Pith. sign in

REVIEW 4 major objections 6 minor 55 references

DSFL: A Dual-Server Byzantine-Resilient Federated Learning Framework via Group-Based Secure Aggregation

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DSFL claims that a dual-server federated learning scheme using additive secret sharing and group-based deviation filtering can keep models accurate and private under up to 30% Byzantine clients, without encryption.

desk verdict A promising fix for LSFL's client-server collusion attack, but the paper's central claim of eliminating non-colluding-server assumptions is contradicted by its own protocol, and the performance claims are overstated. read the letter →

arxiv 2509.08449 v1 pith:7UUQVQIE submitted 2025-09-10 cs.CR cs.AIcs.DC

Charuka Herath , Yogachandran Rahulamathavan , Varuna De Silva , Sangarapillai Lambotharan This is my paper · ORCID
classification cs.CRcs.AIcs.DC
keywords federatedlearningsecureaggregationByzantinerobustnessdual-serverarchitectureadditivesecretsharingnon-IIDdataedgecomputingprivacy-preservingmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that federated learning can simultaneously resist Byzantine participants, protect individual updates from curious servers, and stay cheap enough for edge devices. It proposes DSFL, a dual-server protocol in which each client splits its update into two noisy shares sent to two separate servers, which then compare group-level aggregates to score and filter clients. The paper argues this design avoids encryption and pairwise key exchange, and reports that it outperforms baselines including LSFL, homomorphic encryption, and differential privacy on MNIST, CIFAR-10, and CIFAR-100 with up to 30% attackers. A sympathetic reader would care because the result points to a practical edge-deployable balance between privacy and robustness, provided the trust assumptions hold.

What carries the argument

The load-bearing mechanism is additive secret sharing across two non-colluding honest-but-curious servers, combined with group-wise deviation scoring. Each client sends $w_i^{(1)}=w_i+\zeta_i$ to one server and $w_i^{(2)}=w_i-\zeta_i$ to the other; the servers exchange only group sums and per-group distances encoded in the PCM and CPG matrices. Because the group membership equations are deliberately overlapping and underdetermined ($m<N$ or $\mathrm{rank}(PCM)<N$), neither server alone can solve for individual $w_i$, while the median of per-client deviation scores $d_i''=|Pd_{P_i}-M|$ provides a Byzantine filter that selects the top-$k$ consistent updates. The credit system then rewards selected clients and penalizes unselected ones, gradually excluding persistent free-riders or attackers.

What would settle it

Run the DSFL protocol with the two servers colluding: have them exchange their received shares $w_i^{(1)}$ and $w_i^{(2)}$ and check whether each client's update $w_i$ is recovered exactly; if yes, the privacy guarantee collapses under collusion. Separately, to test the Byzantine filter, launch a coordinated label-flipping attack where malicious clients submit updates that are deliberately close to the median; if the attacker success rate no longer drops to near zero, the top-k median selection fails.

Watch

Extended reading notes

Core claim

The central discovery is that a dual-server aggregation protocol can be hardened against both privacy leakage and Byzantine poisoning by making each server's view of client updates linearly underdetermined. DSFL builds on LSFL's additive-noise sharing but replaces simple aggregate exchange with a participant combination matrix (PCM) and a contributed participant group matrix (CPG): the third-party server sends groupwise sums to the service provider, which computes each group's distance from the global average; deviation scores are assembled per client, the median is taken as the trusted reference, and the top-k closest updates are aggregated. The authors claim that no single server can invert the group equations to recover individual updates, and that top-k median filtering plus a reward-penalty credit system suppresses label-flipping attackers while preserving convergence at $O(1/T)$. They also report exposing a critical flaw in LSFL: one malicious client sharing its share with a server lets that server reconstruct every other client's update from the transmitted distance values. On CIFAR-10, DSFL holds 97.15% accuracy under 20% Byzantine clients, and on CIFAR-100 non-IID it reaches 61.18%, compared with 9.39% for FedAvg under comparable threat.

Load-bearing premise

The load-bearing premise is that the two servers, the Service Provider and the Trusted Authority, are honest-but-curious and never collude; the paper's abstract says it removes this dependency, but the protocol and security proofs explicitly assume it, and if the servers collude, pooling their shares reconstructs every client update.

Editorial extensions

If this is right

  • With 20% Byzantine clients, DSFL holds 96.12% accuracy on MNIST IID, 97.15% on CIFAR-10 IID, and 68.60% on CIFAR-100 IID, where FedAvg collapses to 9.39% on CIFAR-100 non-IID under similar threat.
  • Attacker success rate under label-flipping falls to near zero within the first 5–10 communication rounds, suggesting the deviation filter neutralizes poisoned updates early in training.
  • Per-round runtime of 55.9 ms and 1088 KB communication for 10 clients on MNIST place DSFL close to FedAvg and far below homomorphic-encryption aggregation, which the paper reports at 1020.3 ms and 13.2 MB.
  • The security theorems state that privacy holds only while the two servers do not collude; otherwise the stated guarantees do not apply.
  • The convergence analysis claims an optimal $O(1/T)$ rate under L-smoothness, strong convexity, and bounded variance, with the Byzantine filter preserving this rate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the paper is right, the non-collusion assumption is doing the essential privacy work: the moment the two servers pool their received shares, every client update is recoverable exactly, so the privacy claim should be read as privacy against each server individually, not against colluding servers.
  • The top-k median filtering follows a standard robust-aggregation template; a natural testable extension is to evaluate DSFL against adaptive attackers that mimic benign update distributions, or against model-replacement and backdoor attacks, which the current label-flipping evaluation does not cover.
  • The credit and reward-penalty mechanism turns participation into an economic game; an extension would study whether strategic clients can earn credits while still harming the model, and whether the scheme behaves fairly under client churn and dropout.
  • The underdetermined-system privacy argument is information-theoretic in spirit, but it depends on servers never sharing their views; a concrete extension would compute the minimum number of colluding clients or malicious servers needed to make the PCM equations uniquely solvable.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes DSFL, a dual-server federated learning framework in which each client splits its model update into two additive shares sent to a Service Provider and a Trusted Authority, and the servers jointly perform group-based Byzantine filtering (PCM/CPG matrices), top-k selection, a credit-based reward-penalty mechanism, and secure aggregation. The authors evaluate DSFL on MNIST, CIFAR-10, and CIFAR-100 under IID and non-IID data with up to 30% Byzantine participants, and report runtime and communication overhead. The abstract and conclusion claim that DSFL eliminates the non-colluding-server dependency of LSFL, achieves strong privacy through additive noise sharing, and consistently outperforms state-of-the-art baselines.

Significance. If the security and empirical claims were sound, DSFL would be a useful lightweight dual-server protocol for privacy-preserving Byzantine-robust federated learning on edge devices. The paper contains useful overhead measurements and a broad baseline comparison, and the group-based deviation-scoring idea is potentially interesting. However, the central contribution as stated is not delivered: the protocol explicitly retains the honest-but-curious, non-colluding-server assumption that the abstract claims to remove, and the security analysis is presented only as proof sketches with no formal adversary model. The empirical results also contradict the claim that DSFL consistently outperforms LSFL. The manuscript does not provide machine-checked proofs or reproducible code, so the remaining claims rest on informal arguments and selected experiments.

major comments (4)
  1. [Abstract; Section III.A; Section IV; Section V.G; Algorithm 1] The claim that DSFL eliminates LSFL's dependency on non-colluding semi-honest servers is contradicted by the protocol itself. Algorithm 1 sends w(1)_i to TP and w(2)_i to SP, Section IV states that the design is secure under "a semi-honest, non-colluding assumption between TP and SP", and Section V.G Theorem 2 states that the protocol is "secure as long as SP and TP do not collude". If SP and TP collude, they can pool their shares and recover each client's update exactly via Eq. (10) as w_i = (w(1)_i + w(2)_i)/2. The paper does not provide any mechanism that prevents this, so the headline contribution in the Abstract is not supported.
  2. [Section V.G, Theorems 1-3] The security analysis consists of one-paragraph proof sketches and does not define a formal adversary model, a security game, or a simulation argument. In Theorem 2, the claimed views are internally inconsistent: SP's view is said to include w = w(1)+w(2) and w(2)_i, yet the proof simply asserts that SP cannot infer w(1) without explaining how these quantities can be combined. Since privacy preservation is the paper's central claim, a proof sketch is not sufficient; a formal reduction or an explicit indistinguishability argument is needed.
  3. [Table III; Abstract; Section VI] Table III does not support the assertion that DSFL "consistently outperforms" LSFL. Under 20% Byzantine participants, DSFL is worse than LSFL in four of the six reported settings: MNIST non-IID (90.12 vs. 90.31), CIFAR-10 IID (97.15 vs. 97.53), CIFAR-10 non-IID (95.05 vs. 95.25), and CIFAR-100 IID (68.60 vs. 69.08). DSFL only outperforms LSFL on MNIST IID and CIFAR-100 non-IID. The Abstract and Conclusion should be corrected, or the evaluation should be revised to support the claimed superiority.
  4. [Section IV (Collaborative Filtering Method); Section V.B] The Byzantine-robustness evaluation is partly forced by construction. The selection threshold is set to k = floor((1-beta)N), where beta is the estimated Byzantine fraction, and the experiments set beta equal to the actual attack fraction used in the same scenario (e.g., beta in {0.0, 0.1, 0.2, 0.3} in Section V.B). This assumes the defender knows the exact attack rate, which is unrealistic, and no experiments vary k under a fixed attack fraction or study mismatch between the assumed and actual beta. The reported robustness numbers are therefore optimistic.
minor comments (6)
  1. [Section III.C, Eq. (8)] Equation (8) states wi = w(1)_i + w(2)_i, which is inconsistent with Eq. (2) and Eq. (10), where wi = (w(1)_i + w(2)_i)/2. The reconstruction attack still works with the correct factor, but the equation should be fixed.
  2. [Section IV (Secure Byzantine Robustness)] The displayed formula for m is typeset ambiguously and appears to depend on P rather than P^*; please clarify the intended expression and its relationship to the number of malicious participants.
  3. [Algorithm 2, Step 12] The line "TP computes d''_i = |P dP1 - M|" appears to contain a typo; it should presumably be |P dPi - M| for each participant Pi.
  4. [Figure 2 caption and panel labels] The caption states 5%, 10%, and 20% Byzantine ratios, but the individual panels are labeled 5%, 15%, and 20%; the labels and caption should be reconciled.
  5. [Table I, DSFL row] The entry in the Server column reads "sual", which appears to be a typo for "dual".
  6. [Section V.D] The text says "DSFL consistently outperforms all baselines across datasets and data partitions," but this is contradicted by Table III even when comparing only with LSFL. The wording should be aligned with the data.

Circularity Check

2 steps flagged · score 6.0 of 10

Central claims reduce to their own assumptions: privacy 'eliminates non-collusion' is proven only under non-collusion, and Byzantine robustness sets k from the attack fraction, forcing attacker exclusion by construction.

  1. self definitional [Abstract vs. Section V.G (Theorem 2) and Section IV, Eq. (10)/Algorithm 1]
    "Unlike LSFL, which assumes non-colluding, semi-honest servers, our framework eliminates this dependency... We analyse the security guarantees of the proposed DSFL scheme under the assumptions that the Service Provider (SP) and the Trusted Authority (TP) are honest-but-curious and do not collude."

    Algorithm 1 sends w^(1)_i to TP and w^(2)_i to SP with w_i = (w^(1)_i + w^(2)_i)/2 (Eq. 10), so any colluding server pair holding both shares recovers every w_i exactly and the noise zeta cancels. The security theorem intended to support the headline claim is stated only under the assumption that SP and TP 'do not collude.' Thus the advertised removal of the non-collusion dependency is not derived from the protocol: the protocol's privacy guarantee is, by construction, equivalent to the very non-collusion assumption the abstract claims to eliminate. The contribution is true only when its target premise is stipulated.

  2. fitted input called prediction [Section IV.C.2 (Collaborative Filtering Method) and Section V.B (Adversary Model)]
    "In practice, k is chosen such that k ≤ N−⌊βN⌋... we empirically set k =⌊(1−β)N⌋. ... a selected fraction of participants, denoted by β ∈ {0.0, 0.1, 0.2, 0.3}... behave maliciously"

    The same symbol beta is used for the assumed Byzantine fraction inside the defense and the realized Byzantine fraction in the experiments. With k = floor((1−β)N), the top-k filter is sized to drop exactly the number of poisoned clients present in that experiment. Under the honest-majority assumption and detectable deviation scores, the reported near-zero attacker success and robust accuracies in Table III and Figure 3 are consequences of setting the filter size from the test attack fraction, not independent predictions of the framework. The key robustness parameter is fitted to the attack scenario and the outcome is then presented as DSFL's achieved property.

full rationale

The paper does not rely on a self-citation chain or an imported uniqueness theorem; LSFL [35] is an external prior work and no load-bearing claim rests on the authors' own prior publications. The two genuine circularity issues are structural. First, the central advertised improvement over LSFL is the removal of the non-colluding-server dependency, but the security analysis (Theorem 2) is explicitly conditioned on SP and TP being honest-but-curious and non-colluding, while the protocol's own split W = w^(1)+w^(2) makes each update trivially recoverable by any pair holding both shares. The claimed elimination is therefore not derived; it is assumed into the model. Second, the Byzantine-robustness evaluation uses k = floor((1−β)N) with beta equal to the actual malicious fraction in the same experiments, so the filter size is chosen to exclude exactly the number of attackers present; this makes the reported suppression of attackers and high accuracy partly forced by construction rather than independently demonstrated. Separately, and not as a circularity point, Table III itself contradicts the conclusion's 'consistently outperforms' claim, since LSFL scores higher in four of the six settings; that is a factual inconsistency rather than a circular derivation. Taking these together, the privacy claim is self-definitional and the robustness claim reduces to a fitted threshold, so the paper merits a 6 rather than a lower score.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

No new physical entities are postulated. The protocol introduces virtual constructs (PCM, CPG, credits), but these are algorithmic data structures, not unexplained physical mechanisms. The main burden is on free parameters: sigma, k, beta, and credit values, all of which affect the reported results and are set empirically.

free parameters (4)
  • Gaussian noise scale sigma = 20
    The noise variance for secret shares is set to sigma=20 in Section IV Step II without sensitivity analysis or a differential privacy guarantee; privacy and utility both depend on this value.
  • Top-k selection threshold k = k = floor((1-beta)N), e.g., k=8 for N=10, P*=20%
    Set empirically based on the expected fraction of malicious participants. In experiments beta equals the actual attack fraction, so the defender is given the attack parameter.
  • Expected Byzantine fraction beta = 0.0, 0.1, 0.2, 0.3
    Used to set k and the number of groups m. The paper assumes the system knows this value, which is unrealistic in deployment.
  • Credit parameters gamma, reward rho, penalty phi, cost sigma = not specified
    The reward-penalty mechanism in Section IV requires initial credits, per-round cost, reward, and penalty values, but no concrete values are given in the paper.
assumptions (4)
  • domain assumption The two servers TP and SP are honest-but-curious and do not collude.
    Stated in Section III.A and Section V.G. The entire privacy guarantee collapses if this assumption is violated, and the abstract's claim to remove the non-colluding-server assumption is contradicted.
  • domain assumption Adding Gaussian noise with sigma=20 to one share hides the true update from a server that holds all first shares.
    Invoked implicitly in Section IV and Theorem 1. No formal differential privacy or information-theoretic bound is provided, and the noise scale is arbitrary.
  • domain assumption Euclidean distance of group averages from the global average is a sufficient signal for identifying Byzantine participants.
    Used throughout Section IV. The paper provides no proof that label-flipping or other adaptive attacks must appear as outliers under this distance.
  • standard math Standard smoothness, strong convexity, and bounded variance assumptions for convergence (Assumptions 1-3).
    Used in Section V.H to claim O(1/T) convergence, but the proof does not model the filtering mechanism and simply bounds adversarial updates by an unspecified G.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DSFL: A Dual-Server Byzantine-Resilient Federated Learning Framework via Group-Based Secure Aggregation." pith.science (2026). https://pith.science/paper/7UUQVQIE

@misc{pith2026250908449,
  author       = {Pith},
  title        = {Pith review of: DSFL: A Dual-Server Byzantine-Resilient Federated Learning Framework via Group-Based Secure Aggregation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7UUQVQIE}},
  note         = {Machine review of arXiv:2509.08449}
}
read the original abstract

Federated Learning (FL) enables decentralized model training without sharing raw data, offering strong privacy guarantees. However, existing FL protocols struggle to defend against Byzantine participants, maintain model utility under non-independent and identically distributed (non-IID) data, and remain lightweight for edge devices. Prior work either assumes trusted hardware, uses expensive cryptographic tools, or fails to address privacy and robustness simultaneously. We propose DSFL, a Dual-Server Byzantine-Resilient Federated Learning framework that addresses these limitations using a group-based secure aggregation approach. Unlike LSFL, which assumes non-colluding semi-honest servers, DSFL removes this dependency by revealing a key vulnerability: privacy leakage through client-server collusion. DSFL introduces three key innovations: (1) a dual-server secure aggregation protocol that protects updates without encryption or key exchange, (2) a group-wise credit-based filtering mechanism to isolate Byzantine clients based on deviation scores, and (3) a dynamic reward-penalty system for enforcing fair participation. DSFL is evaluated on MNIST, CIFAR-10, and CIFAR-100 under up to 30 percent Byzantine participants in both IID and non-IID settings. It consistently outperforms existing baselines, including LSFL, homomorphic encryption methods, and differential privacy approaches. For example, DSFL achieves 97.15 percent accuracy on CIFAR-10 and 68.60 percent on CIFAR-100, while FedAvg drops to 9.39 percent under similar threats. DSFL remains lightweight, requiring only 55.9 ms runtime and 1088 KB communication per round.

Figures

Figures reproduced from arXiv: 2509.08449 by the authors.

Figure 1
Figure 1. System Overview proposed in [35]. Each participant Pi splits its private parameter wi into two additive secret shares: wi = 1 2 (w (1) i + w (2) i ) = 1 2 (wi + ζi + wi − ζi), (10) where ζi is Gaussian noise sampled from N (0, σ2 ) with σ = 20. Each participant Pi sends w (1) i and w (2) i to SP and TP, respectively. The dual-Server secure model update process follows this step. This process is systematically deline… view at source ↗
Figure 2
Figure 2. Test accuracies of DSFL and Baseline models for different for 5%, 10% and 20%of Byzantine participants (under label flipping attack) on MNIST, CIFAR-10 and CIFAR-100 datasets (non-IID) TABLE IV Test accuracy (%) of DSFL and FedAvg under varying Byzantine ratios on MNIST, CIFAR-10, and CIFAR-100 (IID / non-IID). Method (% Byzantine) MNIST CIFAR-10 CIFAR-100 FedAvg (0%) 98.67 / 95.65 98.16 / 97.56 55.16 / 53.56 FedAvg… view at source ↗
Figure 3
Figure 3. Attacker success rate over training epochs across different aggregation protocols under label-flipping attacks. The success rate reflects the proportion of malicious updates that successfully influence the global model. DSFL demonstrates a rapid suppression of adversarial influence, reaching near-zero success rates within the first few epochs and maintaining robustness throughout training. In contrast, FedAvg remain… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Comparison of computational and communication complexi￾ties for DSFL, FedAvg, and HE-based solutions [53]. DSFL achieves strong defence with a marginal increase in complexity compared to FedAvg and substantially lower overhead than HE-based protocols. TABLE VI Runtime …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 35 canonical work pages

  1. [1]

    Resolution on generative artificial intelligence systems,

    G. P. Assembly, “Resolution on generative artificial intelligence systems,” 45th Closed Session of the Global Privacy Assembly, 2023

    work page 2023

  2. [2]

    Domain adaptation: Challenges, methods, datasets, and applications,

    P.Singhal,R.Walambe,S.Ramanna,andK.Kotecha,“Domain adaptation: Challenges, methods, datasets, and applications,” IEEE Access, vol. 11, pp. 6973–7020, 2023

    work page 2023

  3. [3]

    The challenges of data quality and data quality assessment in the big data era,

    L. Cai and Y. Zhu, “The challenges of data quality and data quality assessment in the big data era,” Data Science Journal, vol. 14, no. 0, p. 2, 2015

    work page 2015

  4. [4]

    Federated learning of deep networks using model averaging,

    H. B. McMahan, E. Moore, D. Ramage, and B. A. y Arcas, “Federated learning of deep networks using model averaging,” CoRR, vol. abs/1602.05629, 2016. [Online]. Available:http://arxiv.org/abs/1602.05629

    arXiv 2016

  5. [5]

    Federated learning: Strategies for improving communication efficiency,

    J. Konečný, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” CoRR, vol. abs/1610.05492, 2016. [Online]. Available: http://arxiv.org/abs/1610.05492

    arXiv 2016

  6. [6]

    A review on traditional machine learning and deep learning models for wbcs classification in blood smear images,

    S. Khan, M. Sajjad, T. Hussain, A. Ullah, and A. S. Imran, “A review on traditional machine learning and deep learning models for wbcs classification in blood smear images,” IEEE Access, vol. 9, pp. 10657–10673, 2021

    work page 2021

  7. [7]

    Federated vs. centralized machine learning under privacy-elastic users: A comparative analysis,

    G. Drainakis, K. V. Katsaros, P. Pantazopoulos, V. Sourlas, and A. Amditis, “Federated vs. centralized machine learning under privacy-elastic users: A comparative analysis,” in 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), 2020, pp. 1–8. 16

    work page 2020

  8. [8]

    A survey on federated learning: The journey from centralized to distributed on-site learning and beyond,

    S. Abdulrahman, H. Tout, H. Ould-Slimane, A. Mourad, C. Talhi, and M. Guizani, “A survey on federated learning: The journey from centralized to distributed on-site learning and beyond,” IEEE Internet of Things Journal, vol. 8, no. 7, pp. 5476–5497, 2021

    work page 2021

Show all 55 references
  1. [9]

    Federated benchmarking of medical artificial intelligence with medperf,

    A. Karargyris, R. Umeton, M. J. Sheller et al., “Federated benchmarking of medical artificial intelligence with medperf,” Nature Machine Intelligence, vol. 5, pp. 799–810, 2023. [Online]. Available:https://doi.org/10.1038/s42256-023-00652-2

    2023 doi

  2. [10]

    Feder- ated learning in autonomous vehicles using cross- border training,

    H. Xu, M. Pan, X. Huang, and A. Shen, “Feder- ated learning in autonomous vehicles using cross- border training,” https://developer.nvidia.com/blog/ federated-learning-in-autonomous-vehicles-using-cross-border-training/ , October 2024, computer Vision / Video Analytics, NVIDIA...

    2024

  3. [11]

    Securing secure aggregation: mitigating multi-round privacy leakage in federated learning,

    J. So, R. E. Ali, B. Güler, J. Jiao, and A. S. Avestimehr, “Securing secure aggregation: mitigating multi-round privacy leakage in federated learning,” ser. AAAI’23/IAAI’23/EAAI’23. AAAI Press, 2023. [Online]. Available:https://doi.org/10.1609/ aaai.v37i8.26177

    2023

  4. [12]

    Inference attacks against collaborative learning,

    L. Melis, C. Song, E. D. Cristofaro, and V. Shmatikov, “Inference attacks against collaborative learning,” CoRR, vol. abs/1805.04049, 2018. [Online]. Available: http://arxiv.org/ abs/1805.04049

    2018 arXiv

  5. [13]

    A review of secure federated learning: Privacy leakage threats, protection technologies, challenges and future directions,

    L. Ge, H. Li, X. Wang, and Z. Wang, “A review of secure federated learning: Privacy leakage threats, protection technologies, challenges and future directions,” Neurocomputing, vol. 561, p. 126897, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S...

    2023

  6. [14]

    How much privacy does federated learning with secure aggregation guarantee?

    A. R. Elkordy, J. Zhang, Y. H. Ezzeldin, K. Psounis, and S. Avestimehr, “How much privacy does federated learning with secure aggregation guarantee?” 2022. [Online]. Available: https://arxiv.org/abs/2208.02304

    2022 arXiv

  7. [15]

    Federated learning minimal model replacement attack using optimal transport: An attacker perspective,

    K. Naveen Kumar, C. Krishna Mohan, and L. Reddy Cenkera- maddi, “Federated learning minimal model replacement attack using optimal transport: An attacker perspective,” IEEE Trans- actions on Information Forensics and Security, vol. 20, pp. 478– 487, 2025

    2025

  8. [16]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” CoRR, vol. abs/1807.00459, 2018. [Online]. Available: http://arxiv.org/abs/1807.00459

    2018 arXiv

  9. [17]

    Analyzing federated learning through an adversarial lens,

    A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in Proceedings of the 36th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, K. Chaudhuri and R. Salakhutdinov, Eds., v...

    2019

  10. [18]

    Dual model replacement:invisible multi-target backdoor attack based on federal learning,

    R. Wang, G. Zhou, M. Gao, and Y. Xiao, “Dual model replacement:invisible multi-target backdoor attack based on federal learning,” 2024. [Online]. Available:https://arxiv.org/ abs/2404.13946

    2024 arXiv

  11. [19]

    Dba: Distributed backdoor attacks against federated learning,

    C. Xie, K. Huang, P.-Y. Chen, and B. Li, “Dba: Distributed backdoor attacks against federated learning,” in International Conference on Learning Representations, 2020. [Online]. Available:https://openreview.net/forum?id=rkgyS0VFvr

    2020

  12. [20]

    Local model poisoning attacks to Byzantine-Robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-Robust federated learning,” in 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 1605–

    2020

  13. [21]

    A gan- based data poisoning attack against federated learning systems and its countermeasure,

    W. Sun, B. Gao, K. Xiong, and Y. Wang, “A gan- based data poisoning attack against federated learning systems and its countermeasure,” 2024. [Online]. Available: https://arxiv.org/abs/2405.11440

    2024

  14. [22]

    Deep models under the GAN: information leakage from collaborative deep learning,

    B. Hitaj, G. Ateniese, and F. Pérez-Cruz, “Deep models under the GAN: information leakage from collaborative deep learning,” CoRR, vol. abs/1702.07464, 2017. [Online]. Available: http://arxiv.org/abs/1702.07464

    2017 arXiv

  15. [23]

    Exploiting defenses against gan-based feature inference attacks in federated learning,

    X. Luo and X. Zhang, “Exploiting defenses against gan-based feature inference attacks in federated learning,” ACM Trans. Knowl. Discov. Data, vol. 19, no. 3, Apr. 2025. [Online]. Available:https://doi.org/10.1145/3719350

    2025 doi

  16. [24]

    Localmodelpoisoning attacks to byzantine-robust federated learning,

    M.Fang,X.Cao,J.Jia,andN.Z.Gong,“Localmodelpoisoning attacks to byzantine-robust federated learning,” in Proceedings of the 29th USENIX Conference on Security Symposium, ser. SEC’20. USA: USENIX Association, 2020

    2020

  17. [25]

    Data poisoning attacks against federated learning systems,

    V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” vol. abs/2007.08432, 2020. [Online]. Available: https://arxiv.org/ abs/2007.08432

    2007 arXiv

  18. [26]

    Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,

    M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” in 2018 IEEE Symposium on Security and Privacy (SP), 2018, pp. 19–35

    2018

  19. [27]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems, I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garne...

    2017

  20. [28]

    The hidden vulnerability of distributed learning in byzantium,

    R. Guerraoui, S. Rouault, and M. T. Vuilleumier, “The hidden vulnerability of distributed learning in byzantium,” in Interna- tional Conference on Machine Learning (ICML). PMLR, 2018, pp. 3521–3530

    2018

  21. [30]

    Byzantine- robust federated machine learning through adaptive model averaging,

    L. Muñoz-González, K. T. Co, and E. C. Lupu, “Byzantine- robust federated machine learning through adaptive model averaging,” 2019. [Online]. Available: https://arxiv.org/abs/ 1909.05125

    2019 arXiv

  22. [31]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New Yo...

    2017

  23. [32]

    Privacy-preserving deep learning via additively homomorphic encryption,

    L. T. Phong, Y. Aono, T. Hayashi, L. Wang, and S. Moriai, “Privacy-preserving deep learning via additively homomorphic encryption,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 5, pp. 1333–1345, 2018

    2018

  24. [33]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology – ASIACRYPT 2017, ser. Lecture Notes in Computer Science, T. Takagi and T. Peyrin, Eds., vol. 10624. Springer, Cham, 2017. [Online]. Available: h...

    2017 doi

  25. [34]

    Federated machine learning: Survey, multi-level classification, desirable criteria and future directions in communication and networking systems,

    O. A. Wahab, A. Mourad, H. Otrok, and T. Taleb, “Federated machine learning: Survey, multi-level classification, desirable criteria and future directions in communication and networking systems,”IEEECommunicationsSurveysandTutorials,vol.23, no. 2, pp. 1342–1397, 2021

    2021

  26. [35]

    Lsfl: A lightweight and secure federated learning scheme for edge computing,

    Z. Zhang, L. Wu, C. Ma, J. Li, J. Wang, Q. Wang, and S. Yu, “Lsfl: A lightweight and secure federated learning scheme for edge computing,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 365–379, 2023

    2023

  27. [36]

    FLOD: Oblivious defender for private byzantine-robust federated learning with dishonest-majority,

    Y. Dong, X. Chen, K. Li, D. Wang, and S. Zeng, “FLOD: Oblivious defender for private byzantine-robust federated learning with dishonest-majority,” Cryptology ePrint Archive, Paper 2021/993, 2021. [Online]. Available: https: //eprint.iacr.org/2021/993

    2021

  28. [37]

    Differentially private byzantine-robust federated learning,

    X. Ma, X. Sun, Y. Wu, Z. Liu, X. Chen, and C. Dong, “Differentially private byzantine-robust federated learning,” EEE Transactions on Parallel and Distributed Systems, vol. 33, no. 12, p. 3690–3701, Dec. 2022. [Online]. Available: https://doi.org/10.1109/TPDS.2022.3167434

    2022

  29. [38]

    ELSA: secure aggregation for federated learning with malicious actors,

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa, “ELSA: secure aggregation for federated learning with malicious actors,” IACR Cryptol. ePrint Arch., p. 1695, 2022. [Online]. Available: https://eprint.iacr.org/2022/1695

    2022

  30. [39]

    Byzantine-tolerant machine learning,

    P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Byzantine-tolerant machine learning,” CoRR, vol. abs/1703.02757, 2017. [Online]. Available: http://arxiv.org/ abs/1703.02757 17

    2017 arXiv

  31. [40]

    Batchcrypt: efficient homomorphic encryption for cross-silo federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y. Liu, “Batchcrypt: efficient homomorphic encryption for cross-silo federated learning,” ser. USENIX ATC’20. USA: USENIX Association, 2020

    2020

  32. [41]

    Verifynet: Secure and verifiable federated learning,

    G. Xu, H. Li, S. Liu, K. Yang, and X. Lin, “Verifynet: Secure and verifiable federated learning,” IEEE Transactions on Infor- mation Forensics and Security, vol. 15, pp. 911–926, 2020

    2020

  33. [42]

    Sear: Secure and efficient aggregation for byzantine-robust federated learning,

    L. Zhao, J. Jiang, B. Feng, Q. Wang, C. Shen, and Q. Li, “Sear: Secure and efficient aggregation for byzantine-robust federated learning,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 5, pp. 3329–3342, 2022

    2022

  34. [43]

    Pvd-fl: A privacy-preserving and verifiable decentralized federated learn- ing framework,

    J. Zhao, H. Zhu, F. Wang, R. Lu, Z. Liu, and H. Li, “Pvd-fl: A privacy-preserving and verifiable decentralized federated learn- ing framework,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2059–2073, 2022

    2022

  35. [44]

    A secure and efficient federated learning framework for NLP,

    J. Deng, C. Wang, X. Meng, Y. Wang, J. Li, S. Lin, S. Han, F. Miao, S. Rajasekaran, and C. Ding, “A secure and efficient federated learning framework for NLP,” CoRR, vol. abs/2201.11934, 2022. [Online]. Available: https: //arxiv.org/abs/2201.11934

    2022 arXiv

  36. [45]

    Prio+: Privacy preserving aggregate statistics,

    S. Addanki, K. Garbe, E. Jaffe, R. Ostrovsky, and A. Polychroniadou, “Prio+: Privacy preserving aggregate statistics,” in Security and Cryptography for Networks: 13th International Conference, SCN 2022, Amalfi (SA), Italy, September 12–14, 2022, Proceedings. Berlin, Heidelberg...

    2022 doi

  37. [46]

    Secure byzantine- robust machine learning,

    L. He, S. P. Karimireddy, and M. Jaggi, “Secure byzantine- robust machine learning,” CoRR, vol. abs/2006.04747, 2020. [Online]. Available:https://arxiv.org/abs/2006.04747

    2006 arXiv

  38. [47]

    Privacy- enhanced federated learning against poisoning adversaries,

    X. Liu, H. Li, G. Xu, Z. Chen, X. Huang, and R. Lu, “Privacy- enhanced federated learning against poisoning adversaries,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 4574–4588, 2021

    2021

  39. [48]

    A differentially private federated learning model against poisoning attacks in edge computing,

    J. Zhou, N. Wu, Y. Wang, S. Gu, Z. Cao, X. Dong, and K.-K. R. Choo, “A differentially private federated learning model against poisoning attacks in edge computing,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 3, pp. 1941– 1958, 2023

    1941

  40. [49]

    Privacy-preserving and byzantine-robust federated learning,

    C. Dong, J. Weng, M. Li, J.-N. Liu, Z. Liu, Y. Cheng, and S. Yu, “Privacy-preserving and byzantine-robust federated learning,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp. 889–904, 2024

    2024

  41. [50]

    Fedmd: Heterogenous federated learning via model distillation,

    D. Li and J. Wang, “Fedmd: Heterogenous federated learning via model distillation,” CoRR, vol. abs/1910.03581, 2019. [Online]. Available:http://arxiv.org/abs/1910.03581

    1910 arXiv

  42. [51]

    Accurate diabetes risk stratification using machine learning: Role of missing value and outliers

    M. Maniruzzaman, M. Rahman, Al-MehediHasan, and M. et al., “Accurate diabetes risk stratification using machine learning: Role of missing value and outliers.” Journal of Medical Systems, vol. 42, 2018

    2018

  43. [52]

    Byzantine-robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y. Chen, K. Ramchandran, and P. L. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” CoRR, vol. abs/1803.01498, 2018. [Online]. Available:http://arxiv.org/abs/1803.01498

    2018 arXiv

  44. [53]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. S. Quek, and H. Vincent Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Press, vol. 15, p. 3454–3469, Jan. 2020. [Online]. Available:https://doi.org/10.1109/TIF...

    2020

  45. [55]

    Local SGD converges fast and communicates little,

    S. U. Stich, “Local SGD converges fast and communicates little,” in International Conference on Learning Representations, 2019. [Online]. Available: https://openreview.net/forum?id=S1g2JnRcFX Charuka Herath is currently pursuing a PhD in AI and Cybersecurity at Loughborough Un...

    2019

  46. [1622]

    Available:https://www.usenix.org/conference/ usenixsecurity20/presentation/fang

    [Online]. Available:https://www.usenix.org/conference/ usenixsecurity20/presentation/fang

  47. [2019]

    Available:http://arxiv.org/abs/1910.06378

    [Online]. Available:http://arxiv.org/abs/1910.06378

    1910 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.