Pith. sign in

REVIEW 4 major objections 6 minor 48 references

FLAegis: A Two-Layer Defense Framework for Federated Learning Against Poisoning Attacks

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FLAegis claims a two-layer defense — SAX-based spectral clustering to detect and exclude poisoned clients, plus FFT-based robust aggregation for the rest — keeps federated model accuracy near the clean baseline even when 40% of clients are

desk verdict FLAegis is a plausible clustering-plus-FFT defense with a real clean-regime false-positive problem; the attack-robustness comparison mostly survives, but the 'no degradation' claim does not. read the letter →

arxiv 2508.18737 v1 pith:SPPE2HFD submitted 2025-08-26 cs.LG cs.AI

Enrique Mármol Campos , Aurora González Vidal , José Luis Hernández Ramos , Antonio Skarmeta This is my paper
classification cs.LGcs.AI
keywords federatedlearningpoisoningattacksByzantinerobustnessspectralclusteringsymbolicaggregateapproximationFFTaggregationmaliciousclientdetectionnon-IID
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FLAegis claims that federated learning can stay accurate even when a large share of clients attack, if the server first filters attackers and then aggregates the remainder robustly. The paper's first stage turns each client's weight update into a symbolic string with SAX, builds a cosine-similarity matrix over those strings, and runs spectral clustering — which needs no preset number of clusters — flagging the smaller cluster as malicious under the assumption that fewer than half the clients are adversaries. The second stage applies FFT-based aggregation to whatever survives, so a few attackers that escape detection cannot move the global model. On FEMNIST with up to 40% malicious clients under five attacks (label flipping, LIE, STATOPT, mimic, min-max, min-sum), the paper reports detection accuracy near 1.0 for most attacks and final model accuracy around 0.83, close to the 0.845 clean baseline and above SignGuard, FedDMC, and LoMar. A reader should care because the design targets the known failure modes of the two standard defense families — clustering methods afraid of noise, robust aggregators that break at high Byzantine ratios — by having each layer cover the other.

What carries the argument

The load-bearing object is the SAX-transformed update: flatten a client's weight matrices into one vector, divide its value range into 45 equal bands, and replace each value by the symbol of its band. Cosine similarity over these symbol strings amplifies small adversarial deviations that raw cosine similarity misses, and the resulting similarity matrix feeds spectral clustering, which infers the number of clusters from the graph Laplacian's eigenvectors rather than taking it as input. The framework then flags the smaller of the two clusters as the attackers (Algorithm 1, lines 13–17). The second layer is FFT-based aggregation from the authors' prior work: for each coordinate across the survi

What would settle it

A concrete check: run FLAegis with 0% malicious clients on a strongly non-IID FEMNIST partition and demand fewer than 5% of benign clients be flagged in every round — the paper's reported 0.76–0.82 detection accuracy at 0% attackers already fails that test. The complementary test is an adaptive mimic attack that copies the centroid of the benign cluster's SAX symbols rather than a high-variance outlier; if detection and final accuracy at 40% attackers then drop by more than a few points, the central claim is bounded by how well the attacker can imitate the benign symbolic band.

Watch

Extended reading notes

Core claim

FLAegis's central claim is that poisoning resilience comes from a pipeline, not a single mechanism: detect and exclude attackers first, then aggregate the remainder robustly. Client weight vectors are treated as time series, discretized into 45 SAX bands, scored by pairwise cosine similarity, and clustered spectrally so the number of attackers need not be known; the smaller cluster is declared malicious (M < K/2). Survivors pass through an FFT-based aggregator that keeps, per coordinate, the highest-density frequency value. On FEMNIST with up to 40% malicious clients the paper reports accuracy around 0.83 (clean baseline 0.845), detection 1.0 for LIE, STATOPT and label flipping, 0.94–0.8 for

Load-bearing premise

The framework assumes benign updates always form one coherent cluster and malicious updates a separate, smaller one, so the rule 'flag the smaller cluster' is safe — and that assumption is already under strain in the paper's own data, where with zero attackers the detector flags about one in five benign clients.

Editorial extensions

If this is right

  • A federated server can keep model accuracy near the clean baseline (about 0.83 vs 0.845) with up to 40% of clients actively poisoning, in a non-IID setting, without any trusted validation data at the server.
  • No one needs to know how many attackers are present: spectral clustering infers the cluster structure, so the defense adapts round by round even as malicious clients are re-sampled.
  • Because the two layers fail in complementary ways — detection misses mimics, aggregation alone degrades as the Byzantine ratio rises — their combination extends resilience beyond what either defense family achieves alone.
  • The same pipeline extends to decentralized or hierarchical federated architectures, since it needs only weight updates and their pairwise similarities.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: at 0% malicious clients the detector already flags roughly 20% of benign clients (detection accuracy 0.76–0.82), so in a purely benign deployment the first stage would discard good updates and only the FFT layer would hold accuracy up; a confidence threshold that disables filtering when no second cluster is well separated would be a natural, testable addition.
  • Inference: the mimic-attack results (detection falling from 0.94 to 0.8) hint at a stronger adversary: one that estimates the benign cluster's SAX signature and places poisoned updates inside the benign symbolic band rather than copying a single high-variance update. If such an attack held, the method's edge would shrink to the FFT layer alone.
  • Inference: two free parameters — the 45 SAX bands and the 'smaller cluster is malicious' rule — are never swept; a parameter study (10–100 bands, and a size-ratio requirement that the flagged cluster also be below half the clients) would map where detection begins to fail.
  • Inference: the detector has no memory across rounds, so the transient dips at 10% attackers (min-max/min-sum) cost a full round of trust; grafting on a per-client trust score would smooth those dips, at the price of slower reaction to attackers that join later.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes FLAegis, a two-layer defense for federated learning against poisoning attacks. Layer 1 applies SAX symbolic transformation to client weight updates, computes a cosine-similarity matrix, and runs spectral clustering; whenever more than one cluster is found, the clients are split into two groups and the smaller group is labeled malicious. Layer 2 applies an FFT-based robust aggregation from the authors' prior work to the remaining updates. The method is evaluated on FEMNIST with 50 clients and 50 rounds under label flipping, LIE, STATOPT, mimic, min-max, and min-sum attacks, and compared with SignGuard, FedDMC, LoMar, and FedAvg, as well as FFT-combined variants. The authors report near-perfect detection for some attacks, final accuracies around 0.83, and claim that FLAegis outperforms state-of-the-art defenses while adapting to benign and adversarial scenarios without degrading model performance.

Significance. If the claims were fully supported, FLAegis would be a practically relevant two-stage defense: a detection stage that removes most malicious clients and a robust aggregation stage that limits the impact of missed attackers. The paper has strengths: it evaluates against a broad set of attacks, uses a non-IID federated benchmark, includes an ablation study separating the SAX preprocessing and FFT aggregation contributions, and directly compares with several published defenses. However, the empirical support is currently weaker than the abstract suggests. There are no seeds, repeats, or error bars; the FedDMC baseline is run with a configuration the paper itself says is compromised; and the detection stage has an uncontrolled false-positive rate at 0% malicious clients. The central architectural idea is credible and the results point in the right direction, but the paper's stronger claims need revision and additional evidence before publication.

major comments (4)
  1. [Section IV-B1, Algorithm 1 lines 11–17; Fig. 3 and Table IV] The smaller-cluster rule is applied whenever spectral clustering returns more than one cluster, regardless of whether an adversarial cluster actually exists. At 0% malicious clients, Table IV reports detection accuracy of only 0.765–0.8155, meaning about 18–24% of benign clients are flagged each round. Since attackers are re-sampled every round (Section V-A), this is a recurring loss of roughly 10 out of 50 benign updates, not a one-time cost. The high detection accuracies under attack therefore partly reflect the rule's built-in bias (any minority cluster is labeled malicious) rather than evidence that the clustering uncovers adversarial structure. The decision rule needs a statistical test or threshold to determine whether the smaller cluster is genuinely anomalous, and the clean-setting false-positive rate must be reported as a core metric.
  2. [Table V, 0% rows; Section I contribution bullet] The claim that FLAegis 'dynamically adapts to both benign and adversarial scenarios without degrading model performance' is contradicted by the paper's own data. In the clean setting, full FLAegis achieves accuracy around 0.834, below FedAvg's 0.845 and below all FLAegis-without-FFT values (0.836–0.844). Thus the identification phase imposes a consistent clean-accuracy penalty even when no attackers are present. This needs to be acknowledged explicitly, and either the detector must be modified to avoid false positives in benign settings or the claim must be weakened.
  3. [Section V-C2 and Figs. 4–5] The comparison against state-of-the-art defenses is not yet statistically substantiated. No seeds, repeats, or error bars are reported, so all accuracies and detection rates are point estimates from what appear to be single runs. In addition, FedDMC is run with PCA forced to three features, and the text admits this 'significantly compromised the method's discriminative capability.' The 'outperforms state-of-the-art' claim requires multiple seeds with mean and variance, and baseline hyperparameters that are tuned or at least justified; otherwise the comparison is not convincing.
  4. [Section IV-B1, SAX parameters] The SAX alphabet size (45 equidistant bands) is a free parameter presented without any justification, sensitivity analysis, or selection criterion. Because the claimed benefit of SAX in amplifying malicious-vs-benign differences is central to the detection stage, the paper should report how detection accuracy and final model accuracy vary with the number of bands (e.g., 10, 20, 45, 100) or provide a principled way to set this parameter.
minor comments (6)
  1. [Abstract and Section V-B / Table II] The abstract says 'five poisoning attacks,' but Section V-B and Table II describe six attacks (label flipping, LIE, STATOPT, mimic, min-max, min-sum). Please correct the count.
  2. [Section V-C1 and Table IV] The text states that for min-max and min-sum detection drops to approximately 0.79 at 10% malicious clients, but Table IV reports 0.7258 (min-max) and 0.7254 (min-sum). Please reconcile the reported values.
  3. [Tables IV and V] The spelling 'FLAEgis' in the table headers is inconsistent with 'FLAegis' used throughout the rest of the paper.
  4. [Reference [14]] Reference [14] is given as '2024' with no publication venue, arXiv identifier, or full bibliographic details. Please complete the reference.
  5. [Equation (12)] The notation is inconsistent: the bound uses ε_m and later the threshold is written ϵ = min{1, ϵm}. Use one symbol consistently, and define the relationship between ε_m and ℏ.
  6. [Algorithm 1, line 21] The notation W = FFT((W_b)_{b∈B}) is informal. Section II-D describes a coordinate-wise FFT density aggregation; please make the aggregation notation consistent with that description.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FLAegis is evaluated against external baselines, and the self-cited FFT component is independently re-tested in this paper.

full rationale

The claimed derivation chain is empirical. The identification phase (SAX + cosine similarity + spectral clustering, Algorithm 1) uses stated design choices—45 SAX bands and the M < K/2 smaller-cluster rule—rather than parameters fitted to the reported detection accuracies. Detection accuracy is measured against ground-truth malicious-client labels, so high attack-detection rates are not equal to the decision rule by construction. The FFT mitigation layer is drawn from the authors' prior work [14], but the paper describes the method in Section II-D, evaluates FFT alone as a baseline in Figure 5, and tests FFT-extended versions of all comparison defenses, so the self-citation is corroborated by in-paper experiments rather than being the sole load-bearing evidence. The clean-setting false-positive rate (detection accuracy only about 0.76–0.82 at 0% malicious clients, Figure 3 and Table IV) is a robustness/validity concern, and Table V partially contradicts the claim in Section V-C3 that the full pipeline always outperforms partial versions; these are correctness issues, not circular reductions. The central comparisons against SignGuard, FedDMC, and LoMar are external, and no fitted input is renamed as a prediction.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

No new particles or formal entities are introduced. The defense relies on known techniques; the only hand-set quantity is the SAX band count, and the core assumptions are the clustering separability of benign and malicious updates and the FFT aggregation claim carried over from prior work.

free parameters (1)
  • SAX alphabet size (number of equidistant bands) = 45
    Chosen by hand in Section IV-B.1; no sensitivity analysis is provided, and Table IV shows the benefit of SAX varies by attack, being negative for mimic.
assumptions (4)
  • domain assumption The number of malicious clients is below K/2, so the smaller cluster can be assumed malicious.
    Stated in Section IV-A and used in Algorithm 1 lines 13-17.
  • ad hoc to paper SAX amplification makes benign and malicious weight updates sufficiently dissimilar for cosine similarity and spectral clustering to separate them.
    Asserted in Section IV-B.1; no formal bound is given, and the ablation in Table IV shows mixed effects.
  • domain assumption Benign updates from non-IID clients form a single cluster in the SAX/cosine similarity space.
    Required by the decision rule in Algorithm 1; the 0% malicious detection accuracy near 0.8 suggests this assumption is violated.
  • domain assumption FFT-based aggregation removes residual malicious impact without degrading benign updates.
    Taken from the authors' prior work [14] and not re-derived here; used in the mitigation phase.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FLAegis: A Two-Layer Defense Framework for Federated Learning Against Poisoning Attacks." pith.science (2026). https://pith.science/paper/SPPE2HFD

@misc{pith2026250818737,
  author       = {Pith},
  title        = {Pith review of: FLAegis: A Two-Layer Defense Framework for Federated Learning Against Poisoning Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SPPE2HFD}},
  note         = {Machine review of arXiv:2508.18737}
}
read the original abstract

Federated Learning (FL) has become a powerful technique for training Machine Learning (ML) models in a decentralized manner, preserving the privacy of the training datasets involved. However, the decentralized nature of FL limits the visibility of the training process, relying heavily on the honesty of participating clients. This assumption opens the door to malicious third parties, known as Byzantine clients, which can poison the training process by submitting false model updates. Such malicious clients may engage in poisoning attacks, manipulating either the dataset or the model parameters to induce misclassification. In response, this study introduces FLAegis, a two-stage defensive framework designed to identify Byzantine clients and improve the robustness of FL systems. Our approach leverages symbolic time series transformation (SAX) to amplify the differences between benign and malicious models, and spectral clustering, which enables accurate detection of adversarial behavior. Furthermore, we incorporate a robust FFT-based aggregation function as a final layer to mitigate the impact of those Byzantine clients that manage to evade prior defenses. We rigorously evaluate our method against five poisoning attacks, ranging from simple label flipping to adaptive optimization-based strategies. Notably, our approach outperforms state-of-the-art defenses in both detection precision and final model accuracy, maintaining consistently high performance even under strong adversarial conditions.

Figures

Figures reproduced from arXiv: 2508.18737 by the authors.

Figure 1
Figure 1. Overview of the FL setting. Benign clients send clean model updates (circles), while malicious clients may [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Scheme of the two types of poisoning attacks. (a) Label flipping: dataset labels are randomly altered. (b) Model [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Detection accuracy of the different methods against the attacks [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Comparison of our method with FedAvg, SignGuard, FedDMC and LoMar [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Comparison of our method, the FFT, and the FFT-extended versions of SignGuard, FedDMC and LoMar [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 37 canonical work pages

  1. [14]

    Fedrdf: A robust and dynamic aggregation function against poisoning attacks in federated learning,

    E. M. Campos, A. G. Vidal, J. L. H. Ramos, and A. Skarmeta, “Fedrdf: A robust and dynamic aggregation function against poisoning attacks in federated learning,” 2024

    work page 2024

  2. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  3. [2]

    Federated machine learning: Concept and applications,

    Q. Yang, Y . Liu, T. Chen, and Y . Tong, “Federated machine learning: Concept and applications,” ACM Transactions on Intelligent Systems and Technology (TIST), vol. 10, no. 2, pp. 1–19, 2019

    work page 2019

  4. [3]

    The eu general data protection regulation (gdpr): Eu- ropean regulation that has a global impact,

    M. Goddard, “The eu general data protection regulation (gdpr): Eu- ropean regulation that has a global impact,” International Journal of Market Research, vol. 59, no. 6, pp. 703–705, 2017

    work page 2017

  5. [4]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30, 2017

    2017

  6. [5]

    Can machine learning be secure?

    M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?” in Proceedings of the 2006 ACM Symposium on Information, computer and communications security , 2006, pp. 16–25

    work page 2006

  7. [6]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International Conference on Artificial Intelligence and Statistics . PMLR, 2020, pp. 2938–2948. IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 14

    work page 2020

  8. [7]

    A comprehensive survey on poisoning attacks and countermeasures in machine learning,

    Z. Tian, L. Cui, J. Liang, and S. Yu, “A comprehensive survey on poisoning attacks and countermeasures in machine learning,” ACM Computing Surveys, vol. 55, no. 8, pp. 1–35, 2022

    work page 2022

Show all 48 references
  1. [8]

    Poisoning attacks in federated learning: A survey,

    G. Xia, J. Chen, C. Yu, and J. Ma, “Poisoning attacks in federated learning: A survey,” Ieee Access, vol. 11, pp. 10 708–10 722, 2023

    2023

  2. [9]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  3. [10]

    On the byzantine robustness of clustered federated learning,

    F. Sattler, K.-R. M ¨uller, T. Wiegand, and W. Samek, “On the byzantine robustness of clustered federated learning,” in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2020, pp. 8861–8865

    2020

  4. [11]

    A symbolic representation of time series, with implications for streaming algorithms,

    J. Lin, E. Keogh, S. Lonardi, and B. Chiu, “A symbolic representation of time series, with implications for streaming algorithms,” in Proceedings of the 8th ACM SIGMOD workshop on Research issues in data mining and knowledge discovery , 2003, pp. 2–11

    2003

  5. [12]

    Chapter 11 - recommendation engines,

    V . Kotu and B. Deshpande, “Chapter 11 - recommendation engines,” in Data Science (Second Edition) , second edition ed., V . Kotu and B. Deshpande, Eds. Morgan Kaufmann, 2019, pp. 343–394. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ B9780128147610000113

    2019

  6. [13]

    D. A. Simovici, CLUSTERING: Theoretical and Practical Aspects . World Scientific, 2021

    2021

  7. [15]

    Threats to federated learning: A survey,

    L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” arXiv preprint arXiv:2003.02133 , 2020

    2003 arXiv

  8. [16]

    Wavelet transform application for/in non-stationary time-series analysis: A re- view,

    M. Rhif, A. Ben Abbes, I. R. Farah, B. Mart ´ınez, and Y . Sang, “Wavelet transform application for/in non-stationary time-series analysis: A re- view,” Applied Sciences, vol. 9, no. 7, p. 1345, 2019

    2019

  9. [17]

    Discrete wavelet transform-based time series analysis and mining,

    P. Chaovalit, A. Gangopadhyay, G. Karabatis, and Z. Chen, “Discrete wavelet transform-based time series analysis and mining,” ACM Com- puting Surveys (CSUR) , vol. 43, no. 2, pp. 1–37, 2011

    2011

  10. [18]

    Beats: Blocks of eigenvalues algorithm for time series segmentation,

    A. Gonzalez-Vidal, P. Barnaghi, and A. F. Skarmeta, “Beats: Blocks of eigenvalues algorithm for time series segmentation,” IEEE Transactions on Knowledge and Data Engineering , vol. 30, no. 11, pp. 2051–2064, 2018

  11. [19]

    Multibeats: Blocks of eigenvalues algorithm for multivariate time series dimension- ality reduction,

    A. Gonz ´alez-Vidal, A. Martinez-Ibarra, and A. F. Skarmeta, “Multibeats: Blocks of eigenvalues algorithm for multivariate time series dimension- ality reduction,” Information Fusion, vol. 104, p. 102159, 2024

    2024

  12. [20]

    Dimensionality reduction for fast similarity search in large time series databases,

    E. Keogh, K. Chakrabarti, M. Pazzani, and S. Mehrotra, “Dimensionality reduction for fast similarity search in large time series databases,” Knowledge and information Systems , vol. 3, pp. 263–286, 2001

    2001

  13. [21]

    Least squares quantization in pcm,

    S. Lloyd, “Least squares quantization in pcm,” IEEE transactions on information theory, vol. 28, no. 2, pp. 129–137, 1982

    1982

  14. [22]

    Gaussian mixture models,

    D. Yu, L. Deng, D. Yu, and L. Deng, “Gaussian mixture models,” Automatic Speech Recognition: A Deep Learning Approach , pp. 13–21, 2015

    2015

  15. [23]

    Spectral clustering,

    J. Liu and J. Han, “Spectral clustering,” in Data clustering. Chapman and Hall/CRC, 2018, pp. 177–200

    2018

  16. [24]

    A tutorial on spectral clustering,

    U. V on Luxburg, “A tutorial on spectral clustering,” Statistics and computing, vol. 17, pp. 395–416, 2007

    2007

  17. [25]

    Learning spectral clustering,

    F. Bach and M. Jordan, “Learning spectral clustering,” Advances in neural information processing systems , vol. 16, 2003

    2003

  18. [26]

    G. P. Tolstov, Fourier series. Courier Corporation, 2012

    2012

  19. [27]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in International Conference on Machine Learning . PMLR, 2018, pp. 5650–5659

    2018

  20. [28]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866 , 2018

    2018 arXiv

  21. [29]

    Fltrust: Byzantine- robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine- robust federated learning via trust bootstrapping,” arXiv preprint arXiv:2012.13995, 2020

    2012 arXiv

  22. [30]

    Learning to de- tect malicious clients for robust federated learning,

    S. Li, Y . Cheng, W. Wang, Y . Liu, and T. Chen, “Learning to de- tect malicious clients for robust federated learning,” arXiv preprint arXiv:2002.00211, 2020

    2002 arXiv

  23. [31]

    Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,

    Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 2545–2555

    2022

  24. [32]

    Sentinel: An aggregation function to secure decentralized federated learning,

    C. Feng, A. H. Celdran, J. Baltensperger, E. T. M. Bertran, G. Bovet, and B. Stiller, “Sentinel: An aggregation function to secure decentralized federated learning,” arXiv preprint arXiv:2310.08097 , 2023

    2023 arXiv

  25. [33]

    Lomar: A local defense against poisoning attack on federated learning,

    X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, and Y . Liu, “Lomar: A local defense against poisoning attack on federated learning,” IEEE Transactions on Dependable and Secure Computing , 2021

    2021

  26. [34]

    Feddmc: Efficient and robust federated learning via detecting malicious clients,

    X. Mu, K. Cheng, Y . Shen, X. Li, Z. Chang, T. Zhang, and X. Ma, “Feddmc: Efficient and robust federated learning via detecting malicious clients,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  27. [35]

    Byzantine-robust federated learning through collaborative malicious gradient filtering,

    J. Xu, S.-L. Huang, L. Song, and T. Lan, “Byzantine-robust federated learning through collaborative malicious gradient filtering,” in 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS). IEEE, 2022, pp. 1223–1235

    2022

  28. [36]

    Shielding federated learning: Robust aggregation with adaptive client selection,

    W. Wan, S. Hu, J. Lu, L. Y . Zhang, H. Jin, and Y . He, “Shielding federated learning: Robust aggregation with adaptive client selection,” arXiv preprint arXiv:2204.13256 , 2022

    2022 arXiv

  29. [37]

    The sybil attack,

    J. R. Douceur, “The sybil attack,” in International workshop on peer- to-peer systems. Springer, 2002, pp. 251–260

    2002

  30. [38]

    Fully decentralized federated learning,

    A. Lalitha, S. Shekhar, T. Javidi, and F. Koushanfar, “Fully decentralized federated learning,” in Third workshop on bayesian deep learning (NeurIPS), vol. 2, 2018

    2018

  31. [39]

    Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,

    V . Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in 2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 1354–1371

    2022

  32. [40]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,” Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  33. [41]

    Flower: A friendly federated learning research framework,

    D. J. Beutel, T. Topal, A. Mathur, X. Qiu, T. Parcollet, and N. D. Lane, “Flower: A friendly federated learning research framework,” arXiv preprint arXiv:2007.14390, 2020

    2007 arXiv

  34. [42]

    Emnist: Extending mnist to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik, “Emnist: Extending mnist to handwritten letters,” in 2017 international joint conference on neural networks (IJCNN) . IEEE, 2017, pp. 2921–2926

    2017

  35. [43]

    Leaf: A benchmark for federated settings,

    S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Kone ˇcn`y, H. B. McMahan, V . Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” arXiv preprint arXiv:1812.01097 , 2018

    2018 arXiv

  36. [44]

    Entropy estimates of small data sets,

    J. A. Bonachela, H. Hinrichsen, and M. A. Munoz, “Entropy estimates of small data sets,” Journal of Physics A: Mathematical and Theoretical, vol. 41, no. 20, p. 202001, 2008

    2008

  37. [45]

    Sageflow: Robust federated learning against both stragglers and adversaries,

    J. Park, D.-J. Han, M. Choi, and J. Moon, “Sageflow: Robust federated learning against both stragglers and adversaries,” Advances in neural information processing systems , vol. 34, pp. 840–851, 2021

    2021

  38. [46]

    Trojdrl: evaluation of back- door attacks on deep reinforcement learning,

    P. Kiourti, K. Wardega, S. Jha, and W. Li, “Trojdrl: evaluation of back- door attacks on deep reinforcement learning,” in 2020 57th ACM/IEEE Design Automation Conference (DAC) . IEEE, 2020, pp. 1–6

    2020

  39. [47]

    Byzantine-robust learning on heterogeneous datasets via bucketing,

    S. P. Karimireddy, L. He, and M. Jaggi, “Byzantine-robust learning on heterogeneous datasets via bucketing,” arXiv preprint arXiv:2006.09365, 2020

    2006 arXiv

  40. [48]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021. Enrique M ´armol Campos is a postdoctoral re- searcher at the university of Murcia. He graduated in Mathematics in 2018. The...

    2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.