Pith. sign in

REVIEW 3 major objections 5 minor 45 references

FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A malicious client can hijack a federated model's unlearning step to flip the prediction on a chosen user of another client without degrading global accuracy.

desk verdict A plausible new attack on federated unlearning, worth refereeing despite sloppy threat-model wording and missing ASR error bars. read the letter →

arxiv 2501.11848 v1 pith:TYFOAP6R submitted 2025-01-21 cs.CR

Jian Chen , Zehui Lin , Wanyu Lin , Wenlong Shi , Xiaoyan Yin , Di Wang This is my paper · ORCID
classification cs.CR
keywords federatedlearningunlearningmaliciousattackinfluencefunctionsrighttobeforgottenmodelmanipulationgradientanomalydefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated unlearning is the erasure step that lets a server remove a client's data from a jointly trained model without retraining. This paper claims that this erasure step can be turned into an attack: a malicious client can submit a handful of crafted unlearning requests so that the erased global model misclassifies a specific user whose data live on a different client. The attack works by identifying the attacker's own training samples that most strongly support the target user's correct prediction and then asking the server to unlearn those samples after pushing their features close to the target sample. The paper reports an average attack success rate near 80% with only 0.3% of unlearning requests malicious, across several datasets, unlearning methods, and aggregation rules, while the model's accuracy on other users stays roughly unchanged. If correct, this means the right-to-be-forgotten mechanism itself introduces a new attack surface for federated learning.

What carries the argument

The load-bearing mechanism is the influence-function ranking in Eq. (6), $I_{up,loss}(z,z_t) = -\nabla_w L(z_t,\hat w)^\top H_{\hat w}^{-1} \nabla_w L(z,\hat w)$, computed on the attacker's local model: it estimates how much increasing the weight of a training sample $z$ would raise the loss on the target sample $z_t$, and the attacker keeps only samples with the most negative values and the same label as the target. The second component rewrites each selected sample as $x'_j = x_j - \delta_j$ with $\|x'_j - x_t\| \le \zeta$ and $\|\delta_j\| \le \epsilon$, so the server unlearns near-target features rather than the original sample. The proposed defense uses the interquartile range of per-client gradient norms to flag requests and multiplies flagged gradients by a small $\lambda$ to shrink their effect.

What would settle it

Run FedMUA with Influential Sample Identification replaced by an equal-size random selection of same-label samples while keeping Malicious Unlearning Generation identical; the authors report that this random baseline collapses to near-zero attack success on MNIST and to roughly 20% on CIFAR-10. Any federated setup where the random baseline matches or exceeds FedMUA's success would show that the influence-ranking premise, rather than the unlearning mechanism, is what carries the attack.

Watch

Extended reading notes

Core claim

The paper's central claim is that a malicious client can make the unlearned target model satisfy $M_t(x_t, w^u_t) \neq y_t$: the model held by the target user's client predicts a label different from the true one for the target sample $x_t$, even though that sample never left its owner's device and no training update was poisoned. The attack does not corrupt the federated learning training phase; it corrupts the unlearning phase by sending malicious feature unlearning requests for samples that influence the target prediction. The first step, Influential Sample Identification, selects the influential samples inside the attacker's local data using influence functions, keeping those with the strongest negative influence on the target loss that share the target's label. The second step, Malicious Unlearning Generation, moves the selected samples' features toward the target sample before the unlearning request. The evaluation claims the attack flips the target prediction at roughly 80% average success with 0.3% malicious requests, reaches 100% when the request ratio is raised to 10%, and leaves the global model's accuracy on non-target users essentially unchanged.

Load-bearing premise

The load-bearing premise is that the influence ranking computed on the attacker's own local model still identifies, after server aggregation, the samples whose unlearning flips the global model's prediction on the target sample.

Editorial extensions

If this is right

  • Existing federated unlearning pipelines are exposed to a new attacker: one malicious client can single out a user from another client through legitimate-looking unlearning requests, without poisoning training data.
  • Byzantine-robust aggregation rules such as coordinate-wise median, trimmed mean, and Krum do not stop the attack, because the malicious signal enters after aggregation through the unlearning channel.
  • Attack success is tunable: raising the fraction of malicious unlearning requests from 0.3% to 10% pushes reported success to 100%, so the threat grows with the attacker's request budget.
  • The proposed gradient-scaling defense reduces average attack success by roughly half when the shrinking factor is $\lambda=0.1$, showing the vulnerability is mitigated but not closed, and that defenses should audit the unlearning request stream.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit: the whole attack leans on the assumption that influence values computed on the attacker's local model survive server aggregation and predict the global model's post-unlearning behavior. Their own random-selection baseline suggests this transfer is doing the work, since random selection collapses to near-zero success; verifying this directly on the global
  • Because the defense shrinks large gradients after they arrive, a natural follow-up is an arms race: an attacker who clips or normalizes the malicious gradient before submission may evade the interquartile-range trigger. The paper does not evaluate this countermeasure.
  • Their multi-target experiment shows success falls by roughly 45% as the number of simultaneous targets grows from 1 to 9; an untested extension is whether that decay comes from overlapping influential-sample sets or from a fixed perturbation budget, which would decide whether group-targeting attacks can be scaled up in practice.
  • The much lower success on the tabular credit-score data (55%) than on image data suggests the feature-shift perturbation is the binding constraint; testing FedMUA on embedding-based tabular models would clarify whether this gap is a property of the data or of the model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes FedMUA, a malicious unlearning attack against federated learning, in which a client crafts feature-perturbed unlearning requests for influential samples identified via influence functions, aiming to flip the global model's prediction on a target sample from another client. The authors evaluate the attack under FedEraser and KNOT with FedAvg, Median, Trimmed-mean, and Krum aggregation on five datasets, report high attack success rates at low request ratios, and propose a defense based on interquartile-range detection of large gradient updates followed by gradient shrinkage. The paper also releases code for reproducibility.

Significance. If the central claim holds, FedMUA identifies a genuinely new attack surface: federated unlearning, designed to remove data, can be abused by a single malicious client to manipulate predictions on other clients' data while preserving average accuracy. The empirical coverage is broad (two unlearning methods, four aggregation rules, IID and non-IID partitions, multiple datasets), and the Rand+MUG baseline convincingly shows that the influence-based selection is essential, not decorative. The paper also ships reproducible code, which strengthens the work. However, the significance is tempered by a threat-model gap between the stated black-box assumption and the gradient/Hessian computation in the attack, and by the absence of statistical characterization of the headline ASR figures.

major comments (3)
  1. [Section III-B and Section V-A, Eqs. (5)-(6)] The threat model in Section III-B states that the attacker has no knowledge of the global model or other clients' models, including architecture and parameters, yet the ISI stage requires the attacker to compute gradients and Hessian-inverse-vector products of a model with respect to its own local loss. The authors should clarify that the attacker's own local model is available through normal FL participation, and that the black-box assumption applies only to the global model. More importantly, the paper does not justify why influence values computed on the attacker's local model rank samples whose unlearning will flip the global model's prediction after server-side aggregation. Since the Rand+MUG baseline in Figs. 4 and 5 shows that random selection collapses ASR, this transfer property is load-bearing. The authors should provide either a theoretical argument or an empirical analysis (e.g., correlation between local influence and post-aggregation unlearning effect) to support this premise.
  2. [Section VII-C and Tables I-II] The abstract and Section VII-C claim an 80% attack success rate with only 0.3% malicious unlearning requests, but the reported ASR values in Tables I and II are averages across settings and are given without variance or significance tests; the 80% figure is not tied to a specific configuration. Since ASR is the central metric, the authors should report ASR as mean plus standard deviation over multiple target sets and runs, state the number of trials, and provide the exact protocol that yields the 80% figure. Without this, the headline claim is not robustly supported.
  3. [Section VI and Fig. 10] The proposed defense is motivated by an observation on MNIST gradient norms (Fig. 3) and depends on an IQR threshold and a manually chosen shrinkage parameter λ, but the paper does not evaluate the defense across attack ratios, non-IID settings, or a range of threshold choices beyond λ in {0.1, 0.5, 1}. Since the defense is presented as a contribution, the authors should demonstrate that its parameters are not overfit to the specific attack configuration and that it remains effective when the attacker uses different request ratios or numbers of malicious clients.
minor comments (5)
  1. [Section V-A, Eq. (7)] The notation 'max_n(IF(D_m))' is undefined; please specify that it selects the n samples with the largest absolute negative influence values.
  2. [Section V-A, Eq. (8)] The operation S_p(D_n) is not formally defined; please clarify how samples with the identical label are selected.
  3. [Section V-B] The sentence 'Building upon the identification of D_m' appears to refer to D_inf from Eq. (8); please correct this typo.
  4. [Tables I and II] The upward arrows (e.g., '97.39 ±0.06↑') are not explained in the table captions or the text; please state what they indicate.
  5. [References] Reference [15] duplicates reference [9]; please remove the duplicate.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FedMUA's attack success is empirically measured, and neither the attack nor the defense reduces to its own inputs by construction.

full rationale

No circularity found. FedMUA's central claim—that a malicious client can flip the global model's prediction on a target sample using only 0.3% malicious unlearning requests—is an empirical outcome measured by ASR (Eq. 11), not a quantity derived from fitted constants or from the definitions of the attack's own components. The ISI stage uses the standard external influence-function formula (Eqs. 5–6) only to rank candidate samples; the paper does not define 'attack success' as 'samples with negative IF are unlearned,' and the Rand+MUG baseline (Figs. 4–5) explicitly shows that the ranking provides signal beyond random selection, so the ranking is not success-by-construction. MUG's feature perturbation (Eqs. 9–10) is a heuristic whose effect on the aggregated global model is verified experimentally, not derived from the optimization problem, and no equation in the paper reduces the reported ASR to an input parameter. The defense's IQR/gradient-norm detector is motivated by an observation on the same datasets used for evaluation, which raises a generalization concern about the defense numbers, but the defense is not used to 'predict' attack success and no fitted parameter is renamed as a prediction. The only self-citation ([34], a prior De-pois defense paper) appears in a list of existing defenses and is not load-bearing. The black-box threat model's consistency with the gradient/Hessian computation in Eq. (6) is a correctness or threat-model concern, not a circularity concern, because the paper does not claim that influence ranking is derived from the global model's parameters.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The attack is empirical and uses no fitted mathematical constants, but it depends on the transferability of influence functions from a local model to the federated global model, on the effectiveness of the FU methods, and on the server not inspecting requested features. The defense adds hand-chosen IQR and lambda parameters tuned on the evaluation datasets.

free parameters (6)
  • epsilon (feature perturbation bound) = epsilon_max = norm(x_m - x_t); scaled by 0.6, 0.8, 1.0
    Attack budget for altering influential-sample features; Table IV shows ASR depends strongly on it.
  • zeta (target proximity threshold) = not reported numerically
    Eq. (10) requires each maliciously unlearned sample to lie within zeta of the target; no value is given, leaving the main request-generation criterion unspecified.
  • malicious unlearning request ratio (alpha) = 0.3% headline; range 0.1% to 1%, plus 10% stress test
    The abstract's 80% ASR claim is tied to this ratio; results in Tables I, II, III and Fig. 4/5 are parameterized by it.
  • number of malicious clients = 2 in main experiments; 1, 3, 4 and 50% in ablations
    Attack strength scales with attacker count; multi-client and multi-attacker results (Fig. 8, 9) depend on this budget.
  • defense gradient shrinkage lambda = 0.1 or 0.5
    Chosen to shrink suspected malicious gradients; defense effectiveness in Fig. 10 is reported for these values.
  • Dirichlet concentration for non-IID partition = 0.5
    Controls label skew in non-IID experiments; lower or higher concentrations would change the ASR values reported in Table II.
assumptions (4)
  • domain assumption Influence functions calculated on the attacker's local model remain valid for the non-convex neural networks and the federated aggregation process used in the experiments.
    The ISI step (Section V-A, Eq. 6) assumes the local-model Hessian and gradients identify samples whose unlearning changes the global model's target prediction. The paper provides no convergence or robustness guarantee.
  • domain assumption Federated unlearning methods (FedEraser, KNOT) actually remove the influence of submitted samples to the degree the attack requires.
    The attack only works if the server-side unlearning materially erases the maliciously modified influential samples (Eq. 3). If an FU method performs incomplete erasure, the mechanism fails.
  • domain assumption The attacker has model-level access through the FL protocol and can compute gradients and Hessians on its own local model.
    Contrary to the paper's black-box claim, Eq. (6) requires model parameters and gradient information; the whole ISI computation relies on the client having downloaded or trained a local model.
  • ad hoc to paper Feature manipulations of a small fraction of local data are not detected by the server or by other clients.
    The stealthiness of the attack depends on malicious feature-unlearning requests looking like benign requests; the paper does not evaluate request-level detection of feature anomalies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks." pith.science (2026). https://pith.science/paper/TYFOAP6R

@misc{pith2026250111848,
  author       = {Pith},
  title        = {Pith review of: FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TYFOAP6R}},
  note         = {Machine review of arXiv:2501.11848}
}
read the original abstract

Recently, the practical needs of ``the right to be forgotten'' in federated learning gave birth to a paradigm known as federated unlearning, which enables the server to forget personal data upon the client's removal request. Existing studies on federated unlearning have primarily focused on efficiently eliminating the influence of requested data from the client's model without retraining from scratch, however, they have rarely doubted the reliability of the global model posed by the discrepancy between its prediction performance before and after unlearning. To bridge this gap, we take the first step by introducing a novel malicious unlearning attack dubbed FedMUA, aiming to unveil potential vulnerabilities emerging from federated learning during the unlearning process. The crux of FedMUA is to mislead the global model into unlearning more information associated with the influential samples for the target sample than anticipated, thus inducing adverse effects on target samples from other clients. To achieve this, we design a novel two-step method, known as Influential Sample Identification and Malicious Unlearning Generation, to identify and subsequently generate malicious feature unlearning requests within the influential samples. By doing so, we can significantly alter the predictions pertaining to the target sample by initiating the malicious feature unlearning requests, leading to the deliberate manipulation for the user adversely. Additionally, we design a new defense mechanism that is highly resilient against malicious unlearning attacks. Extensive experiments on three realistic datasets reveal that FedMUA effectively induces misclassification on target samples and can achieve an 80% attack success rate by triggering only 0.3% malicious unlearning requests.

Figures

Figures reproduced from arXiv: 2501.11848 by the authors.

Figure 1
Figure 1. Overview of FedMUA. Taking credit rating as an [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An illustration of FedMUA in the IID setting. The [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Key observation in MNIST. The value of gradients [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: ASR of FedMUA and baseline on FedEraser. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: ASR of FedMUA and baseline on KNOT. TABLE III: Performance comparison between FedMUA and the baselines. FU Ratio of Purchase MNIST CIFAR-10 Method Unlearning Requests AccG(%) Acc gG−B (%) Acc gG (%) AccG(%) Acc gG−B (%) Acc gG(%) AccG(%) Acc gG−B (%) Acc gG (%) FedEras…
Figure 6
Figure 6. Figure 6: ASR of FedMUA for attacking different numbers of [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: ASR of FedMUA for attacking multi-targets simulta [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: Impact of the number of attackers. the number of malicious clients set to 2. The performance comparison of FedMUA on different datasets, FU methods and aggregation rules in IID settings are summarized in Table IV(a) and Table IV(b). The empirical findings suggest that …
Figure 10
Figure 10. Figure 10: Performance of the defense mechanism. (a) FAT (b) FADngs [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: ASR of baseline defenses against FedMUA. [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 39 canonical work pages

  1. [1]

    Secure and efficient federated learning with provable performance guarantees via stochastic quantization,

    X. Lyu, X. Hou, C. Ren, X. Ge, P. Yang, Q. Cui, and X. Tao, “Secure and efficient federated learning with provable performance guarantees via stochastic quantization,” IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  2. [2]

    Towards secure and verifiable hybrid federated learning,

    R. Du, X. Li, D. He, and K.-K. R. Choo, “Towards secure and verifiable hybrid federated learning,” IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  3. [3]

    Reliable and in- terpretable personalized federated learning,

    Z. Qin, L. Yang, Q. Wang, Y . Han, and Q. Hu, “Reliable and in- terpretable personalized federated learning,” in Proceedings of CVPR , 2023, pp. 20 422–20 431

    work page 2023

  4. [4]

    Revisiting weighted aggregation in federated learning with neural networks,

    Z. Li, T. Lin, X. Shang, and C. Wu, “Revisiting weighted aggregation in federated learning with neural networks,” in Proceedings of ICML , 2023, pp. 19 767–19 788. 14 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY

    work page 2023

  5. [5]

    Feder- ated conformal predictors for distributed uncertainty quantification,

    C. Lu, Y . Yu, S. P. Karimireddy, M. Jordan, and R. Raskar, “Feder- ated conformal predictors for distributed uncertainty quantification,” in Proceedings of ICML , 2023, pp. 22 942–22 964

    work page 2023

  6. [6]

    Multimodal federated learning via contrastive representation ensemble,

    Q. Yu, Y . Liu, Y . Wang, K. Xu, and J. Liu, “Multimodal federated learning via contrastive representation ensemble,” in Proceedings of ICLR, 2023

    work page 2023

  7. [7]

    The eu general data protection regu- lation (gdpr),

    P. V oigt and A. V on dem Bussche, “The eu general data protection regu- lation (gdpr),” A Practical Guide, 1st Ed., Cham: Springer International Publishing, vol. 10, no. 3152676, pp. 10–5555, 2017

    2017

  8. [8]

    Understanding the scope and impact of the california consumer privacy act of 2018,

    E. L. Harding, J. J. Vanto, R. Clark, L. Hannah Ji, and S. C. Ainsworth, “Understanding the scope and impact of the california consumer privacy act of 2018,” Journal of Data Protection & Privacy , vol. 2, no. 3, pp. 234–253, 2019

    work page 2018

Show all 45 references
  1. [9]

    Verifi: Towards verifiable federated unlearning,

    X. Gao, X. Ma, J. Wang, Y . Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Verifi: Towards verifiable federated unlearning,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  2. [10]

    Federaser: Enabling efficient client-level data removal from federated learning models,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client-level data removal from federated learning models,” in Proceedings of IWQoS , 2021, pp. 1–10

    2021

  3. [11]

    Asynchronous federated unlearning,

    N. Su and B. Li, “Asynchronous federated unlearning,” in Proceedings of INFOCOM, 2023, pp. 1–10

    2023

  4. [12]

    Fast federated machine unlearning with nonlinear functional theory,

    T. Che, Y . Zhou, Z. Zhang, L. Lyu, J. Liu, D. Yan, D. Dou, and J. Huan, “Fast federated machine unlearning with nonlinear functional theory,” in Proceedings of ICML , 2023

    2023

  5. [13]

    Fedrecovery: Differentially private machine unlearning for federated learning frame- works,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecovery: Differentially private machine unlearning for federated learning frame- works,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  6. [14]

    Understanding black-box predictions via influence functions,

    P. W. Koh and P. Liang, “Understanding black-box predictions via influence functions,” in Proceedings of ICML , 2017, pp. 1885–1894

    2017

  7. [15]

    Ver- ifi: Towards verifiable federated unlearning,

    X. Gao, X. Ma, J. Wang, Y . Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Ver- ifi: Towards verifiable federated unlearning,” CoRR arXiv:2205.12709 , 2022

    2022 arXiv

  8. [16]

    Federated unlearning with knowledge distillation,

    C. Wu, S. Zhu, and P. Mitra, “Federated unlearning with knowledge distillation,” CoRR arXiv:2201.09441, 2022

    2022 arXiv

  9. [17]

    Federated unlearning via class- discriminative pruning,

    J. Wang, S. Guo, X. Xie, and H. Qi, “Federated unlearning via class- discriminative pruning,” in Proceedings of WWW , 2022, pp. 622–632

    2022

  10. [18]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining,

    Y . Liu, L. Xu, X. Yuan, C. Wang, and B. Li, “The right to be forgotten in federated learning: An efficient realization with rapid retraining,” in Proceedings of INFOCOM , 2022, pp. 1749–1758

    2022

  11. [19]

    Hidden poison: Machine unlearning enables camouflaged poisoning attacks,

    J. Z. Di, J. Douglas, J. Acharya, G. Kamath, and A. Sekhari, “Hidden poison: Machine unlearning enables camouflaged poisoning attacks,” in Proceedings of NeurIPS ML Safety Workshop , 2022

    2022

  12. [20]

    Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks,

    W. Qian, C. Zhao, W. Le, M. Ma, and M. Huai, “Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks,” in Proceedings of SIGKDD , 2023, pp. 1932–1942

    2023

  13. [21]

    Static and sequential malicious attacks in the context of selective forgetting,

    C. Zhao, W. Qian, R. Ying, and M. Huai, “Static and sequential malicious attacks in the context of selective forgetting,” Proceedings of NeurIPS, vol. 36, 2023

    2023

  14. [22]

    A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services,

    H. Hu, S. Wang, J. Chang, H. Zhong, R. Sun, S. Hao, H. Zhu, and M. Xue, “A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services,” in Proceedings of NDSS , 2024

    2024

  15. [23]

    Resolving training biases via influence-based data relabeling,

    S. Kong, Y . Shen, and L. Huang, “Resolving training biases via influence-based data relabeling,” in Proceedings of ICLR , 2021

    2021

  16. [24]

    Regularizing second-order influences for continual learning,

    Z. Sun, Y . Mu, and G. Hua, “Regularizing second-order influences for continual learning,” in Proceedings of CVPR , 2023, pp. 20 166–20 175

    2023

  17. [25]

    Understanding influence functions and data models via harmonic analysis,

    N. Saunshi, A. Gupta, M. Braverman, and S. Arora, “Understanding influence functions and data models via harmonic analysis,” in Pro- ceedings of ICLR , 2023

    2023

  18. [26]

    Representer point selection for explaining regularized high- dimensional models,

    C.-P. Tsai, J. Zhang, H.-F. Yu, E. Chien, C.-J. Hsieh, and P. K. Ravikumar, “Representer point selection for explaining regularized high- dimensional models,” in Proceedings of ICML, 2023, pp. 34 469–34 490

    2023

  19. [27]

    Hydra: Hypergradient data relevance analysis for interpreting deep neural networks,

    Y . Chen, B. Li, H. Yu, P. Wu, and C. Miao, “Hydra: Hypergradient data relevance analysis for interpreting deep neural networks,” inProceedings of AAAI, vol. 35, no. 8, 2021, pp. 7081–7089

    2021

  20. [28]

    Fastif: Scalable influence functions for efficient model interpretation and debugging,

    H. Guo, N. Rajani, P. Hase, M. Bansal, and C. Xiong, “Fastif: Scalable influence functions for efficient model interpretation and debugging,” in Proceedings of EMNLP , 2021, pp. 10 333–10 350

    2021

  21. [29]

    Scaling up influence functions,

    A. Schioppa, P. Zablotskaia, D. Vilar, and A. Sokolov, “Scaling up influence functions,” in Proceedings of AAAI , vol. 36, no. 8, 2022, pp. 8179–8186

    2022

  22. [30]

    Flpu- rifier: Backdoor defense in federated learning via decoupled contrastive training,

    J. Zhang, C. Zhu, X. Sun, C. Ge, B. Chen, W. Susilo, and S. Yu, “Flpu- rifier: Backdoor defense in federated learning via decoupled contrastive training,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  23. [31]

    Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models,

    Z. Yao, H. Zhang, Y . Guo, X. Tian, W. Peng, Y . Zou, L. Y . Zhang, and C. Chen, “Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  24. [32]

    Can we mitigate backdoor attack using adversarial detection methods?

    K. Jin, T. Zhang, C. Shen, Y . Chen, M. Fan, C. Lin, and T. Liu, “Can we mitigate backdoor attack using adversarial detection methods?” IEEE Transactions on Dependable and Secure Computing , 2022

    2022

  25. [33]

    Anti-backdoor learning: Training clean models on poisoned data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” in Proceedings of NeurIPS, vol. 34, 2021, pp. 14 900–14 912

    2021

  26. [34]

    De-pois: An attack- agnostic defense against data poisoning attacks,

    J. Chen, X. Zhang, R. Zhang, C. Wang, and L. Liu, “De-pois: An attack- agnostic defense against data poisoning attacks,” IEEE Transactions on Information Forensics and Security , vol. 16, pp. 3412–3425, 2021

    2021

  27. [35]

    C. C. Aggarwal and C. C. Aggarwal, An introduction to outlier analysis. Springer, 2017

    2017

  28. [36]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in Proceedings of S&P, 2017, pp. 3–18

    2017

  29. [37]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in Proceedings of NDSS , 2019

    2019

  30. [38]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proceedings of AISTATS, 2017, pp. 1273–1282

    2017

  31. [39]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in Proceedings of ICML, 2018, pp. 5650–5659

    2018

  32. [40]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” vol. 30, 2017

    2017

  33. [41]

    Fat: Federated adversarial training,

    G. Zizzo, A. Rawat, M. Sinn, and B. Buesser, “Fat: Federated adversarial training,” in Proceedings of NeurIPS Workshop on SpicyFL , 2020

    2020

  34. [42]

    Fadngs: Federated learning for anomaly detection,

    B. Dong, D. Chen, Y . Wu, S. Tang, and Y . Zhuang, “Fadngs: Federated learning for anomaly detection,” IEEE Transactions on Neural Networks and Learning Systems , 2024

    2024

  35. [43]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in Proceedings of ICLR , 2015

    2015

  36. [44]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of CVPR , 2016, pp. 770–778

    2016

  37. [45]

    Measuring the effects of non- identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non- identical data distribution for federated visual classification,” arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.