Pith. sign in

REVIEW 3 major objections 6 minor 45 references

Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attack

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BadSFL shows Scaffold's control variate can be tampered with to turn benign clients into backdoor accomplices, making the attack last three times longer than prior baselines.

desk verdict BadSFL's control-variate attack idea is real, but the paper's central durability claim is internally contradicted by its own Neurotoxin analysis and needs major revision before it is trustworthy. read the letter →

arxiv 2411.16167 v3 pith:4H3VUBAI submitted 2024-11-25 cs.LG

Xingshuo Han , Xuanye Zhang , Xiang Lan , Haozhao Wang , Shengmin Xu , Shen Ren , Jason Zeng , Ming Wu
show 2 more authors
Michael Heinrich Tianwei Zhang
This is my paper · ORCID
classification cs.LG
keywords backdoorattackfederatedlearningScaffoldcontrolvariatenon-IIDdatadurabilityGANaugmentationbenignaccomplice
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that Scaffold, a standard federated learning method designed to handle non-IID data, is more vulnerable to backdoor attacks than ordinary FedAvg because its control variate can be tampered with. The proposed attack, BadSFL, manipulates the control variate so that benign clients' local gradient updates are steered toward the attacker's poisoned direction, turning those clients into unwitting accomplices. A GAN-based data supplementation step lets the attacker imitate data from other clients, preserving accuracy on benign tasks. The result is a backdoor that stays above 90% attack accuracy for all 100 training rounds, lasting roughly three times longer than the two strongest baseline attacks after the attacker stops participating.

What carries the argument

The control variate c in Scaffold is a per-client correction term that estimates the difference between local and global gradients; the server also maintains a global control variate that is broadcast each round. BadSFL's load-bearing object is the modified training loss $L(D_p, w_p) + L(D_p, P_j(w_p, c))$, where $P_j(w_p, c) = w_p + w_g \cdot (n-1)/n - \eta_l \cdot c \cdot j$ is a formula that simulates an aggregation round and predicts the global model $j$ rounds ahead using the known global control variate. This lookahead term is what makes the backdoor persist after the attacker stops injecting updates, because the poisoned model is aligned with the direction in which benign clients' corrected updates will move. The GAN component supplements the attacker's non-IID dataset with synthetic samples resembling other clients' classes so that the local poisoned model does not diverge from the global optimum.

What would settle it

Run the same BadSFL attack with the lookahead term removed (set $j=0$ or replace $P_j$ with $w_p$) and compare backdoor durability; if the backdoor still persists for 60+ rounds, the control variate lookahead is not the mechanism. Alternatively, after a single real Scaffold aggregation round, compare the actual global model to the predicted model from Eq. 2; large divergence would indicate the formula does not approximate the real updates.

Watch

Extended reading notes

Core claim

The central discovery is that the control variate mechanism of Scaffold, which normally corrects client drift, can be repurposed by a malicious client to propagate a backdoor through benign clients. By uploading a poisoned control variate update together with a locally trained backdoor model, the attacker influences how every selected benign client adjusts its local update in the next round. The paper introduces a lookahead objective that predicts the global model one future aggregation round and trains the backdoor model to stay close to that predicted trajectory. Experiments on MNIST, CIFAR-10, and CIFAR-100 show that BadSFL achieves above 80% backdoor task accuracy within the first ten active rounds and maintains above 90% accuracy for the full 100 rounds after the attacker exits at round 40, compared to baselines that decay below 50% by round 60.

Load-bearing premise

The attack's durability rests on the unstated assumption that the lookahead formula $P_j(w_p, c)$ in Eq. 2 accurately predicts how Scaffold's aggregation will move the global model; the paper neither derives this formula nor measures its prediction error, and the variable $n$ in the formula is never defined.

Editorial extensions

If this is right

  • If Scaffold is used in non-IID federated learning, a single compromised client can create a persistent backdoor that survives after the attacker leaves.
  • The control variate channel becomes a new attack surface: defenses must monitor or verify control variate updates, not just model weight updates.
  • The durability gain means attackers can time their injection window and still control the model for the rest of training, increasing the practical threat window.
  • The success of BadSFL under multiple defenses suggests that variance-reduction strategies do not inherently block this attack path.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Eq. 2 is presented without derivation; a natural next step is to check whether the same lookahead criterion emerges from Scaffold's actual update rules, and whether it generalizes to other variance-reduction algorithms such as FedDyn or MIME.
  • The GAN-based supplementation assumes a local generator can produce samples from classes the attacker has never seen; a testable extension would measure how attack durability depends on the fidelity and coverage of these synthetic samples.
  • If the control variate is the true propagation channel, then defending at the aggregation level by clipping or robustly aggregating control variate updates should sharply reduce attack persistence.
  • The reported 3x durability ratio may depend on the specific number of clients, participation rate, and local epochs used in the experiments; a sensitivity analysis would show whether the benefit survives scale-up.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes BadSFL, a backdoor attack against Scaffold federated learning (SFL). The attack has three components: GAN-based data supplementation intended to approximate the global data distribution, a trigger-selection procedure, and a modified training objective (Eq. 3) that includes a predicted-future-global-model term (Eq. 2) built from the global control variate. The authors claim that BadSFL achieves high backdoor task accuracy and preserves primary-task accuracy, and that after the attacker stops participating at round 40 the backdoor persists above 90% accuracy for all 100 rounds, three times longer than baseline attacks. Experiments are reported on MNIST, CIFAR-10, and CIFAR-100 against four baselines and four defenses.

Significance. If the central durability claim held, this would be a noteworthy security result: it would show that Scaffold's control variate, designed to reduce client drift, can be exploited so that benign clients' updates reinforce a backdoor after the attacker leaves. The attack design is original, and the evaluation spans multiple datasets, trigger types, and defenses. However, the load-bearing durability mechanism rests on an underived formula, and a paragraph in the same section appears to contradict the headline durability claim. The paper would be significant if these gaps were closed; in its current form, the evidence for the main claim is not internally consistent.

major comments (3)
  1. [Section 5.3 and 'Analysis on Neurotoxin'] Section 5.3 states that 'BadSFL ensures a resilient backdoor function with accuracy exceeding 90% over the entire 100 SFL rounds' after the attacker exits at round 40. The same section's 'Analysis on Neurotoxin' paragraph says that with Neurotoxin, 'backdoor accuracy declines similarly to the baseline attack after the attacker exits at round 50. This trend is also observed in BadSFL experiments, warranting further investigation.' Read at face value, this is a direct contradiction: if BadSFL's backdoor accuracy also declines after the attacker exits, it cannot remain above 90% for the entire 100 rounds. The manuscript provides no additional figure, table, or ablation that resolves which statement is correct. This is the central quantitative claim of the paper, so the authors must provide the actual BTA trajectory after the attacker exits, state the exit round consistently, and clarify whether the 'declines similarly' statement refers to BadSFL or only to the Neurotoxin baseline.
  2. [Section 4.3, Eq. (2)] Equation (2), Pj(wp, c) = wp + wg*(n-1)/n - eta_l*c*j, is introduced as a way to simulate an aggregation round and predict the global model one or more rounds ahead. The quantity n is never defined, the formula is not derived from Algorithm 1's server and local updates, and no experiment validates Pj against the actual future global model. Since the added loss term L(Dp, Pj(wp,c)) in Eq. (3) is the proposed mechanism for durability, this is load-bearing. Please provide a derivation (or a clear citation), define n and j, and include a validation of the prediction quality against real Scaffold trajectories.
  3. [Section 4.1 and Section 5.2] The GAN-based supplementation claims that the attacker can generate realistic samples from classes that do not belong to Di but originate from other clients' datasets. A GAN trained only on Di has no information about the class-conditional structure of absent classes, and initializing the discriminator D to the global model wg does not obviously turn wg into a real/fake discriminator for those absent classes. The manuscript offers no mechanistic explanation or quantitative evaluation demonstrating that generated samples from absent classes are class-consistent. Because this supplementation is used to claim 'full knowledge of the dataset distribution' and to maintain primary-task accuracy, either a mechanistic explanation or a class-consistency evaluation is required.
minor comments (6)
  1. [Algorithms 1 and 2] The notation for the control variate is inconsistent: Algorithm 1 uses ci and c, Algorithm 2 uses c and cp, and the text often refers only to 'c'. Please define the server-side control variate and the per-client control variates explicitly and use them consistently.
  2. [Abstract and Section 5.3] The abstract says the backdoor maintains effectiveness for 'over 60 global rounds', while Section 5.3 claims accuracy 'exceeding 90% over the entire 100 SFL rounds'. These quantitative claims should be aligned.
  3. [Section 5.2 and Section 5.3] Section 5.2 reports primary-task accuracy around 55% on CIFAR-10 with data supplementation, while Section 5.3 says the primary task accuracy is kept at 60%. Please reconcile these numbers.
  4. [Figure 8] The defense results in Figure 8 are reported without numerical values or error bars, making it hard to assess the magnitude of the claimed robustness. Reporting mean and variance or full BTA curves for each defense would strengthen the claim.
  5. [Table 1] The column headers 'FL PT FB' are unexplained; please define them in the caption or in the text, for example as label-flipping, pattern-trigger, and feature-based backdoor settings.
  6. [Section 5.1] The sentence 'with 50% randomly of them selected for training' should be reworded for clarity, and the client-selection procedure should be stated precisely (e.g., random selection without replacement each round).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: BadSFL's derivation chain is self-contained; the underived Eq. 2 is an auxiliary training heuristic, not a prediction fitted to the reported result, and no load-bearing self-citations exist.

full rationale

The paper's central claims are empirical comparisons against external baselines (Black-box, Neurotoxin, IBA, 3DFed) with fixed hyperparameters (Section 5.1), so no fitted input is renamed as a prediction. Equation 2 is introduced without derivation and with n undefined, but it functions as an auxiliary loss term in Eq. 3 rather than as a derived output of the phenomenon it is claimed to enhance; the durability result is measured by BTA curves, not deduced from Eq. 2. The reference to Wen et al. [39] is not a self-citation by the present authors and does not supply Eq. 2, so no ansatz is smuggled in via citation. No uniqueness theorem is invoked. The GAN-based data supplementation is an assumption about attacker capability, not a circular reduction. The 'Analysis on Neurotoxin' paragraph in Section 5.3 states that the declining-backdoor-accuracy trend is 'also observed in BadSFL experiments, warranting further investigation,' which internally contradicts the earlier claim of >90% BTA over 100 rounds; however, an internal inconsistency is a correctness/consistency concern, not definitional circularity, and the comparison against baselines remains externally grounded. Accordingly, the circularity score is 0.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two unproven premises: the lookahead formula in Eq. 2 and the GAN's ability to synthesize unseen classes. Both are load-bearing for durability and stealth, and neither is derived, ablated, or verified with released artifacts. Standard Scaffold protocol is the remaining background assumption.

free parameters (2)
  • future_horizon_j = 10
    Hand-chosen in Eq. 2 for all datasets; no sensitivity analysis is reported. It controls how many future rounds the predicted global model extrapolates.
  • generated_sample_count_per_round = not reported
    The number of GAN-generated samples added to D_f is never specified in Section 4.1 or Table 1, despite being central to the data supplementation effect.
assumptions (3)
  • ad hoc to paper Equation 2 correctly predicts the Scaffold global model j rounds ahead.
    Introduced in Section 4.3 without derivation; n is undefined and j is hand-set; the durability claim depends on it.
  • ad hoc to paper The attacker's local GAN can generate realistic samples from classes absent from the attacker's own dataset, effectively giving full knowledge of the global data distribution.
    Section 4.1 claims this without a mechanism or quantitative verification; GANs typically only model the training distribution.
  • domain assumption The server executes unmodified Scaffold aggregation as in Algorithm 1.
    Threat model assumes the attacker cannot control the server; if the server used robust aggregation on control variates, the attack would likely fail.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attack." pith.science (2026). https://pith.science/paper/4H3VUBAI

@misc{pith2026241116167,
  author       = {Pith},
  title        = {Pith review of: Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4H3VUBAI}},
  note         = {Machine review of arXiv:2411.16167}
}
read the original abstract

By using a control variate to calibrate the local gradient of each client, Scaffold has been widely known as a powerful solution to mitigate the impact of data heterogeneity in Federated Learning. Although Scaffold achieves significant performance improvements, we show that this superiority is at the cost of increased security vulnerabilities. Specifically, this paper presents BadSFL, the first backdoor attack targeting Scaffold, which turns benign clients into accomplices to amplify the attack effect. The core idea of BadSFL is to uniquely tamper with the control variate to subtly steer benign clients' local gradient updates towards the attacker's poisoned direction, effectively turning them into unwitting accomplices and significantly enhancing the backdoor persistence. Additionally, BadSFL leverages a GAN-enhanced poisoning strategy to enrich the attacker's dataset, maintaining high accuracy on both benign and backdoored samples while remaining stealthy. Extensive experiments demonstrate that BadSFL achieves superior attack durability, maintaining effectiveness for over 60 global rounds, lasting up to three times longer than existing baselines even after ceasing malicious model injections.

Figures

Figures reproduced from arXiv: 2411.16167 by the authors.

Figure 1
Figure 1. Model averaging under IID and non-IID scenarios. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Scaffold correction term on a single client. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Dataset supplementation on CIFAR-10 and MNIST. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Attack comparisons with baselines. (a) Green Car (b) Race Car (c) White Horse (d) Red Ship [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Feature-based backdoor attacks on CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 9
Figure 9. Figure 9: Neurotoxin. BadSFL maintains a 5 times longer-lasting backdoor func￾tion in the global model in future rounds. In the pattern trig￾ger attack, BadSFL also injects a more effective backdoor function into the global model with 10% higher accuracy compared to the baseline…
Figure 8
Figure 8. Figure 8: Defense against backdoor attacks. nign clients continue submitting normal updates in subse￾quent rounds, which could potentially affect the poisoned updates from the attacker in previous attacking rounds thus erasing the backdoor function. Despite this, BadSFL en￾sures…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 36 canonical work pages

  1. [1]

    Get rid of your trail: Remotely erasing backdoors in federated learning

    Manaar Alam, Hithem Lamri, and Michail Maniatakos. Get rid of your trail: Remotely erasing backdoors in federated learning. arXiv preprint arXiv:2304.10638, 2023. 3

    arXiv 2023

  2. [2]

    Per- door: Persistent backdoors in federated learning using ad- versarial perturbations

    Manaar Alam, Esha Sarkar, and Michail Maniatakos. Per- door: Persistent backdoors in federated learning using ad- versarial perturbations. In 2023 IEEE International Confer- ence on Omni-layer Intelligent Systems (COINS), pages 1–6. IEEE, 2023. 1, 4

    work page 2023

  3. [3]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on artificial intelli- gence and statistics, pages 2938–2948. PMLR, 2020. 1, 2, 3, 6

    work page 2020

  4. [4]

    Analyzing federated learning through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning, pages 634–643. PMLR, 2019. 5

    work page 2019

  5. [5]

    Machine learning with adversaries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural in- formation processing systems, 30, 2017. 3

    work page 2017

  6. [6]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 ,

    arXiv

  7. [7]

    Chameleon: Adapting to peer im- ages for planting durable backdoors in federated learning

    Yanbo Dai and Songze Li. Chameleon: Adapting to peer im- ages for planting durable backdoors in federated learning. In International Conference on Machine Learning , pages 6712–6725. PMLR, 2023. 1, 4

    work page 2023

  8. [8]

    The mnist database of handwritten digit images for machine learning research [best of the web]

    Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Processing Magazine, 29(6):141–142, 2012. 6

    work page 2012

Show all 45 references
  1. [9]

    On the vulnerability of backdoor defenses for federated learning

    Pei Fang and Jinghui Chen. On the vulnerability of backdoor defenses for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence , pages 11800–11808,

  2. [10]

    Abc-fl: anomalous and benign client classification in fed- erated learning

    Hyejun Jeong, Joonyong Hwang, and Tai Myung Chung. Abc-fl: anomalous and benign client classification in fed- erated learning. arXiv preprint arXiv:2108.04551, 2021. 1

    2021 arXiv

  3. [11]

    Advances and open problems in federated learn- ing

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aur´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cum- mings, et al. Advances and open problems in federated learn- ing. Foundations and Trends® in Machine Learning, ...

    2021

  4. [12]

    Scaffold: Stochastic controlled averaging for feder- ated learning

    Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for feder- ated learning. In International conference on machine learn- ing, pages 5132–5143. PMLR, 2020. 1, 2

    2020

  5. [13]

    Overcoming catastrophic forgetting in neu- ral networks

    James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska- Barwinska, et al. Overcoming catastrophic forgetting in neu- ral networks. Proceedings of the national academy of sc...

    2017

  6. [14]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 6

    2009

  7. [15]

    Gan-based information leakage attack de- tection in federated learning

    Jianxiong Lai, Xiuli Huang, Xianzhou Gao, Chang Xia, Jingyu Hua, et al. Gan-based information leakage attack de- tection in federated learning. Security and Communication Networks, 2022, 2022. 4

    2022

  8. [16]

    Preservation of the global knowledge by not- true distillation in federated learning

    Gihun Lee, Minchan Jeong, Yongjin Shin, Sangmin Bae, and Se-Young Yun. Preservation of the global knowledge by not- true distillation in federated learning. Advances in Neural Information Processing Systems, 35:38461–38474, 2022. 2

    2022

  9. [17]

    Detection and mitigation of label-flipping at- tacks in federated learning systems with kpca and k-means

    Dongcheng Li, W Eric Wong, Wei Wang, Yao Yao, and Matthew Chau. Detection and mitigation of label-flipping at- tacks in federated learning systems with kpca and k-means. In 2021 8th International Conference on Dependable Sys- tems and Their Applications (DSA) , pages 551–559. IEEE,

    2021

  10. [18]

    3dfed: Adaptive and extensi- ble framework for covert backdoor attack in federated learn- ing

    Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensi- ble framework for covert backdoor attack in federated learn- ing. In 2023 IEEE Symposium on Security and Privacy (SP), pages 1893–1907. IEEE, 2023. 6

    2023

  11. [19]

    Model- contrastive federated learning

    Qinbin Li, Bingsheng He, and Dawn Song. Model- contrastive federated learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10713–10722, 2021. 2

    2021

  12. [20]

    A survey on federated learning systems: Vision, hype and reality for data privacy and protection

    Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering, 2021. 2

    2021

  13. [21]

    Federated optimiza- tion in heterogeneous networks

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimiza- tion in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020. 2

    2020

  14. [22]

    On the convergence of fedavg on non-iid data

    Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. arXiv preprint arXiv:1907.02189, 2019. 1

    1907 arXiv

  15. [23]

    Back- door learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey. IEEE Transactions on Neural Net- works and Learning Systems, 2022. 2

    2022

  16. [24]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses , pages 273–294. Springer,

  17. [25]

    Poisoning with cer- berus: Stealthy and colluded backdoor attack against fed- erated learning

    Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang, Jiqiang Liu, and Xiangliang Zhang. Poisoning with cer- berus: Stealthy and colluded backdoor attack against fed- erated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 9020–9028, 2023. 3, 6

    2023

  18. [26]

    Poisoning attacks against feature-based image classification

    Robin Mayerhofer and Rudolf Mayer. Poisoning attacks against feature-based image classification. In Proceedings of the Twelfth ACM Conference on Data and Application Se- curity and Privacy, pages 358–360, 2022. 5

    2022

  19. [27]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics , pages 1273–1282. PMLR, 2017. 1

    2017

  20. [28]

    Local learning matters: Rethinking data heterogeneity in federated learning

    Matias Mendieta, Taojiannan Yang, Pu Wang, Minwoo Lee, Zhengming Ding, and Chen Chen. Local learning matters: Rethinking data heterogeneity in federated learning. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8397–8406, 2022. 2

    2022

  21. [29]

    Badvfl: Backdoor attacks in vertical federated learning

    Mohammad Naseri, Yufei Han, and Emiliano De Cristo- faro. Badvfl: Backdoor attacks in vertical federated learning. arXiv preprint arXiv:2304.08847, 2023. 1

    2023 arXiv

  22. [30]

    {FLAME}: Taming backdoors in federated learning

    Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Bj ¨orn B Brandenburg, Hossein Yalame, Helen M¨ollering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Se- c...

    2022

  23. [31]

    Iba: Towards irreversible back- door attacks in federated learning

    Thuy Dung Nguyen, Tuan A Nguyen, Anh Tran, Khoa D Doan, and Kok-Seng Wong. Iba: Towards irreversible back- door attacks in federated learning. Advances in Neural In- formation Processing Systems , 36:66364–66376, 2023. 3, 6

    2023

  24. [32]

    Sparsefed: Mit- igating model poisoning attacks in federated learning with sparsification

    Ashwinee Panda, Saeed Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, and Prateek Mittal. Sparsefed: Mit- igating model poisoning attacks in federated learning with sparsification. In International Conference on Artificial In- telligence and Statistics, pages 7587–7624....

    2022

  25. [33]

    Gan-driven data poisoning attacks and their mitigation in federated learning systems

    Konstantinos Psychogyios, Terpsichori-Helen Velivassaki, Stavroula Bourou, Artemis V oulkidis, Dimitrios Skias, and Theodore Zahariadis. Gan-driven data poisoning attacks and their mitigation in federated learning systems. Electronics, 12(8):1805, 2023. 4

    2023

  26. [34]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019. 1, 2

    1911 arXiv

  27. [35]

    Mitigating poisoning attack in federated learning

    Aashma Uprety and Danda B Rawat. Mitigating poisoning attack in federated learning. In2021 IEEE Symposium Series on Computational Intelligence (SSCI) , pages 01–07. IEEE,

  28. [36]

    Attack of the tails: Yes, you really can backdoor federated learning

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems , 33:16070–16084,

  29. [37]

    Federated learning with matched averaging

    Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dimitris Pa- pailiopoulos, and Yasaman Khazaeni. Federated learning with matched averaging. arXiv preprint arXiv:2002.06440,

    2002 arXiv

  30. [38]

    Tackling the objective inconsistency prob- lem in heterogeneous federated optimization

    Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective inconsistency prob- lem in heterogeneous federated optimization. Advances in neural information processing systems , 33:7611–7623,

  31. [39]

    Think- ing two moves ahead: Anticipating other users improves backdoor attacks in federated learning

    Yuxin Wen, Jonas Geiping, Liam Fowl, Hossein Souri, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Think- ing two moves ahead: Anticipating other users improves backdoor attacks in federated learning. arXiv preprint arXiv:2210.09305, 2022. 4, 5

    arXiv

  32. [40]

    Dba: Dis- tributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Dis- tributed backdoor attacks against federated learning. In In- ternational conference on learning representations, 2019. 1, 2, 3

    2019

  33. [41]

    Crfl: Certifiably robust federated learning against backdoor at- tacks

    Chulin Xie, Minghao Chen, Pin-Yu Chen, and Bo Li. Crfl: Certifiably robust federated learning against backdoor at- tacks. In International Conference on Machine Learning , pages 11372–11382. PMLR, 2021. 8

    2021

  34. [42]

    Bapfl: You can backdoor personalized federated learn- ing

    Tiandi Ye, Cen Chen, Yinggui Wang, Xiang Li, and Ming Gao. Bapfl: You can backdoor personalized federated learn- ing. ACM Transactions on Knowledge Discovery from Data,

  35. [43]

    A3fl: Adversarially adaptive backdoor attacks to federated learning

    Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Dinghao Wu. A3fl: Adversarially adaptive backdoor attacks to federated learning. Advances in neural information pro- cessing systems, 36:61213–61233, 2023. 3

    2023

  36. [44]

    Poisoning attack in federated learning using generative ad- versarial nets

    Jiale Zhang, Junjun Chen, Di Wu, Bing Chen, and Shui Yu. Poisoning attack in federated learning using generative ad- versarial nets. In 2019 18th IEEE international conference on trust, security and privacy in computing and communi- cations/13th IEEE international conference o...

    2019

  37. [45]

    Neurotoxin: Durable backdoors in federated learning

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kan- nan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. In International Conference on Ma- chine Learning, pages 26429–26446. PMLR, 2022. 2, 4, 6

    2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.