REVIEW 3 major objections 6 minor 1 cited by
Provably Robust Federated Reinforcement Learning
T0 review · 3 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read The paper claims that federated reinforcement learning can be made provably resistant to poisoning attacks by training separate global policies on disjoint groups of agents and combining their action predictions by majority vote or…
desk verdict A real attack and a plausible ensemble defense, but the 'provably robust' claim is only proven outside the experimental settings; that mismatch is the thing to fix. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the ensemble itself: agents are partitioned by hashed IDs into K disjoint groups, each group trains a global policy with any foundational aggregation rule, and at test time the K policies cast one vote each. Discrete actions are combined by frequency count (majority vote) and continuous actions by geometric median. The proofs work by bounding how much damage a single malicious agent can do — one poisoned group can change at most one vote — so the continuous case reduces to the known geometric-median deviation lemma for Byzantine-robust estimation, and the discrete case reduces to a margin argument comparing pre- and post-attack vote counts.
What would settle it
Run the ensemble with the number of malicious agents strictly below the theorem thresholds (for example K=7 groups with n'=3 malicious agents for the continuous case, or a discrete case with a known vote margin) and then adversarially search for a test state and poisoned actions for which the majority vote changes in the discrete case or the geometric-median deviation exceeds 2w(K−n')/(K−2n') in the continuous case; a single such configuration would refute the respective theorem.
Extended reading notes
Core claim
The central claim is that the robustness problem in federated reinforcement learning can be reduced to a voting problem with a clean worst-case bound. In the discrete case, Theorem 1 proves that the ensemble's majority-vote action is unchanged when at most n' agents are malicious, where n' is bounded by the pre-attack gap between the two most frequent actions: n' ≤ floor((v(s,x) − v(s,y) − 1{y<x})/2). In the continuous case, Theorem 2 proves that the geometric median action shifts by at most 2w(K−n')/(K−2n') whenever n' < K/2, where w is the largest distance between a group's action and the pre-attack ensemble action. The paper further claims that its Normalized attack, which maximizes the angular deviation between pre- and post-attack aggregated updates, is the first model-poisoning attack able to substantially degrade FedPG-BR, and that the ensemble defense closes this gap across all tested foundational aggregation rules.
Load-bearing premise
The provable guarantee holds only while the number of malicious agents stays below the theorem thresholds — fewer than half the groups for continuous actions, and no more than half the pre-attack vote margin for discrete actions; in the paper's main experiments, with 30% malicious agents and 5 groups, those thresholds are exceeded, so the observed resilience there depends on the group-level aggregation rules rather than on the theorems.
Editorial extensions
If this is right
- If Theorem 1 is correct, no poisoning attack can flip the ensemble's discrete action at any test state whenever the malicious-agent count stays below half the pre-attack vote margin.
- If Theorem 2 is correct, continuous-action attacks are confined to a bounded action shift that shrinks as the number of groups K grows relative to the number of malicious agents n'.
- Embedding existing Byzantine-robust aggregation rules in the ensemble lets them achieve test rewards close to attack-free FedAvg even under the Normalized attack, according to the experiments.
- The Normalized attack establishes that direction-aware model poisoning can break FedPG-BR in non-ensemble settings, a failure mode the ensemble is designed to absorb.
- The ensemble's robustness transfers to any foundational aggregation rule except FedAvg, since the theorems do not depend on which rule the groups use internally.
Reading between the lines
- The theorem's continuous bound counts malicious agents rather than poisoned groups; an attacker who packs many agents into one group wastes their numbers, because a single group can flip at most one vote, so the effective resource under defense is the number of distinct groups.
- The paper's default experimental setting (30 agents, 30% malicious, K=5) puts n'=9 outside both theorem thresholds, so the robustness shown in those figures is governed by the group-internal aggregation rules rather than by Theorems 1–2 — a distinction a practitioner should check before relying on the provable guarantees.
- A natural extension would re-sample the random partition of agents into groups each round; then an adaptive attacker who learns the hash function cannot always know which group to poison, converting the deterministic guarantee into a per-round probabilistic one.
- For discrete action spaces, the vote margin is a pre-attack quantity; an attacker who can observe the frequency distribution at test states could time the attack to a round where the margin is thin, so the guarantee's practical strength depends on the margin being persistently large.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper studies poisoning attacks and defenses in federated reinforcement learning. The authors propose the Normalized attack, which maximizes the angle between pre- and post-attack aggregated policy updates, and an ensemble defense: agents are partitioned into K disjoint groups, each group trains its own global policy with an arbitrary foundational aggregation rule, and at test time the K policies vote (discrete actions) or are combined by geometric median (continuous actions). The main theoretical results are Theorem 1, stating that the discrete ensemble's predicted action is unchanged when the number of malicious agents is at most the pre-attack vote-margin threshold in Eq. (13), and Theorem 2, stating that the continuous ensemble's action shift is bounded by 2w(K−n')/(K−2n') when n'<K/2. Experiments on Cart Pole, Lunar Lander, and Inverted Pendulum show that the Normalized attack degrades non-ensemble robust aggregation rules (including FedPG-BR) and that the ensemble defense maintains high test rewards under several attacks.
Significance. The Normalized attack is a genuinely different attack formulation (angular rather than magnitude-based), and its empirical success against FedPG-BR in non-ensemble settings is a useful result. The proposed defense is simple and, within its stated assumptions, the proof strategy is sound: the discrete guarantee follows from a vote-margin argument and the continuous guarantee from a known geometric-median stability lemma. If the formal guarantees covered the experimental settings, the 'provably robust' claim would be strong. The paper also provides a fairly broad evaluation (four attacks, six aggregation rules, three environments). However, as detailed in the major comments, the default experimental configuration falls outside the hypotheses of both theorems; the claim that the method is provably robust in the demonstrated regime is therefore not established.
major comments (3)
- [§6.1.5, Theorems 1 and 2] The default experimental setting violates the formal hypotheses. The default has n=30 agents, 30% malicious, and K=5 groups, so n'=9. Theorem 2 requires n'<K/2=2.5; at n'=9 the denominator K−2n' in Eq. (15) is negative and the bound is not meaningful. For Theorem 1, because the K votes are frequencies over K policies, v(s,x)+v(s,y)≤K=5, so the right-hand side of Eq. (13) is at most floor((5−0−1)/2)=2; hence n'=9 can never satisfy the condition. Consequently, the robustness observed in Figs. 3, 4, 7, and 8 is not explained by Theorems 1–2. The empirical claim relies on the additional, unproven assumption that a group containing malicious agents still produces the same action as in the attack-free case. The paper should either add a per-group robustness lemma (with explicit conditions on the foundational aggregation rule and the number of malicious agents per group) or restrict the experiments and the 'provably robust' wording to configurations satisfying n'<K/2 and Eq. (13).
- [§5.3, Theorem 1 (Eq. 13)] The statement 'The condition for n' is n' = floor(...)' contradicts the proof in Appendix A.1, which derives n' ≤ floor(...). As written, the theorem only asserts the conclusion for one exact value of n', rather than for every n' at or below the threshold. The statement should be 'if n' ≤ floor(...), then Φ(s)=Φ'(s)=x,' and the overview in §5.1 should say 'at most' rather than 'when the number equals the threshold.'
- [§A.2 and §A.3, proof of Theorem 2] The proof jumps from the definition of w to the bound (21) without showing that the hypothesis of Lemma 1 is satisfied. The missing step is that at most n' groups contain a malicious agent, so at least K−n' of the vectors F'(s,θ_k)−Φ(s) have norm at most w. This step should be made explicit, because the entire continuous-space guarantee rests on it; moreover, it clarifies why Lemma 1's condition on the number of 'large' vectors is about groups, not agents.
minor comments (6)
- [§A.3, Eq. (22)] The condition 'K−r≤∑ 1 ∥v_k∥≤w' is garbled; it should include an indicator function, likely 'K−r ≤ ∑_{k∈[K]} 1{∥v_k∥≤w}', otherwise the statement is not a well-formed mathematical condition.
- [§5.2, Complexity analysis] The sentence 'each agent participates in only one global training round over T rounds' is confusing; it should say that each agent is assigned to exactly one group and participates in T training rounds of that group.
- [§4.2, Stage II] The sentence 'we update ζ as ζ = ζ+' is truncated due to formatting; complete the update rule.
- [References] Reference [35] contains a typo, 'gaavernor'; it should be 'Governor'.
- [§6.1.5] The sentence 'The default value of these six parameters are shown in Table 4' is unclear because the preceding text names only Δ, λ̂, and ζ̂; specify all six parameters or adjust the wording.
- [Fig. 4 caption] The subfigure labels in the caption appear as (a)–(e) with (e) after (d), which matches the figure, but the order (Random action, Random noise, Trim, Shejwalkar, Normalized) should be used consistently in the main text and caption.
Circularity Check
No circularity: The security theorems are self-contained counting and geometric-median arguments; cited self-works are contextual, and the experimental coverage gap is a correctness concern, not circularity.
full rationale
I walked the derivation chain for both security theorems. Theorem 1 is an elementary counting argument: it compares pre-attack vote frequencies v(s,x) and v(s,y), models each attacked group as flipping at most one vote, and derives the threshold in Eq. (13) from the inequalities v'(s,x) >= v(s,x)-n' and v'(s,y) <= v(s,y)+n'; the threshold is not assumed as a conclusion. Theorem 2 is a direct application of the standard geometric-median robustness guarantee stated in Lemma A.3, which the paper cites to external sources [10,30] rather than to the authors' own prior results; the bound in Eq. (15) is the lemma's bound instantiated with r=n' and w defined from pre-attack actions. The Normalized attack is an empirical contribution evaluated against defenses and is not used as an input to the security proofs. Self-citations in the paper (e.g., [8,14,48,50]) appear as related-work comparisons, baselines, or background descriptions, and none carries a load-bearing premise of the provable-robustness argument. The mismatch between the theorems' hypotheses (n'<K/2 for continuous action spaces, and the Eq. (13) threshold for discrete spaces) and the default experimental configuration (n'=9 with K=5) is a domain-coverage or correctness issue, not a circularity: the derivation does not reduce to its own inputs. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' own work, and the known geometric-median result is external, identifiable support. The paper is therefore self-contained against external benchmarks, with no significant circularity.
Assumptions & free parameters
free parameters (4)
- Attack step sizes lambda_hat and zeta_hat =
0.83/0.03 (Cart Pole), 1/0.02 (Lunar Lander), 0.83/0.2 (Inverted Pendulum)
- Number of groups K =
5 (default; 3, 5, 7 explored in Fig. 10)
- Perturbation vector Delta =
-sign(Avg{g_i}) (default 'sgn')
- Initial lambda and zeta values =
Not specified
assumptions (4)
- standard math Lemma 1 (geometric median perturbation bound, from Minsker and Cohen et al.)
- domain assumption Threat model from Fan et al. 2021: attacker controls up to n' malicious agents with full knowledge of updates and aggregation rule
- domain assumption A group with no malicious agents produces the same action at test state s before and after the attack
- domain assumption Deterministic tie-breaking by smaller action index in the discrete case
Cite this review
Pith. "Pith review of Provably Robust Federated Reinforcement Learning." pith.science (2026). https://pith.science/paper/SXBRJGDV
@misc{pith2026250208123,
author = {Pith},
title = {Pith review of: Provably Robust Federated Reinforcement Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/SXBRJGDV}},
note = {Machine review of arXiv:2502.08123}
}
read the original abstract
Federated reinforcement learning (FRL) allows agents to jointly learn a global decision-making policy under the guidance of a central server. While FRL has advantages, its decentralized design makes it prone to poisoning attacks. To mitigate this, Byzantine-robust aggregation techniques tailored for FRL have been introduced. Yet, in our work, we reveal that these current Byzantine-robust techniques are not immune to our newly introduced Normalized attack. Distinct from previous attacks that targeted enlarging the distance of policy updates before and after an attack, our Normalized attack emphasizes on maximizing the angle of deviation between these updates. To counter these threats, we develop an ensemble FRL approach that is provably secure against both known and our newly proposed attacks. Our ensemble method involves training multiple global policies, where each is learnt by a group of agents using any foundational aggregation rule. These well-trained global policies then individually predict the action for a specific test state. The ultimate action is chosen based on a majority vote for discrete action systems or the geometric median for continuous ones. Our experimental results across different settings show that the Normalized attack can greatly disrupt non-ensemble Byzantine-robust methods, and our ensemble approach offers substantial resistance against poisoning attacks.
Figures
Figures from the paper (13 more)
Forward citations
Cited by 1 Pith paper
-
Beyond Prediction: Reinforcement Learning as the Defining Leap in Healthcare AI
A survey of reinforcement learning in healthcare that frames RL as a paradigm shift from prediction to agentive clinical intelligence.
Reference graph
Works this paper leans on
-
[1]
How to backdoor federated learning
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In AISTATS, 2020
work page 2020
-
[2]
Neuronlike adaptive elements that can solve difficult learning control problems
Andrew G Barto, Richard S Sutton, and Charles W Anderson. Neuronlike adaptive elements that can solve difficult learning control problems. In IEEE transactions on systems, man, and cybernetics , 1983
work page 1983
-
[3]
A little is enough: Circumvent- ing defenses for distributed learning
Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumvent- ing defenses for distributed learning. In NeurIPS, 2019
work page 2019
-
[4]
Machine learning with adversaries: Byzantine tolerant gradient descent
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS, 2017
work page 2017
-
[5]
Multi-agent reinforcement learning: An overview
Lucian Buşoniu, Robert Babuška, and Bart De Schutter. Multi-agent reinforcement learning: An overview. In Innovations in multi-agent systems and applications-1 , 2010
work page 2010
-
[6]
Density-based cluster- ing based on hierarchical density estimates
Ricardo JGB Campello, Davoud Moulavi, and Jörg Sander. Density-based cluster- ing based on hierarchical density estimates. In PAKDD, 2013
work page 2013
-
[7]
Fltrust: Byzantine-robust federated learning via trust bootstrapping
Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021
work page 2021
-
[8]
Provably secure federated learning against malicious clients
Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. In AAAI, 2021
work page 2021
Show all 55 references
-
[9]
Distributed statistical machine learning in adversarial settings: Byzantine gradient descent
Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. In POMACS, 2017
2017
-
[10]
Geometric median in nearly linear time
Michael B Cohen, Yin Tat Lee, Gary Miller, Jakub Pachocki, and Aaron Sidford. Geometric median in nearly linear time. In STOC, 2016
2016
-
[11]
Bench- marking deep reinforcement learning for continuous control
Yan Duan, Xi Chen, Rein Houthooft, John Schulman, and Pieter Abbeel. Bench- marking deep reinforcement learning for continuous control. In ICML, 2016
2016
-
[12]
Challenges of real-world reinforcement learning: definitions, benchmarks and analysis
Gabriel Dulac-Arnold, Nir Levine, Daniel J Mankowitz, Jerry Li, Cosmin Paduraru, Sven Gowal, and Todd Hester. Challenges of real-world reinforcement learning: definitions, benchmarks and analysis. In Machine Learning, 2021
2021
-
[13]
Fault-tolerant federated reinforcement learning with theoreti- cal guarantee
Xiaofeng Fan, Yining Ma, Zhongxiang Dai, Wei Jing, Cheston Tan, and Bryan Kian Hsiang Low. Fault-tolerant federated reinforcement learning with theoreti- cal guarantee. In NeurIPS, 2021
2021
-
[14]
Local model poisoning attacks to byzantine-robust federated learning
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In USENIX Security Symposium, 2020
2020
-
[15]
Aflguard: Byzantine-robust asynchronous federated learning
Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Elizabeth S Bentley. Aflguard: Byzantine-robust asynchronous federated learning. In ACSAC, 2022
2022
-
[16]
Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025
Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sun- dararaja Sitharama Iyengar, and Haibo Yang. Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025
2025
-
[17]
Byzantine-robust decentralized federated learning
Minghong Fang, Zifan Zhang, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, Neil Gong, et al. Byzantine-robust decentralized federated learning. In CCS, 2024
2024
-
[18]
On the hardness of decentralized multi-agent policy evaluation under byzantine attacks
Minghong Fang, Zifan Zhang, Alvaro Velasquez, Jia Liu, et al. On the hardness of decentralized multi-agent policy evaluation under byzantine attacks. In WiOpt, 2024
2024
-
[19]
Federated deep reinforcement learning based trajectory design for uav-assisted networks with mobile ground devices
Yunfei Gao, Mingliu Liu, Xiaopeng Yuan, Yulin Hu, Peng Sun, and Anke Schmeink. Federated deep reinforcement learning based trajectory design for uav-assisted networks with mobile ground devices. In Scientific Reports, 2024
2024
-
[20]
Federated reinforcement learning with environment heterogeneity
Hao Jin, Yang Peng, Wenhao Yang, Shusen Wang, and Zhihua Zhang. Federated reinforcement learning with environment heterogeneity. In AISTATS, 2022
2022
-
[21]
Fed- erated reinforcement learning: Linear speedup under markovian sampling
Sajad Khodadadian, Pranay Sharma, Gauri Joshi, and Siva Theja Maguluri. Fed- erated reinforcement learning: Linear speedup under markovian sampling. In ICML, 2022
2022
-
[22]
Reinforcement learning in robotics: A survey
Jens Kober, J Andrew Bagnell, and Jan Peters. Reinforcement learning in robotics: A survey. In The International Journal of Robotics Research , 2013
2013
-
[23]
Less than a single pass: Stochastically controlled stochastic gradient
Lihua Lei and Michael Jordan. Less than a single pass: Stochastically controlled stochastic gradient. In AISTATS, 2017
2017
-
[24]
Federated transfer reinforcement learning for autonomous driving
Xinle Liang, Yang Liu, Tianjian Chen, Ming Liu, and Qiang Yang. Federated transfer reinforcement learning for autonomous driving. InFederated and Transfer Learning, 2022
2022
-
[25]
On the robustness of cooperative multi-agent reinforcement learning
Jieyu Lin, Kristina Dzeparoska, Sai Qian Zhang, Alberto Leon-Garcia, and Nicolas Papernot. On the robustness of cooperative multi-agent reinforcement learning. In IEEE Security and Privacy Workshops , 2020
2020
-
[26]
Lifelong federated reinforcement learning: a learning architecture for navigation in cloud robotic systems
Boyi Liu, Lujia Wang, and Ming Liu. Lifelong federated reinforcement learning: a learning architecture for navigation in cloud robotic systems. In IEEE Robotics and Automation Letters, 2019
2019
-
[27]
Reinforcement learning for clinical decision support in critical care: comprehensive review
Siqi Liu, Kay Choong See, Kee Yuan Ngiam, Leo Anthony Celi, Xingzhi Sun, and Mengling Feng. Reinforcement learning for clinical decision support in critical care: comprehensive review. In Journal of medical Internet research , 2020
2020
-
[28]
Local environment poisoning attacks on federated reinforcement learning
Evelyn Ma, Praneet Rathi, and S Rasoul Etesami. Local environment poisoning attacks on federated reinforcement learning. arXiv preprint arXiv:2303.02725 , 2023
2023 arXiv
-
[29]
Communication-efficient learning of deep networks from decentralized data
H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al. Communication-efficient learning of deep networks from decentralized data. In AISTATS, 2017
2017
-
[30]
Geometric median and robust estimation in banach spaces
Stanislav Minsker. Geometric median and robust estimation in banach spaces. In Bernoulli, 2015
2015
-
[31]
Asynchronous methods for deep reinforcement learning
Volodymyr Mnih, Adria Puigdomenech Badia, Mehdi Mirza, Alex Graves, Timo- thy Lillicrap, Tim Harley, David Silver, and Koray Kavukcuoglu. Asynchronous methods for deep reinforcement learning. In ICML, 2016
2016
-
[32]
Every vote counts: Ranking-based training of federated learning to resist poisoning attacks
Hamid Mozaffari, Virat Shejwalkar, and Amir Houmansadr. Every vote counts: Ranking-based training of federated learning to resist poisoning attacks. In USENIX Security Symposium, 2023
2023
-
[33]
Massively parallel methods for deep reinforcement learning
Arun Nair, Praveen Srinivasan, Sam Blackwell, Cagdas Alcicek, Rory Fearon, Alessandro De Maria, Vedavyas Panneershelvam, Mustafa Suleyman, Charles Beattie, Stig Petersen, et al. Massively parallel methods for deep reinforcement learning. arXiv preprint arXiv:1507.04296, 2015
2015 arXiv
-
[34]
Flame: Taming backdoors in federated learning
Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Bran- denburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. Flame: Taming backdoors in federated learning. In USENIX Security Symposium, 2022
2022
-
[35]
Justinian’s gaavernor: Robust distributed learning with gradient aggregation agent
Xudong Pan, Mi Zhang, Duocai Wu, Qifan Xiao, Shouling Ji, and Min Yang. Justinian’s gaavernor: Robust distributed learning with gradient aggregation agent. In USENIX Security Symposium, 2020
2020
-
[36]
Detox: A redundancy-based framework for faster and more robust gradient aggregation
Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Detox: A redundancy-based framework for faster and more robust gradient aggregation. In NeurIPS, 2019
2019
-
[37]
Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection
Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi. Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. In NDSS, 2022
2022
-
[38]
Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021
2021
-
[39]
Reinforcement learning: An introduction
Richard S Sutton and Andrew G Barto. Reinforcement learning: An introduction. MIT press, 2018
2018
-
[40]
Multi-agent reinforcement learning: Independent vs
Ming Tan. Multi-agent reinforcement learning: Independent vs. cooperative agents. In ICML, 1993
1993
-
[41]
Mujoco: A physics engine for model-based control
Emanuel Todorov, Tom Erez, and Yuval Tassa. Mujoco: A physics engine for model-based control. In IROS, 2012
2012
-
[42]
Grandmaster level in starcraft ii using multi-agent reinforcement learning
Oriol Vinyals, Igor Babuschkin, Wojciech M Czarnecki, Michaël Mathieu, Andrew Dudzik, Junyoung Chung, David H Choi, Richard Powell, Timo Ewalds, Petko Georgiev, et al. Grandmaster level in starcraft ii using multi-agent reinforcement learning. In Nature, 2019
2019
-
[43]
Attack of the tails: Yes, you really can backdoor federated learning
Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In NeurIPS, 2020
2020
-
[44]
Federated deep reinforcement learning for internet of things with decentralized cooperative edge caching
Xiaofei Wang, Chenyang Wang, Xiuhua Li, Victor CM Leung, and Tarik Taleb. Federated deep reinforcement learning for internet of things with decentralized cooperative edge caching. In IEEE Internet of Things Journal , 2020
2020
-
[45]
Simple statistical gradient-following algorithms for connec- tionist reinforcement learning
Ronald J Williams. Simple statistical gradient-following algorithms for connec- tionist reinforcement learning. In Machine learning, 1992
1992
-
[46]
Dba: Distributed backdoor attacks against federated learning
Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In ICLR, 2020
2020
-
[47]
Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance. In ICML, 2019
2019
-
[48]
Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error
Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. In ICML, 2024
2024
-
[49]
Byzantine- robust distributed learning: Towards optimal statistical rates
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine- robust distributed learning: Towards optimal statistical rates. In ICML, 2018
2018
-
[50]
Poisoning federated recommender systems with fake users
Ming Yin, Yichang Xu, Minghong Fang, and Neil Zhenqiang Gong. Poisoning federated recommender systems with fake users. In The Web Conference, 2024
2024
-
[51]
Federated reinforcement learning for generalizable motion planning
Zhenyuan Yuan, Siyuan Xu, and Minghui Zhu. Federated reinforcement learning for generalizable motion planning. In American Control Conference, 2023
2023
-
[52]
Fully decentralized multi-agent reinforcement learning with networked agents
Kaiqing Zhang, Zhuoran Yang, Han Liu, Tong Zhang, and Tamer Basar. Fully decentralized multi-agent reinforcement learning with networked agents. In ICML, 2018
2018
-
[53]
Adaptive reward- poisoning attacks against reinforcement learning
Xuezhou Zhang, Yuzhe Ma, Adish Singla, and Xiaojin Zhu. Adaptive reward- poisoning attacks against reinforcement learning. In ICML, 2020
2020
-
[54]
Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients
Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In KDD, 2022
2022
-
[55]
Poisoning attacks on federated learning-based wireless traffic prediction
Zifan Zhang, Minghong Fang, Jiayuan Huang, and Yuchen Liu. Poisoning attacks on federated learning-based wireless traffic prediction. In IFIP/IEEE Networking Conference, 2024. A Appendix A.1 Proof of Theorem 1 Given a test state 𝑠, the action frequencies for actions 𝑥 and𝑦 whe...
2024
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.