REVIEW 4 major objections 5 minor 20 references
FIDELIS: Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning
T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read FIDELIS claims that a blockchain-consensus isolation-forest judge model, trained on gradient statistics from a public dataset, detects poisoned updates and holds global accuracy above 98% with up to 35% malicious clients.
desk verdict Novel combination of blockchain-based judge selection and isolation forest detection, but the judge-selection score is a false-positive-only test that can select a degenerate detector, and the experiments have no baselines. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The judge model: an isolation forest trained on 45-dimensional gradient-statistic summaries (nine batch statistics times a five-stat summary) extracted by training the initial model on a public dataset. Each client builds one; the blockchain's consensus protocol—ElGamal-encrypted votes homomorphically tallied—selects a single judge model used to flag anomalous model updates before FedAvg aggregation.
What would settle it
Run FIDELIS with a public dataset unrelated to the private task (for example, a public pet-image dataset while clients train on CIFAR-10) and measure the judge model's true-positive rate; if it drops well below the reported 95–100%, the representativeness assumption fails. Alternatively, launch a backdoor (non-label-flipping) poisoning attack under the same protocol: the paper only evaluates label-flipping, so a successful backdoor would show the robustness claim is attack-specific.
Extended reading notes
Core claim
The central claim is that the movement of gradients during benign training, summarized by nine per-batch statistics (mean, standard deviation, minimum, maximum, range, skew, kurtosis, L1, L2) further reduced to five-stat summaries, gives an isolation forest enough signal to distinguish poisoned from benign model updates. Each client produces such a judge model, and consensus is reached by testing every candidate judge on a clean public test set and homomorphically tallying encrypted votes, so no single client controls the detector. The winning judge model then labels each submitted update; any update marked anomalous is excluded from federated averaging. Experiments with ResNet-18 on a dog-v
Load-bearing premise
The load-bearing assumption is that gradient statistics from training on the public dataset represent the distribution of benign clients' gradient updates on their private data, across rounds and attack intensities; if that match fails, the judge either misses poisoned updates or rejects benign ones.
Editorial extensions
If this is right
- If correct, federated learning can run without a trusted aggregator while still filtering poisoned updates, enabling FL in fully untrusted IoT settings.
- The judge-model consensus protocol gives a standardized, reproducible detection method, addressing the lack of standardization noted in the paper.
- The linear scalability of judge creation means the defense can be applied as client counts grow, at least up to 200 clients as tested.
- The high global accuracy at 35% malicious clients suggests the defense tolerates substantial poisoning without model degradation.
- The judge layer is defined independently of the aggregation rule, so it can be paired with robust aggregators like FedLAW or RFA, which the paper explicitly considers.
Reading between the lines
- The public-dataset representativeness assumption is untested; if clients' private data is non-IID relative to the public set, judge accuracy likely degrades, so a natural extension is to evaluate under distribution shift.
- An adaptive attacker who knows the public dataset could craft poisoned updates whose gradient statistics mimic benign ones, potentially bypassing the isolation forest; the paper does not address this.
- The consensus protocol assumes malicious clients lack a majority; if that assumption weakens, all judge selection and acceptance can be gamed, a boundary the paper explicitly sets but does not stress-test.
- Using multiple public datasets or a validation committee could improve representativeness and resilience over the single-dataset design.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes FIDELIS, a blockchain-based federated learning framework that removes the trusted global server and uses an isolation-forest 'judge model' to detect poisoned model updates before aggregation. Each client trains a local judge on gradient statistics derived from a public dataset plus a local model on private data; clients then vote via homomorphic encryption to select a single judge, and a majority vote decides which model updates are accepted. Experiments on Oxford-IIIT Pets (public) and Cat-vs-Dog (client data) report judge true-positive/F1 rates, global model accuracy under label-flipping attacks, and linear runtime scaling for judge creation.
Significance. If the claims hold, FIDELIS would be a useful step toward decentralized poisoning defense for federated learning, combining a concrete anomaly-detection method with a blockchain consensus layer. The paper is explicit about the adversary model and provides an algorithmic description of judge training, which helps reproducibility. The scalability experiment is a strength. However, the central robustness claim is not yet supported: the judge-selection consensus is logically flawed, the attack experiments lack baselines and comparisons to existing defenses, and the representativeness of the public dataset is untested. These issues are fixable but are load-bearing for the paper's main conclusions.
major comments (4)
- [§IV-C] The judge-selection consensus scores only false-positive behavior. Each judge is tested on the clean public test set P_test and receives a pass (1) if no sample is flagged anomalous. A degenerate judge that always outputs benign receives the same full score as a well-trained detector, and permissive judges are indistinguishable from accurate ones. The claim that "this process ensures that the most accurate model is chosen" is therefore unsupported; true-positive rates on poisoned updates are never compared, and no tie-breaking rule is specified. A malicious minority could propose such permissive judges, and the selected judge would then fail to exclude poisoned updates. Since the experiments do not instantiate the consensus process, this selection behavior is never tested.
- [§V-C, Fig. 5] The global-accuracy experiment has no baseline without defense and no comparison to existing robust aggregation methods (e.g., Krum, Trimmed Mean, Zeno, Raza et al.). The reported >98% accuracy with up to 35% malicious clients may simply reflect the weakness of the attack: each malicious client flips labels on only 35% of its own dataset, so the effective fraction of poisoned data is at most 15.75% even with 45% malicious clients. Without a FedAvg-no-defense baseline, the reader cannot attribute the result to FIDELIS. The paper should report the accuracy of vanilla FedAvg under the same attack and compare against standard byzantine-robust baselines.
- [§V-B, Algorithm 1] The judge model is trained exclusively on gradient statistics from the Oxford-IIIT Pets public dataset, while client models are trained on Cat-vs-Dog private data. Algorithm 1 instructs clients to "simulate this process of collecting data points for other clients" from the public dataset, implicitly assuming that the public data's gradient distribution matches the benign clients' private-data distribution. This assumption is load-bearing: if the public data is not representative, the judge will either reject benign updates or accept poisoned ones. The paper provides no experiments with different public datasets, different data distributions, or non-IID client data, and does not test how the judge's accuracy degrades under distribution shift.
- [§IV-D, §V] The consensus mechanism for accepting model updates is described but never instantiated in the experiments. There is no blockchain, homomorphic encryption, or voting simulation in the evaluation; the experimental pipeline appears to be a centralized judge-based filter followed by FedAvg. Consequently, the paper's scalability results (Fig. 6) measure judge creation, not the consensus/verification process, and the claimed decentralization is not empirically validated. At minimum, the authors should simulate the voting and tallying steps and report the communication/computation overhead, or clearly state which components were not implemented.
minor comments (5)
- [§IV-B] Notation is inconsistent: Table II defines private data as D_i, but the text says clients train on "their own private data Pi." Also, Algorithm 1's "1-D list Ti" is unclear since each simulation produces a 45-dimensional feature vector.
- [Table I] Typo: "Isolation Forrest" should be "Isolation Forest."
- [§V-D] "majority of runtime is compromised of CNN training" should be "composed of."
- [Fig. 4] The y-axis is labeled "Accuracy (%)" but the curves report TP and F1; this should be clarified to avoid conflating true-positive rate with classification accuracy.
- [Algorithm 1] The number of simulations n and the isolation forest hyperparameters (contamination, n_estimators, etc.) are not specified. These are needed for reproducibility, especially since the five-stat summary totals 45 features per simulation.
Circularity Check
No significant circularity: the paper's claims are empirical measurements, not derivations that reduce to their own inputs.
full rationale
FIDELIS is presented as an implemented system with experimental measurements rather than a formal derivation chain. The judge model is trained (Algorithm 1) on 45-dimensional gradient statistics from the public Oxford-IIIT Pet training split, validated on the 10% held-out test split; the consensus step scores judges by whether they flag clean test data, and the global-model accuracy and judge TP/F1 are measured on updates generated by clients. None of these quantities is defined in terms of the others in a way that forces the reported result. The same public dataset is used both to train the judge and to evaluate the global model, but the global model's client updates are trained on the Cat-vs-Dog dataset, so there is no label or update leakage that would make the detection accuracy a fitted artifact. The paper contains no self-citations that carry the argument, no imported uniqueness theorem, and no ansatz smuggled in by citation. The most significant concern is a correctness gap rather than circularity: the judge-selection score in Section IV-C is a false-positive-only pass/fail on clean data, so a degenerate permissive judge can tie or win, and the claim that 'this process ensures that the most accurate model is chosen' (Section IV-C) is not supported. That is a logical/security flaw, not a circular derivation, and does not raise the circularity score under the specified criteria.
Assumptions & free parameters
free parameters (3)
- number of training simulations n
- isolation forest hyperparameters (e.g., contamination, n_estimators)
- choice of nine statistics and five-stat summary
assumptions (4)
- domain assumption Malicious clients never hold a majority of clients
- domain assumption The public dataset is clean, representative of the task, and immutable
- domain assumption Gradient statistics from public-dataset training simulate benign clients' gradient statistics on private data
- domain assumption An additively homomorphic ElGamal scheme with efficient decryption is available
Cite this review
Pith. "Pith review of FIDELIS: Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/TZXDQHYH
@misc{pith2026250810042,
author = {Pith},
title = {Pith review of: FIDELIS: Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/TZXDQHYH}},
note = {Machine review of arXiv:2508.10042}
}
read the original abstract
Federated learning enhances traditional deep learning by enabling the joint training of a model with the use of IoT device's private data. It ensures privacy for clients, but is susceptible to data poisoning attacks during training that degrade model performance and integrity. Current poisoning detection methods in federated learning lack a standardized detection method or take significant liberties with trust. In this paper, we present \Sys, a novel blockchain-enabled poison detection framework in federated learning. The framework decentralizes the role of the global server across participating clients. We introduce a judge model used to detect data poisoning in model updates. The judge model is produced by each client and verified to reach consensus on a single judge model. We implement our solution to show \Sys is robust against data poisoning attacks and the creation of our judge model is scalable.
Figures
Figures from the paper (3 more)
Reference graph
Works this paper leans on
-
[1]
Data poisoning attacks against federated learning systems,
V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in Computer security–ESORICs 2020: 25th European sym- posium on research in computer security, ESORICs 2020, guildford, UK, September 14–18, 2020, proceedings, part i 25. Springer, 2020, pp. 480–501
work page 2020
-
[2]
Communication-efficient learning of deep networks from decentralized data,
B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics. PMLR, 2017, pp. 1273–1282
work page 2017
-
[3]
L. Lavaur, Y . Busnel, and F. Autrel, “Systematic analysis of label-flipping attacks against federated learning in collaborative intrusion detection systems,” in Proceed- ings of the 19th International Conference on Availability, Reliability and Security , 2024, pp. 1–12
work page 2024
-
[4]
A survey on data poisoning attacks and defenses,
J. Fan, Q. Yan, M. Li, G. Qu, and Y . Xiao, “A survey on data poisoning attacks and defenses,” in 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC). IEEE, 2022, pp. 48–55
work page 2022
-
[5]
Untargeted poisoning attack detection in federated learning via behavior attestational,
R. Al Mallah, D. Lopez, G. Badu-Marfo, and B. Fa- rooq, “Untargeted poisoning attack detection in federated learning via behavior attestational,” IEEE Access, vol. 11, pp. 125 064–125 079, 2023
work page 2023
-
[6]
Using Anomaly Detection to Detect Poisoning Attacks in Federated Learning Applications
A. Raza, S. Li, K.-P. Tran, and L. Koehl, “Using anomaly detection to detect poisoning attacks in federated learning applications,” arXiv preprint arXiv:2207.08486 , 2022
work page Pith review arXiv 2022
-
[7]
Zeno: Distributed stochastic gradient descent with suspicion-based fault- tolerance,
C. Xie, S. Koyejo, and I. Gupta, “Zeno: Distributed stochastic gradient descent with suspicion-based fault- tolerance,” in International Conference on Machine Learning. PMLR, 2019, pp. 6893–6901
work page 2019
-
[8]
Deepchain: Auditable and privacy-preserving deep learning with blockchain-based incentive,
J. Weng, J. Weng, J. Zhang, M. Li, Y . Zhang, and W. Luo, “Deepchain: Auditable and privacy-preserving deep learning with blockchain-based incentive,” IEEE Transactions on Dependable and Secure Computing , vol. 18, no. 5, pp. 2438–2455, 2019
work page 2019
Show all 20 references
-
[9]
Blockchain assisted decentral- ized federated learning (blade-fl): Performance analysis and resource allocation,
J. Li, Y . Shao, K. Wei, M. Ding, C. Ma, L. Shi, Z. Han, and H. V . Poor, “Blockchain assisted decentral- ized federated learning (blade-fl): Performance analysis and resource allocation,” IEEE Transactions on Parallel and Distributed Systems, vol. 33, no. 10, pp. 2401–2415, 2021
2021
-
[10]
Block- fla: Accountable federated learning via hybrid blockchain architecture,
H. B. Desai, M. S. Ozdayi, and M. Kantarcioglu, “Block- fla: Accountable federated learning via hybrid blockchain architecture,” in Proceedings of the eleventh ACM con- ference on data and application security and privacy , 2021, pp. 101–112
2021
-
[11]
Bafl: A blockchain-based asynchronous federated learning framework,
L. Feng, Y . Zhao, S. Guo, X. Qiu, W. Li, and P. Yu, “Bafl: A blockchain-based asynchronous federated learning framework,” IEEE Transactions on Computers , vol. 71, no. 5, pp. 1092–1103, 2021
2021
-
[12]
Hbfl: A hierarchical blockchain-based federated learn- ing framework for collaborative iot intrusion detection,
M. Sarhan, W. W. Lo, S. Layeghy, and M. Portmann, “Hbfl: A hierarchical blockchain-based federated learn- ing framework for collaborative iot intrusion detection,” Computers and Electrical Engineering , vol. 103, p. 108379, 2022
2022
-
[13]
Recursive euclidean distance-based robust aggregation technique for federated learning,
C. Herath, Y . Rahulamathavan, and X. Liu, “Recursive euclidean distance-based robust aggregation technique for federated learning,” in 2023 IEEE IAS Global Con- ference on Emerging Technologies (GlobConET). IEEE, 2023, pp. 1–6
2023
-
[14]
Byzantine-robust federated learning via cosine similarity aggregation,
T. Zhu, Z. Guo, C. Yao, J. Tan, S. Dou, W. Wang, and Z. Han, “Byzantine-robust federated learning via cosine similarity aggregation,” Computer Networks, vol. 254, p. 110730, 2024
2024
-
[15]
Mitigating data poisoning attacks on a federated learning-edge computing network,
R. Doku and D. B. Rawat, “Mitigating data poisoning attacks on a federated learning-edge computing network,” in 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC) . IEEE, 2021, pp. 1–6
2021
-
[16]
Machine learning with adversaries: Byzantine tolerant gradient descent,
P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural informa- tion processing systems , vol. 30, 2017
2017
-
[17]
Federated learning framework based on trimmed mean aggregation rules,
T. Wang, Z. Zheng, and F. Lin, “Federated learning framework based on trimmed mean aggregation rules,” Expert Systems with Applications , p. 126354, 2025
2025
-
[18]
Robust aggregation for federated learning,
K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing , vol. 70, pp. 1142–1154, 2022
2022
-
[19]
Trustworthy federated learning via blockchain,
Z. Yang, Y . Shi, Y . Zhou, Z. Wang, and K. Yang, “Trustworthy federated learning via blockchain,” IEEE Internet of Things Journal , vol. 10, no. 1, pp. 92–109, 2022
2022
-
[20]
Revisiting weighted aggregation in federated learning with neu- ral networks,
Z. Li, T. Lin, X. Shang, and C. Wu, “Revisiting weighted aggregation in federated learning with neu- ral networks,” in International Conference on Machine Learning. PMLR, 2023, pp. 19 767–19 788
2023
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.