Client-Side Patching against Backdoor Attacks in Federated Learning

Borja Molina-Coronado

REVIEW 5 major objections 5 minor 42 references

Client-Side Patching against Backdoor Attacks in Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Client-side patching cuts backdoor attack success below 3 percent.

desk verdict A plausible client-side backdoor defense with a nice non-i.i.d. result, but the claims outrun the evidence: missing seeds, a circular heuristic, and an overclaimed 'below 3%' number. read the letter →

arxiv 2412.10605 v2 pith:DHDH6HID submitted 2024-12-13 cs.CR cs.AIcs.LG

Borja Molina-Coronado This is my paper · ORCID

classification cs.CRcs.AIcs.LG

keywords federatedlearningbackdoorattacksclient-sidedefenseadversarialmodelpatchingtriggeroptimizationnon-IIDdatapoisoningrobustness

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a single benign client, without server-side detection or access to other clients' data, can remove backdoors from a federated model by first searching for the attacker's trigger pattern and then fine-tuning the model so that the trigger no longer changes the prediction. The proposed pipeline is tested against three well-known backdoor attacks on MNIST and Fashion-MNIST, under both i.i.d. and non-i.i.d. data splits. The reported result is that backdoor accuracy drops to a few percent or zero, matching or beating state-of-the-art server-side defenses, while clean-data accuracy stays competitive. The practical interest is that the defense is placed at the party that actually holds the data, avoiding the server-side blind spot that limits existing methods.

What carries the argument

The load-bearing mechanism is an iterative trigger search followed by label-preserving fine-tuning. A candidate trigger is parameterized as $\delta_{s\to t} = m \cdot \gamma$, a binary mask $m$ fixing shape and location times a perturbation matrix $\gamma$ fixing intensity, so the search is over localized additive patches. The optimization loss combines a backdoor term that makes the model misclassify poisoned samples as the target, a clean term that preserves accuracy on source-class samples, and an $\ell^1$ sparsity penalty. To keep the search tractable, a heuristic selects for each source class the target that minimizes the combined backdoor-plus-clean loss, so not all class pairs are optimized. During patching, candidate triggers are applied only to their source class and the patched samples keep their original labels, pushing the model to output the true label even when the trigger is present. The whole procedure runs on the client, so the adversarial knowledge and local data never leave the benign node.

What would settle it

Train the same federated setup with a backdoor whose trigger is not a small localized additive mask, for example a full-image watermark or a semantic patch placed by a generative model, then run the client-side patching; if backdoor accuracy stays high, the central claim is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that backdoor triggers in a federated model can be found and neutralized from one benign client's local vantage point. For each candidate source class, the client runs a PGD-style optimization to synthesize a sparse, localized trigger that makes the global model misclassify that source class into a chosen target class, with a heuristic picking the most promising target per source to keep the search affordable. The client then builds a patching dataset by stamping these candidate triggers onto clean source-class samples while keeping the original labels, and fine-tunes the global model on the clean plus patched data. Because the patched samples teach the model to ignore the trigger, the backdoor behavior is suppressed. The paper claims this reduces average backdoor accuracy to about 3% across the three tested attacks while preserving or slightly improving clean accuracy, and that it outperforms existing defenses specifically in non-i.i.d. settings, where server-side aggregators fail.

Load-bearing premise

The defense assumes that the trigger the attacker actually uses is close enough to one of the localized additive triggers a benign client can synthesize from its own data and the global model, so that patching with the candidate removes the real backdoor.

Editorial extensions

If this is right

A benign federation can remove backdoors without any server-side detection layer, closing the blind spot that existing defense proposals face.
Because the defense is client-side and uses only local data, it remains effective when client data is non-i.i.d., a setting where the paper's comparisons show server-side aggregators degrade.
The patching step is applied at the end of federated training, so the per-round computational overhead during normal training is low.
Adversarial knowledge stays private on the benign node, preventing an attacker who observes the aggregated model from adapting the attack to unpatchable regions.
The reported numbers imply that one client's local trigger search can generalize to the attacker's actual trigger, at least for the localized additive triggers used in the tested attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If this holds broadly, the approach could be stacked with existing server-side aggregators, since it targets the model's learned trigger association rather than the malicious updates themselves.
The trigger search space is restricted to sparse localized additive masks, so a natural next test is whether the method generalizes to triggers that are large, non-additive, or semantically embedded, which the paper's attacks do not cover.
A motivated attacker who knows the defense could craft a trigger far from the candidate mask space or optimized to survive patching; this adaptive threat model is not evaluated in the paper.
The per-client optimization over source-target pairs may become expensive as the number of classes grows, so the heuristic target selection would need to be benchmarked on datasets with many classes.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear [Name],

The thing to know about this one: client-side backdoor defense in federated learning, where benign clients reverse-engineer candidate triggers and patch the global model by fine-tuning on those triggers with the original labels. The non-i.i.d. results are genuinely interesting—every server-side baseline collapses on at least two attacks, and the proposed method keeps backdoor accuracy low in the tested configurations. If the approach holds up, it's a useful subfield-level contribution.

What's actually new is the combination of PGD-style trigger search on the client side and model patching via fine-tuning on recovered triggers. That specific pipeline, applied inside FL training and evaluated against MRA, DBA, and Neurotoxin, I have not seen before. The patching loss using original labels is a sensible way to avoid wrecking clean accuracy.

Now the soft spots, in roughly ascending order of trouble.

First, the heuristic in Section 3.1 is underspecified. It says to select target t' by minimizing Lbd(Dp_{s→t'}) plus clean loss, but Dp_{s→t'} is defined with the optimized trigger δ_{s→t'}, which is exactly what the heuristic is supposed to let you avoid computing for all pairs. As written, the algorithm is circular. That needs to be clarified or replaced.

Second, the evaluation has no error bars, no seed variance, no released code or hyperparameters. It's all single runs, and in federated learning that's noisy. The conclusion claims "backdoor accuracy below 3%," but Table 4 reports 6.4% (MRA) and 4.2% (DBA). Those numbers don't match the claim.

Third, the Neurotoxin baselines are suspect in two settings. In Table 2, no-defense ASR is 0.102; in Table 3, 0.016. The attack didn't work there, yet FLAME and MedianKrum show ASR above 0.9. A defense making things worse than no defense is a red flag that the attack setup is misbehaving, and those comparisons are not informative.

Fourth, the stress-test concern about trigger representativeness is real. The evaluation uses one random trigger shape per attack, the most favorable case for recovery. The defense's core assumption is that a PGD-recovered mask·gamma trigger on one client's data matches the attacker's trigger well enough that patching transfers. That is untested for other trigger geometries. It's a limitation, not a demonstrated failure, but the paper should say so.

The citation pattern looks fine; the self-citation to [9] isn't load-bearing. The authors are engaging with the right literature.

Bottom line: the idea is plausible and worth a serious look, but the empirical claims run ahead of the evidence. This is for FL researchers working on backdoor defenses, especially client-side approaches. I'd send it to reviewers with the expectation of heavy revision. If the authors fix the heuristic, add seeds, correct the claims, and stress-test with varied triggers, this could be a solid paper. Right now it's conditional.

For a reading group, I'd say maybe, mainly to discuss the non-i.i.d. angle. I wouldn't cite it yet.

Best, [Your name]

Referee Report

5 major / 5 minor

Summary. This paper proposes a client-side defense against backdoor attacks in federated learning. The defense has two stages: Section 3.1 uses a PGD-style optimization on a benign client's local data to search for candidate localized trigger patterns δ_{s→t}=m·γ for likely source-target pairs, and Section 3.2 builds a patch dataset by applying those candidate triggers to clean samples with their original labels and fine-tuning the global model so that it becomes insensitive to the triggers. The method is evaluated on MNIST and Fashion-MNIST under i.i.d. and non-i.i.d. federated settings against the Model Replacement Attack, the Distributed Backdoor Attack, and Neurotoxin, and is compared with MedianKrum, FoolsGold, FLAME, LFighter, and RoseAgg. The authors report low backdoor accuracy for their method, particularly in non-i.i.d. settings, while maintaining clean-data accuracy.

Significance. If validated, the client-side patching idea is novel and practically relevant: it avoids server-side assumptions about update distributions, keeps the trigger-search process on private client data, and offers a way to remove backdoors without knowing the attacker's exact trigger. The paper also evaluates against several strong baselines and includes non-i.i.d. data, a regime where many server-side defenses are known to struggle. However, the current evidence is not yet convincing: the experiments lack repeated runs and error bars, the attack setup uses only one trigger configuration per attack, the source-target selection heuristic in Section 3.1 is underspecified, and the headline claims of 'outperforming existing state-of-the-art defenses' and 'backdoor accuracy below 3%' are contradicted by the paper's own tables. The core idea is worth pursuing, but the empirical and algorithmic presentation needs substantial strengthening before the claims are supported.

major comments (5)

[Section 3.1] The heuristic for selecting the target class, t′ = argmin_{t′≠s} [Lbd(Dp_{s→t′}) + Lclean(Ds)], is not computable as written, because Lbd(Dp_{s→t′}) is defined only after the trigger δ_{s→t′} has been optimized, whereas the argmin is supposed to select the pair before optimization. This makes the algorithm underspecified; please clarify whether all source-target pairs are optimized first and then selected, or provide a feasible proxy that does not depend on the unknown trigger.
[Sections 3.1-3.2, Tables 2-5] The defense's load-bearing premise is that a PGD-optimized localized additive trigger δ=m·γ found on one benign client transfers to the attacker's actual trigger. The evaluation in Section 4.1 uses only one random trigger pattern per attack and does not vary trigger shape, size, location, or non-additive/full-image triggers. Since the patching objective Lpatch uses only the candidate triggers T_k, the paper provides no evidence that the defense works when the attacker's trigger lies outside the searched mask family or is missed by the optimization. Please add experiments across trigger configurations and report trigger-recovery success or a formal transfer condition.
[Section 4.1, Tables 2-5] The empirical support is weakened by the absence of repeated runs, error bars, or seed information; every reported accuracy is a single trial, so the 0.0% ASR values against several baselines and the small non-zero ASR values for the proposal cannot be distinguished from noise. Please report means and standard deviations over multiple independent runs and specify the number of runs.
[Abstract and Section 6, Tables 2-5] The claim that the proposal 'outperforms existing state-of-the-art defenses' is not supported in the i.i.d. scenario, where LFighter achieves 0 ASR in all cells with equal or higher MTA in Tables 2-3. The conclusion's statement that the proposal achieves 'backdoor accuracy values below 3%' is contradicted by Table 4, where the proposal has ASR 6.4% for MRA and 4.2% for DBA; additionally, the Neurotoxin attack is ineffective in the i.i.d. setting even without defense (ASR 10.2% for MNIST and 1.6% for Fashion-MNIST), so those cells do not demonstrate attack mitigation. Please qualify the claims accordingly.
[Section 4.1] Critical parameters of the proposed method are not reported: PGD iteration count and step size, sparsity weight ω, trigger mask shape and location, patch fine-tuning epochs and learning rate, and the rule for forming T_k. Without these details the experiments cannot be reproduced or compared fairly with the baselines; please include a full configuration table or pseudocode.

minor comments (5)

[Section 1] There are minor typographical errors, including 'oft en fail short' and 'a overview'; these should be corrected.
[Section 4.1] The sentence 'between 60% and 90% of clients are selected at random' should report the exact sampling fraction used in the experiments, since this affects the aggregation dynamics.
[Tables 2-5] The paper defines 'backdoor accuracy' (BA) in Section 4.1 but the tables use 'ASR' for the same quantity; please use the terminology consistently throughout.
[Section 5] The discussion of related works [41] and [42] would benefit from a sentence explaining how those methods differ from the proposed client-side patching in terms of threat model and assumptions about client data.
[References] For reproducibility, please provide DOIs or arXiv identifiers for recent references, especially RoseAgg [25] and LFighter [24], where the page numbers or venue identifiers are incomplete.

Circularity Check

1 steps flagged · score 2.0 of 10

No central circularity; one self-definitional pair-selection heuristic and a non-load-bearing self-citation keep the score low.

self definitional [Section 3.1, 'Finding Potential Source-Target Class Pairs' (heuristic for t′ and definitions of Dp_{s→t} and Lbd).]
"t′ = arg min_{t′∈C,t′≠s} [Lbd(Dp_{s→t′}) + Lclean(Ds)]; Dp_{s→t} = {(x + δs→t, t) : x ∈ D_s}; Lbd = E_{(x^p,t)∼Dp_{s→t}} ℓ(fθ(x^p), t)."

The selection of t′ is meant to prioritize source-target pairs before optimizing triggers, but the criterion Lbd(Dp_{s→t′}) is defined through Dp_{s→t′} = {(x + δ_{s→t′}, t′)} and therefore requires the optimized trigger δ_{s→t′} for that pair. Thus t′ is defined in terms of the very quantity the optimization is supposed to produce, so the heuristic can only be evaluated after all pairs have been optimized and cannot reduce the number of pairs as claimed. This is an internal self-definitional loop, not a fit of the evaluation metric; the reported BA values use independently chosen attack triggers, so the central empirical comparison is not circular.

full rationale

The central claim—that client-side trigger search plus patching reduces backdoor accuracy—is not circular: the attack triggers used in evaluation are chosen independently ('For each attack, we select a random trigger pattern') rather than taken from the defense's candidate set, and the reported backdoor-accuracy metric is computed on those attack triggers. No fitted parameter is renamed as a prediction. The only self-citation, [9] (Celtibero), supports the contextual claim that server-side defenses struggle under non-i.i.d. data; this is not load-bearing and is corroborated by the paper's own baseline results. One internal self-definitional step is flagged in Section 3.1: the heuristic for selecting target class t′ requires Lbd(Dp_{s→t′}), which presupposes the optimized trigger δ_{s→t′} that the pair-selection step is supposed to prioritize. This is an algorithmic circularity/underspecification, but it does not make the central empirical comparison equivalent to its inputs; the defense's success still depends on whether its candidate triggers transfer to the independently chosen attack triggers, an empirical question the paper tests only for one trigger shape per attack.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method has no formal derivation; its effectiveness rests on domain assumptions about trigger representation and transfer. Several hyperparameters are hand-chosen and unreported, so the ledger captures the unstated degrees of freedom. No new entities are introduced.

free parameters (4)

ω (sparsity weight in Lsparsity) = not reported
Controls the trade-off between trigger sparsity and backdoor effectiveness; hand-chosen and unreported, yet central to the trigger optimization in Section 3.1.
Trigger mask m (shape and location) = not reported
Parameterizes δ = m·γ; how m is chosen or updated is not specified, so the trigger search space is a free modeling choice.
PGD iteration count and step size = not reported
The iterative trigger optimization in Section 3.1 is described as PGD-like, but no budget or step size is given; results may depend on this search effort.
Patching fine-tune epochs and learning rate = not reported
Lpatch is minimized by fine-tuning the global model; the training budget is unspecified and affects the clean-accuracy versus neutralization trade-off.

assumptions (4)

domain assumption Backdoor triggers can be represented as a localized additive perturbation δ = m·γ.
Assumed in Section 3.1 following refs [17,18]; if attacks use non-additive or distributed triggers, the optimization space may miss them.
domain assumption Candidate triggers optimized on a benign client generalize to the attacker's true trigger.
The patching dataset uses candidate triggers T_k, not the attacker's trigger; the entire defense rests on this transfer.
domain assumption Fine-tuning on patched samples with original labels removes backdoor memory without materially hurting clean accuracy.
Lpatch in Section 3.2 is assumed to fix vulnerable spots; no convergence or robustness guarantee is proven.
domain assumption The threat model (40% adversaries, target class 0, random trigger patterns) is representative of real attacks.
Experimental setup in Section 4.1; no adaptive or varying-trigger attacks are tested.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Client-Side Patching against Backdoor Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/DHDH6HID

@misc{pith2026241210605,
  author       = {Pith},
  title        = {Pith review of: Client-Side Patching against Backdoor Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DHDH6HID}},
  note         = {Machine review of arXiv:2412.10605}
}

read the original abstract

Federated learning is a versatile framework for training models in decentralized environments. However, the trust placed in clients makes federated learning vulnerable to backdoor attacks launched by malicious participants. While many defenses have been proposed, they often fail short when facing heterogeneous data distributions among participating clients. In this paper, we propose a novel defense mechanism for federated learning systems designed to mitigate backdoor attacks on the clients-side. Our approach leverages adversarial learning techniques and model patching to neutralize the impact of backdoor attacks. Through extensive experiments on the MNIST and Fashion-MNIST datasets, we demonstrate that our defense effectively reduces backdoor accuracy, outperforming existing state-of-the-art defenses, such as LFighter, FLAME, and RoseAgg, in i.i.d. and non-i.i.d. scenarios, while maintaining competitive or superior accuracy on clean data.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 36 canonical work pages

[9]

Celtibero: Robust Layered Aggregation for Federated Learning

Borja Molina-Coronado. Celtibero: Robust layered aggr egation for feder- ated learning. arXiv preprint arXiv:2408.14240 , 2024

work page Pith review arXiv 2024
[1]

Communication-eﬃcient learning of d eep networks from decentralized data

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hamps on, and Blaise Aguera y Arcas. Communication-eﬃcient learning of d eep networks from decentralized data. In Artiﬁcial intelligence and statistics , pages 1273–

work page
[2]

Federated learning for connected a nd au- tomated vehicles: A survey of existing approaches and chall enges

Vishnu Pandi Chellapandi, Liangqi Yuan, Christopher G B rinton, Stanis- law H Żak, and Ziran Wang. Federated learning for connected a nd au- tomated vehicles: A survey of existing approaches and chall enges. IEEE Transactions on Intelligent Vehicles , 2023

work page 2023
[3]

Federated learning for health- care: Systematic review and architecture proposal

Rodolfo Stoﬀel Antunes, Cristiano André da Costa, Arne K üderle, Im- rana Abdullahi Yari, and Björn Eskoﬁer. Federated learning for health- care: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST) , 13(4):1–23, 2022

work page 2022
[4]

Ansam Khraisat, Ammar Alazab, Sarabjot Singh, Tony Jan, and Alfredo Jr. Gomez. Survey on federated learning for intrusion detec tion system: Concept, architectures, aggregation strategies, challen ges, and future di- rections. ACM Computing Surveys , 57(1):1–38, 2024

work page 2024
[5]

How to backdoor federated learning

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah E strin, and Vi- taly Shmatikov. How to backdoor federated learning. In International con- ference on artiﬁcial intelligence and statistics , pages 2938–2948. PMLR, 2020

work page 2020
[6]

Privacy and robustness in federa ted learning: Attacks and defenses

Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, J un Zhao, Qiang Yang, and S Yu Philip. Privacy and robustness in federa ted learning: Attacks and defenses. IEEE transactions on neural networks and learning systems, 2022. 11

work page 2022
[7]

Federated learning with dif- ferential privacy: Algorithms and performance analysis

Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farha d Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with dif- ferential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security , 15:3454–3469, 2020

work page 2020

Show all 42 references

[8]

{FLAME}: Taming backdoors in federated learning

Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fer eidooni, Samuel Marchal, Markus Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Se- cur...

2022
[10]

Neurotoxin: Durable backdoors in federated learning

Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kannan, and Joseph Go nzalez. Neurotoxin: Durable backdoors in federated learning. In International Conference on Machine Learning , pages 26429–26446. PMLR, 2022

2022
[11]

Diﬀerentially private learning with adaptive cli pping

Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ra- maswamy. Diﬀerentially private learning with adaptive cli pping. Advances in Neural Information Processing Systems , 34:17455–17466, 2021

2021
[12]

X. Wang, L. Kaplan, S. Chien, and J. Acharya. Attack of th e tails: Yes, you really can backdoor federated learning. In Advances in Neural Information Processing Systems (NeurIPS) , 2020

2020
[13]

Poisoning with cerberus: Stealthy an d colluded backdoor attack against federated learning

Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang , Jiqiang Liu, and Xiangliang Zhang. Poisoning with cerberus: Stealthy an d colluded backdoor attack against federated learning. In Proceedings of the AAAI Conference on Artiﬁcial Intelligence , volume 37, pages 9020–9028, 2023

2023
[14]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szege dy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014

2014 arXiv
[15]

Towards deep learning models res istant to adversarial attacks

Aleksander Mądry, Aleksandar Makelov, Ludwig Schmidt , Dimitris Tsipras, and Adrian Vladu. Towards deep learning models res istant to adversarial attacks. stat, 1050(9), 2017

2017
[16]

A sur- vey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies

Zhuang Qian, Kaizhu Huang, Qiu-Feng Wang, and Xu-Yao Zh ang. A sur- vey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies. Pattern Recognition, 131:108889, 2022

2022
[17]

L atent back- door attacks on deep neural networks

Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. L atent back- door attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 2041– 2055, 2019

2019
[18]

Input-aware dynamic backd oor attack

Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backd oor attack. Advances in Neural Information Processing Systems , 33:3454–3464, 2020. 12

2020
[19]

The mnist database of handwritten digits

Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/, 1998

1998
[20]

Dba: Dist ributed back- door attacks against federated learning

Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Dist ributed back- door attacks against federated learning. In International conference on learning representations, 2019

2019
[21]

On the dirichlet distribution

Jiayu Lin. On the dirichlet distribution. Department of Mathematics and Statistics, Queens University , 40, 2016

2016
[22]

Median-krum : A joint distance-statistical based byzantine-robust algorithm i n federated learning

Francesco Colosimo and Floriano De Rango. Median-krum : A joint distance-statistical based byzantine-robust algorithm i n federated learning. In Proceedings of the Int’l ACM Symposium on Mobility Managemen t and Wireless Access, pages 61–68, 2023

2023
[23]

The limitations of federated learning in sybil settings

Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020) , pages 301–316, 2020

2020
[24]

Lﬁghter: Defending against the lab el-ﬂipping attack in federated learning

Najeeb Moharram Jebreel, Josep Domingo-Ferrer, David Sánchez, and Al- berto Blanco-Justicia. Lﬁghter: Defending against the lab el-ﬂipping attack in federated learning. Neural Networks , 170:111–126, 2024

2024
[25]

Roseagg: Robust defense against targeted collusion attacks in feder ated learning

He Yang, Wei Xi, Yuhao Shen, Canhui Wu, and Jizhong Zhao. Roseagg: Robust defense against targeted collusion attacks in feder ated learning. IEEE Transactions on Information Forensics and Security , 2024

2024
[26]

Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

1911 arXiv
[27]

Vppﬂ: A veriﬁable privacy-preserving federated learning s cheme against poisoning attacks

Yuxian Huang, Geng Yang, Hao Zhou, Hua Dai, Dong Yuan, an d Shui Yu. Vppﬂ: A veriﬁable privacy-preserving federated learning s cheme against poisoning attacks. Computers & Security , 136:103562, 2024

2024
[28]

Machine learning with adversaries: Byzantine tol erant gradient descent

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, a nd Julien Stainer. Machine learning with adversaries: Byzantine tol erant gradient descent. Advances in neural information processing systems , 30, 2017

2017
[29]

Fl- defender: Com- bating targeted attacks in federated learning

Najeeb Moharram Jebreel and Josep Domingo-Ferrer. Fl- defender: Com- bating targeted attacks in federated learning. Knowledge-Based Systems , 260:110178, 2023

2023
[30]

Shield-secure aggregation a gainst poisoning in hierarchical federated learning

Yushan Siriwardhana, Pawani Porambage, Madhusanka Li yanage, Samuel Marchal, and Mika Ylianttila. Shield-secure aggregation a gainst poisoning in hierarchical federated learning. IEEE Transactions on Dependable and Secure Computing, 2024. 13

2024
[31]

Cali- brating noise to sensitivity in private data analysis

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam S mith. Cali- brating noise to sensitivity in private data analysis. In Theory of Cryptog- raphy: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pages 265–284. Springer, 2006

2006
[32]

Lomar: A local defense against poisoning attack on federate d learning

Xingyu Li, Zhe Qu, Shangqing Zhao, Bo Tang, Zhuo Lu, and Y ao Liu. Lomar: A local defense against poisoning attack on federate d learning. IEEE Transactions on Dependable and Secure Computing , 20(1):437–450, 2021

2021
[33]

Fltrust: Byzantine-robust federated learning via trust bootstrapp ing

Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang G ong. Fltrust: Byzantine-robust federated learning via trust bootstrapp ing. arXiv preprint arXiv:2012.13995, 2020

2012 arXiv
[34]

Baﬄe: Backdoor detection via feedback-based fe derated learn- ing

Sebastien Andreina, Giorgia Azzurra Marson, Helen Möl lering, and Ghas- san Karame. Baﬄe: Backdoor detection via feedback-based fe derated learn- ing. In 2021 IEEE 41st International Conference on Distributed Computi ng Systems (ICDCS) , pages 852–863. IEEE, 2021

2021
[35]

M aking federated learning robust to adversarial attacks by learni ng data and model association

Adnan Qayyum, Muhammad Umar Janjua, and Junaid Qadir. M aking federated learning robust to adversarial attacks by learni ng data and model association. Computers & Security , 121:102827, 2022

2022
[36]

Crowdguard: Federated backdoor de tection in federated learning

Phillip Rieger, Torsten Krauß, Markus Miettinen, Alex andra Dmitrienko, and Ahmad-Reza Sadeghi. Crowdguard: Federated backdoor de tection in federated learning. NDSS, 2024

2024
[37]

Toward resource-eﬃcient federa ted learning in mobile edge computing

Rong Yu and Peichun Li. Toward resource-eﬃcient federa ted learning in mobile edge computing. IEEE Network , 35(1):148–155, 2021

2021
[38]

Mit igating back- door attacks in federated learning

Chen Wu, Xian Yang, Sencun Zhu, and Prasenjit Mitra. Mit igating back- door attacks in federated learning. arXiv preprint arXiv:2011.01767 , 2020

2011 arXiv
[39]

Federated unl earning with knowledge distillation

Chen Wu, Sencun Zhu, and Prasenjit Mitra. Federated unl earning with knowledge distillation. arXiv preprint arXiv:2201.09441 , 2022

2022 arXiv
[40]

Adaptive machine unlearning

Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, S aeed Shariﬁ- Malvajerdi, and Chris Waites. Adaptive machine unlearning . Advances in Neural Information Processing Systems , 34:16319–16330, 2021

2021
[41]

Sars: A personalized federated learning framework towards fairne ss and robustness against backdoor attacks

Weibin Zhang, Youpeng Li, Lingling An, Bo Wan, and Xuyu W ang. Sars: A personalized federated learning framework towards fairne ss and robustness against backdoor attacks. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 8(4):1–24, 2024

2024
[42]

One-shot backdoor removal for federated lear ning

Zijie Pan, Zuobin Ying, Yajie Wang, Chuan Zhang, Chunha i Li, and Liehuang Zhu. One-shot backdoor removal for federated lear ning. IEEE Internet of Things Journal , 2024. 14

2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [9]

Celtibero: Robust Layered Aggregation for Federated Learning

Borja Molina-Coronado. Celtibero: Robust layered aggr egation for feder- ated learning. arXiv preprint arXiv:2408.14240 , 2024

work page Pith review arXiv 2024

[2] [1]

Communication-eﬃcient learning of d eep networks from decentralized data

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hamps on, and Blaise Aguera y Arcas. Communication-eﬃcient learning of d eep networks from decentralized data. In Artiﬁcial intelligence and statistics , pages 1273–

work page

[3] [2]

Federated learning for connected a nd au- tomated vehicles: A survey of existing approaches and chall enges

Vishnu Pandi Chellapandi, Liangqi Yuan, Christopher G B rinton, Stanis- law H Żak, and Ziran Wang. Federated learning for connected a nd au- tomated vehicles: A survey of existing approaches and chall enges. IEEE Transactions on Intelligent Vehicles , 2023

work page 2023

[4] [3]

Federated learning for health- care: Systematic review and architecture proposal

Rodolfo Stoﬀel Antunes, Cristiano André da Costa, Arne K üderle, Im- rana Abdullahi Yari, and Björn Eskoﬁer. Federated learning for health- care: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST) , 13(4):1–23, 2022

work page 2022

[5] [4]

Ansam Khraisat, Ammar Alazab, Sarabjot Singh, Tony Jan, and Alfredo Jr. Gomez. Survey on federated learning for intrusion detec tion system: Concept, architectures, aggregation strategies, challen ges, and future di- rections. ACM Computing Surveys , 57(1):1–38, 2024

work page 2024

[6] [5]

How to backdoor federated learning

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah E strin, and Vi- taly Shmatikov. How to backdoor federated learning. In International con- ference on artiﬁcial intelligence and statistics , pages 2938–2948. PMLR, 2020

work page 2020

[7] [6]

Privacy and robustness in federa ted learning: Attacks and defenses

Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, J un Zhao, Qiang Yang, and S Yu Philip. Privacy and robustness in federa ted learning: Attacks and defenses. IEEE transactions on neural networks and learning systems, 2022. 11

work page 2022

[8] [7]

Federated learning with dif- ferential privacy: Algorithms and performance analysis

Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farha d Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with dif- ferential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security , 15:3454–3469, 2020

work page 2020