Graph Representation-based Model Poisoning on Federated Large Language Models

Hanlin Cai; Haofan Dong; Houtianfu Wang; Kai Li; Ozgur B. Akan

REVIEW 6 major objections 5 minor 15 references

Graph Representation-based Model Poisoning on Federated Large Language Models

T0 review · 6 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Graph representation-based model poisoning attacks federated LLMs by learning the relational structure of benign updates, then synthesizing malicious updates that stay above cosine-similarity defense thresholds while pushing targeted…

desk verdict The attack's central premise—that a client attacker can see other clients' local updates—is never justified, and the thin evaluation can't support the broad evasion claims. read the letter →

arxiv 2507.01694 v2 pith:7RI4HZGK submitted 2025-07-02 cs.CR cs.SYeess.SY

Hanlin Cai , Haofan Dong , Houtianfu Wang , Kai Li , Ozgur B. Akan This is my paper

classification cs.CRcs.SYeess.SY

keywords federatedlargelanguagemodelsmodelpoisoninggraphrepresentationlearningvariationalautoencoderByzantine-robustaggregationcosinesimilaritydefenseadversarialupdatesFedLLMsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard defenses protecting federated large language models, which flag model updates by Euclidean distance or cosine similarity, fail against an adversary that first learns the relational structure of benign updates. It presents GRMP, a poisoning attack that builds a graph whose nodes are local updates and whose edges encode pairwise similarity, trains a variational graph autoencoder on that graph, and uses the learned latent structure to generate malicious updates that look statistically indistinguishable from legitimate ones. In a six-client DistilBERT federation on the AG News dataset, the attack keeps both malicious clients above the dynamic detection threshold, holds global learning accuracy near 83%, and drives the misclassification rate for targeted business articles to 60%. The conclusion a sympathetic reader takes from the paper is that outlier-statistics defenses are not sufficient on their own for billion-parameter federated models.

What carries the argument

The carrying machinery is a variational graph autoencoder (VGAE) combined with a Lagrange dual optimization and a graph-signal-processing module. The attacker turns collected benign local updates into a graph: each update is a node, and edges indicate cosine similarity above a threshold; a graph convolutional encoder maps each node into a latent distribution, and a decoder reconstructs the adjacency matrix with inner products and a sigmoid. The VGAE is trained adversarially by maximizing reconstruction loss, the Lagrange dual formulation selects a latent vector that maximizes poisoning impact under stealth constraints, and the graph-signal-processing module decomposes benign updates through the graph Laplacian and recombines the adversarial graph structure with benign feature signals to produce the final malicious weight update.

What would settle it

Run the same six-client, twenty-round AG News experiment with a server that, in addition to the dynamic cosine threshold, builds the pairwise similarity graph of all updates and checks whether the two attackers' nodes form a tight clique only loosely connected to the benign cluster; if GRMP's updates pass this graph audit too, the complete-bypass claim stands, and if they are flagged, the claim falls.

Watch

Extended reading notes

Core claim

The central claim is that GRMP can circumvent advanced defense systems by exploiting higher-order correlations among benign client gradients. The attack operates in two phases: early rounds contribute near-innocuous updates to build client trust, then a surge raises the attack success rate to 60% on targeted business articles while the global model's learning accuracy stays around 83%. Because the malicious updates are generated from the same graph manifold as the benign updates, their cosine similarity to the aggregate direction remains above the defense threshold across all twenty rounds. The paper takes this as evidence that the DiSim assumption, malicious updates differ markedly from benign statistical patterns, is inadequate for adaptive adversaries targeting large language models.

Load-bearing premise

The attack assumes a malicious client can observe the local updates of honest clients across communication rounds; without that observation, the graph model has nothing to learn from.

Editorial extensions

If this is right

A defense that only checks Euclidean distance or cosine similarity of updates cannot reliably separate GRMP-style malicious updates from benign ones, because the malicious updates are generated to stay on the benign side of the dynamic threshold.
The global model can lose targeted functionality while its overall accuracy remains high: in the reported setting, business-article classification is corrupted even though learning accuracy stays around 83%.
The attack's two-phase timing means a client that contributes innocuously for many rounds can later flip its behavior without triggering a reputation-based or threshold-based filter.
Defenses for FedLLMs will need to inspect the semantic content or the relational structure of updates, not just aggregate statistics, to catch this class of poisoning.
Because the attack exploits the statistical variance inherent in non-IID textual data, the same mechanism should transfer to other FedLLM tasks where natural variation hides malicious structure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same graph-representation recipe is not tied to the VGAE specifically: any generative model that can reproduce the higher-order correlation statistics of benign updates could plausibly be substituted, so the qualitative result is about the information the attacker models, not the particular encoder.
The defense roadmap in the paper points to a concrete testable design: build the same similarity graph at the server, then look for structural anomalies such as a clique of updates that stays loosely connected to the benign cluster; this reverses GRMP's own machinery.
The reported setting is one benchmark, one base model, and one dynamic-threshold defense, so the 60% attack success rate should be read as a proof of feasibility; how the attack degrades under stronger defenses or larger client pools is an open empirical question.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Quick take: the paper's central attack pipeline requires the attacker to observe all clients' local updates, but the stated threat model is a client-only adversary. That gap alone sinks the contribution as it stands.

What's good: the paper is clearly written, the experiment is reproducible in principle (GitHub link), and the roadmap in Section V is sensible. The specific observation that a dynamic cosine-similarity threshold is evadable in a small FedLLM setting is plausible and worth knowing.

Where it's soft: first, the threat model. Section III-A says 'the attacker collects benign local updates from multiple clients' with no mechanism. In standard FedLLMs, clients only get the global model. 'Authorized access' in II-A doesn't explain it. No server collusion, no broadcast assumption, nothing. Without that access, the VGAE has no feature matrix, no adjacency matrix, and the whole GRMP pipeline has no input.

Second, the evaluation. One defense (a dynamic cosine threshold), six clients, twenty rounds, no unpoisoned baseline, no seeds or error bars. The global accuracy of 83% means little without a control. The abstract's claim that GRMP 'circumvents advanced defense systems' is unsupported; only one similarity filter was tested.

Third, novelty. The GRMP architecture is essentially the VGAE poisoning method in the authors' ref [5], so the contribution here is a small demo on DistilBERT/AG News. That's legitimate as a replication or application note, but the paper doesn't frame it that way.

Fourth, circularity. Section III-B says the Lagrange dual 'incorporates stealth constraints directly into the objective,' and the tested defense is the same cosine-similarity statistic. So the evasion is partly built into the objective, which weakens the claim that this is a general result.

Who this is for: readers who want a compact example of a graph-based poisoning attack on a small language model, or who are surveying threat models. The roadmap could be useful for a position paper.

Would I accept for peer review? Not in its current form. I'd want a major revision that fixes the threat model (or explicitly assumes a stronger attacker), adds comparisons with Krum/Trimmed-Median/Median/Bulyan, multiple seeds, a baseline, and a clear statement of what's actually new. A serious editor should probably desk reject this version and invite a resubmission if the authors can address those points.

Serious thinker? The paper is coherent in its writing, but the internal mismatch between threat model and method is load-bearing, so I'd say no.

Referee Report

6 major / 5 minor

Summary. The paper proposes GRMP, a graph-representation-based model poisoning attack against federated large language models. The attacker is said to collect benign local updates, build a similarity graph whose nodes are flattened update vectors, train a variational graph autoencoder, and then use a Lagrange dual optimization and graph signal processing module to synthesize malicious updates that evade DiSim (distance/similarity) defenses. The manuscript also surveys existing DiSim defenses, reports an evaluation on AG News with DistilBERT in which the attack achieves 60% ASR while staying above a dynamic cosine-similarity threshold, and outlines a research roadmap for graph-aware defenses.

Significance. If the results are correct, GRMP would provide a concrete demonstration that cosine-similarity-based defenses can be bypassed by an adversary that learns the relational structure of benign updates, and the reported 60% ASR with threshold evasion is a specific, falsifiable experimental claim. The paper also gives a useful taxonomy of DiSim defenses and makes its code publicly available. However, the threat-model assumptions, the absence of any mathematical formulation for the dual/GSP modules, and the single, underspecified defense evaluation leave the central claim insufficiently supported.

major comments (6)

[III-A / II-A] The attack pipeline depends on the attacker 'collects benign local updates from multiple clients over the communication rounds' (Section III-A, first paragraph), but the threat model in Section II defines the adversary as a legitimate but malicious client. Standard FedLLM clients only receive the global model from the server, not other clients' local updates, and the phrase 'authorized access to learn from benign local updates' (Section II-A) is not a mechanism. If wireless broadcast eavesdropping or a malicious server is assumed, that must be stated explicitly; otherwise the VGAE has no feature or adjacency matrix to train on and the entire GRMP pipeline has no input. Relatedly, with six clients and two attackers, each round has only four benign updates; the paper should clarify whether the graph is built across rounds and report its actual size.
[III-B] The Lagrange dual optimization and GSP module are the core of the attack, but no mathematical formulation is given: there is no objective function, no constraint set, no Lagrangian or dual update, and no spectral decomposition formula. This makes the claimed stealth guarantee ('remains statistically indistinguishable') unverifiable. In particular, the attacker's knowledge of the defense's dynamic cosine threshold is never specified, and the connection between the synthesized update and the targeted business-to-sports misclassification is never formalized. Please provide the full optimization problem and algorithm.
[IV-A / IV-B] The evaluation tests only one unnamed 'dynamic detection threshold' defense; no concrete update rule or reference to a specific FedSecurity defense is given. The abstract's claim that GRMP 'can effectively circumvent advanced defense systems' is therefore not supported by the experiments. Please compare against named DiSim mechanisms (e.g., Krum, Multi-Krum, Trimmed-Mean, cosine threshold variants), report an unpoisoned baseline for learning accuracy and ASR, include multiple seeds with standard deviations, and report detection rates rather than only a threshold plot.
[III-A] The training objective for the VGAE is stated as 'maximizing the reconstruction loss function ... increasing the reconstruction error' (Section III-A). This is the opposite of standard VAE/VGAE training and is inconsistent with the goal of learning the distribution of benign updates; maximizing reconstruction error would make the decoder produce poor reconstructions, not 'structurally plausible' malicious updates. Please correct the sign or define a custom objective and explain how the resulting model improves attack quality.
[IV-A / Abstract] The experiments use DistilBERT on AG News classification with six clients and twenty rounds. This is a small language model task, not 'billion-parameter LLMs' as claimed in the abstract and introduction. Moreover, each graph node is a flattened parameter update vector (DistilBERT has about 66M parameters), but the paper does not explain how the VGAE handles feature vectors of that dimension, nor does it compare with simpler attack baselines (e.g., scaled benign updates, noise, or existing model poisoning attacks). Please either narrow the claims to the tested setting, report dimensionality reduction or parameter subsampling, and add baselines.
[IV-B] The 'two-phase strategy' (initial ASR below 2%, later surge to 60%) is attributed to the attackers, but Section III does not describe any mechanism for scheduling attack intensity across rounds, nor any hyperparameter that changes at the transition. As written, the early rounds appear to be benign updates, in which case the defense is not being tested in those rounds. Please specify the schedule or remove the strategic narrative.

minor comments (5)

[Figure 1] Figure 1(b) contains garbled and overlapping dialogue text, making the normal-versus-poisoned example difficult to follow; please redraw the figure with clearly separated panels.
[III-A] The graph construction similarity threshold, VGAE latent dimension, architecture, and training hyperparameters are not reported; a table of settings would substantially improve reproducibility.
[IV-A] The set of financial keywords used to define targeted business articles, the number of targeted test samples, and the optimizer/learning rate/batch size for federated training are not specified; please provide these details.
[IV-A / IV-B] Figures 4 and 5 appear to show a single trajectory with no error bars or confidence intervals; at minimum, the number of independent runs should be stated.
[References] Reference [5] is a closely related prior work on variational graph representation for model poisoning; the manuscript should explicitly discuss the differences between GRMP and that work to clarify the novelty.

Circularity Check

1 steps flagged · score 6.0 of 10

Defense evasion is built into the attack objective: stealth is defined by the same cosine-similarity statistic the evaluated defense uses, so the reported bypass is enforced by construction.

self definitional [Section III-A/III-B (stealth objective) and Section IV-A (defense definition)]
"The Lagrange dual approach incorporates stealth constraints directly into the objective, allowing the attacker to iteratively refine the VGAE's output toward an optimal adversarial graph structure without violating detection thresholds. ... The corresponding adjacency matrix is generated by computing pairwise similarities, typically using cosine similarity, between all update vectors. ... This defense approach identifies malicious updates by dynamically adjusting the detection threshold to flag those that deviate significantly from the expected cosine similarity patterns [4]."

GRMP's stealth is defined by the same statistic the defense uses for detection. The attacker builds the graph from cosine-similarity edges between benign updates (III-A), and the Lagrange dual 'incorporates stealth constraints directly into the objective' so the crafted update must not violate detection thresholds (III-B). The evaluated defense is exactly a dynamic cosine-similarity threshold (IV-A). Thus staying above the threshold (Fig. 5) is a hard constraint of the optimization, not an emergent experimental finding. The paper then reports 'complete bypass' as evidence that GRMP exploits the fundamental assumption gap in DiSim-defense; because the objective was constrained by the defender's metric, the evasion result is true by construction.

full rationale

The paper’s central evasion claim reduces by construction. Section III-B states that the attack’s objective directly incorporates stealth constraints — i.e., staying within the detection threshold — while Section IV-A defines the tested defense by exactly that cosine-similarity threshold. The graph construction in III-A also uses cosine similarity to define the benign-update manifold. Consequently, the reported result that malicious updates remain above the defense threshold is a restatement of the optimization constraint, not an independent finding. This warrants a score of 6: one core 'prediction' (defense evasion) is forced by the objective, while the attack-success-rate portion remains an empirical, non-circular result. I do not score the self-citation to the authors’ prior VGAE work [5] as circular, since no load-bearing theorem is imported from it and the present experiments are code-reproduced. The threat-model gap about how a malicious client obtains other clients’ benign local updates is a real assumption risk, but it is a correctness/threat-model concern, not a derivation-circularity concern.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The ledger shows that the central claim depends on an unstated attacker access assumption, on an unproven equivalence between pairwise similarity graphs and higher-order correlations, and on a defense choice that is never tested against stronger robust aggregations. The paper also leaves all attack hyperparameters unspecified, so the reported numbers cannot be separated from implementation choices.

free parameters (3)

graph construction similarity threshold
Section III-A says an edge is formed if pairwise cosine similarity exceeds a predefined threshold, but the threshold value is never reported. The resulting graph topology determines what correlations the VGAE learns.
VGAE latent dimension and architecture
The encoder/decoder structure is described only at a high level; the latent dimension is a free design choice that directly controls the attack's expressiveness and is not stated.
defense dynamic threshold parameters
Section IV-A says the defense uses a dynamic detection threshold based on statistical properties of updates, but the exact rule is not specified, so the reported evasion could depend on a weak or poorly chosen threshold.

assumptions (5)

domain assumption The attacker can collect benign local updates from multiple clients during communication rounds.
Section III-A, first paragraph. In standard FedLLMs, clients only receive the global model, not each other's raw updates; the paper does not explain how a malicious client obtains these benign updates, yet they are the entire training input to the VGAE.
ad hoc to paper A graph built from pairwise cosine similarities captures the higher-order correlations needed to synthesize evasive updates.
Section III-A. The paper asserts this equivalence without evidence; higher-order correlations would normally require more than pairwise edges.
ad hoc to paper Optimizing a Lagrange dual with stealth constraints yields a malicious update that remains indistinguishable under DiSim defenses.
Section III-B. No equations, convergence arguments, or formal guarantees are given for this central step.
domain assumption DistilBERT is a valid proxy for the billion-parameter LLMs in the threat model.
Section IV-A. The paper motivates attacks on billion-parameter LLMs but evaluates on DistilBERT, which has around 66M parameters and a far smaller update space.
domain assumption The dynamic cosine-similarity threshold defense is representative of state-of-the-art DiSim defenses.
Sections II-C and IV-A. The paper describes Krum, Trimmed-Mean, Median, and Bulyan but never tests GRMP against them, yet the abstract claims it can circumvent 'advanced defense systems'.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Graph Representation-based Model Poisoning on Federated Large Language Models." pith.science (2026). https://pith.science/paper/7RI4HZGK

@misc{pith2026250701694,
  author       = {Pith},
  title        = {Pith review of: Graph Representation-based Model Poisoning on Federated Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7RI4HZGK}},
  note         = {Machine review of arXiv:2507.01694}
}

read the original abstract

Federated large language models (FedLLMs) enable powerful generative capabilities within wireless networks while preserving data privacy. Nonetheless, FedLLMs remain vulnerable to model poisoning attacks. This article first reviews recent advancements in model poisoning techniques and existing defense mechanisms for FedLLMs, underscoring critical limitations, especially when dealing with non-IID textual data distributions. Current defense strategies predominantly employ distance or similarity-based outlier detection mechanisms, relying on the assumption that malicious updates markedly differ from benign statistical patterns. However, this assumption becomes inadequate against adaptive adversaries targeting billion-parameter LLMs. The article further investigates graph representation-based model poisoning (GRMP), an emerging attack paradigm that exploits higher-order correlations among benign client gradients to craft malicious updates indistinguishable from legitimate ones. GRMP can effectively circumvent advanced defense systems, causing substantial degradation in model accuracy and overall performance. Moreover, the article outlines a forward-looking research roadmap that emphasizes the necessity of graph-aware secure aggregation methods, specialized vulnerability metrics tailored for FedLLMs, and evaluation frameworks to enhance the robustness of federated language model deployments.

Figures

Figures reproduced from arXiv: 2507.01694 by the authors.

**Figure 1.** (a) FedLLMs deployment across heterogeneous wireless communication networks. (b) Illustrative dialogue demonstrating LLM functionality as a [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

**Figure 2.** (a) Illustration of FedLLMs, where each legitimate user trains a local model based on private data, and the edge server aggregates local benign [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Framework for the graph representation-based model poisoning (GRMP) attack. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: GRMP attack’s impact on learning accuracy and attack success rate [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Individual client cosine similarity evolution with defense threshold [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

15 extracted references · 4 canonical work pages

[5]

Lever- age variational graph representation for model poisoning on federated learning,

K. Li, X. Yuan, J. Zheng, W. Ni, F. Dressler, and A. Jamalipour, “Lever- age variational graph representation for model poisoning on federated learning,”IEEE Transactions on Neural Networks and Learning Systems, 2024

2024
[1]

Towards federated large language models: Motivations, methods, and future directions,

Y . Cheng, W. Zhang, Z. Zhang, C. Zhang, S. Wang, and S. Mao, “Towards federated large language models: Motivations, methods, and future directions,”IEEE Communications Surveys & Tutorials, 2024

2024
[2]

A comprehensive survey of large ai models for future com- munications: Foundations, applications and challenges,

F. Jiang, C. Pan, L. Dong, K. Wang, M. Debbah, D. Niyato, and Z. Han, “A comprehensive survey of large ai models for future com- munications: Foundations, applications and challenges,”arXiv preprint arXiv:2505.03556, 2025

arXiv 2025
[3]

Secure and private over-the-air federated learning: Biased and unbiased aggregation design,

N. Yan, K. Wang, K. Zhi, C. Pan, K. K. Chai, and H. V . Poor, “Secure and private over-the-air federated learning: Biased and unbiased aggregation design,”IEEE Transactions on Wireless Communications, 2025

work page 2025
[4]

Fedsecurity: A benchmark for attacks and defenses in federated learning and federated llms,

S. Han, B. Buyukates, Z. Hu, H. Jin, W. Jin, L. Sun, X. Wang, W. Wu, C. Xie, Y . Yaoet al., “Fedsecurity: A benchmark for attacks and defenses in federated learning and federated llms,” inProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 5070–5081

2024
[6]

Local model poisoning attacks to{Byzantine-Robust}federated learning,

M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to{Byzantine-Robust}federated learning,” in29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622

2020
[7]

Sgan-ra: Reconstruction attack for big model in asynchronous federated learning,

K. Wang, H. Zhang, G. Kaddoum, H. Shin, T. Q. Quek, and M. Z. Win, “Sgan-ra: Reconstruction attack for big model in asynchronous federated learning,”IEEE Communications Magazine, vol. 63, no. 4, pp. 66–72, 2025

2025
[8]

Privacy and robustness in federated learning: Attacks and defenses,

L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and P. S. Yu, “Privacy and robustness in federated learning: Attacks and defenses,” IEEE transactions on neural networks and learning systems, vol. 35, no. 7, pp. 8726–8746, 2022

2022

Show all 15 references

[9]

Efficient driving behavior narration and reasoning on edge device using large language models,

Y . Huang, Y . Cheng, and K. Wang, “Efficient driving behavior narration and reasoning on edge device using large language models,”IEEE Transactions on V ehicular Technology, no. 99, pp. 1–5, 2025

2025
[10]

Sine: Similarity is not enough for mitigating local model poisoning attacks in federated learning,

H. Kasyap and S. Tripathy, “Sine: Similarity is not enough for mitigating local model poisoning attacks in federated learning,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4481–4494, 2024

2024
[11]

On harnessing semantic communication with natural language processing,

S. R. Pokhrelet al., “On harnessing semantic communication with natural language processing,”IEEE Internet of Things Journal, 2025

2025
[12]

Federated learning for internet of things: A comprehensive survey,

D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, J. Li, and H. V . Poor, “Federated learning for internet of things: A comprehensive survey,”IEEE Communications Surveys & Tutorials, vol. 23, no. 3, pp. 1622–1658, 2021

2021
[13]

Exploring visual explanations for defending federated learning against poisoning attacks,

J. Zheng, K. Li, X. Yuan, W. Ni, E. Tovar, and J. Crowcroft, “Exploring visual explanations for defending federated learning against poisoning attacks,” inProceedings of the 30th Annual International Conference on Mobile Computing and Networking, 2024, pp. 1596–1598

2024
[14]

A comprehensive survey on graph anomaly detection with deep learning,

X. Ma, J. Wu, S. Xue, J. Yang, C. Zhou, Q. Z. Sheng, H. Xiong, and L. Akoglu, “A comprehensive survey on graph anomaly detection with deep learning,”IEEE transactions on knowledge and data engineering, vol. 35, no. 12, pp. 12 012–12 038, 2021

2021
[15]

Robust aggregation for federated learning,

K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,”IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022

2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [5]

Lever- age variational graph representation for model poisoning on federated learning,

K. Li, X. Yuan, J. Zheng, W. Ni, F. Dressler, and A. Jamalipour, “Lever- age variational graph representation for model poisoning on federated learning,”IEEE Transactions on Neural Networks and Learning Systems, 2024

2024

[2] [1]

Towards federated large language models: Motivations, methods, and future directions,

Y . Cheng, W. Zhang, Z. Zhang, C. Zhang, S. Wang, and S. Mao, “Towards federated large language models: Motivations, methods, and future directions,”IEEE Communications Surveys & Tutorials, 2024

2024

[3] [2]

A comprehensive survey of large ai models for future com- munications: Foundations, applications and challenges,

F. Jiang, C. Pan, L. Dong, K. Wang, M. Debbah, D. Niyato, and Z. Han, “A comprehensive survey of large ai models for future com- munications: Foundations, applications and challenges,”arXiv preprint arXiv:2505.03556, 2025

arXiv 2025

[4] [3]

Secure and private over-the-air federated learning: Biased and unbiased aggregation design,

N. Yan, K. Wang, K. Zhi, C. Pan, K. K. Chai, and H. V . Poor, “Secure and private over-the-air federated learning: Biased and unbiased aggregation design,”IEEE Transactions on Wireless Communications, 2025

work page 2025

[5] [4]

Fedsecurity: A benchmark for attacks and defenses in federated learning and federated llms,

S. Han, B. Buyukates, Z. Hu, H. Jin, W. Jin, L. Sun, X. Wang, W. Wu, C. Xie, Y . Yaoet al., “Fedsecurity: A benchmark for attacks and defenses in federated learning and federated llms,” inProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 5070–5081

2024

[6] [6]

Local model poisoning attacks to{Byzantine-Robust}federated learning,

M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to{Byzantine-Robust}federated learning,” in29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622

2020

[7] [7]

Sgan-ra: Reconstruction attack for big model in asynchronous federated learning,

K. Wang, H. Zhang, G. Kaddoum, H. Shin, T. Q. Quek, and M. Z. Win, “Sgan-ra: Reconstruction attack for big model in asynchronous federated learning,”IEEE Communications Magazine, vol. 63, no. 4, pp. 66–72, 2025

2025

[8] [8]

Privacy and robustness in federated learning: Attacks and defenses,

L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and P. S. Yu, “Privacy and robustness in federated learning: Attacks and defenses,” IEEE transactions on neural networks and learning systems, vol. 35, no. 7, pp. 8726–8746, 2022

2022