Pith. sign in

REVIEW 4 major objections 5 minor 43 references

Poisoning Behavioral-based Worker Selection in Mobile Crowdsensing using Generative Adversarial Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a malicious insider can poison mobile crowdsensing worker-selection models with GAN-generated training data, raising false cancellation predictions and cutting victim pay by up to 47% while evading outlier detection.

desk verdict A competent application of a known GAN poisoning method to a new target (MCS worker selection) with a clear threat model, but the evaluation overclaims stealth due to a likely autoencoder setup and an alpha-oracle issue. read the letter →

arxiv 2506.05403 v1 pith:5HOMBJES submitted 2025-06-04 cs.CR

Ruba Nasser , Ahmed Alagha , Shakti Singh , Rabeb Mizouni , Hadi Otrok , Jamal Bentahar This is my paper
classification cs.CR
keywords MobilecrowdsensingPoisoningattackGenerativeadversarialnetworksWorkerselectionBehavioralmodelInsiderthreatOutlierdetectionPaymentreduction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a malicious insider in a mobile crowdsensing platform can quietly retrain the platform's per-worker behavior models so that workers who normally accept tasks look likely to cancel them. The proposed attack uses a Poisoning GAN (PGAN) to generate synthetic training points that are substituted for a victim worker's canceled-task records, pushing the behavior model to misclassify accepted tasks as canceled. Evaluated on a real ride-hailing dataset with 86 workers, the attack raises the false-positive rate while keeping the false-negative rate nearly unchanged, reduces victim workers' total payment by up to 47% at 80% poisoning, and keeps the group's quality of service stable. If the claim holds, AI-based worker selection is open to targeted revenue manipulation that pointwise outlier detection and group-QoS monitoring would not flag.

What carries the argument

The load-bearing mechanism is the Poisoning GAN (PGAN), a three-network architecture with a generator $G_i$, a discriminator $D_i$, and a classifier $C_i$ trained separately for each victim worker. The generator is trained to minimize the weighted sum of the discriminator's objective and the classifier's loss, so the points it produces both look like the target class (to get past the autoencoder) and exploit the behavior model's decision boundary (to raise false cancellations). The weight $\alpha$ controls the tradeoff between stealth and attack strength: at $\alpha=1$ the PGAN behaves like a conditional GAN and generates points close to the target class, while at $\alpha=0.1$ the paper reports the highest false-positive rate with enough similarity to the target class to evade detection. The poisoning is injected by replacing a fraction of the target-class data rather than appending new points.

What would settle it

Re-run the attack without test-set access: fix $\alpha$ from a validation split or a proxy statistic rather than by maximizing FPR on each victim's test set, then measure FPR and payments at 80% poisoning. If the false-positive rate no longer reaches the reported levels, or if the autoencoder detects the generated points when $\alpha$ is chosen without the oracle, the claimed stealth and payment reduction would not hold.

Watch

Extended reading notes

Core claim

The authors' central claim is that an insider adversary who can overwrite part of a victim worker's historical data can degrade that worker's behavioral model in a targeted way: the model starts predicting cancellation for tasks the worker would actually accept. The poisoning is done with a PGAN trained per victim, where a generator competes against a discriminator and a behavior classifier; the generated points replace a portion of the target class (canceled tasks) in the training set. The authors report that the attack increases the false-positive rate from 7% to 33% at 80% poisoning, leaves the false-negative rate nearly unchanged, produces fewer detections by an autoencoder-based outlier detector than label-flipping or feature-manipulation benchmarks, and cuts the average payment of victim workers by up to 47% while group QoS stays stable. They position this as the first adversarial attack aimed specifically at behavioral-based worker selection in mobile crowdsensing.

Load-bearing premise

The reported attack strength assumes the insider can tune the tradeoff parameter $\alpha$ for each victim by measuring the false-positive rate on that victim's held-out test set, which gives the attacker knowledge of test labels and test-time data that a real insider would not usually have; if that oracle is unavailable, the attack's effectiveness could be substantially lower.

Editorial extensions

If this is right

  • MCS platforms that train a separate behavior model per worker become vulnerable to targeted revenue manipulation by any insider who can modify training data, not just to generic model degradation.
  • Because the attack raises false cancellation predictions without lowering group QoS, monitoring group-level service quality is not sufficient to detect this poisoning.
  • GAN-generated poisoning points are harder for autoencoder-based outlier detectors to catch than label flipping and feature manipulation at comparable poisoning levels, so standard pointwise anomaly screening gives limited protection.
  • The gradual decline in victim payments makes the attack harder for administrators or workers to attribute to malice, compounding the trust damage to the platform.
  • Defenses such as ensemble learning, adversarial training, and privacy-preserving training would be needed, each with computational or accuracy tradeoffs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the paper tunes $\alpha$ per victim using test-set FPR, the 47% payment reduction is best read as an upper bound; a realistic insider who must choose $\alpha$ without oracle access is not tested, and the effectiveness could be materially lower.
  • The same poisoning recipe should transfer to other per-user behavioral recruitment systems, such as delivery work, freelancing, or shift scheduling, wherever a central platform trains individual acceptance or cancellation models and an insider can replace historical records.
  • A stronger defense than pointwise outlier detection would be to check the entire poisoned training set for distributional shift between the original and replaced target-class data; the paper leaves that as an open extension.
  • Because the attack replaces existing target-class records rather than adding new ones, an auditor who tracks data provenance or class-count consistency could catch it, a scenario the paper does not model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a poisoning attack against behavioral-based worker selection in mobile crowdsensing. An insider adversary trains a Poisoning GAN (PGAN), borrowed from Muñoz-González et al. [10], on each victim worker's historical dataset to generate synthetic points. The generated points replace part of the target class ('canceled tasks') in the worker's training data, with the goal of increasing the False Positive Rate of the worker's behavioral model (predicting cancellation for accepted tasks) while preserving the False Negative Rate and evading an autoencoder-based outlier detector. The attack is evaluated on the Ride Austin dataset for 86 workers, with comparisons to label-flipping and feature-manipulation baselines. The authors report higher FPR than feature manipulation, lower detectability than both baselines, stable group QoS, and up to a 47% reduction in victim payments at 80% poisoning.

Significance. If substantiated, the paper addresses a genuinely under-explored attack surface: behavioral-based worker selection in MCS, which is used to decide which workers receive tasks and payment. The threat model of a malicious insider with access to training data is realistic, and the evaluation on 86 real workers is a strength. The paper also provides algorithmic detail (Algorithm 1, Equations 7-12) that makes the PGAN mechanism reproducible in principle. However, the current evidence is weakened by three load-bearing problems: alpha is tuned on the test set rather than a validation split; the outlier-detector training data are ambiguous with respect to whether the autoencoder sees clean or poisoned data; and the payment formula in Equation (23) appears to reward lower-QoS workers, which would bias the payment-reduction results. These issues affect the paper's two central claims, namely attack effectiveness and stealthiness, so the results as reported are not yet convincing.

major comments (4)
  1. [Section 6.4, Figures 3-4] The optimal value of alpha is selected by evaluating the FPR on each worker's test set and taking the alpha that maximizes that test-set FPR. The same test sets are then used to report all subsequent attack metrics in Sections 6.5-6.7, including the 33% FPR at 80% poisoning and the 47% payment reduction. This gives the attacker oracle access to test labels and to the test-time feature distribution, which is not part of the threat model in Section 4.1. The reported FPR at alpha=0.1 is therefore a fitted quantity, not a predictive result. Please tune alpha on a validation split or on a disjoint historical time window, and report attack performance for non-oracle choices of alpha as well.
  2. [Sections 4.4 and 6.6, Figures 10a-10b] It is unclear whether the autoencoder-based outlier detector is trained on clean target-class data before injection or on the target-class data after the insider has replaced a portion of it with PGAN-generated points. Section 4.4 describes the injection before the detector is trained, and Section 6.6 only states that the same architecture and number of epochs were used for all attacks. If the autoencoder is trained on the poisoned target-class set, then PGAN points are part of the training distribution, and near-zero detection rates in Figures 10a and 10b would be expected by construction; they would not demonstrate evasion of a detector trained on legitimate data. This directly affects the paper's stealthiness claim. Please state explicitly whether the detector is trained on clean or poisoned data, and if it is trained on poisoned data, retrain it on clean data before computing detection rates.
  3. [Section 5.2, Equation (23)] The payment formula Payment = mu + ((QoS_g - QoS_i)/QoS_g) * BP pays a worker more as that worker's individual QoS_i decreases, because the numerator grows when QoS_i shrinks. This is the opposite of what a QoS-based payment scheme should do, and it is the quantity driving the payment-reduction results in Figure 13. Please correct the formula (likely QoS_i/QoS_g or a ratio involving the group minimum) and rerun the payment evaluation in Section 6.7, or justify the formula explicitly if this counter-intuitive behavior is intentional.
  4. [Sections 6.4-6.7] All reported results are averages over 86 workers without error bars, confidence intervals, or significance tests. Differences between the proposed attack and the feature-manipulation baseline in Figures 10-13 may be within the natural variability across workers, and the payment comparison in Figure 13 is presented without any measure of spread. Please add standard errors or confidence intervals, and where appropriate a paired significance test across workers, for the averaged FPR, detection rate, payment, and QoS figures.
minor comments (5)
  1. [Sections 3 and 4.2] The text says 'replacing missing values using Principal Component Analysis'; PCA is not a missing-value replacement method. Please rephrase as 'imputing missing values using PCA' or describe the actual imputation procedure.
  2. [Equations (11) and (12)] The notation in Equations (11) and (12) is missing closing parentheses: L_Ci should be lambda * L_CE(C_i(xtilde), y_t) + (1-lambda) * L_CE(C_i(x), y), and L_Gi should be alpha * L_CE(D_i(xtilde), y_r) + (1-alpha) * L_CE(C_i(xtilde), 1 - y_t). The current form 'C_i(xtilde, y_t)' is ambiguous and should be fixed.
  3. [Figure 5 caption] The caption says 'the points generated with alpha = 1, as shown in Figure 5b', but the alpha = 1 plot is Figure 5c. Please correct the cross-reference.
  4. [Section 6.4] The alpha sweep does not state the poisoning percentage used to generate Figures 3 and 4. Without this information, the FPR values in Figure 3 cannot be compared with the poisoning-percentage results in Figure 7. Please report the fixed poisoning percentage used in the sweep.
  5. [Section 6.7] The evaluation uses '20% of the total workers randomly selected as victims' and averages over 100 tasks, but no random seed or number of repetitions is reported. Please provide these details to make the payment and QoS results reproducible.

Circularity Check

2 steps flagged · score 6.0 of 10

The stealth claim reduces to the detector being trained on already-injected PGAN points, and the headline FPR/payment impact is amplified by selecting alpha on the same test sets later used for evaluation.

  1. fitted input called prediction [Section 6.4, used in Sections 6.5-6.7]
    "To determine the optimal value of alpha, a unique PGAN model was trained for each of the 86 workers in the dataset, across a range of α ∈ [0, 1] with increments of 0.1. These models were used to generate poisoning points, which were then injected into each worker’s training dataset by replacing features of the target class with the generated data. The resulting poisoned datasets were used to train workers’ behavioral models, and the effectiveness of the attack was evaluated on each worker’s test dataset."

    Alpha is selected by maximizing FPR on the workers’ test sets (peak 0.12 at alpha=0.1), and the same alpha is then fixed for all subsequent experiments, including the FPR-vs-poisoning curves and the payment reductions. The reported FPR is thus the maximum over the tested grid, achieved by an oracle that chooses the hyperparameter on the same data used to measure success. The magnitude of the headline attack effectiveness is therefore partly a selection artifact rather than an independent prediction.

  2. self definitional [Section 4.4, detection results in Section 6.6]
    "After training a PGAN model for each victim worker, the insider utilizes the trained generator Gi to produce poisoning data Pi. This generated data is then injected into the training dataset Di by replacing the original data points belonging to class yt with Pi. Before training the workers’ behavioral models, the platform attempts to detect and remove outliers from each class in Di to prevent biased model decisions."

    Because Pi is injected before the autoencoder is trained, the 'target class data' used to fit the detector already contains the PGAN-generated attack points. The detector therefore learns to reconstruct those exact points with low error, so the near-zero detection rates in Figures 10a/10b are expected by construction. The paper never states that the autoencoder was trained on clean, pre-injection data; Section 6.6 only says the architecture and epochs were consistent across attacks. The stealthiness claim, which is the paper’s main differentiator over label flipping and feature manipulation, thus reduces to the detector being trained on the poisoned distribution it is supposed to detect.

full rationale

The PGAN generation objective itself is borrowed from prior work [10] and is not circular, and the FPR/FNR, payment, and QoS numbers are produced by simulation rather than by an algebraic identity. However, two load-bearing evaluation steps are circular. First, the autoencoder-based outlier detector is trained on the target-class data after the PGAN points have replaced the original target class, so low detection of PGAN points is built into the setup rather than demonstrated against a detector trained on legitimate data. Second, alpha is selected by maximizing FPR on the same test sets that are later used to report attack effectiveness, inflating the headline FPR and the consequent payment reduction. No self-citation chain is load-bearing, so the circularity is partial rather than total, but it affects the paper's central stealth and effectiveness claims.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests primarily on the attacker's assumed access and on hand-tuned hyperparameters (alpha, lambda, detector thresholds). No new physical or conceptual entities are introduced. The most fragile items are alpha being tuned on test sets and the unstated autoencoder training setup.

free parameters (4)
  • alpha (attack trade-off weight) = 0.1
    Selected by maximizing FPR on the workers' test sets, giving the attacker oracle access to test labels. This is the key hyperparameter controlling attack strength vs stealth.
  • lambda (classifier loss weight) = 0.8
    Hand-set with no sensitivity analysis; balances classifier loss on generated vs original points.
  • outlier detector thresholds = 5% and 10%
    Chosen based on values used in the literature [36]; affects the reported number of detected poisoning points.
  • payment simulation parameters (base payment BP, fee mu, group size) = not reported
    Used to compute Figure 13 and the 47% payment reduction claim, but their numerical values are not given.
assumptions (5)
  • domain assumption The insider adversary has full access to each victim's training dataset Di and can replace a portion of the target class data before the platform trains behavioral models.
    Threat model in Section 4.1; this defines the attacker's capability and is load-bearing for the entire attack.
  • domain assumption The attacker can train a PGAN per victim before the platform trains the behavioral model, and the GAN training converges to a useful generator after 2000 epochs.
    Section 4.3 and 6.1; the attack depends on this timing and convergence.
  • domain assumption The autoencoder-based outlier detector is trained on the target class data in a way that leaves the generated points largely undetected.
    Section 4.4; the paper does not specify whether the autoencoder is trained on clean or poisoned data, which strongly affects the reported detectability.
  • domain assumption The QoS-based selection formulas and the behavioral model training from [25] are a valid representation of real MCS worker selection.
    Used throughout Sections 5 and 6; the attack's payment impact is measured through this selection model.
  • standard math GAN minimax objectives and binary cross-entropy losses are well-defined and the standard machinery applies.
    Used in Eqs. (7)-(12) and is standard background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Poisoning Behavioral-based Worker Selection in Mobile Crowdsensing using Generative Adversarial Networks." pith.science (2026). https://pith.science/paper/5HOMBJES

@misc{pith2026250605403,
  author       = {Pith},
  title        = {Pith review of: Poisoning Behavioral-based Worker Selection in Mobile Crowdsensing using Generative Adversarial Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5HOMBJES}},
  note         = {Machine review of arXiv:2506.05403}
}
read the original abstract

With the widespread adoption of Artificial intelligence (AI), AI-based tools and components are becoming omnipresent in today's solutions. However, these components and tools are posing a significant threat when it comes to adversarial attacks. Mobile Crowdsensing (MCS) is a sensing paradigm that leverages the collective participation of workers and their smart devices to collect data. One of the key challenges faced at the selection stage is ensuring task completion due to workers' varying behavior. AI has been utilized to tackle this challenge by building unique models for each worker to predict their behavior. However, the integration of AI into the system introduces vulnerabilities that can be exploited by malicious insiders to reduce the revenue obtained by victim workers. This work proposes an adversarial attack targeting behavioral-based selection models in MCS. The proposed attack leverages Generative Adversarial Networks (GANs) to generate poisoning points that can mislead the models during the training stage without being detected. This way, the potential damage introduced by GANs on worker selection in MCS can be anticipated. Simulation results using a real-life dataset show the effectiveness of the proposed attack in compromising the victim workers' model and evading detection by an outlier detector, compared to a benchmark. In addition, the impact of the attack on reducing the payment obtained by victim workers is evaluated.

Figures

Figures reproduced from arXiv: 2506.05403 by the authors.

Figure 1
Figure 1. Overview of the proposed attack in the MCS platform, including 4 different modules: [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. PGAN model representation Before Mi is trained in the MCS platform, an insider uses Di to train a PGAN model and leverages it to generate a set of poisoning points Pi . The main goal of the attack is to degrade the performance of Mi when trained using the poisoned dataset by increasing the error rate of misclassifying points from class 0 into the target class yt = 1. The attacker injects the points Pi into the train… view at source ↗
Figure 3
Figure 3. Average FPR of the workers’ poisoned models for varying values of alpha [PITH_FULL_IMAGE:figures/full_fig_p028_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Average F1 scores of the workers’ poisoned models for varying values of alpha [PITH_FULL_IMAGE:figures/full_fig_p028_4.png]
Figure 5
Figure 5. Figure 5: T-sne plots showing the distribution of poisoning points for different [PITH_FULL_IMAGE:figures/full_fig_p030_5.png]
Figure 6
Figure 6. Figure 6: Fraction of poisoning points detected averaged for all workers’ models [PITH_FULL_IMAGE:figures/full_fig_p031_6.png]
Figure 7
Figure 7. Figure 7: Models’ average error rates for varying poisoning percentages [PITH_FULL_IMAGE:figures/full_fig_p032_7.png]
Figure 8
Figure 8. Figure 8: Models performance evaluation averaged for all workers for varying poisoning per [PITH_FULL_IMAGE:figures/full_fig_p033_8.png]
Figure 9
Figure 9. Figure 9: Task cancellation probabilities averaged for all workers [PITH_FULL_IMAGE:figures/full_fig_p034_9.png]
Figure 10
Figure 10. Figure 10: Average number of poisoning points detected by an autoencoder [PITH_FULL_IMAGE:figures/full_fig_p034_10.png]
Figure 11
Figure 11. Figure 11: FPR of the proposed method and the benchmarks for varying poisoning percentages [PITH_FULL_IMAGE:figures/full_fig_p035_11.png]
Figure 12
Figure 12. Figure 12: FNR of the proposed method and the benchmarks for varying poisoning percentages [PITH_FULL_IMAGE:figures/full_fig_p036_12.png]
Figure 13
Figure 13. Figure 13: Payment received by the victim workers for 100 tasks, averaged across all workers [PITH_FULL_IMAGE:figures/full_fig_p037_13.png]
Figure 14
Figure 14. Figure 14: QoSg averaged for all tasks on the MCS system, beyond just the reduction in the revenue of the victim workers. It also poses a serious threat to the platform as it can, over time, lead to losing trust in the system’s reliability and trustworthiness. In fact, real-worl…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

43 extracted references · 38 canonical work pages

  1. [10]

    Poisoning Attacks with Generative Adversarial Nets

    L. Mu˜ noz-Gonz´ alez, B. Pfitzner, M. Russo, J. Carnerero-Cano, E. C. Lupu, Poisoning attacks with generative adversarial nets, arXiv preprint arXiv:1906.07773. 40

    work page Pith review arXiv 1906

  2. [1]

    Uber, DeepETA: How Uber predicts arrival times using deep learning, available: https://www.uber.com/en-AE/blog/ deepeta-how-uber-predicts-arrival-times/?uclick_id= 6c27d554-32d3-48de-a931-7bc781617ce0 , (accessed: 2025-04-24). 39

    work page 2025

  3. [2]

    Waze, Using data to prevent crashes, available: https://www.waze.com/ wazeforcities/casestudies/using-data-to-prevent-crashes/ , (ac- cessed: 2025-04-24)

    work page 2025

  4. [3]

    Nasser, R

    R. Nasser, R. Mizouni, S. Singh, H. Otrok, Systematic survey on artificial intelligence based mobile crowd sensing and sourcing solutions: Applica- tions and security challenges, Ad Hoc Networks 164 (2024) 103634

    work page 2024

  5. [4]

    Hussein, M

    A. Hussein, M. Raed, A. Al-Shaikhi, M. Mohandes, B. Liu, Crowd anomaly estimation and detection: A review, Franklin Open (2024) 100169

    work page 2024

  6. [5]

    F. A. Yerlikaya, S ¸. Bahtiyar, Data poisoning attacks against machine learn- ing algorithms, Expert Systems with Applications 208 (2022) 118101

    work page 2022

  7. [6]

    Hoang, Y

    V.-T. Hoang, Y. A. Ergu, V.-L. Nguyen, R.-G. Chang, Security risks and countermeasures of adversarial attacks on ai-driven applications in 6g net- works: A survey, Journal of Network and Computer Applications (2024) 104031

    work page 2024

  8. [7]

    W. Li, W. Meng, L.-F. Kwok, H. Horace, Enhancing collaborative intru- sion detection networks against insider attacks using supervised intrusion sensitivity-based trust management model, Journal of Network and Com- puter Applications 77 (2017) 135–145

    work page 2017

Show all 43 references
  1. [8]

    IBM, Shedding Light on AI Bias with Real-World Ex- amples, available: https://www.ibm.com/think/topics/ shedding-light-on-ai-bias-with-real-world-examples , (accessed: 2025-04-25)

    2025

  2. [9]

    Zeng, Y.-W

    G.-Q. Zeng, Y.-W. Yang, K.-D. Lu, G.-G. Geng, J. Weng, Evolutionary adversarial autoencoder for unsupervised anomaly detection of industrial internet of things, IEEE Transactions on Reliability

  3. [11]

    Z. Chen, B. Kantarci, Adversarial machine learning-driven fake task an- ticipation in mobile crowdsensing systems, in: 2021 IEEE International Conference on Service-Oriented System Engineering (SOSE), IEEE, 2021, pp. 57–63

    2021

  4. [12]

    Prud’Homme, B

    A. Prud’Homme, B. Kantarci, Poisoning attack anticipation in mobile crowdsensing: A competitive learning-based study, in: Proceedings of the 3rd ACM Workshop on Wireless Security and Machine Learning, 2021, pp. 73–78

    2021

  5. [13]

    Goodfellow, J

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio, Generative adversarial nets, Advances in neural information processing systems 27

  6. [14]

    Zhang, S

    C. Zhang, S. Yu, Z. Tian, J. J. Yu, Generative adversarial networks: A survey on attack and defense perspective, ACM Computing Surveys 56 (4) (2023) 1–35

    2023

  7. [15]

    Singkorapoom, S

    P. Singkorapoom, S. Phoomvuthisarn, Pre-trained model robustness against gan-based poisoning attack in medical imaging analysis, in: IFIP International Conference on Artificial Intelligence Applications and Inno- vations, Springer, 2023, pp. 302–313

    2023

  8. [16]

    Psychogyios, T.-H

    K. Psychogyios, T.-H. Velivassaki, S. Bourou, A. Voulkidis, D. Skias, T. Za- hariadis, Gan-driven data poisoning attacks and their mitigation in feder- ated learning systems, Electronics 12 (8) (2023) 1805

    2023

  9. [17]

    Abdullah, V

    M. Abdullah, V. Bapu, K. Akash, A. M. Khan, M. Bhargavi, Label flipping attacks on federated learning: Gan-based poisoning and countermeasures, in: 2024 International Conference on Data Science and Network Security (ICDSNS), IEEE, 2024, pp. 1–6

    2024

  10. [18]

    Zhang, J

    J. Zhang, J. Chen, D. Wu, B. Chen, S. Yu, Poisoning attack in federated learning using generative adversarial nets, in: 2019 18th IEEE interna- tional conference on trust, security and privacy in computing and com- 41 munications/13th IEEE international conference on big data ...

    2019

  11. [19]

    Baluja, I

    S. Baluja, I. Fischer, Adversarial transformation networks: Learning to generate adversarial examples, arXiv preprint arXiv:1703.09387

    arXiv

  12. [20]

    Y. Song, R. Shu, N. Kushman, S. Ermon, Constructing unrestricted ad- versarial examples with generative models, Advances in neural information processing systems 31

  13. [21]

    X. Wang, K. He, J. E. Hopcroft, At-gan: A generative attack model for adversarial transferring on generative adversarial nets, arXiv preprint arXiv:1904.07793 3 (4) (2019) 3

    2019 arXiv

  14. [22]

    Z. Zhao, D. Dua, S. Singh, Generating natural adversarial examples, arXiv preprint arXiv:1710.11342

    arXiv

  15. [23]

    Eykholt, I

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, D. Song, Robust physical-world attacks on deep learning visual classification, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625–1634

    2018

  16. [24]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adver- sarial examples, arXiv preprint arXiv:1412.6572

    arXiv

  17. [25]

    Abououf, S

    M. Abououf, S. Singh, H. Otrok, R. Mizouni, E. Damiani, Machine learn- ing in mobile crowd sourcing: A behavior-based recruitment model, ACM Transactions on Internet Technology (TOIT) 22 (1) (2021) 1–28

    2021

  18. [26]

    M. E. G. Gendy, A. Al-Kabbany, E. F. Badran, Green crowdsensing with comprehensive reputation awareness and predictive device-application matching using a new real-life dataset, IEEE Access 8 (2020) 225757– 225776

    2020

  19. [27]

    Nasser, R

    R. Nasser, R. Mizouni, H. Otrok, S. Singh, M. Abououf, M. Kadadha, A biometrics-based behavioral trust framework for continuous mobile crowd sensing recruitment, IEEE Access 10 (2022) 68582–68597. 42

    2022

  20. [28]

    X. Zhu, Y. Luo, A. Liu, W. Tang, M. Z. A. Bhuiyan, A deep learning- based mobile crowdsensing scheme by predicting vehicle mobility, IEEE Transactions on Intelligent Transportation Systems 22 (7) (2020) 4648– 4659

    2020

  21. [29]

    Q. T. Ngo, S. Yoon, Context-aware worker recruitment for mobile crowd sensing based on mobility prediction, IEEE Access 11 (2023) 92353–92364. doi:10.1109/ACCESS.2023.3308202

    2023

  22. [30]

    Nasser, Z

    R. Nasser, Z. Aboulhosn, R. Mizouni, S. Singh, H. Otrok, A machine learning-based framework for user recruitment in continuous mobile crowd- sensing, Ad Hoc Networks 145 (2023) 103175

    2023

  23. [31]

    Wei, G.-Q

    H.-N. Wei, G.-Q. Zeng, K.-D. Lu, G.-G. Geng, J. Weng, Moar-cnn: Multi- objective adversarially robust convolutional neural network for sar image classification, IEEE Transactions on Emerging Topics in Computational Intelligence

  24. [32]

    Anthi, L

    E. Anthi, L. Williams, A. Javed, P. Burnap, Hardening machine learning denial of service (dos) defences against adversarial attacks in iot smart home networks, computers & security 108 (2021) 102352

    2021

  25. [33]

    Abusnaina, A

    A. Abusnaina, A. Khormali, H. Alasmary, J. Park, A. Anwar, A. Mohaisen, Adversarial learning attacks on graph-based iot malware detection systems, in: 2019 IEEE 39th international conference on distributed computing sys- tems (ICDCS), IEEE, 2019, pp. 1296–1305

    2019

  26. [34]

    Rahman, M

    A. Rahman, M. S. Hossain, N. A. Alrajeh, F. Alsolami, Adversarial ex- amples—security threats to covid-19 deep learning systems in medical iot devices, IEEE Internet of Things Journal 8 (12) (2020) 9603–9610

    2020

  27. [35]

    Baracaldo, B

    N. Baracaldo, B. Chen, H. Ludwig, A. Safavi, R. Zhang, Detecting poi- soning attacks on machine learning in iot environments, in: 2018 IEEE international congress on internet of things (ICIOT), IEEE, 2018, pp. 57– 64. 43

    2018

  28. [36]

    Borghesi, A

    A. Borghesi, A. Bartolini, M. Lombardi, M. Milano, L. Benini, A semisu- pervised autoencoder-based approach for anomaly detection in high per- formance computing systems, Engineering Applications of Artificial Intel- ligence 85 (2019) 634–644

    2019

  29. [37]

    H. Li, J. Tong, S. Weng, X. Dong, T. He, Detecting a business anomaly based on qos benchmarks of resource-service chains for collaborative tasks in the iot, IEEE Access 7 (2019) 165509–165519

    2019

  30. [38]

    Sakurada, T

    M. Sakurada, T. Yairi, Anomaly detection using autoencoders with non- linear dimensionality reduction, in: Proceedings of the 2nd Workshop on Machine Learning for Sensory Data Analysis, ACM, 2014, pp. 4–11. doi:10.1145/2689746.2689747

    2014

  31. [39]

    Zhang, Z

    C. Zhang, Z. Tang, K. Li, Clean-label poisoning attack with perturbation causing dominant features, Information Sciences 644 (2023) 118899

    2023

  32. [40]

    Aloraini, A

    F. Aloraini, A. Javed, O. Rana, P. Burnap, Adversarial machine learning in iot from an insider point of view, Journal of Information Security and Applications 70 (2022) 103341

    2022

  33. [41]

    B. V. Hanrahan, N. F. Ma, C. W. Yuan, The roots of bias on uber, arXiv preprint arXiv:1803.08579

    arXiv

  34. [42]

    CBS News, Algorithmic wage discrimination: Ai’s role in wage disparities, available: https://www.cbsnews.com/news/ algorithmic-wage-discrimination-artificial-intelligence , (ac- cessed: 2024-11-11)

    2024

  35. [43]

    M. Yang, X. Wang, H. Qian, Y. Zhu, H. Zhu, M. Guizani, V. Chang, An improved federated learning algorithm for privacy preserving in cybertwin- driven 6g system, IEEE Transactions on Industrial Informatics 18 (10) (2022) 6733–6742. 44

    2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.