Pith. sign in

REVIEW 4 major objections 6 minor 76 references

FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FL-PLAS claims that federated learning can fend off backdoor attacks even when 90% of clients are malicious, by aggregating only feature extractors and never sharing classifiers.

desk verdict Useful pFL-based defense with broad experiments, but the 90%-malicious claim holds only for standard data poisoning, not the paper's own threat model. read the letter →

arxiv 2505.12019 v1 pith:TQTLZIAR submitted 2025-05-17 cs.CR cs.LG

Jianyi Zhang , Ziyin Zhou , Yilong Li , Qichao Jin This is my paper · ORCID
classification cs.CRcs.LG
keywords federatedlearningbackdoordefensepartiallayeraggregationdatapoisoningmaliciousclientstriggersemanticedge-case
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a defense for federated learning against backdoor poisoning that keeps each client's classifier private while only the feature extractor is uploaded and aggregated. The central claim is that backdoor behavior lives in the classifier, not the feature extractor, so a clean classifier attached to a poisoned feature extractor will not misclassify triggered inputs. On MNIST, CIFAR-10, and CIFAR-100, under trigger, semantic, and edge-case backdoor attacks, the method reports low backdoor accuracy and high main-task accuracy even when up to 90% of participating clients are malicious, with no auxiliary dataset held by the server. A sympathetic reader would care because current defenses degrade once malicious clients exceed roughly half the population or rely on server-held clean data, which conflicts with FL privacy.

What carries the argument

The central mechanism is partial layer aggregation: the local model is split at a chosen cutting layer into a feature extractor and a classifier; clients upload only the feature extractor, the server runs FedAvg over those extractor parameters, and each client keeps and uses its own classifier with the updated extractor. This prevents backdoor labels from propagating through the shared model while still allowing collaborative feature learning. The paper also treats the cutting-layer choice as a tunable defense knob: deeper aggregation improves main-task accuracy but raises backdoor accuracy, so a small classifier is preferred.

What would settle it

Train FL-PLAS with a malicious client that optimizes its feature-extractor update specifically to push aggregated features of triggered inputs toward the target class, then measure whether clean clients' unpoisoned classifiers begin classifying triggered test samples as the target; a backdoor accuracy well above the benign baseline would show that the classifier-isolation assumption fails.

Watch

Extended reading notes

Core claim

The load-bearing discovery is an asymmetry between layers: a backdoor feature extractor combined with a clean classifier yields near-zero backdoor accuracy, while a backdoor classifier combined with a clean feature extractor yields near-perfect backdoor accuracy (Table 2). From this the paper concludes that the backdoor label association is carried by the classifier, and that keeping classifiers local severs the route by which malicious clients' poisoned labels reach benign clients. FL-PLAS therefore aggregates only the feature extractor with FedAvg, and each client combines the aggregated extractor with its own classifier. The paper presents this as sufficient to defend against trigger, semantic, and edge-case backdoors at malicious-client ratios up to 90%, without any server-side dataset.

Load-bearing premise

The defense assumes that backdoor information cannot reach a clean client through the shared feature extractor alone; if a malicious client can craft feature-extractor updates that make clean classifiers map trigger features to the target label, keeping classifiers local would no longer block the attack.

Editorial extensions

If this is right

  • FL-PLAS maintains low backdoor accuracy and competitive main-task accuracy when more than half of clients are malicious, a regime where clustering- or majority-based defenses fail.
  • The defense works without any auxiliary dataset on the server, unlike FLTrust, and adds no screening complexity beyond standard FedAvg.
  • It resists trigger, semantic, and edge-case backdoors on MNIST, CIFAR-10, and CIFAR-100 with differing architectures.
  • The number of aggregated layers is a trade-off: more shared layers raise main-task accuracy but also raise backdoor accuracy, so the classifier should be kept small.
  • On small models such as LeNet, keeping a relatively large classifier local reduces main-task accuracy, a privacy-utility trade-off the paper acknowledges.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An adaptive attacker excluded by the paper's threat model could try to craft feature-extractor updates whose aggregated features cause clean classifiers to map trigger patterns to the target label; testing this would reveal whether the defense holds against stronger adversaries.
  • The layer-asymmetry observation may be architecture- and task-dependent; re-running the Table 2 assembly test on transformer-based models or on NLP/audio tasks could show whether the classifier-only backdoor localization generalizes.
  • Because FL-PLAS is structurally similar to personalized federated learning's partial-model personalization, it could be combined with server-side anomaly detection or trust scoring to reduce residual backdoor accuracy, such as the 0.47 edge-case value at 90% malicious clients.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes FL-PLAS, a federated learning defense that divides each client's model into a feature extractor and a classifier, aggregates only the feature extractor parameters on the server, and keeps each client's classifier local. The motivating observation (Table 2) is that backdoor accuracy depends mainly on whether the classifier is poisoned, not on whether the feature extractor is poisoned, so local classifiers should prevent backdoor labels from spreading to benign clients. FL-PLAS is evaluated on MNIST, CIFAR-10, and CIFAR-100 under trigger, semantic, and edge-case attacks, with malicious-client ratios up to 90%, and is compared against FedAvg, FLTrust, FLAME, RSA, Krum, and NDC. The reported results show low backdoor accuracy and competitive main-task accuracy for FL-PLAS, along with an efficiency comparison arguing that FL-PLAS has no screening overhead.

Significance. If the claims hold, FL-PLAS is a potentially valuable contribution to the FL backdoor-defense literature: it does not require a server-side auxiliary dataset, it has trivial screening complexity, and it targets the high-malicious-ratio regime where many existing defenses fail. The paper also has notable strengths: a clear motivating experiment (Table 2), an explicit threat model and defense goals, a public code repository, and an efficiency analysis. However, the significance is currently limited by three issues: the evaluation measures FL-PLAS on averaged local models while other defenses are measured on a single global model; the experiments appear to be single-run with no error bars; and the security claim rests on an assumption that a poisoned feature extractor cannot transfer backdoor behavior to a clean classifier, which is not tested against attackers who optimize the feature extractor despite being permitted to do so by the stated threat model.

major comments (4)
  1. [Section 4 and Section 7.4] The threat model in Section 4 explicitly allows malicious users to "manipulate local model updates at will," and Section 7.4 claims the method is insensitive to whether malicious clients collude. However, the evaluation in Section 6.1 instantiates only standard data-poisoning attackers who add triggers, flip labels, or modify local data while otherwise following the FedAvg objective. Under 90% malicious clients, colluding attackers could instead craft feature-extractor updates so that the aggregated feature extractor maps trigger-carrying inputs into the target-class region of the feature space, after which the benign clients' own clean classifiers would assign the target label even though classifiers are never shared. The correctness of the defense therefore depends on an untested assumption: that backdoor information cannot be transferred through the shared feature extractor to a clean classifier. I ask for either (a) an explicit restriction of the threat model that excludes collusive or adaptive feature-extractor optimization, with a justification, or (b) an experimental evaluation against such an adaptive attack. Without one of these, the statement that backdoor labels "do not impact other clients" is not established for the threat model the paper itself declares.
  2. [Section 4, Evaluation Metrics; Section 6.2] The evaluation protocol is asymmetric: for FL-PLAS, BA and MA are computed by averaging over all local models, while for FedAvg, FLTrust, FLAME, RSA, Krum, and NDC the metrics are computed on the single global model. This can inflate FL-PLAS's apparent robustness because poorly performing local models are hidden in the average and because the comparison does not evaluate any concrete deployable global model for FL-PLAS. The quantitative claims in Tables 4 and 5, including the statement about improving defense capability by over 44%, rely on this asymmetric comparison. Please report the distribution (mean, standard deviation, min/max) of FL-PLAS's local MA and BA, and provide a comparison protocol in which all methods are assessed in a symmetric manner, for example by evaluating FL-PLAS with a fixed, clearly specified classifier choice or by reporting the full spread of local results.
  3. [Section 6.2 and Tables 3-5] The experiments appear to be single-run, with no error bars, multiple seeds, or statistical significance tests. Because the headline claim is robustness at 90% malicious clients, and Section 7.1 (Table 7) shows that BA can jump from 0.109 to 0.369 when the number of aggregated layers changes from 11 to 12 on CIFAR-10, a single seed is insufficient to support the quantitative conclusions. Please report results over at least three independent seeds with standard deviations, and ideally include a sensitivity analysis over client sampling and the Dirichlet distribution parameter.
  4. [Section 7.1 and Table 7] The number of cutting layers l is a free parameter with a dramatic effect on the defense: Table 7 shows BA of 0.110 at l=11, 0.369 at l=12, and 0.900 at l=13 for CIFAR-10 at 90% malicious clients. The paper states that this selection "needs to be analyzed" but does not provide a principled criterion for choosing l on a new dataset or architecture. As a result, the central claim that FL-PLAS works without an auxiliary dataset is qualified by a manually tuned architectural choice. Please provide a selection rule or heuristic, and report the value of l used for every experimental configuration together with a sensitivity analysis.
minor comments (6)
  1. [Section 5.2, Algorithms 1-2] The complexity analysis is unclear: the text says Algorithm 2 has complexity O(p + Di/b) and "equals to Linear complexity O(N)", but N is never defined, and the total complexity O(r*O(N) + p*n) = O(N^2) does not follow rigorously from the stated quantities. Please rewrite this paragraph with consistent notation.
  2. [Figure 6] The caption says "MA of CIFAR-100 in semantic attack" while the text and the rest of the figure describe CIFAR-10. Please correct the caption or the labels so that the dataset name is consistent.
  3. [Table 6] RFA appears in the screening complexity table but is never defined or cited in the text. Please either define RFA and its reference or remove it from the comparison.
  4. [Section 2.2] The description of the semantic backdoor is internally inconsistent: it first says pointy-eared dog images are assigned the label "cat" and later says labels are flipped from "dog" to "cat". Please clarify which variant is used in the experiments.
  5. [Table 3] The table lists a "Combined learning rate" of learning rate × 0.998^t, but the per-dataset learning rates are only given in the prose of Section 6.1. Please add the model/dataset mapping and learning rates directly to the table for reproducibility.
  6. [Section 6.2.2] The claim that FL-PLAS "improves defense capability by over 44%" is not precisely defined. Please state the exact formula used to compute this percentage improvement and the baseline to which it is compared.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the core defense claim rests on a direct empirical test, not on fitted parameters or load-bearing self-citation.

full rationale

The paper's derivation chain is self-contained. The mechanism—aggregate only feature extractors and keep classifiers local—guarantees by construction that backdoor label associations stored in the classifier are not broadcast to other clients. The non-trivial question is whether a poisoned feature extractor alone can still backdoor a clean classifier, and the paper tests this directly in Section 5.1, Table 2, where a backdoored feature extractor combined with a clean classifier gives BA about 0.1 on MNIST, with the same observation reported for CIFAR-100. The defense claim is therefore an empirical observation rather than a definitional identity. No parameter is fitted to a subset and then reported as a prediction: the BA/MA values in Tables 4-5 and Figures 3-6 are direct measurements under the stated attack settings. The only self-citation, [69] in Section 5.1, is used as motivation for the layer-splitting hypothesis, not as load-bearing evidence; the needed observation is re-established by the paper's own Table 2. Concerns about adaptive attackers who deliberately engineer the shared feature extractor to cause clean classifiers to assign the target label, and about how BA is averaged when most clients are malicious, are threat-model and evaluation-validity issues rather than circularity.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The method introduces no new entities. It relies on two domain assumptions: classifier-localization blocks backdoor propagation, and non-adaptive attackers. The free hyperparameter is the layer split, chosen per architecture without a stated principled rule.

free parameters (1)
  • cutting layer count (l) = not stated per model; split chosen from architecture
    The number of layers shared in aggregation is a design choice that trades MA against BA (Table 7). The paper does not give a principled rule for choosing it across the three model architectures, leaving a free hyperparameter.
assumptions (3)
  • domain assumption Backdoor association lives in the classifier: a poisoned feature extractor combined with a clean classifier does not produce high backdoor accuracy (Table 2).
    The entire defense hinges on this observation; the paper only demonstrates it on MNIST/LeNet and CIFAR-100/ResNet-18, with no theoretical guarantee and no test against adaptive attacks that try to encode backdoor in features.
  • domain assumption Malicious clients do not adapt to the defense, e.g., by crafting feature extractor updates that activate backdoors in clean classifiers.
    The threat model in Section 4 does not include attackers who know the aggregation rule and optimize against it, so the defense is only assessed against static data-poisoning attacks.
  • domain assumption Parameter count of classifier is small, so not aggregating it does not hurt convergence or main-task accuracy.
    Section 7.2 gives examples of architectures with small classifiers and shows similar loss/MA curves for FL-PLAS and FedAvg, but this is empirical and depends on the chosen layer split.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients." pith.science (2026). https://pith.science/paper/TQTLZIAR

@misc{pith2026250512019,
  author       = {Pith},
  title        = {Pith review of: FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TQTLZIAR}},
  note         = {Machine review of arXiv:2505.12019}
}
read the original abstract

Federated learning (FL) is gaining increasing attention as an emerging collaborative machine learning approach, particularly in the context of large-scale computing and data systems. However, the fundamental algorithm of FL, Federated Averaging (FedAvg), is susceptible to backdoor attacks. Although researchers have proposed numerous defense algorithms, two significant challenges remain. The attack is becoming more stealthy and harder to detect, and current defense methods are unable to handle 50\% or more malicious users or assume an auxiliary server dataset. To address these challenges, we propose a novel defense algorithm, FL-PLAS, \textbf{F}ederated \textbf{L}earning based on \textbf{P}artial\textbf{ L}ayer \textbf{A}ggregation \textbf{S}trategy. In particular, we divide the local model into a feature extractor and a classifier. In each iteration, the clients only upload the parameters of a feature extractor after local training. The server then aggregates these local parameters and returns the results to the clients. Each client retains its own classifier layer, ensuring that the backdoor labels do not impact other clients. We assess the effectiveness of FL-PLAS against state-of-the-art (SOTA) backdoor attacks on three image datasets and compare our approach to six defense strategies. The results of the experiment demonstrate that our methods can effectively protect local models from backdoor attacks. Without requiring any auxiliary dataset for the server, our method achieves a high main-task accuracy with a lower backdoor accuracy even under the condition of 90\% malicious users with the attacks of trigger, semantic and edge-case.

Figures

Figures reproduced from arXiv: 2505.12019 by the authors.

Figure 1
Figure 1. Illustration of the three steps in one iteration of FL. There are [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustration of FL-PLAS workflow in round [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. BA of various datasets under the trigger attack. 3(a) depicts how the BA of MNIST changes against different [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: BA of CIFAR-10 in two new types of attacks. 4(a) shows semantic attack, 4(b) shows edge-case attack. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: MA of datasets in trigger attacks. 5(a) shows how the MA of MNIST changes, 5(b) shows how MA of [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: MA of CIFAR-10 in two new types of attacks. 6(a) shows how the MA of CIFAR-10 changes in semantic [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Effect of FL-PLAS on the model. 7(a) shows how the loss of MNIST changes in the trigger attack, and 7(b) [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: BA and MA of datasets in trigger attacks. 8(a) shows how the BA of malicious ratio changes under MNIST, [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

76 extracted references · 48 canonical work pages

  1. [1]

    Federated learning: Strategies for improving communication efficiency

    Jakub Koneˇcn`y, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 2016

    arXiv 2016

  2. [2]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication- efficient learning of deep networks from decentralized data. In 20th International Conference on Artificial Intelligence and Statistics. PMLR, 2017

    work page 2017

  3. [3]

    Vulnerabilities in federated learning

    Nader Bouacida and Prasant Mohapatra. Vulnerabilities in federated learning. IEEE Access, 9:63229–63249, 2021

    work page 2021

  4. [4]

    Defending against backdoors in federated learning with robust learning rate

    Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. Defending against backdoors in federated learning with robust learning rate. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 9268–9276, 2021

    work page 2021

  5. [5]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  6. [6]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    arXiv 2017

  7. [7]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In 23rd International Conference on Artificial Intelligence and Statistics, volume 108. PMLR, 2020

    work page 2020

  8. [8]

    Data poisoning attacks against federated learning systems

    Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 25, pages 480–501. Springer, 2020

    work page 2020

Show all 76 references
  1. [9]

    Lfighter: Defend- ing against the label-flipping attack in federated learning

    Najeeb Moharram Jebreel, Josep Domingo-Ferrer, David Sánchez, and Alberto Blanco-Justicia. Lfighter: Defend- ing against the label-flipping attack in federated learning. Neural Networks, 170:111–126, 2024

    2024

  2. [10]

    Attack of the tails: Yes, you really can backdoor federated learning

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. arXiv preprint arXiv:2007.05084, 2020

    2007 arXiv

  3. [11]

    On the vulnerability of backdoor defenses for federated learning

    Pei Fang and Jinghui Chen. On the vulnerability of backdoor defenses for federated learning. In AAAI Conference on Artificial Intelligence, 2023

    2023

  4. [12]

    Backdoor federated learning by poisoning backdoor-critical layers

    Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan. Backdoor federated learning by poisoning backdoor-critical layers. 2024

    2024

  5. [13]

    Threats to federated learning: A survey.arXiv preprint arXiv:2003.02133, 2020

    Lingjuan Lyu, Han Yu, and Qiang Yang. Threats to federated learning: A survey.arXiv preprint arXiv:2003.02133, 2020

    2003 arXiv

  6. [14]

    Giannakis, and Qing Ling

    Liping Li, Wei Xu, Tianyi Chen, Georgios B. Giannakis, and Qing Ling. RSA: byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In 33rd AAAI Conference on Artificial Intelligence, 2019

    2019

  7. [15]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    1911 arXiv

  8. [16]

    Learning to detect malicious clients for robust federated learning

    Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. Learning to detect malicious clients for robust federated learning. arXiv preprint arXiv:2002.00211, 2020

    2002 arXiv

  9. [17]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In Network and Distributed Systems Security (NDSS) Symposium, 2021

    2021

  10. [18]

    {FLAME}: Taming backdoors in federated learning

    Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security...

    2022

  11. [19]

    Machine learning with adversaries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In 30th Annual Conference on Neural Information Processing Systems, 2017

    2017

  12. [20]

    Backdooring convolutional neural networks via targeted weight perturbations

    Jacob Dumford and Walter Scheirer. Backdooring convolutional neural networks via targeted weight perturbations. In 2020 IEEE International Joint Conference on Biometrics (IJCB). IEEE, 2020

    2020

  13. [21]

    Data poisoning attacks and defenses to crowdsourcing systems

    Minghong Fang, Minghao Sun, Qi Li, Neil Gong, Jin Tian, and Jia Liu. Data poisoning attacks and defenses to crowdsourcing systems. In Proceedings of the Web Conference, pages 969–980, 2021. 17 Running Title for Header

    2021

  14. [22]

    Poisoning attacks to graph-based recommender systems

    Minghong Fang, Guolei Yang, Neil Zhenqiang Gong, and Jia Liu. Poisoning attacks to graph-based recommender systems. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 381–392, 2018

    2018

  15. [23]

    Fake co-visitation injection attacks to recommender systems

    Guolei Yang, Neil Zhenqiang Gong, and Ying Cai. Fake co-visitation injection attacks to recommender systems. In NDSS, 2017

    2017

  16. [24]

    Exploiting machine learning to subvert your spam filter

    Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D Joseph, Benjamin IP Rubinstein, Udam Saini, Charles A Sutton, J Doug Tygar, and Kai Xia. Exploiting machine learning to subvert your spam filter. LEET, 8:1–9, 2008

    2008

  17. [25]

    Advances and open problems in federated learning

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Keith Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. arXiv preprint arXiv:1912.04977, 2019

    1912 arXiv

  18. [26]

    Backdoor learning: A survey

    Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. arXiv preprint arXiv:2007.08745, 2020

    2007 arXiv

  19. [27]

    Byzantine-robust learning on heterogeneous datasets via resampling

    Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-robust learning on heterogeneous datasets via resampling. arXiv preprint arXiv:2006.09365, 2020

    2006 arXiv

  20. [28]

    Measuring the effects of non-identical data distribution for federated visual classification

    Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classification. arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

  21. [29]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  22. [30]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy. IEEE, 2016

    2016

  23. [31]

    Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks

    Sanghyun Hong, Pietro Frigo, Yi˘gitcan Kaya, Cristiano Giuffrida, and Tudor Dumitras, . Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In 28th USENIX Security Symposium, 2019

    2019

  24. [32]

    Antidote: understanding and defending against poisoning of anomaly detectors

    Benjamin IP Rubinstein, Blaine Nelson, Ling Huang, Anthony D Joseph, Shing-hon Lau, Satish Rao, Nina Taft, and J Doug Tygar. Antidote: understanding and defending against poisoning of anomaly detectors. In 9th ACM SIGCOMM Conference on Internet Measurement, 2009

    2009

  25. [33]

    Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein

    Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In 31st Annual Conference on Neural Information Processing Systems, NeurIPS, pages 6106–6116, 2018

    2018

  26. [34]

    When does machine learning fail? generalized transferability for evasion and poisoning attacks

    Octavian Suciu, Radu Marginean, Yigitcan Kaya, Hal Daume III, and Tudor Dumitras. When does machine learning fail? generalized transferability for evasion and poisoning attacks. In 27th USENIX Security Symposium, 2018

    2018

  27. [35]

    Attacking graph-based classification via manipulating the graph structure

    Binghui Wang and Neil Zhenqiang Gong. Attacking graph-based classification via manipulating the graph structure. In ACM CCS, 2019

    2019

  28. [36]

    Poisoning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh, Scotland, UK, June 26 - July 1, 2012. icml.cc / Omnipress, 2012

    2012

  29. [37]

    Manipulating machine learning: Poisoning attacks and countermeasures for regression learning

    Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy (SP), pages 19–35. IEEE, 2018

    2018

  30. [38]

    Data poisoning attacks on factorization-based collaborative filtering

    Bo Li, Yining Wang, Aarti Singh, and Yevgeniy V orobeychik. Data poisoning attacks on factorization-based collaborative filtering. In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Gar- nett, editors, Advances in Neural Information Processing Sy...

    2016

  31. [39]

    Towards poisoning of deep learning algorithms with back-gradient optimization

    Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security...

    2017

  32. [40]

    Is feature selection secure against training data poisoning? In Proceedings of the 32nd International Conference on Machine Learning, ICML, volume 37, pages 1689–1698

    Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. Is feature selection secure against training data poisoning? In Proceedings of the 32nd International Conference on Machine Learning, ICML, volume 37, pages 1689–1698. JMLR.org, 2015

    2015

  33. [41]

    Local model poisoning attacks to byzantine-robust federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In 29th{USENIX} Security Symposium, 2020. 18 Running Title for Header

    2020

  34. [42]

    A little is enough: Circumventing defenses for distributed learning

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d’Alché-Buc, Emily B. Fox, and Roman Garnett, editors, Advances in Neural Information Processin...

    2019

  35. [43]

    Fall of empires: Breaking byzantine-tolerant SGD by inner product manipulation

    Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine-tolerant SGD by inner product manipulation. In Proceedings of the Thirty-Fifth Conference on Uncertainty in Artificial Intelligence, UAI, volume 115, pages 261–270. AUAI Press, 2019

    2019

  36. [44]

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin B. Calo. Analyzing federated learning through an adversarial lens. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9...

    2019

  37. [45]

    DBA: distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. DBA: distributed backdoor attacks against federated learning. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30,

    2020

  38. [46]

    Neural trojans

    Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In International Conference on Computer Design. IEEE, 2017

    2017

  39. [47]

    Februus: Input purification defense against trojan attacks on deep neural network systems

    Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Annual Computer Security Applications Conference, 2020

    2020

  40. [48]

    Bridging mode connectivity in loss landscapes and adversarial robustness

    Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness. arXiv preprint arXiv:2005.00060, 2020

    2005 arXiv

  41. [49]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses. Springer, 2018

    2018

  42. [50]

    Spectral signatures in backdoor attacks

    Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018

    2018

  43. [51]

    Detecting backdoor attacks on deep neural networks by activation clustering.arXiv preprint arXiv:1811.03728, 2018

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering.arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  44. [52]

    Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection

    Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection. In 30th USENIX Security Symposium, 2021

    2021

  45. [53]

    Baffle: Backdoor detection via feedback-based federated learning

    Sebastien Andreina, Giorgia Azzurra Marson, Helen Möllering, and Ghassan Karame. Baffle: Backdoor detection via feedback-based federated learning. In 41st International Conference on Distributed Computing Systems, pages 852–863. IEEE, 2021

    2021

  46. [54]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, 2019

    2019

  47. [55]

    Deep probabilistic models to detect data poisoning attacks

    Mahesh Subedar, Nilesh Ahuja, Ranganath Krishnan, Ibrahima J Ndiour, and Omesh Tickoo. Deep probabilistic models to detect data poisoning attacks. arXiv preprint arXiv:1912.01206, 2019

    1912 arXiv

  48. [56]

    A unified framework for analyzing and detecting malicious examples of dnn models

    Kaidi Jin, Tianwei Zhang, Chao Shen, Yufei Chen, Ming Fan, Chenhao Lin, and Ting Liu. A unified framework for analyzing and detecting malicious examples of dnn models. arXiv preprint arXiv:2006.14871, 2020

    2006 arXiv

  49. [57]

    Fedinv: Byzantine-robust federated learning by inversing local model updates

    Bo Zhao, Peng Sun, Tao Wang, and Keyu Jiang. Fedinv: Byzantine-robust federated learning by inversing local model updates. In 36th AAAI Conference on Artificial Intelligence, 2022

    2022

  50. [58]

    Flip: A provable defense framework for backdoor mitigation in federated learning

    Kaiyuan Zhang, Guanhong Tao, Qiuling Xu, Siyuan Cheng, Shengwei An, Yingqi Liu, Shiwei Feng, Guangyu Shen, Pin-Yu Chen, Shiqing Ma, et al. Flip: A provable defense framework for backdoor mitigation in federated learning. In International Conference on Learning Representations ...

    2023

  51. [59]

    Using anomaly detection to detect poisoning attacks in federated learning applications

    Ali Raza, Shujun Li, Kim-Phuc Tran, and Ludovic Koehl. Using anomaly detection to detect poisoning attacks in federated learning applications. arXiv preprint arXiv:2207.08486, 2022

    2022 arXiv

  52. [60]

    Exploiting shared representations for personalized federated learning

    Liam Collins, Hamed Hassani, Aryan Mokhtari, and Sanjay Shakkottai. Exploiting shared representations for personalized federated learning. In International conference on machine learning, pages 2089–2099. PMLR, 2021

    2021

  53. [61]

    Efficient wireless federated learning with partial model aggregation

    Zhixiong Chen, Wenqiang Yi, Hyundong Shin, Arumugam Nallanathan, and Geoffrey Ye Li. Efficient wireless federated learning with partial model aggregation. IEEE Transactions on Communications, 2024. 19 Running Title for Header

    2024

  54. [62]

    Federated learning with partial model personalization

    Krishna Pillutla, Kshitiz Malik, Abdel-Rahman Mohamed, Mike Rabbat, Maziar Sanjabi, and Lin Xiao. Federated learning with partial model personalization. In International Conference on Machine Learning, pages 17716– 17758. PMLR, 2022

    2022

  55. [63]

    Federated learning with personalization layers

    Manoj Ghuhan Arivazhagan, Vinay Aggarwal, Aaditya Kumar Singh, and Sunav Choudhary. Federated learning with personalization layers. arXiv preprint arXiv:1912.00818, 2019

    1912 arXiv

  56. [64]

    Personalized federated learning with moreau envelopes

    Canh T Dinh, Nguyen Tran, and Josh Nguyen. Personalized federated learning with moreau envelopes. Advances in Neural Information Processing Systems, 33:21394–21405, 2020

    2020

  57. [65]

    arXiv preprint arXiv:2305.15706, 2023

    Jiahao Tan, Yipeng Zhou, Gang Liu, Jessie Hui Wang, and Shui Yu.pFedSim: Similarity-aware model aggregation towards personalized federated learning. arXiv preprint arXiv:2305.15706, 2023

    2023 arXiv

  58. [66]

    End-to-end evaluation of federated learning and split learning for internet of things

    Yansong Gao, Minki Kim, Sharif Abuadbba, Yeonjae Kim, Chandra Thapa, Kyuyeon Kim, Seyit A Camtepe, Hyoungshick Kim, and Surya Nepal. End-to-end evaluation of federated learning and split learning for internet of things. arXiv preprint arXiv:2003.13376, 2020

    2003 arXiv

  59. [67]

    Revisiting personalized federated learning: Robustness against backdoor attacks

    Zeyu Qin, Liuyi Yao, Daoyuan Chen, Yaliang Li, Bolin Ding, and Minhao Cheng. Revisiting personalized federated learning: Robustness against backdoor attacks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD ’23, page 4743–4755, New Y...

    2023

  60. [68]

    One-pixel signature: Characterizing cnn models for backdoor detection

    Shanjiaoyang Huang, Weiqi Peng, Zhiwei Jia, and Zhuowen Tu. One-pixel signature: Characterizing cnn models for backdoor detection. In European Conference on Computer Vision, pages 326–341. Springer, 2020

    2020

  61. [69]

    Xmam: X-raying models with a matrix to reveal backdoor attacks for federated learning

    Jianyi Zhang, Fangjiao Zhang, Qichao Jin, Zhiqiang Wang, Xiaodong Lin, and Xiali Hei. Xmam: X-raying models with a matrix to reveal backdoor attacks for federated learning. Digital Communications and Networks, 10(4):1154–1167, 2024

    2024

  62. [70]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998

    1998

  63. [71]

    Handwritten digit recognition with a back-propagation network.Advances in neural information processing systems, 2, 1989

    Yann LeCun, Bernhard Boser, John Denker, Donnie Henderson, Richard Howard, Wayne Hubbard, and Lawrence Jackel. Handwritten digit recognition with a back-propagation network.Advances in neural information processing systems, 2, 1989

    1989

  64. [72]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  65. [73]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE conference on computer vision and pattern recognition, 2016

    2016

  66. [74]

    Mobilenets: Efficient convolutional neural networks for mobile vision applications

    Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861, 2017

    2017 arXiv

  67. [75]

    Byzantine-robust distributed learning: Towards optimal statistical rates

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In ICML, pages 5650–5659. PMLR, 2018. 20

    2018

  68. [2020]

    OpenReview.net, 2020

    2020

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.