work page 2022

  25. [25]

    Learn from others and be yourself in heterogeneous federated learning,

    W. Huang, M. Ye, and B. Du, “Learn from others and be yourself in heterogeneous federated learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 10 143–10 153. 1

    work page 2022

  26. [26]

    Provfl: Property inference attacks against vertical federated learning,

    L. Bai, X. Zhang, S. Zhang, Q. Ye, and H. Hu, “Provfl: Property inference attacks against vertical federated learning,” IEEE Transactions on Information Forensics and Security , 2025. 1

    work page 2025

  27. [27]

    Fedgt: Identification of malicious clients in federated learning with secure aggregation,

    M. Xhemrishi, J. Östman, A. Wachter-Zeh, and A. G. i Amat, “Fedgt: Identification of malicious clients in federated learning with secure aggregation,” IEEE Transactions on Information Forensics and Security,

    work page

  28. [28]

    Self-driven entropy aggregation for byzantine-robust heterogeneous federated learning,

    W. Huang, Z. Shi, M. Ye, H. Li, and B. Du, “Self-driven entropy aggregation for byzantine-robust heterogeneous federated learning,” in ICML, 2024. 1

    work page 2024

  29. [29]

    When the curious abandon honesty: Federated learn- ing is not private,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “When the curious abandon honesty: Federated learn- ing is not private,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P) . IEEE, 2023, pp. 175–199. 1

    work page 2023

  30. [30]

    Threats to federated learning: A survey,

    L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” arXiv preprint arXiv:2003.02133 , 2020. 1, 2

    Pith/arXiv arXiv 2003

  31. [31]

    Deep model poisoning attack on federated learning,

    X. Zhou, M. Xu, Y . Wu, and N. Zheng, “Deep model poisoning attack on federated learning,” Future Internet, vol. 13, no. 3, p. 73, 2021. 2

    work page 2021

  32. [32]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021. 2, 3, 7, 8

    work page 2021

  33. [33]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622. 2

    work page 2020

  34. [34]

    Data poisoning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in Computer security–ESORICs 2020: 25th European symposium on research in computer security, ESORICs 2020, guildford, UK, September 14–18, 2020, proceedings, part i 25 . Springer, 2020, pp. 480–501. 2

    work page 2020

  35. [35]

    Efficiently achieving privacy preservation and poisoning attack resistance in federated learning,

    X. Li, X. Yang, Z. Zhou, and R. Lu, “Efficiently achieving privacy preservation and poisoning attack resistance in federated learning,” IEEE Transactions on Information Forensics and Security , 2024. 2

    work page 2024

  36. [36]

    Decaf: Data distribution decompose attack against federated learning,

    Z. Dai, Y . Gao, C. Zhou, A. Fu, Z. Zhang, M. Xue, Y . Zheng, and Y . Zhang, “Decaf: Data distribution decompose attack against federated learning,” IEEE Transactions on Information Forensics and Security ,

    work page

  37. [37]

    Federated learning for credit risk assessment

    C. M. Lee, J. D. Fernández, S. P. Menci, A. Rieger, and G. Fridgen, “Federated learning for credit risk assessment.” in HICSS, 2023, pp. 386–395. 2

    work page 2023

  38. [38]

    A federated learning-enabled predictive analysis to forecast stock market trends,

    S. Pourroostaei Ardakani, N. Du, C. Lin, J.-C. Yang, Z. Bi, and L. Chen, “A federated learning-enabled predictive analysis to forecast stock market trends,” Journal of Ambient Intelligence and Humanized Computing, vol. 14, no. 4, pp. 4529–4535, 2023. 2

    work page 2023

  39. [39]

    A survey on ensemble learning,

    X. Dong, Z. Yu, W. Cao, Y . Shi, and Q. Ma, “A survey on ensemble learning,” Frontiers of Computer Science , vol. 14, pp. 241–258, 2020. 3

    work page 2020

  40. [40]

    Ensemble learning: A survey,

    O. Sagi and L. Rokach, “Ensemble learning: A survey,” Wiley interdis- ciplinary reviews: data mining and knowledge discovery , vol. 8, no. 4, p. e1249, 2018. 3

    work page 2018

  41. [41]

    Ensemble learning method using stacking with base learner, a comparison,

    R. Dey and R. Mathur, “Ensemble learning method using stacking with base learner, a comparison,” in International Conference on Data Analytics and Insights . Springer, 2023, pp. 159–169. 3

    work page 2023

  42. [42]

    Learning with symmetric label noise: The importance of being unhinged,

    B. Van Rooyen, A. Menon, and R. C. Williamson, “Learning with symmetric label noise: The importance of being unhinged,” Advances in neural information processing systems , vol. 28, 2015. 3

    work page 2015

  43. [43]

    Co-teaching: Robust training of deep neural networks with extremely noisy labels,

    B. Han, Q. Yao, X. Yu, G. Niu, M. Xu, W. Hu, I. Tsang, and M. Sugiyama, “Co-teaching: Robust training of deep neural networks with extremely noisy labels,” Advances in neural information processing systems, vol. 31, 2018. 3

    work page 2018

  44. [44]

    Badsampler: Harnessing the power of catastrophic forgetting to poison byzantine-robust federated learning,

    Y . Liu, C. Wang, and X. Yuan, “Badsampler: Harnessing the power of catastrophic forgetting to poison byzantine-robust federated learning,” in Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2024, pp. 1944–1955. 3

    work page 2024

  45. [45]

    Can you really backdoor federated learning?

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” arXiv preprint arXiv:1911.07963 , 2019. 3

    Pith/arXiv arXiv 1911

  46. [46]

    Backdoor defense via deconfounded representation learning,

    Z. Zhang, Q. Liu, Z. Wang, Z. Lu, and Q. Hu, “Backdoor defense via deconfounded representation learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 12 228–12 238. 3

    work page 2023

  47. [47]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948. 3

    work page 2020

  48. [48]

    Dba: Distributed backdoor attacks against federated learning,

    C. Xie, K. Huang, P.-Y . Chen, and B. Li, “Dba: Distributed backdoor attacks against federated learning,” in International conference on learn- ing representations, 2019. 3

    work page 2019

  49. [49]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,” Advances in Neural Information Processing Systems, vol. 32, 2019. 3, 7, 8

    work page 2019

  50. [50]

    Fedghost: Data-free model poisoning enhancement in federated learning,

    Z. Ma, X. Huang, Z. Wang, Z. Qin, X. Wang, and J. Ma, “Fedghost: Data-free model poisoning enhancement in federated learning,” IEEE TIFS, 2025. 3, 7, 8

    work page 2025

  51. [51]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30, 2017. 3, 7, 8

    work page 2017

  52. [52]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866 , 2018. 3

    Pith/arXiv arXiv 2018

  53. [53]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in ICML. Pmlr, 2018, pp. 5650–5659. 4, 7, 8

    work page 2018

  54. [54]

    The hidden vulnerability of distributed learning in byzantium,

    R. Guerraoui, S. Rouault et al., “The hidden vulnerability of distributed learning in byzantium,” in ICML. PMLR, 2018, pp. 3521–3530. 4, 7, 8

    work page 2018

  55. [55]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” in ISOC Network and Dis- tributed System Security Symposium (NDSS) , 2021. 4

    work page 2021

  56. [56]

    The mnist database of handwritten digits,

    Y . LeCun, “The mnist database of handwritten digits,” http://yann. lecun. com/exdb/mnist/, 1998. 7

    work page 1998

  57. [57]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009. 7

    work page 2009

  58. [58]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017. 7

    Pith/arXiv arXiv 2017

  59. [59]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Proceedings of Machine learning and systems , vol. 2, pp. 429–450, 2020. 7, 8

    work page 2020

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.