Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

SoK: Benchmarking Poisoning Attacks and Defenses in Federated Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A unified benchmark of 15 poisoning attacks and 17 defenses claims to settle which threats and countermeasures are most effective in federated learning—and shows that none of the defenses holds under non-IID data.

desk verdict A useful SoK and open benchmark for FL poisoning, but the headline attack/defense rankings are not statistically supported and should be read cautiously. read the letter →

arxiv 2502.03801 v1 pith:LM6NISNM submitted 2025-02-06 cs.CR cs.AIcs.LG

Heyi Zhang , Yule Liu , Xinlei He , Jun Wu , Tianshuo Cong , Xinyi Huang This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords federatedlearningpoisoningattacksmodeldatabackdoorrobustaggregationbenchmarkFLPoison
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the scattered, isolated evaluations of poisoning attacks and defenses in federated learning have produced unreliable and fragmented conclusions. To fix that, it builds one open benchmark, FLPoison, and runs 15 attacks and 17 defenses through the same pipeline on two datasets, two FL algorithms, and both IID and non-IID data. The central empirical claim is a set of rankings: Gaussian, Sign Flipping, and FangAttack are the most effective model poisoning attacks; BadNets is the most effective data poisoning attack; FLTrust and DnC defend best against model poisoning; FLAME defends best against data poisoning. The paper also claims that defenses designed for one attack type are partly effective against the other, and that no current defense is robust under non-IID data. A sympathetic reader would care because these rankings, if valid, give practitioners a single evidence-based reference for choosing defenses and designing new ones.

What carries the argument

The load-bearing object is FLPoison, a modular benchmark with three decoupled layers—federated learning (FedSGD, FedAvg, FedOpt), attack (model, data, hybrid), and aggregation (defenses)—so that any attack can be paired with any defense under identical settings. The evaluation runs 2,040 configurations (15 attacks × 17 defenses × 2 datasets × 2 algorithms × 2 data distributions) and summarizes results with two proposed metrics: Targeted Attack Impact (TAI) for data poisoning attacks and Targeted Defense Robustness (TDR) for defenses. These metrics make cross-method comparison possible and let the paper claim that MPA- and DPA-oriented defenses are mutually effective to a degree.

What would settle it

Run the same benchmark with per-method hyperparameter tuning (or with the original authors' recommended settings) and check whether the top-ranked attacks and defenses—Gaussian, Sign Flipping, FangAttack, BadNets, FLTrust, DnC, FLAME—remain at the top; if the rankings shift substantially, the current conclusions are artifacts of configuration choices.

Watch

Extended reading notes

Core claim

The paper claims that, when evaluated under one consistent protocol, the landscape of poisoning in federated learning sorts into clear winners. Model poisoning attacks that are simple and require little attacker knowledge—Gaussian noise injection, sign flipping, and the aggregator-aware Fang attack—consistently degrade accuracy more than sophisticated statistical-evasion attacks. Among data poisoning attacks, the plain BadNets backdoor has the highest attack success rate, outperforming more complex distributed and optimization-based backdoors. On the defense side, FLTrust, which uses a small clean server dataset to score client updates by cosine similarity, and DnC, which filters outliers by spectral decomposition, are the most effective against model poisoning; FLAME, which combines clustering, norm clipping, and adaptive noise, is the most effective against data poisoning. The paper further claims that model-poisoning defenses like Krum and Multi-Krum transfer surprisingly well to data poisoning, while no tested defense keeps accuracy and attack success rate acceptable under non-IID data.

Load-bearing premise

The rankings stand only if the re-implementations of all 15 attacks and 17 defenses faithfully match their original papers and the chosen hyperparameters are fair to each method, which the paper itself notes is not always the case for some defenses.

Editorial extensions

If this is right

  • If the rankings hold, practitioners should treat simple attacks (Gaussian, Sign Flipping, FangAttack) as the baseline threat for model poisoning rather than more complex ones.
  • FLTrust and DnC become the default first-line defenses against model poisoning, and FLAME against backdoor/data poisoning, under IID data.
  • Defenses designed for one attack vector (e.g., Krum for model poisoning) can be repurposed for the other, so evaluation should not be siloed.
  • The non-IID gap means current defenses are not production-ready for heterogeneous federated learning, pointing to a concrete research target.
  • The unified benchmark gives future work a drop-in harness to test new attacks and defenses against existing ones.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own ablation suggests that the ranking depends on adversary ratio; at higher ratios, simple attacks scale more than adaptive ones, so the "most effective" label is regime-dependent rather than universal.
  • The mutual-effectiveness result implies that defense evaluation taxonomies that separate MPA and DPA may be missing transferable mechanisms; a promising research direction is to identify which defense components (robust statistics vs. pattern detection) drive the transfer.
  • Because the paper reports that some defenses ran with non-adaptive hyperparameters or produced running errors, a fair comparison would require per-defense hyperparameter tuning; default settings may favor methods that need less tuning.
  • The two proposed metrics TAI and TDR weight accuracy and attack success rate equally, which is a modeling choice; other weightings could change the rankings.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This SoK paper systematizes poisoning attacks and defenses in federated learning. It proposes a taxonomy that distinguishes model poisoning attacks, data poisoning attacks, and hybrid attacks, and surveys 17 defense strategies. The central contribution is FLPoison, a modular open-source benchmark that evaluates 15 attacks and 17 defenses across two datasets (MNIST and CIFAR-10), two FL algorithms (FedSGD and FedOpt), and two data-heterogeneity levels. The paper reports quantitative results in a set of large tables and derives rankings of the most effective attacks and defenses, along with claims about the mutual effectiveness of defenses against model and data poisoning. It also provides design guidelines and an ablation study over adversary ratios. If the empirical benchmark is reliable, this would be a useful resource for the community, combining taxonomy, code, and a unified comparison that most prior surveys lack.

Significance. The paper's main value is its scale and unification: a single benchmark covering 15 attacks and 17 defenses, with code released, is a tangible contribution to a field where evaluations are typically fragmented and inconsistent. The taxonomy, especially the fine-grained categorization of poisoning attacks and defenses, and the attempt to study cross-algorithm and cross-heterogeneity behavior, are useful and go beyond prior surveys. The paper also makes a concrete empirical claim that defenses against model and data poisoning have partial mutual effectiveness. These contributions are significant if the benchmark's rankings are robust. The paper also deserves credit for disclosing incomplete cells and configuration changes in the appendix, even though those disclosures raise serious concerns about the validity of the rankings.

major comments (4)
  1. [§6.2, Table 4, Appendix B.6] The headline MPA rankings are not statistically supported. On CIFAR-10 the reported averages are Gaussian 50.3% versus FangAttack 50.5%, and on MNIST Sign Flipping 57.9%, ALIE 57.6%, and IPM 56.4% are separated by less than 1.5 percentage points. No standard deviations, confidence intervals, or number of seeds are reported anywhere in Section 6 or Appendix B.6. A single seed draw could plausibly invert these orderings, so the conclusion that 'Gaussian, Sign Flipping, and FangAttack are identified as the most effective MPAs' needs variance information or a statistical test before it can be treated as established.
  2. [§6.3, Tables 6 and 10, Appendix B.4] The defense averages are computed over incomplete and asymmetric cells. Several entries are marked '-' due to 'running errors due to non-adaptive hyper-parameters' (for example, F.G. is missing in all CIFAR-10 rows of Tables 6 and 10, and D.S. is missing in most CIFAR-10 rows), and Appendix B.4 states that some non-IID defenses require a lower learning rate as specified in batchrun.py. If dropped cells remove different defenses from different attack columns, or if learning rates were lowered only for a subset of defenses, the aggregate numerators and denominators are not comparable. The paper should report the exact cell coverage, re-run or justify the erroring configurations, and show that the rankings in Section 6.3 are robust to excluding or repairing these cells.
  3. [§6.2.1 and §6.3.1, Eqs. (20) and (21)] The TAI and TDR composite metrics are introduced without derivation or sensitivity analysis. TAI = ACC/ACC_no_attack + ASR and TDR = ACC/ACC_no_attack + 1 - ASR add accuracy and attack success rate on a common scale, and the resulting rankings in Figures 5b, 6b, 7b, and 8b may depend on this arbitrary weighting. The authors should validate the composite metrics, for example by reporting rank correlations with the raw ACC and ASR values already given in Tables 5, 7, and 10, or by checking alternative weightings, before using TAI and TDR to support qualitative takeaways.
  4. [§6.1, Appendix B.1, Table 9] The comparison between FedSGD and FedOpt is not well-defined. With full participation and a server learning rate set to 1, the FedOpt rule in Algorithm 1 reduces exactly to FedAvg, yet the paper labels this condition as FedOpt and draws algorithm-dependent conclusions in Section 6.2.1 (e.g., 'MPAs are more effective under FedSGD' and 'most DPAs are stronger under FedOpt'). The authors should clarify whether the second algorithm is FedOpt or FedAvg, adjust the labels and interpretation accordingly, and ensure the algorithm-specific takeaways are not misattributed.
minor comments (4)
  1. [Appendix B.1] The heading contains a typo: 'Federal learning' should be 'Federated learning'.
  2. [Figure 1] The taxonomy figure labels one branch 'Outliner Detection Defense'; this should read 'Outlier Detection Defense'.
  3. [§4.1.3, Eq. (3)] The interval for the ALIE malicious weight update is written as (µi − zmaxσi, µi − zmaxσi), with identical endpoints; it should presumably be (µi − zmaxσi, µi + zmaxσi) or an analogous asymmetric interval.
  4. [Tables 5, 6, and 7] Several abbreviations are inconsistent or misspelled: 'M.P.' appears in Table 5 while 'ModelRep' is used elsewhere, and the row label 'A VG' in Tables 4, 6, and 7 should be 'AVG'.

Circularity Check

0 steps flagged · score 2.0 of 10

Benchmark rankings are empirical and not constructed from their inputs; the only self-citation is non-load-bearing, so circularity is minor.

full rationale

The paper is an empirical SoK benchmark, not a derivation from first principles, and its central claims do not reduce to their inputs by construction. The composite metrics TAI and TDR (Eq. 20 and Eq. 21) are transparent, parameter-free combinations of the standard measured quantities ACC and ASR; they are evaluation summaries, not fitted predictors, and the headline rankings follow directly from the tables (e.g., BadNets has the highest average ASR in Table 5 on both datasets). No attack or defense result is obtained by fitting a parameter and then renaming that fit as a prediction. The taxonomy is organized following prior work [30, 46] but is not used to derive the experimental outcomes. The only self-citation by overlapping authors is reference [55], cited in Appendix B.2 as an example alongside [48] for "adding dirty data"; this is a routine, non-load-bearing citation and does not support any uniqueness claim or forbid alternatives. The paper also self-reports limitations that weaken confidence in the rankings but are not circularity: several defense cells are marked '-' due to "running errors due to non-adaptive hyper-parameters" (Tables 6 and 10), and Appendix B.4 discloses that "some defenses converge slowly due to strict outlier filtering under non-IID settings, requiring a lower learning rate". These configuration choices and the absence of reported variance across seeds are correctness-and-robustness concerns, not evidence that a claimed result is equivalent to its own input. Overall, the derivation chain is self-contained against external benchmarks and code, so no significant circularity is present; the score reflects only the presence of a minor, non-load-bearing self-citation.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. Its central claims rest on experimental design choices (data partition, poisoning ratios, adversary ratios, hyperparameters) and on the assumption that the benchmark implementations are faithful reproductions. The number of free parameters is modest but they directly shape the rankings, and several are not described with enough detail to be audited from the paper alone.

free parameters (6)
  • Dirichlet alpha = 0.5
    Controls the degree of non-IID data heterogeneity; chosen as representative, but the conclusions about non-IID robustness depend on this single value.
  • Data poisoning ratio = 0.32 (20/64 images per batch)
    Poisoning ratio for data poisoning attacks, following prior work; affects all DPA results.
  • Adversary ratio (main runs) = 24/50 (MNIST), 4/20 (CIFAR-10)
    Proportion of malicious clients; high ratios may inflate attack effectiveness.
  • Adversary ratios (ablation) = 0.1, 0.2, 0.48
    Used to probe sensitivity, but 0.48 is extreme.
  • Lower learning rate for some non-IID defenses = specified in batchrun.py
    Applied to some defenses under non-IID; could bias comparisons if not equally applied.
  • Learning rate / batch size / epochs = 0.01 / 64 / 500-800
    Global training settings; standard but still choices.
assumptions (5)
  • domain assumption The adversary controls the first f clients and the rest are benign
    Section B.3 threat model; standard in prior work but limits generality to Sybil-style attacks.
  • domain assumption All clients participate in every round
    Section 6.1 states fully participating clients; real FL uses client sampling.
  • domain assumption FedSGD and FedOpt are sufficient representative algorithms; FedAvg is excluded
    Section B.3 says they evaluate two algorithms; FedAvg is the most widely used in practice, so results may not carry over.
  • domain assumption Hybrid poisoning attacks are treated as data poisoning in the evaluation
    Appendix B.4 groups all targeted attacks (including hybrid) as DPAs, which may conflate distinct attack mechanisms.
  • ad hoc to paper The hyperparameters from original papers, plus the paper's adjustments, are accepted as fair baselines
    The paper adapts learning rates for some defenses; this is an ad hoc choice that affects the comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Benchmarking Poisoning Attacks and Defenses in Federated Learning." pith.science (2026). https://pith.science/paper/LM6NISNM

@misc{pith2026250203801,
  author       = {Pith},
  title        = {Pith review of: SoK: Benchmarking Poisoning Attacks and Defenses in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LM6NISNM}},
  note         = {Machine review of arXiv:2502.03801}
}
read the original abstract

Federated learning (FL) enables collaborative model training while preserving data privacy, but its decentralized nature exposes it to client-side data poisoning attacks (DPAs) and model poisoning attacks (MPAs) that degrade global model performance. While numerous proposed defenses claim substantial effectiveness, their evaluation is typically done in isolation with limited attack strategies, raising concerns about their validity. Additionally, existing studies overlook the mutual effectiveness of defenses against both DPAs and MPAs, causing fragmentation in this field. This paper aims to provide a unified benchmark and analysis of defenses against DPAs and MPAs, clarifying the distinction between these two similar but slightly distinct domains. We present a systematic taxonomy of poisoning attacks and defense strategies, outlining their design, strengths, and limitations. Then, a unified comparative evaluation across FL algorithms and data heterogeneity is conducted to validate their individual and mutual effectiveness and derive key insights for design principles and future research. Along with the analysis, we frame our work to a unified benchmark, FLPoison, with high modularity and scalability to evaluate 15 representative poisoning attacks and 17 defense strategies, facilitating future research in this domain. Code is available at https://github.com/vio1etus/FLPoison.

Figures

Figures reproduced from arXiv: 2502.03801 by the authors.

Figure 1
Figure 1. Taxonomies of Poisoning Attacks in Federated Learning [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Overview of Our FLPoison data poisoning. In the data poisoning module, a synthesizer takes preprocessed data and applies the specified poisoning strategies. A data poisoning indicator determines whether a data batch will be poisoned, passing the modified batch for training or inference. Finally, the aggregation layer collects updates from clients via the server and applies a chosen ag￾gregation rule to produce the r… view at source ↗
Figure 3
Figure 3. Illustration of Poisoning Attack Principles [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Visualization of statistical heterogeneity across 20 clients for our IID and Non-IID partitions on CIFAR-10 dataset, where [PITH_FULL_IMAGE:figures/full_fig_p021_4.png]
Figure 5
Figure 5. Figure 5: Comparison of Attacks in terms of FL Algorithms [PITH_FULL_IMAGE:figures/full_fig_p021_5.png]
Figure 6
Figure 6. Figure 6: Comparison of Attacks in terms of Data Heterogeneity [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]
Figure 7
Figure 7. Figure 7: Comparison of Defenses in terms of FL Algorithms [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]
Figure 8
Figure 8. Figure 8: Comparison of Defenses in terms of Data Heterogeneity [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]
Figure 9
Figure 9. Figure 9: Comparison of Average Time Overhead Per Epoch [PITH_FULL_IMAGE:figures/full_fig_p023_9.png]
Figure 10
Figure 10. Figure 10: Comparison of Average ACC/ASR Under Different Adversary Ratios [PITH_FULL_IMAGE:figures/full_fig_p024_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Graph Representation Learning Augmented Model Manipulation on Federated Fine-Tuning of LLMs

    cs.LG 2026-05 unverdicted novelty 5.0 of 10

    Graph representation learning plus iterative augmented Lagrangian optimization creates stronger, harder-to-detect model manipulation attacks on federated LLM fine-tuning, cutting global accuracy by up to 26%.

Reference graph

Works this paper leans on

59 extracted references · 48 canonical work pages · cited by 1 Pith paper

  1. [1]

    Accessed: 2024-10-03

    California consumer privacy act (ccpa), state of cali- fornia - department of justice - office of the attorney general, oct 2018. Accessed: 2024-10-03. 1

    work page 2018

  2. [2]

    Accessed: 2024-10-03

    General data protection regulation (gdpr), apr 2024. Accessed: 2024-10-03. 1

    work page 2024

  3. [3]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deb- orah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on ar- tificial intelligence and statistics , pages 2938–2948. PMLR, 2020. 3, 4, 5, 9, 18, 19

    work page 2020

  4. [4]

    A little is enough: Circumventing defenses for distributed learning

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019. 1, 3, 7, 9

    work page 2019

  5. [5]

    Analyzing federated learn- ing through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learn- ing through an adversarial lens. In International con- ference on machine learning , pages 634–643. PMLR,

    work page

  6. [6]

    Poi- soning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poi- soning attacks against support vector machines. InPro- ceedings of the 29th International Coference on Inter- national Conference on Machine Learning , ICML’12, page 1467–1474, Madison, WI, USA, 2012. Omni- press. 3, 4, 18

    work page 2012

  7. [7]

    Machine learning with adver- saries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guer- raoui, and Julien Stainer. Machine learning with adver- saries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017. 1, 3, 4, 5, 6, 7, 12

    work page 2017

  8. [8]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhen- qiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995, 2020. 1, 6, 7, 9

    arXiv 2012

Show all 59 references
  1. [9]

    Asynchronous byzantine machine learning (the case of sgd)

    Georgios Damaskinos, Rachid Guerraoui, Rhicheek Patra, Mahsa Taziki, et al. Asynchronous byzantine machine learning (the case of sgd). In International Conference on Machine Learning , pages 1145–1154. PMLR, 2018. 3

    2018

  2. [10]

    Utilization of fate in risk management of credit in small and micro enterprises, 2020

    editor2fedai. Utilization of fate in risk management of credit in small and micro enterprises, 2020. 1

    2020

  3. [11]

    Local model poisoning attacks to {Byzantine- Robust} federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to {Byzantine- Robust} federated learning. In 29th USENIX security symposium (USENIX Security 20) , pages 1605–1622,

  4. [12]

    The limitations of federated learning in sybil set- tings

    Clement Fung, Chris JM Yoon, and Ivan Beschast- nikh. The limitations of federated learning in sybil set- tings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020) , pages 301–316, 2020. 1, 3, 4, 7, 8, 9, 12

    2020

  5. [13]

    Backdoor attacks and defenses in federated learning: State-of-the-art, taxonomy, and future direc- tions

    Xueluan Gong, Yanjiao Chen, Qian Wang, and Wei- han Kong. Backdoor attacks and defenses in federated learning: State-of-the-art, taxonomy, and future direc- tions. IEEE Wireless Communications, 30(2):114–121,

  6. [14]

    Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. 1, 3, 4, 18, 19

    2017 arXiv

  7. [15]

    The hidden vulnerability of distributed learning in byzantium

    Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning , pages 3521–3530. PMLR, 2018. 3, 4, 6, 7

    2018

  8. [16]

    Federated learning for mobile keyboard prediction

    Andrew Hard, Kanishka Rao, Rajiv Mathews, Swa- roop Ramaswamy, Françoise Beaufays, Sean Augen- stein, Hubert Eichner, Chloé Kiddon, and Daniel Ram- age. Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604, 2018. 1

    2018 arXiv

  9. [17]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arxiv e-prints. arXiv preprint arXiv:1512.03385 , 10,

    arXiv

  10. [18]

    Measuring the effects of non-identical data distribu- tion for federated visual classification

    Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribu- tion for federated visual classification. arXiv preprint arXiv:1909.06335, 2019. 9

    1909 arXiv

  11. [19]

    Robust statis- tics

    Peter J Huber and Elvezio M Ronchetti. Robust statis- tics. John Wiley & Sons, 2011. 6

    2011

  12. [20]

    Communication-efficient dis- tributed sgd with sketching

    Nikita Ivkin, Daniel Rothchild, Enayat Ullah, Ion Sto- ica, Raman Arora, et al. Communication-efficient dis- tributed sgd with sketching. Advances in Neural Infor- mation Processing Systems, 32, 2019. 5 14

    2019

  13. [21]

    Learning from history for byzantine robust optimiza- tion

    Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for byzantine robust optimiza- tion. In International Conference on Machine Learn- ing, pages 5311–5319. PMLR, 2021. 1, 3, 7, 9

    2021

  14. [22]

    Byzantine-robust learning on heterogeneous datasets via bucketing

    Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine-robust learning on heterogeneous datasets via bucketing. In International Conference on Learning Representations, 2022. 3, 4, 7, 9

    2022

  15. [23]

    Learning mul- tiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning mul- tiple layers of features from tiny images. 2009. 9

    2009

  16. [24]

    Ardis: a swedish historical handwritten digit dataset

    Huseyin Kusetogullari, Amir Yavariabdi, Abbas Ched- dad, Håkan Grahn, and Johan Hall. Ardis: a swedish historical handwritten digit dataset. Neural Computing and Applications, 32(21):16505–16518, 2020. 5

    2020

  17. [25]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278– 2324, 1998. 5

    1998

  18. [26]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278– 2324, 1998. 9

    1998

  19. [27]

    3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning

    Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In 2023 IEEE Symposium on Secu- rity and Privacy (SP) , pages 1893–1907. IEEE, 2023. 5, 9

    2023

  20. [28]

    An experimental study of byzantine-robust aggregation schemes in federated learning

    Shenghui Li, Edith C-H Ngai, and Thiemo V oigt. An experimental study of byzantine-robust aggregation schemes in federated learning. IEEE Transactions on Big Data, 2023. 2, 9, 18

    2023

  21. [29]

    Federated learning in mobile edge networks: A comprehensive survey

    Wei Yang Bryan Lim, Nguyen Cong Luong, Dinh Thai Hoang, Yutao Jiao, Ying-Chang Liang, Qiang Yang, Dusit Niyato, and Chunyan Miao. Federated learning in mobile edge networks: A comprehensive survey. IEEE communications surveys & tutorials, 22(3):2031–2063,

  22. [30]

    Privacy and robustness in federated learning: Attacks and defenses

    Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, Jun Zhao, Qiang Yang, and S Yu Philip. Privacy and robustness in federated learning: Attacks and defenses. IEEE transactions on neural networks and learning systems, 2022. 2, 17

    2022

  23. [31]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ram- age, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017. 1, 9, 18

    2017

  24. [32]

    Feder- ated learning for internet of things: A comprehensive survey

    Dinh C Nguyen, Ming Ding, Pubudu N Pathirana, Aruna Seneviratne, Jun Li, and H Vincent Poor. Feder- ated learning for internet of things: A comprehensive survey. IEEE Communications Surveys & Tutorials , 23(3):1622–1658, 2021. 1

    2021

  25. [33]

    Federated learning for smart healthcare: A survey

    Dinh C Nguyen, Quoc-Viet Pham, Pubudu N Pathi- rana, Ming Ding, Aruna Seneviratne, Zihuai Lin, Oc- tavia Dobre, and Won-Joo Hwang. Federated learning for smart healthcare: A survey. ACM Computing Sur- veys (Csur), 55(3):1–37, 2022. 1

    2022

  26. [34]

    In 31st USENIX Security Sympo- sium (USENIX Security 22) , pages 1415–1432, 2022

    Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al.{FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Sympo- sium (USENIX Securit...

    2022

  27. [35]

    Federated evaluation and tuning for on-device personalization: System de- sign & applications, 2022

    Matthias Paulik, Matt Seigel, Henry Mason, Dominic Telaar, Joris Kluivers, Rogier van Dalen, Chi Wai Lau, Luke Carlson, Filip Granqvist, Chris Vandevelde, Sudeep Agarwal, Julien Freudiger, Andrew Byde, Ab- hishek Bhowmick, Gaurav Kapoor, Si Beaumont, Áine Cahill, Dominic Hughe...

    2022

  28. [36]

    Robust aggregation for federated learning.IEEE Trans- actions on Signal Processing, 70:1142–1154, 2022

    Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning.IEEE Trans- actions on Signal Processing, 70:1142–1154, 2022. 1, 5, 6, 7

    2022

  29. [37]

    Federated learning for emoji prediction in a mobile keyboard

    Swaroop Ramaswamy, Rajiv Mathews, Kanishka Rao, and Françoise Beaufays. Federated learning for emoji prediction in a mobile keyboard. arXiv preprint arXiv:1906.04329, 2019. 1

    1906 arXiv

  30. [38]

    Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Kone ˇcný, Sanjiv Kumar, and Hugh Brendan McMahan

    Sashank J. Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Kone ˇcný, Sanjiv Kumar, and Hugh Brendan McMahan. Adaptive fed- erated optimization. In International Conference on Learning Representations, 2021. 9, 18

    2021

  31. [39]

    Deepsight: Mitigat- ing backdoor attacks in federated learning through deep model inspection

    Phillip Rieger, Thien Duc Nguyen, Markus Mietti- nen, and Ahmad-Reza Sadeghi. Deepsight: Mitigat- ing backdoor attacks in federated learning through deep model inspection. arXiv preprint arXiv:2201.00763 ,

    arXiv

  32. [40]

    Sok: Systematizing attack studies in federated learning–from sparseness to completeness

    Geetanjli Sharma, MAP Chamikara, Mohan Baruwal Chhetri, and Yi-Ping Phoebe Chen. Sok: Systematizing attack studies in federated learning–from sparseness to completeness. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications Secu- rity, pages 579–592, 20...

    2023

  33. [41]

    Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning

    Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021. 3, 4, 7, 9, 11 15

    2021

  34. [42]

    Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning

    Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning. In 2022 IEEE Symposium on Secu- rity and Privacy (SP) , pages 1354–1371. IEEE, 2022. 2, 9, 18

    2022

  35. [43]

    Au- ror: Defending against poisoning attacks in collabora- tive deep learning systems

    Shiqi Shen, Shruti Tople, and Prateek Saxena. Au- ror: Defending against poisoning attacks in collabora- tive deep learning systems. In Proceedings of the 32nd annual conference on computer security applications , pages 508–519, 2016. 5, 7, 9

    2016

  36. [44]

    Sparsified sgd with memory

    Sebastian U Stich, Jean-Baptiste Cordonnier, and Mar- tin Jaggi. Sparsified sgd with memory. Advances in neural information processing systems, 31, 2018. 5

    2018

  37. [45]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963,

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963,

    1911 arXiv

  38. [46]

    A compre- hensive survey on poisoning attacks and countermea- sures in machine learning

    Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu. A compre- hensive survey on poisoning attacks and countermea- sures in machine learning. ACM Computing Surveys , 55(8):1–35, 2022. 2, 17

    2022

  39. [47]

    Data and model poisoning backdoor attacks on wireless federated learn- ing, and the defense mechanisms: A comprehensive survey

    Yichen Wan, Youyang Qu, Wei Ni, Yong Xiang, Longxiang Gao, and Ekram Hossain. Data and model poisoning backdoor attacks on wireless federated learn- ing, and the defense mechanisms: A comprehensive survey. IEEE Communications Surveys & Tutorials ,

  40. [48]

    Attack of the tails: Yes, you really can backdoor federated learn- ing

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learn- ing. Advances in Neural Information Processing Sys- tems, 33:16070–...

    2020

  41. [49]

    Feder- ated learning with matched averaging

    Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dim- itris Papailiopoulos, and Yasaman Khazaeni. Feder- ated learning with matched averaging. arXiv preprint arXiv:2002.06440, 2020. 9

    2002 arXiv

  42. [50]

    Crfl: Certifiably robust federated learning against back- door attacks

    Chulin Xie, Minghao Chen, Pin-Yu Chen, and Bo Li. Crfl: Certifiably robust federated learning against back- door attacks. In International Conference on Machine Learning, pages 11372–11382. PMLR, 2021. 4, 7, 8, 9

    2021

  43. [51]

    Dba: Distributed backdoor attacks against federated learn- ing

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learn- ing. In International conference on learning represen- tations, 2019. 3, 5, 9, 18, 19

    2019

  44. [52]

    Fall of empires: Breaking byzantine-tolerant sgd by in- ner product manipulation

    Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine-tolerant sgd by in- ner product manipulation. In Uncertainty in Artificial Intelligence, pages 261–270. PMLR, 2020. 1, 3, 4, 7, 9

    2020

  45. [53]

    Signguard: Byzantine-robust federated learn- ing through collaborative malicious gradient filtering

    Jian Xu, Shao-Lun Huang, Linqi Song, and Tian Lan. Signguard: Byzantine-robust federated learn- ing through collaborative malicious gradient filtering. arXiv preprint arXiv:2109.05872, 2021. 7, 9, 12

    2021 arXiv

  46. [54]

    Heterogeneous federated learning: State- of-the-art and research challenges

    Mang Ye, Xiuwen Fang, Bo Du, Pong C Yuen, and Dacheng Tao. Heterogeneous federated learning: State- of-the-art and research challenges. ACM Computing Surveys, 56(3):1–44, 2023. 8

    2023

  47. [55]

    Jailbreak attacks and defenses against large language models: A survey

    Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jailbreak attacks and defenses against large language models: A survey. arXiv preprint arXiv:2407.04295, 2024. 18

    2024 arXiv

  48. [56]

    Byzantine-robust distributed learning: Towards optimal statistical rates

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International con- ference on machine learning , pages 5650–5659. Pmlr,

  49. [57]

    Bayesian nonparametric federated learning of neural networks

    Mikhail Yurochkin, Mayank Agarwal, Soumya Ghosh, Kristjan Greenewald, Nghia Hoang, and Yasaman Khazaeni. Bayesian nonparametric federated learning of neural networks. In International conference on ma- chine learning, pages 7252–7261. PMLR, 2019. 9

    2019

  50. [58]

    Fldetector: Defending federated learn- ing against model poisoning attacks via detecting mali- cious clients

    Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhen- qiang Gong. Fldetector: Defending federated learn- ing against model poisoning attacks via detecting mali- cious clients. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2545–25...

    2022

  51. [59]

    batchrun.py

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ram- chandran Kannan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. In Interna- tional Conference on Machine Learning, pages 26429– 26446. PMLR, 2022. 3, 5,...

    2022

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.