Pith. sign in

REVIEW 4 major objections 3 minor 52 references

A TEE-signed training record can let federated learning reject Byzantine updates before aggregation.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Sentinel signs a TEE-attested record of each client's control-flow and variable usage and admits only updates whose attestation passes, reaching ASR 0 for its modeled attacks.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection The system-level idea is plausible and the overhead data is real, but the data-poisoning defense is not supported by the design or the evaluation. the 4 major comments →

arxiv 2509.00634 v1 pith:CN6PYNX4 submitted 2025-08-30 cs.CR cs.AI

Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threats

Chaoyu Zhang , Heng Jin , Shanghao Shi , Hexuan Yu , Sydney Johns , Y. Thomas Hou , Wenjing Lou This is my paper
classification cs.CR cs.AI
keywords Federated learningByzantine attacksremote attestationtrusted execution environmentmodel poisoningdata poisoningcontrol-flow integritynon-IID data
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Sentinel claims that federated learning servers can stop Byzantine clients by checking what actually happened during local training, rather than by statistically filtering updates afterward. Each client runs training under an instrumented process and records a control-flow trace plus monitored variable usage inside a trusted execution environment; the client signs this record together with the model update and a per-round challenge, and the server aggregates only updates whose attestation verifies. The paper argues this removes the core weakness of data-driven Byzantine defenses, which confuse benign non-IID drift with malicious updates. If correct, the same mechanism can block control-flow hijacking and tampering with weights or gradients, at the cost of roughly 9–20% runtime overhead and under 1% memory overhead on IoT hardware.

Core claim

The central claim is that remote attestation, built on a TEE-signed record of the client's code execution, is sufficient to certify that a local training run followed the expected logic and did not tamper with critical variables, and therefore that the resulting model update is trustworthy enough to aggregate. Sentinel instruments the training source code to track the control-flow graph—forward jumps/calls, return points, conditional branches—and two classes of critical variables: static read-only configuration (hyperparameters, batch size, loaded dataset) and dynamic values (weights, gradients, loss). A trusted training recorder inside the TEE continuously captures these measurements, signs

What carries the argument

The load-bearing object is the trusted training recorder: a software–hardware unit inside a Trusted Execution Environment (a CPU-protected secure world) that records, stores, and signs execution measurements during local training. It is fed by source-code instrumentation that captures the control-flow graph CF_i and critical variable usage CV_i. The signed attestation report (σ_i, CF_i, CV_i, δ_i, ch_i) is bound to a per-round challenge and to the model update itself. The server-side verification engine checks signature authenticity, compares the trace against the expected control-flow graph CF* and the reported variable usage against expected usage CV*, and halts on first mismatch. The desi

Load-bearing premise

All adversarial manipulation occurs inside the code path whose control-flow and variables are being measured; manipulation of the dataset before instrumented training starts, or changes that leave control flow and monitored variables unchanged, will not be flagged.

What would settle it

A concrete experiment: run Sentinel with a client that poisons its local dataset (e.g., inserts trigger samples) before the instrumented training loop starts, then trains normally; if the server accepts the poisoned update with a passing attestation report, the central claim that Sentinel mitigates data-poisoning attacks fails for pre-loading data poisoning.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Targeted backdoors are neutralized in all tested configurations: attack success rate drops to 0.0% for both control-flow and data-only Krum-style attacks, on FMNIST and CIFAR-10, under IID and non-IID splits.
  • Non-IID data no longer causes false-positive rejection: because acceptance depends on execution-logic verification rather than update similarity, legitimate diverse clients keep contributing, and Sentinel's accuracy is highest or tied-highest among the compared defenses in untargeted attack runs.
  • Replay of stale updates is bound to fail: each attestation report contains a server-issued per-round nonce, so a previously valid update cannot be reused in a later round.
  • Overhead is compatible with resource-limited devices: runtime grows roughly 9–20%, memory stays within 1%, and verification time remains in the single-digit milliseconds on a Raspberry Pi V.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The guarantee covers execution, not data content: a malicious client can still poison its dataset before the instrumented loop begins and receive a valid attestation, so extending Sentinel to hash or externally validate the input dataset would close the gap the paper leaves open.
  • The same architecture would combine naturally with statistical robust aggregation, covering cases where variables are 'used as expected' but the client's data distribution is adversarially chosen.
  • The paper's verification of 'static variables' like the loaded dataset checks read-only status and expected value usage, not whether the data itself is benign; a testable extension is to compare a dataset digest against trusted per-round hashes.
  • If instrumentation misses any branch or variable an attacker can influence, the attestation can pass for a compromised execution; practical strength therefore depends on how exhaustively the task owner instruments the actual training code, which the paper assumes rather than proves.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes Sentinel, a remote-attestation framework for federated learning. Client training code is instrumented to record control-flow and critical-variable usage; a TEE-resident trusted training recorder signs an attestation report that is sent to the server, which verifies the report before aggregating the corresponding model update. The authors claim this mitigates both model poisoning and data poisoning attacks without relying on heuristic statistical filtering. The evaluation compares Sentinel against FedAvg, Krum, Coomed, TrimmedMean, Bulyan, and FLTrust under targeted and untargeted control-flow and data-only attacks on FMNIST and CIFAR-10, and reports runtime/memory overhead on Raspberry Pi devices.

Significance. If the central claim held, Sentinel would be a useful system-level complement to data-driven Byzantine defenses: it replaces heuristic outlier filters with verifiable execution evidence, and the TEE-signed, challenge-bound attestation report addresses replay and forgery. The paper's strengths include a concrete protocol design, a clear attack taxonomy, and measured overhead data on real IoT hardware. However, the load-bearing claim that Sentinel defends against data poisoning is not established by the evaluation, and the adversarial scenarios tested are almost identical to the events the recorder is designed to flag, making the reported ASR=0 partially a restatement of the detection setup. The absence of false-positive measurements under benign non-IID drift also leaves the main motivational problem unquantified.

major comments (4)
  1. [Section IV-B / Section III-B] The data-poisoning defense is not supported. Section IV-B lists 'the loaded dataset' as a static critical variable, but verification only checks that this variable remains read-only; it does not validate the dataset's contents, labels, or provenance. A Byzantine client can poison its local dataset before instrumented training begins (e.g., label flipping or trigger insertion) or use a malicious data loader; control flow is unchanged, the dataset variable is never written after loading, and dynamic-variable dependency checks still pass because gradients are produced by valid forward/backward passes. The threat model in Section III-B explicitly includes data poisoning, yet the evaluated T-DO and UNT-DO attacks in Fig. 5 and Tables I-II replace model updates after training rather than poisoning training data. Thus the reported ASR=0 does not cover the claimed data-poisoning defense.
  2. [Section V-B / Fig. 5] The evaluation is largely circular for the two attack families. T-CF/UNT-CF are defined as redirecting execution to a malicious optimizer, and T-DO/UNT-DO are defined as replacing benign updates with adversarial ones. These are exactly the control-flow violations and unauthorized variable writes that the recorder is designed to log and the verifier is designed to reject. Sentinel's ASR=0 is therefore close to a restatement of the detection mechanism. A meaningful test requires attacks that stay inside the instrumented training path, for example crafted gradients computed by valid backpropagation on poisoned data, or subtle modifications to data values that do not alter control flow or trigger a static-variable write.
  3. [Section V-A / Tables I-II] The scale and implementation of the FL evaluation are ambiguous. The text says a parameter server coordinates 100 clients but also that three Raspberry Pi V devices are used as 'simulated clients.' It is not stated whether Sentinel was actually implemented and run on 100 clients, or whether the defense-effectiveness numbers in Tables I and II come from a subset or a simulation. This matters because the ASR/accuracy claims depend on how many clients are Byzantine, how attestation reports are generated for all clients, and how the server handles mixed real/simulated reports. No error bars or statistical significance are reported for the defense results, despite claims such as 'ASR = 0% in all cases.'
  4. [Section V-B / Section I] No false-positive rate or benign-update acceptance rate is reported. The paper's motivation is that data-driven defenses misclassify legitimate non-IID updates as malicious. For Sentinel, the analogous risk is that benign clients' attestation reports fail due to nondeterministic execution, instrumentation imprecision, or expected control-flow variability across heterogeneous data, causing legitimate updates to be rejected. Tables I-II show Sentinel's accuracy under attack, but not the fraction of benign clients rejected in a clean non-IID setting. Without this measurement, the claim that Sentinel 'ensures trustworthiness' while preserving FL accuracy under non-IID data is incomplete.
minor comments (3)
  1. [Fig. 3] The protocol figure contains garbled mathematical symbols (e.g., 'u̅√ummationtext') and inconsistent notation (M(t), Y(L), etc.). It should be regenerated for clarity.
  2. [Section V-C / Table III] There is a duplicate/formatting issue: the table is labeled both 'TABLE III' and 'TABLE I: System overhead...' in the text. Please unify the numbering and captions.
  3. [Section III-B / Section V-B] The terms 'data poisoning' and 'data-only attack' are used almost interchangeably, but they denote different threat classes: poisoning corrupts training data, whereas a data-only attack modifies runtime variables without changing control flow. Clarify the distinction and align the threat model with the evaluated attacks.

Circularity Check

1 steps flagged

Evaluation ASR=0 reduces to detector definition; data-poisoning coverage not independently established.

specific steps
  1. self definitional [Section V-A (attack design); Section IV-A (verification rule); Section V-B (result)]
    "To test Sentinel, we design targeted and untargeted control-flow attacks, T-CF-Krum and UNT-CF-Krum, which redirect execution to a malicious optimizer, and data-only attacks, T-DO-Krum and UNT-DO-Krum, which replace benign updates with adversarial ones (Fig. 5). ... The verification engine authenticates the report, checks its integrity, and analyzes the control-flow for hijacking and variable usage for unauthorized modifications indicative of data-only attacks. Only attestation reports that pass all verification checks are deemed valid ... Sentinel nullifies targeted attacks (ASR = 0% in all c"

    The tested attacks are not independent adversarial cases; they are exact instances of the anomaly class the verifier is defined to reject. T-CF/UNT-CF 'redirect execution to a malicious optimizer' (control-flow hijacking), and T-DO/UNT-DO 'replace benign updates' (unauthorized modification of a critical variable). The verifier's stated acceptance rule is to analyze 'control-flow for hijacking and variable usage for unauthorized modifications' and admit only reports that pass those checks. Therefore ASR=0 follows by construction from the detector's definition rather than from empirical discovery. The evaluation does not test evasive attacks that preserve control-flow and data dependencies, such as pre-training data poisoning, so the headline claim that Sentinel 'nullifies targeted attacks'

full rationale

The central protocol is not built on a self-citation chain: Sentinel uses standard TEE/RA building blocks, and no load-bearing derivation depends on the authors' prior work. The overhead measurements are independent and empirical. The circularity is concentrated in the security evaluation: each evaluated attack is defined as the exact event the verifier is designed to flag, making the reported ASR=0 a tautological consequence of the acceptance predicate rather than evidence against broader Byzantine behavior. Separately, the claimed defense against data poisoning is not independently supported: verification checks only that the loaded-dataset variable is read-only and that dynamic variables follow valid dependencies, so a client that poisons its dataset before training can still pass attestation and contribute a poisoned update. This is a threat-coverage gap rather than a circular derivation, but it further limits the external content of the central security claim. Overall, the paper shows partial circularity in the attack/defense pairing, while retaining independent content in the system design and overhead evaluation.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 1 invented entities

The central claim rests almost entirely on the TEE and recorder being tamper-resistant, on the server knowing the expected execution profile, and on the dataset being honest when it enters the measured program. No numerical free parameters are fitted; the evaluation hyperparameters are settings. The only new component is the trusted training recorder, whose security properties are assumed rather than independently evidenced.

axioms (4)
  • domain assumption The TEE and measurement engine are tamper-resistant and correctly implemented, and the instrumentation cannot be bypassed by a compromised client.
    Section III-B defines the trusted computing base and states that the TEE serves as the root of trust and that the measurement engine is assumed to be tamper-resistant and correctly implemented. This is the foundation of the whole attestation guarantee.
  • domain assumption The server knows the exact expected control-flow graph CF*_i and expected variable usage CV*_i for each client's training run.
    Section IV-B says verification compares recorded CF_i and CV_i against CF*_i and CV*_i. In a heterogeneous setting with data-dependent branching, specifying these expectations a priori is nontrivial and is not discussed.
  • domain assumption The training dataset is honest at the moment it is loaded, or any data corruption occurs inside the measured code path.
    Section IV-B treats the loaded dataset only as a read-only static variable. Data poisoned before measurement therefore passes attestation, so the data-poisoning claim rests on this unstated premise.
  • domain assumption The signed attestation report binds the submitted update delta_i to the measured execution through the hash and challenge.
    Section IV-A defines sigma_i = Sign_TEE,sk_i(H(CF_i, CV_i, delta_i, ch_i)). This assumes the cryptographic binding is correctly implemented and the TEE signs exactly the measured values.
invented entities (1)
  • Trusted training recorder inside the TEE no independent evidence
    purpose: Continuously logs control-flow CF_i and critical-variable usage CV_i, stores them securely, and produces signed attestation reports.
    This is the paper's proposed component. Its security properties are assumed in the threat model; no independent implementation, formal proof, or external artifact is provided.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threats." pith.science (2026). https://pith.science/paper/CN6PYNX4

@misc{pith2026250900634,
  author       = {Pith},
  title        = {Pith review of: Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threats},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CN6PYNX4}},
  note         = {Machine review of arXiv:2509.00634}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated Learning (FL) has gained significant attention for its privacy-preserving capabilities, enabling distributed devices to collaboratively train a global model without sharing raw data. However, its distributed nature forces the central server to blindly trust the local training process and aggregate uncertain model updates, making it susceptible to Byzantine attacks from malicious participants, especially in mission-critical scenarios. Detecting such attacks is challenging due to the diverse knowledge across clients, where variations in model updates may stem from benign factors, such as non-IID data, rather than adversarial behavior. Existing data-driven defenses struggle to distinguish malicious updates from natural variations, leading to high false positive rates and poor filtering performance. To address this challenge, we propose Sentinel, a remote attestation (RA)-based scheme for FL systems that regains client-side transparency and mitigates Byzantine attacks from a system security perspective. Our system employs code instrumentation to track control-flow and monitor critical variables in the local training process. Additionally, we utilize a trusted training recorder within a Trusted Execution Environment (TEE) to generate an attestation report, which is cryptographically signed and securely transmitted to the server. Upon verification, the server ensures that legitimate client training processes remain free from program behavior violation or data manipulation, allowing only trusted model updates to be aggregated into the global model. Experimental results on IoT devices demonstrate that Sentinel ensures the trustworthiness of the local training integrity with low runtime and memory overhead.

Figures

Figures reproduced from arXiv: 2509.00634 by Chaoyu Zhang, Heng Jin, Hexuan Yu, Shanghao Shi, Sydney Johns, Wenjing Lou, Y. Thomas Hou.

Figure 1
Figure 1. Figure 1: Illustration of malicious model updates detection using a similarity [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Sentinel enables trustworthy FL by recording the control-flow graph and critical variable usage through a trusted training recorder. The verification engine on the server side validates these reports and aggregates only verified updates, preventing blind trust in Byzantine attackers and ensuring transparency in the training process of remote devices. Sentinel: Mitigating Byzantine A!acks in Federated Learn… view at source ↗
Figure 6
Figure 6. Figure 6: Sentinel Protocol: Secure communication between Client and Server. (The shadowed operations are executed within TEE.) Brendan McMahan, et al. 2019. Towards federated learning at scale: System design. Proceedings of machine learning and systems 1 (2019), 374–388. [12] Christopher Briggs, Zhong Fan, and Peter Andras. 2020. Federated learning with hierarchical clustering of local updates to improve training o… view at source ↗
Figure 4
Figure 4. Figure 4: Testbed: Raspberry Pi V as the Training Devices for Local Clients in [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 3
Figure 3. Figure 3: Testbed: Raspberry Pi V as the Training Devices for To evaluate the feasibility and overhead of integrating remot ttttiitFLdlRbPi V diit [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 5
Figure 5. Figure 5: We consider four attack strategies: T-CF-Krum and UNT-CF-Krum, which use control-flow hijacking to redirect execution to a malicious optimizer, and T-DO-Krum and UNT-DO-Krum, which perform data-only attacks to replace benign ones. instrumentation in the source interpreter traces critical events, monitors stack frames, and inspects instructions during key workflows. Critical variables are verified before im… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

52 extracted references · 33 canonical work pages

  1. [1]

    Federated learning: Strategies for improving communication efficiency,

    J. Koneˇcn`y, H. B. McMahan, F. X. Yu, P. Richt ´arik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” arXiv preprint arXiv:1610.05492 , 2016

    Pith/arXiv arXiv 2016

  2. [2]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics (AISTATS 17) , pp. 1273– 1282, 2017

    2017

  3. [3]

    Space–air–ground–sea integrated network with federated learning,

    H. Zhao, F. Ji, Y . Wang, K. Yao, and F. Chen, “Space–air–ground–sea integrated network with federated learning,” Remote Sensing, vol. 16, no. 9, p. 1640, 2024

    work page 2024

  4. [4]

    State-of-the-art approaches to enhancing privacy preservation of machine learning datasets: A survey,

    C. Zhang and S. Li, “State-of-the-art approaches to enhancing privacy preservation of machine learning datasets: A survey,” arXiv preprint arXiv:2404.16847, 2024

    Pith/arXiv arXiv 2024

  5. [5]

    Federated learning for iout: Concepts, applications, challenges and future directions,

    N. Victor, R. Chengoden, M. Alazab, S. Bhattacharya, S. Magnusson, P. K. R. Maddikunta, K. Ramana, and T. R. Gadekallu, “Federated learning for iout: Concepts, applications, challenges and future directions,” IEEE Internet of Things Magazine , vol. 5, no. 4, pp. 36–41, 2023

    work page 2023

  6. [6]

    Mindfl: Mitigating the impact of imbalanced and noisy-labeled data in federated learning with quality and fairness-aware client selection,

    C. Zhang, N. Wang, S. Shi, C. Du, W. Lou, and Y . T. Hou, “Mindfl: Mitigating the impact of imbalanced and noisy-labeled data in federated learning with quality and fairness-aware client selection,” in MILCOM 2023-2023 IEEE Military Communications Conference (MILCOM) , pp. 331–338, IEEE, 2023

    work page 2023

  7. [7]

    U. N. I. of Standards and T. (NIST), Federated Learning for Critical Infrastructure. 2023. Available via NCBI Bookshelf

    work page 2023

  8. [8]

    Feco: Boosting intrusion detection capability in iot networks via contrastive learning,

    N. Wang, S. Shi, Y . Chen, W. Lou, and Y . T. Hou, “Feco: Boosting intrusion detection capability in iot networks via contrastive learning,” IEEE Transactions on Dependable and Secure Computing , 2025

    2025

  9. [9]

    Hermes: Boosting the performance of machine-learning-based intrusion detection system through geometric feature learning,

    C. Zhang, S. Shi, N. Wang, X. Xu, S. Li, L. Zheng, R. Marchany, M. Gardner, Y . T. Hou, and W. Lou, “Hermes: Boosting the performance of machine-learning-based intrusion detection system through geometric feature learning,” in Proceedings of the Twenty-fifth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Network...

    work page 2024

  10. [10]

    Machine learning- based intrusion detection systems: Capabilities, methodologies, and open research challenges,

    C. Zhang, N. Wang, Y . T. Hou, and W. Lou, “Machine learning- based intrusion detection systems: Capabilities, methodologies, and open research challenges,” Authorea Preprints, 2025

    work page 2025

  11. [11]

    Free lunch for federated remote sensing target fine-grained classification: A parameter- efficient framework,

    S. Chen, T. Shu, H. Zhao, J. Wang, S. Ren, and L. Yang, “Free lunch for federated remote sensing target fine-grained classification: A parameter- efficient framework,” Knowledge-Based Systems, vol. 294, p. 111694, 2024

    work page 2024

  12. [12]

    StarCast: A Secure and Spectrum-Efficient Group Communication Scheme for LEO Satellite Networks,

    C. Zhang, H. Yu, S. Shi, S. Li, Y . Shi, E. Burger, Y . T. Hou, and W. Lou, “StarCast: A Secure and Spectrum-Efficient Group Communication Scheme for LEO Satellite Networks,” IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN) , 2025

    work page 2025

  13. [13]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,

    Y . Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,” Proceedings of the ACM on Measurement and Analysis of Computing Systems , vol. 1, no. 2, pp. 1–25, 2017

    work page 2017

  14. [14]

    Byzantine-resilient secure federated learning,

    J. So, B. G ¨uler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,” IEEE Journal on Selected Areas in Communications , 2020

    work page 2020

  15. [15]

    The hidden vulnerability of distributed learning in byzantium,

    R. Guerraoui, S. Rouault, et al., “The hidden vulnerability of distributed learning in byzantium,” in International conference on machine learning , pp. 3521–3530, PMLR, 2018

    work page 2018

  16. [16]

    Local model poisoning attacks to byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” in 29th USENIX Security Symposium (USENIX Security 20) , pp. 1605–1622, 2020

    work page 2020

  17. [17]

    Analyzing feder- ated learning through an adversarial lens,

    A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing feder- ated learning through an adversarial lens,” in International conference on machine learning , pp. 634–643, PMLR, 2019

    work page 2019

  18. [18]

    Scale-mia: A scalable model inversion attack against secure federated learning via latent space reconstruction,

    S. Shi, N. Wang, Y . Xiao, C. Zhang, Y . Shi, Y . T. Hou, and W. Lou, “Scale-mia: A scalable model inversion attack against secure federated learning via latent space reconstruction,” Network and Distributed System Security (NDSS) Symposium , 2025

    work page 2025

  19. [19]

    MedLeak: Multimodal medical data leakage in secure federated learning with crafted models,

    S. Shi, M. S. Haque, A. Parida, C. Zhang, M. Linguraru, Y . T. Hou, S. Anwar, and W. Lou, “MedLeak: Multimodal medical data leakage in secure federated learning with crafted models,” in Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE), IEEE/ACM, 2025

    work page 2025

  20. [20]

    Auror: Defending against poisoning attacks in collaborative deep learning systems,

    S. Shen, S. Tople, and P. Saxena, “Auror: Defending against poisoning attacks in collaborative deep learning systems,” in Proceedings of the 32nd Annual Conference on Computer Security Applications , pp. 508– 519, 2016

    2016

  21. [21]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866 , 2018

    Pith/arXiv arXiv 2018

  22. [22]

    Learning to detect malicious clients for robust federated learning,

    S. Li, Y . Cheng, W. Wang, Y . Liu, and T. Chen, “Learning to detect malicious clients for robust federated learning,” arXiv preprint arXiv:2002.00211, 2020

    Pith/arXiv arXiv 2002

  23. [23]

    Pdgan: A novel poisoning defense method in federated learning using generative adversarial network,

    Y . Zhao, J. Chen, J. Zhang, D. Wu, J. Teng, and S. Yu, “Pdgan: A novel poisoning defense method in federated learning using generative adversarial network,” in International Conference on Algorithms and Architectures for Parallel Processing, pp. 595–609, Springer, 2019

    2019

  24. [24]

    Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,

    P. Rieger, T. D. Nguyen, M. Miettinen, and A.-R. Sadeghi, “Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,” 2022

    2022

  25. [25]

    Contra: Defending against poisoning attacks in federated learning,

    S. Awan, B. Luo, and F. Li, “Contra: Defending against poisoning attacks in federated learning,” in Computer Security–ESORICS 2021: 26th European Symposium on Research in Computer Security, Darmstadt, Germany, October 4–8, 2021, Proceedings, Part I 26 , pp. 455–475, Springer, 2021

    work page 2021

  26. [26]

    Federated learning with hierarchical clustering of local updates to improve training on non-iid data,

    C. Briggs, Z. Fan, and P. Andras, “Federated learning with hierarchical clustering of local updates to improve training on non-iid data,” in 2020 International Joint Conference on Neural Networks (IJCNN) , pp. 1–9, IEEE, 2020

    2020

  27. [27]

    flare: Defending federated learning against model poisoning attacks via latent space representations,

    N. Wang, C. Zhang, Y . Xiao, Y . Chen, W. Lou, and Y . T. Hou, “flare: Defending federated learning against model poisoning attacks via latent space representations,” IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 3, pp. 2607–2623, 2025

    work page 2025

  28. [28]

    UCBlocker: Unwanted call blocking using anonymous authentication,

    C. Du, H. Yu, Y . Xiao, Y . T. Hou, A. D. Keromytis, and W. Lou, “UCBlocker: Unwanted call blocking using anonymous authentication,” in 32nd USENIX Security Symposium (USENIX Security 23) , pp. 445– 462, 2023

    work page 2023

  29. [29]

    Aaka: An anti-tracking cellular authentication scheme leveraging anonymous credentials,

    H. Yu, C. Du, Y . Xiao, A. Keromytis, C. Wang, R. Gazda, Y . T. Hou, and W. Lou, “Aaka: An anti-tracking cellular authentication scheme leveraging anonymous credentials,” in Network and Distributed System Security Symposium (NDSS) , 2023

    2023

  30. [30]

    Mobile tracking in 5g and beyond networks: Problems, challenges, and new directions,

    C. Du, H. Yu, Y . Xiao, W. Lou, C. Wang, R. Gazda, and Y . T. Hou, “Mobile tracking in 5g and beyond networks: Problems, challenges, and new directions,” in 2022 IEEE 19th International Conference on Mobile Ad Hoc and Smart Systems (MASS) , pp. 426–434, IEEE, 2022

    2022

  31. [31]

    Bijack: Break- ing bitcoin network with tcp vulnerabilities,

    S. Li, S. Shi, Y . Xiao, C. Zhang, Y . T. Hou, and W. Lou, “Bijack: Break- ing bitcoin network with tcp vulnerabilities,” in European Symposium on Research in Computer Security , pp. 306–326, Springer, 2023

    work page 2023

  32. [32]

    Closing the visibility gap: A monitoring framework for verifiable open RAN operations,

    H. Yu, M. Barat, Y . Xiao, Y . T. Hou, and W. Lou, “Closing the visibility gap: A monitoring framework for verifiable open RAN operations,” in Conference on Communications and Network Security (CNS) , IEEE, 2025

    work page 2025

  33. [33]

    Deepattest: An end-to-end attestation framework for deep neural networks,

    H. Chen, C. Fu, B. D. Rouhani, J. Zhao, and F. Koushanfar, “Deepattest: An end-to-end attestation framework for deep neural networks,” in Pro- ceedings of the 46th International Symposium on Computer Architecture , pp. 487–498, 2019

    work page 2019

  34. [34]

    Ppfl: Privacy-preserving federated learning with trusted execution envi- ronments,

    F. Mo, H. Haddadi, K. Katevas, E. Marin, D. Perino, and N. Kourtellis, “Ppfl: Privacy-preserving federated learning with trusted execution envi- ronments,” in Proceedings of the 19th annual international conference on mobile systems, applications, and services , pp. 94–108, 2021

    work page 2021

  35. [35]

    Sear: Secure and efficient aggregation for byzantine-robust federated learning,

    L. Zhao, J. Jiang, B. Feng, Q. Wang, C. Shen, and Q. Li, “Sear: Secure and efficient aggregation for byzantine-robust federated learning,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 5, pp. 3329–3342, 2021

    work page 2021

  36. [36]

    Intel sgx explained,

    V . Costan and S. Devadas, “Intel sgx explained,” in IACR Cryptology ePrint Archive, vol. 2016, p. 086, 2016

    work page 2016

  37. [37]

    Enabling execution assurance of federated learning at untrusted participants,

    X. Zhang, F. Li, Z. Zhang, Q. Li, C. Wang, and J. Wu, “Enabling execution assurance of federated learning at untrusted participants,” in IEEE INFOCOM 2020-IEEE Conference on Computer Communications , pp. 1877–1886, IEEE, 2020

    work page 2020

  38. [38]

    A fpga-based heterogeneous implemen- tation of ntruencrypt,

    H. Yu, C. Zhang, and H. Jiang, “A fpga-based heterogeneous implemen- tation of ntruencrypt,” in Advances in Parallel & Distributed Processing, and Applications: Proceedings from PDPTA’20, CSC’20, MSV’20, and GCC’20, pp. 461–475, Springer, 2021

    2021

  39. [39]

    High-performance and energy-efficient fpga-gpu-cpu heterogeneous system implementation,

    C. Zhang, H. Yu, Y . Zhou, and H. Jiang, “High-performance and energy-efficient fpga-gpu-cpu heterogeneous system implementation,” in Advances in Parallel & Distributed Processing, and Applications: Proceedings from PDPTA’20, CSC’20, MSV’20, and GCC’20 , pp. 477– 492, Springer, 2021

    2021

  40. [40]

    Gpu acceleration of ciphertext-policy attribute-based encryption,

    K. Fan, C. Zhang, R. Shan, H. Yu, and H. Jiang, “Gpu acceleration of ciphertext-policy attribute-based encryption,” in 2019 20th IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD) , pp. 94–101, IEEE, 2019

    2019

  41. [41]

    APEX: A verified architecture for proofs of execution on remote devices under full software compromise,

    I. D. O. Nunes, K. Eldefrawy, N. Rattanavipanon, and G. Tsudik, “APEX: A verified architecture for proofs of execution on remote devices under full software compromise,” in 29th USENIX Security Symposium (USENIX Security 20) , pp. 771–788, 2020

    work page 2020

  42. [42]

    Diat: Data integrity attestation for resilient collaboration of autonomous systems.,

    T. Abera, R. Bahmani, F. Brasser, A. Ibrahim, A.-R. Sadeghi, and M. Schunter, “Diat: Data integrity attestation for resilient collaboration of autonomous systems.,” in NDSS, 2019

    work page 2019

  43. [43]

    Oat: Attesting operation integrity of embedded devices,

    Z. Sun, B. Feng, L. Lu, and S. Jha, “Oat: Attesting operation integrity of embedded devices,” in 2020 IEEE Symposium on Security and Privacy (SP), pp. 1433–1449, IEEE, 2020

    work page 2020

  44. [44]

    {ARI}: Attestation of real-time mission execution integrity,

    J. Wang, Y . Wang, A. Li, Y . Xiao, R. Zhang, W. Lou, Y . T. Hou, and N. Zhang, “ {ARI}: Attestation of real-time mission execution integrity,” in 32nd USENIX Security Symposium (USENIX Security 23) , pp. 2761– 2778, 2023

    work page 2023

  45. [45]

    {ACES}: Automatic compartments for embedded systems,

    A. A. Clements, N. S. Almakhdhub, S. Bagchi, and M. Payer, “ {ACES}: Automatic compartments for embedded systems,” in 27th USENIX Security Symposium (USENIX Security 18) , pp. 65–82, 2018

    work page 2018

  46. [46]

    Trustzone: Integrated hardware and software security,

    T. Alves and D. Felton, “Trustzone: Integrated hardware and software security,” ARM White Paper

    work page

  47. [47]

    C-flat: control-flow attestation for embedded systems software,

    T. Abera, N. Asokan, L. Davi, J.-E. Ekberg, T. Nyman, A. Paverd, A.-R. Sadeghi, and G. Tsudik, “C-flat: control-flow attestation for embedded systems software,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pp. 743–754, 2016

    work page 2016

  48. [48]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    Pith/arXiv arXiv 2017

  49. [49]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  50. [50]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, R. Guerraoui, J. Stainer, et al., “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems , pp. 119–129, 2017

    work page 2017

  51. [51]

    Byzantine-robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” arXiv preprint arXiv:1803.01498, 2018

    Pith/arXiv arXiv 2018

  52. [52]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” Network and Distributed Systems Security Symposium NDSS , 2021

    2021

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.