Pith. sign in

REVIEW 4 major objections 5 minor 52 references

Temporal Analysis of Adversarial Attacks in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper experimentally shows that the timing of adversarial attacks in federated learning matters as much as their type: attacks running in the final rounds or throughout training cause the largest accuracy drops, while a One-Class SVM…

desk verdict A competent but overstated temporal-attack benchmark on MNIST; the label-flipping results mostly support the timing claim, the model-poisoning results undercut it, and the defense numbers leak ground-truth labels. read the letter →

arxiv 2501.11054 v1 pith:BW6AZM3H submitted 2025-01-19 cs.LG cs.CR

Rohit Mapakshi , Sayma Akther , Mark Stamp This is my paper · ORCID
classification cs.LGcs.CR
keywords federatedlearningtemporalattacksmodelpoisoninglabelflippingGANreconstructionoutlierdetectionFedAvgMPAF
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the timing of an adversarial client's attacks in federated learning is a first-order factor in how much damage the attack does. In experiments on eight model types and MNIST, the authors show that attacks running in the last 30% of federated rounds, or throughout all rounds, cut accuracy far more than attacks confined to the middle rounds. They also show that early attacks leave models able to recover, that a One-Class SVM outlier-detection defense restores much of the lost accuracy under model poisoning, and that the same timing pattern does not hold equally for every attack or model family. If true, this means FL system designers should treat when an attacker is active as a key variable and should prioritize defenses for late and full-duration attack windows.

What carries the argument

The experiments run ten federated rounds with 25% of clients adversarial and compare three attack windows: FULL (adversaries active every round), MID (active in the middle 30% of rounds), and END (active in the last 30%). Aggregation is FedAvg for neural and linear models and bagging for tree models. The model-poisoning attack follows MPAF: a malicious client takes the difference between a randomly initialized low-accuracy base model and the current global model, multiplies the difference by a factor $\lambda>1$, and sends the magnified fake update for aggregation. Defense is a supervised One-Class SVM trained on client evaluation metrics (precision, recall, F1, loss) to flag and drop malicious updates. These pieces together make the temporal comparison possible by varying only when the malicious behavior occurs.

What would settle it

Re-run the model-poisoning experiments with a magnification factor close to 1 or with a base model that already has moderate accuracy, and check whether the MID window still collapses CNN, RNN, and LSTM to near-random accuracy. If it does, the late-round conclusion is an artifact of attack strength; if MID stays high while END collapses, the timing claim holds. Separately, stop the attack after round 3 and measure whether accuracy returns to baseline by round 10, which the paper's recovery claim predicts.

Watch

Extended reading notes

Core claim

The central discovery is that temporal attack windows are not interchangeable: for the label-flipping and model-poisoning attacks tested, the FULL and END windows degrade the global model substantially, while the MID window has little effect in label flipping and the strongest models recover from early attacks. The effect is most dramatic under MPAF model poisoning, where CNN, RNN, and LSTM accuracies collapse to near-random levels (for example, 0.098, 0.142, and 0.089 in the FULL, MID, and END cases for CNN) without defense; One-Class SVM outlier detection lifts these models back to about 0.81–0.84 accuracy. By contrast, the GAN reconstruction attack is weak against neural models and only affects the tree-based models. The paper concludes that models can recover from early attacks, that later or persistent attacks are the dangerous ones, and that model family and defense choice materially change the outcome.

Load-bearing premise

The timing conclusion rests on the assumption that the model-poisoning attack is strong but not so overwhelming that it destroys the model in every window; if the random base model and the magnification factor $\lambda$ make the attack catastrophic even in the middle rounds, then the observed 'later rounds damage more' pattern is an artifact of attack strength, not of timing.

Editorial extensions

If this is right

  • Defenses that cannot protect every round should concentrate on the final 30% of federated rounds and on clients that are anomalous in every round.
  • A transient attack early in training is survivable, so detection mechanisms can afford to be slower if the threat is known to be intermittent.
  • One-Class SVM filtering of client updates recovers most of the accuracy lost to model poisoning, restoring CNN, RNN, and LSTM from near-random to roughly 0.81–0.84 accuracy.
  • Model selection changes exposure: MLP is the most attack-resistant model tested, while LSTM, despite the best clean accuracy, collapses under model poisoning, and tree ensembles are the weak point for GAN reconstruction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: Because the MPAF attack's magnification factor and random base model are not reported, the quantitative ranking of windows may not transfer to weaker or stronger poisoning; sweeping $\lambda$ would separate timing from attack magnitude.
  • Editorial: The recovery from early attacks suggests that defenders could treat persistence, not just anomaly size, as a signal, weighting recent-round behavior more heavily in client trust scores.
  • Editorial: The outlier-detection evaluation is supervised, trained on known honest-versus-malicious labels; an unsupervised deployment, where such labels are absent, is the stricter test of whether the defense works in practice.
  • Editorial: The GAN attack's weakness may be a consequence of the horizontal partition keeping seven of ten classes per client, so the synthetic missing-label data is easy for the model to ignore; a partition with fewer classes per client would test the attack more severely.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper experimentally studies how the timing of adversarial client attacks affects federated learning (FL) models on MNIST. It defines three temporal windows—FULL, MID, and END (last 30% of rounds)—and tests three attack types (label flipping, model poisoning via MPAF, and GAN reconstruction) across eight classifiers (MLR, SVC, MLP, CNN, RNN, LSTM, Random Forest, XGBoost). It also evaluates a supervised outlier-detection defense at the aggregation server. The central claim is that temporal attacks are most damaging when adversaries are active throughout or in later rounds, and that outlier detection mitigates simple attacks. Results are reported as accuracy, precision, recall, F1, and loss in bar charts and in detailed appendix tables.

Significance. If the temporal claim held, the paper would give FL practitioners a concrete reason to treat attack timing as a first-order variable and to prioritize defenses for late or full-duration attacks. The breadth of the model zoo and the reporting of the full metric set in Appendix B are useful for replication. However, the support is mixed: label flipping partially supports the claim, while model poisoning results in Table B.3 do not, and the defense evaluation in Section 5.2 uses ground-truth malicious-client labels to train the outlier detector, an unrealistic assumption. The significance is therefore currently qualified by these issues.

major comments (4)
  1. [Section 5.4, Table B.3] The claim that attacks matter 'especially when the adversaries are active throughout or during the later rounds' is contradicted by the model poisoning results for CNN, RNN, and LSTM. In the MID window, these models achieve accuracies of 0.1145, 0.1780, and 0.0892, respectively, which are at or near the random baseline of 0.10 and are virtually indistinguishable from the FULL and END results (e.g., CNN FULL 0.0980, END 0.0951). The temporal distinction collapses for these models; the observed pattern is that the attack is catastrophic whenever active, not that later rounds are worse. This undermines the abstract and the Section 6 conclusion.
  2. [Section 2.4.2] The model poisoning attack (MPAF) is specified only as using 'a randomly initialized base model' with a magnification factor λ > 1, but λ is never reported. Without controlling λ, the attack strength is unquantified; with a large λ and a random base, the deep models are overwhelmed in every window, making the temporal comparison an artifact of attack strength rather than timing. The paper should report λ, justify its value, and include a sensitivity analysis over λ, or at least an ablation demonstrating that the results are not driven by an arbitrarily strong attack.
  3. [Section 5.2, Tables B.2, B.4, B.6] The outlier detector is trained using the ground-truth labels of which clients are malicious ('based on the client labels of honest or malicious'). In a realistic FL setting the server does not know which clients are malicious; this is precisely what the detector is supposed to infer. Training on these labels leaks privileged information, so the reported defense accuracies (e.g., One-Class SVM accuracy 0.97 in Table 2) overstate the benefit of outlier detection. The defense should be evaluated without exposing ground-truth adversary identities, for example using unsupervised anomaly detection or a held-out validation set that is not part of the attack scenario.
  4. [Section 6] The conclusion states that 'attacks in the earlier rounds do not have a strong effect' and that 'FL models can recover from attacks,' but no EARLY-only attack window was run; the experiments only cover FULL, MID, and END. Recovery cannot be inferred from the absence of damage in MID relative to END; a direct EARLY-only condition, with later rounds clean, is needed to test the claim that early attacks are harmless and that models recover.
minor comments (5)
  1. [Section 2.6.1] The heading 'Multinominal Logistic Regression' contains a typo; it should be 'Multinomial Logistic Regression'.
  2. [Section 3] The text refers to 'the Fl system' in one place; this should be 'FL system'.
  3. [Table A.7] The hyperparameter 'Colsample by-tree' is likely a typo for 'colsample_bytree' in the XGBoost notation.
  4. [Figure 1, reference [18]] Figure 1 cites a Wikipedia image as reference [18]; a primary scholarly source for centralized versus decentralized FL would be more appropriate.
  5. [Reproducibility] No link to source code or a specification of the exact λ value is provided; adding these would materially improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper reports direct experimental measurements, and no claimed result reduces to a fitted input or a self-citation chain.

full rationale

This is an experimental measurement study, not a derivation. The temporal attack comparison is made by running FL training under three defined attack windows (FULL, MID, END) and recording standard metrics such as accuracy, precision, recall, F1, and loss. No model parameter is fitted to one subset of the data and then presented as a prediction of a closely related quantity; no quantity is defined in terms of the quantity it is claimed to explain. The central claim, that attacks in later rounds or throughout training have larger effects, is a direct empirical comparison across results such as Tables B.1, B.3, and B.5, and it can fail or hold independently of how the experiments were set up. The one nearby concern is the outlier-detection defense: its training labels come from the same attack pipeline, but the defense evaluation is performed on a fresh run with outlier detection enabled, so any possible leakage would be an experimental-design or soundness issue rather than a circular derivation. Likewise, the unreported magnification factor lambda in the MPAF model-poisoning attack and the absence of an EARLY-only window are concerns about attack strength and experimental coverage, not about a result being true by construction. The paper contains no load-bearing self-citations; the MPAF method is attributed to the external reference [8], and the FL framework is attributed to Flower [3]. Since every reported outcome is a measured quantity and no claimed result is equivalent to its own input by definition, the circularity score is 0.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claims rest on standard FL implementation assumptions, MNIST as a proxy domain, unreported attack-strength parameters, and a ground-truth-labeled defense evaluation. All results are measured, not derived.

free parameters (7)
  • Neural network hyperparameters (MLP, CNN, RNN, LSTM) = learning rate 0.01, local epochs 10, batch size 20, optimizer Adam
    Selected via grid search in Appendix A to maximize baseline accuracy; different operating points could change relative sensitivity to attacks.
  • Classical model hyperparameters (MLR, SVC) = MLR local epochs 10 with L2; SVC C=1, linear kernel
    Selected via grid search; affect baseline and attack robustness measurements.
  • Tree model hyperparameters (Random Forest, XGBoost) = XGBoost learning rate 0.08, max depth 10, subsample 0.80, colsample 0.80, alpha 8, lambda 8; RF same with one boosting…
    Selected via grid search; tree models use federated bagging aggregation.
  • Model poisoning amplification factor λ
    Section 2.4.2 says λ > 1 but the actual value is not reported; directly controls how destructive the attack is in each round.
  • Label flipping poisoning ratio
    Section 2.4.1 mentions 'a specified percentage' but the percentage is not reported; controls attack strength for the main temporal finding.
  • GAN architecture and training schedule
    Section 2.4.3 describes a Conditional GAN but gives no architecture, training rounds, or sample injection details; these choices determine why the GAN attack was weak.
  • Outlier detector hyperparameters
    Section 5.2 says best hyperparameters were found by grid search but does not report them.
assumptions (4)
  • domain assumption The Flower framework correctly implements FedAvg and bagging aggregation
    All aggregation results depend on the correctness of the framework's implementation (Section 4.3).
  • domain assumption MNIST is a sufficient benchmark for conclusions about FL robustness
    All experiments use MNIST; the paper generalizes to FL models without testing other datasets.
  • ad hoc to paper The server knows which clients are malicious to train the outlier detector
    Section 5.2 trains outlier detectors using client labels of honest or malicious; this assumes ground truth unavailable in deployment.
  • domain assumption Attack implementations faithfully represent real adversaries
    Label flipping, MPAF with a random base model, and GAN reconstruction are assumed to be realistic untargeted attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Temporal Analysis of Adversarial Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/BW6AZM3H

@misc{pith2026250111054,
  author       = {Pith},
  title        = {Pith review of: Temporal Analysis of Adversarial Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BW6AZM3H}},
  note         = {Machine review of arXiv:2501.11054}
}
read the original abstract

In this paper, we experimentally analyze the robustness of selected Federated Learning (FL) systems in the presence of adversarial clients. We find that temporal attacks significantly affect model performance in the FL models tested, especially when the adversaries are active throughout or during the later rounds. We consider a variety of classic learning models, including Multinominal Logistic Regression (MLR), Random Forest, XGBoost, Support Vector Classifier (SVC), as well as various Neural Network models including Multilayer Perceptron (MLP), Convolution Neural Network (CNN), Recurrent Neural Network (RNN), and Long Short-Term Memory (LSTM). Our results highlight the effectiveness of temporal attacks and the need to develop strategies to make the FL process more robust against such attacks. We also briefly consider the effectiveness of defense mechanisms, including outlier detection in the aggregation algorithm.

Figures

Figures reproduced from arXiv: 2501.11054 by the authors.

Figure 1
Figure 1. Centralized vs decentralized FL [18] 2.1.2 Centralized Federated Learning Training Process A centralized FL training process consists of multiple rounds repeated by a server that coordinates the training process. A round typically consists of the following steps. 1. Client Selection: The server selects clients that fit certain eligibility cri￾teria. For example, such criteria could be based on computing power, con￾n… view at source ↗
Figure 2
Figure 2. Federated bagging [19] clients to observe intermediate states of the global model, and can enable malicious clients to engineer more sophisticated attacks. • Compromised Server: The server in FL coordinates training and model aggregation. A compromised server could alter model updates and misdi￾rects the entire learning process. Since the server has access to all gradient updates, it might also be able to leak sensi… view at source ↗
Figure 3
Figure 3. Sample MNIST images The MNIST dataset is approximately balanced across the labels, 0 through 9. The precise number of samples in each class of the dataset are given in the form of a bar graph in [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Class distribution of MNIST dataset 4.3 Federated Learning Setup The FL stack developed for this research is based on Flower: A Friendly Feder￾ated Learning Framework [3]. Flower has three main components, namely, the server, client, and strategy. • Server: The Server …
Figure 5
Figure 5. Figure 5: Flower federated ML framework [3] focus in on temporal effects of adversarial attacks, and hence adversarial clients are perform their attacks during different stages of the FL rounds as follows. • FULL: Adversarial attacks are present in all FL rounds • MID: Adversari…
Figure 6
Figure 6. Figure 6: Baseline accuracies of FL models 5.2 Outlier Detection Experiments We employ a supervised approach to create a classifier that attempts to dis￾tinguish between honest and malicious clients. First, we train the FL model, as described in Algorithm 2. In the process, eval…
Figure 7
Figure 7. Figure 7: Scatterplot of honest and malicious clients [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Visual comparison of outlier detection algorithms [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Label flipping attack results In general, the MID case has little effect on the models, while the END and FULL cases have a more substantial effect. MLR in the FULL case (and to a lesser extent in the END case), and CNN in the END case are affected most by label flippi…
Figure 10
Figure 10. Figure 10: Model poisoning attack results We observe that the model poisoning attack has a drastic effect on the CNN, RNN, and LSTM models—without outlier detection, these models yield accu￾racies that are essentially random. Outlier detection dramatically improves the performan…
Figure 11
Figure 11. Figure 11: GAN reconstruction attack results 6 Conclusion When adversaries are present in later rounds of the FL process, we tend to observe a larger negative effect on model performance, while attacks in the earlier rounds do not have a strong effect. This indicates that FL mod…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 41 canonical work pages

  1. [1]

    Kulkarni, and H

    Mohammad Mohammadi Amiri, Deniz G¨ und¨ uz, Sanjeev R. Kulkarni, and H. Vincent Poor. Update aware device scheduling for federated learning at the wireless edge. In 2020 IEEE International Symposium on Information Theory, ISIT, pages 2598–2603, 2020

    work page 2020

  2. [2]

    Towards effective device-aware federated learning

    Vito Walter Anelli, Yashar Deldjoo, Tommaso Di Noia, and Antonio Fer- rara. Towards effective device-aware federated learning. In AI*IA 2019 – Advances in Artificial Intelligence , pages 477–491, 2019

    work page 2019

  3. [3]

    Flower: A friendly federated learning research framework

    Daniel J Beutel, Taner Topal, Akhil Mathur, Xinchi Qiu, Javier Fernandez- Marques, Yan Gao, Lorenzo Sani, Hei Li Kwing, Titouan Parcollet, Pedro PB de Gusm˜ ao, and Nicholas D Lane. Flower: A friendly federated learning research framework. https://arxiv.org/abs/2007.14390, 2020

    arXiv 2007

  4. [4]

    Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS ’17, pages 1175–1191, 2017

    work page 2017

  5. [5]

    Federated learning with autotuned communication-efficient secure aggregation

    Keith Bonawitz, Fariborz Salehi, Jakub Kone vcn` y, Brendan McMahan, and Marco Gruteser. Federated learning with autotuned communication-efficient secure aggregation. In 2019 53rd Asilomar Conference on Signals, Systems, and Computers, pages 1222–1226, 2019

    work page 2019

  6. [6]

    Random forests

    Leo Breiman. Random forests. Machine learning, 45:5–32, 2001

    2001

  7. [7]

    Breunig, Hans-Peter Kriegel, Raymond T

    Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and J¨ org Sander. LOF: Identifying density-based local outliers. In Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data , SIG- MOD ’00, pages 93–104, 2000

    work page 2000

  8. [8]

    MPAF: Model poisoning attacks to federated learning based on fake clients

    Xiaoyu Cao and Neil Zhenqiang Gong. MPAF: Model poisoning attacks to federated learning based on fake clients. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops , CVPRW, pages 3395–3403, 2022

    work page 2022

Show all 52 references
  1. [9]

    XGBoost: A scalable tree boosting sys- tem

    Tianqi Chen and Carlos Guestrin. XGBoost: A scalable tree boosting sys- tem. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages 785–794, 2016. 22

    2016

  2. [10]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. https: //arxiv.org/abs/1712.05526, 2017

    2017 arXiv

  3. [11]

    Communication-efficient fed- erated deep learning with layerwise asynchronous model update and tem- porally weighted aggregation

    Yang Chen, Xiaoyan Sun, and Yaochu Jin. Communication-efficient fed- erated deep learning with layerwise asynchronous model update and tem- porally weighted aggregation. IEEE Transactions on Neural Networks and Learning Systems, 31(10):4229–4238, 2020

    2020

  4. [12]

    Asyn- chronous online federated learning for edge devices with non-IID data

    Yujing Chen, Yue Ning, Martin Slawski, and Huzefa Rangwala. Asyn- chronous online federated learning for edge devices with non-IID data. In 2020 IEEE International Conference on Big Data , Big Data, pages 15–24, 2020

    2020

  5. [13]

    Federated learning with multichannel ALOHA

    Jinho Choi and Shiva Raj Pokhrel. Federated learning with multichannel ALOHA. IEEE Wireless Communications Letters , 9(4):499–502, 2019

    2019

  6. [14]

    Support-vector networks

    Corinna Cortes and Vladimir Vapnik. Support-vector networks. Machine learning, 20:273–297, 1995

    1995

  7. [15]

    Heterofl: Computation and communication efficient federated learning for heterogeneous clients

    Enmao Diao, Jie Ding, and Vahid Tarokh. Heterofl: Computation and communication efficient federated learning for heterogeneous clients. In In- ternational Conference on Learning Representations, 2020

    2020

  8. [16]

    Rawat, and Chunmei Liu

    Ronald Doku, Danda B. Rawat, and Chunmei Liu. Towards federated learn- ing approach to determine data relevance in big data. In 2019 IEEE 20th International Conference on Information Reuse and Integration for Data Science (IRI), pages 184–192, 2019

    2019

  9. [17]

    https://data.europa.eu/eli/reg/2016/679/oj, 2016

    EUR-lex: Regulation (EU) 2016/679 of the European Parliament and of the Council. https://data.europa.eu/eli/reg/2016/679/oj, 2016

    2016

  10. [18]

    https: //en.wikipedia.org/wiki/Federated_learning#/media/File: Federated_learning_(centralized_vs_decentralized).png, 2023

    Federated learning (centralized vs decentralized). https: //en.wikipedia.org/wiki/Federated_learning#/media/File: Federated_learning_(centralized_vs_decentralized).png, 2023

    2023

  11. [19]

    https://flower.ai/static/ images/blog/content/2023-11-29-xgboost-fl.jpg , 2023

    Flower AI: XGBoost federated learning. https://flower.ai/static/ images/blog/content/2023-11-29-xgboost-fl.jpg , 2023

    2023

  12. [20]

    https://flower.ai/docs/framework/tutorial-quickstart- xgboost.html#tree-based-bagging-aggregation, 2023

    Flower framwork: Tree-based bagging aggregation — Quickstart with XGBoost. https://flower.ai/docs/framework/tutorial-quickstart- xgboost.html#tree-based-bagging-aggregation, 2023

    2023

  13. [21]

    Long short-term memory.Neural Computation, 9(8):1735–1780, 1997

    Sepp Hochreiter and J¨ urgen Schmidhuber. Long short-term memory.Neural Computation, 9(8):1735–1780, 1997

    1997

  14. [22]

    Model and feature aggre- gation based federated learning for multi-sensor time series trend following

    Yao Hu, Xiaoyan Sun, Yang Chen, and Zishuai Lu. Model and feature aggre- gation based federated learning for multi-sensor time series trend following. In Advances in Computational Intelligence , pages 233–246. Springer, 2019

    2019

  15. [23]

    Incentive design for efficient federated learning in mobile networks: A contract theory approach

    Jiawen Kang, Zehui Xiong, Dusit Niyato, Han Yu, Ying-Chang Liang, and Dong In Kim. Incentive design for efficient federated learning in mobile networks: A contract theory approach. In 2019 IEEE VTS Asia Pacific Wireless Communications Symposium, APWCS, pages 1–5, 2019. 23

    2019

  16. [24]

    Reliable federated learning for mobile networks

    Jiawen Kang, Zehui Xiong, Dusit Niyato, Yuze Zou, Yang Zhang, and Mohsen Guizani. Reliable federated learning for mobile networks. IEEE Wireless Communications, 27(2):72–80, 2020

    2020

  17. [25]

    Blockchained on-device federated learning

    Hyesung Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Blockchained on-device federated learning. IEEE Communications Letters, 24(6):1279–1283, 2020

    2020

  18. [26]

    Peer-to-peer federated learning on graphs

    Anusha Lalitha, Osman Cihan Kilinc, Tara Javidi, and Farinaz Koushanfar. Peer-to-peer federated learning on graphs. https://arxiv.org/abs/1901. 11173, 2019

    1901

  19. [27]

    MNIST handwritten digit database

    Yann LeCun and Corinna Cortes. MNIST handwritten digit database. http://yann.lecun.com/exdb/mnist/, 2010

    2010

  20. [28]

    Backpropagation applied to handwritten zip code recog- nition

    Yann LeCun et al. Backpropagation applied to handwritten zip code recog- nition. Neural Computation, 1(4):541–551, 1989

    1989

  21. [29]

    Fair resource allocation in federated learning

    Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. Fair resource allocation in federated learning. https://arxiv.org/abs/1905.10497, 2020

    1905 arXiv

  22. [30]

    Secure Model Fusion for Distributed Learning Using Partial Homomorphic Encryption , pages 154–179

    Changchang Liu, Supriyo Chakraborty, and Dinesh Verma. Secure Model Fusion for Distributed Learning Using Partial Homomorphic Encryption , pages 154–179. Springer, 2019

    2019

  23. [31]

    Isolation forest

    Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 Eighth IEEE International Conference on Data Mining , pages 413– 422, 2008

    2008

  24. [32]

    H Deng, and Kui Ren

    Yang Liu, Zhuo Ma, Ximeng Liu, Siqi Ma, Surya Nepal, Robert. H Deng, and Kui Ren. Boosting privately: Federated extreme gradient boosting for mobile crowdsensing. In 2020 IEEE 40th International Conference on Distributed Computing Systems , ICDCS, pages 1–11, 2020

    2020

  25. [33]

    Blockchain and federated learning for privacy-preserved data sharing in industrial iot

    Yunlong Lu, Xiaohong Huang, Yueyue Dai, Sabita Maharjan, and Yan Zhang. Blockchain and federated learning for privacy-preserved data sharing in industrial iot. IEEE Transactions on Industrial Informatics , 16(6):4177– 4186, 2020

    2020

  26. [34]

    FLchain: Federated learning via MEC-enabled blockchain network

    Umer Majeed and Choong Seon Hong. FLchain: Federated learning via MEC-enabled blockchain network. In 2019 20th Asia-Pacific Network Op- erations and Management Symposium , APNOMS, pages 1–4, 2019

    2019

  27. [35]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Confer- ence on Artificial Intelligence and Statistics , volume 54, pages 1...

    2017

  28. [36]

    https://numpy.org/

    Numpy: The fundamental package for scientific computing with Python. https://numpy.org/. 24

  29. [37]

    https://pandas.pydata.org/

    pandas: Powerful data structures for data analysis, time series, and statis- tics. https://pandas.pydata.org/

  30. [38]

    https://pytorch.org/

    Pytorch. https://pytorch.org/

  31. [39]

    Fedpaq: A communication-efficient federated learn- ing method with periodic averaging and quantization

    Amirhossein Reisizadeh, Aryan Mokhtari, Hamed Hassani, Ali Jadbabaie, and Ramtin Pedarsani. Fedpaq: A communication-efficient federated learn- ing method with periodic averaging and quantization. In International Con- ference on Artificial Intelligence and Statistics , pages 2...

    2021

  32. [40]

    A fast algorithm for the minimum covariance determinant estimator

    Peter J Rousseeuw and Katrien Van Driessen. A fast algorithm for the minimum covariance determinant estimator. Technometrics, 41(3):212–223, 1999

    1999

  33. [41]

    Braintorrent: A peer-to-peer environment for decen- tralized federated learning

    Abhijit Guha Roy, Shayan Siddiqui, Sebastian P¨ olsterl, Nassir Navab, and Christian Wachinger. Braintorrent: A peer-to-peer environment for decen- tralized federated learning. https://arxiv.org/abs/1905.06731, 2019

    1905 arXiv

  34. [43]

    Rumelhart, Geoffrey E

    David E. Rumelhart, Geoffrey E. Hinton, and Ronald J. Williams. Learn- ing representations by back-propagating errors. Nature, 323(6088):533–536, 1986

    1986

  35. [44]

    Samy and Sarunas Girdzijauskas

    Ahmed E. Samy and Sarunas Girdzijauskas. Mitigating sybil attacks in federated learning. In Information Security Practice and Experience , pages 36–51. Springer, 2023

    2023

  36. [45]

    Platt, John Shawe-Taylor, Alex J

    Bernhard Sch¨ olkopf, John C. Platt, John Shawe-Taylor, Alex J. Smola, and Robert C. Williamson. Estimating the support of a high-dimensional distribution. Neural Computation, 13(7):1443–1471, 2001

    2001

  37. [46]

    https://scikit-learn.org/ stable/

    scikit-learn: Machine learning in Python. https://scikit-learn.org/ stable/

  38. [47]

    Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein

    Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! Targeted clean-label poisoning attacks on neural networks.https://arxiv.org/abs/ 1804.00792, 2018

    2018 arXiv

  39. [48]

    Measure contribution of participants in federated learning

    Guan Wang, Charlie Xiaoqian Dang, and Ziye Zhou. Measure contribution of participants in federated learning. In2019 IEEE International Conference on Big Data (Big Data) , pages 2597–2604, 2019

    2019

  40. [49]

    https://xgboost

    XGBoost: Scalable and flexible gradient boosting. https://xgboost. readthedocs.io/en/stable/

  41. [50]

    Hybridalpha: An efficient approach for privacy-preserving federated learn- ing

    Runhua Xu, Nathalie Baracaldo, Yi Zhou, Ali Anwar, and Heiko Ludwig. Hybridalpha: An efficient approach for privacy-preserving federated learn- ing. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, AISec’19, page 13–23, 2019. 25

    2019

  42. [51]

    Fed- erated learning

    Qiang Yang, Yang Liu, Yong Cheng, Yan Kang, and Tianjian Chen. Fed- erated learning. Synthesis Lectures on Artificial Intelligence and Machine Learning, 13(3):1–207, 2019

    2019

  43. [52]

    Experience-driven computational resource allocation of federated learning by deep reinforcement learning

    Yufeng Zhan, Peng Li, and Song Guo. Experience-driven computational resource allocation of federated learning by deep reinforcement learning. In 2020 IEEE International Parallel and Distributed Processing Symposium (IPDPS), pages 234–243, 2020

    2020

  44. [53]

    Liu, and Yang Xiang

    Xiaoyu Zhang, Xiaofeng Chen, Joseph K. Liu, and Yang Xiang. Deep- PAR and DeepDPA: Privacy preserving and asynchronous deep learning for industrial IoT. IEEE Transactions on Industrial Informatics , 16(3):2081– 2090, 2020. Appendix A In this appendix, we list the hyperparamete...

    2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.