Pith. sign in

REVIEW 4 major objections 6 minor 50 references

On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Small groups of malicious clients can force LDP federated learning models to near-random accuracy, even when the server uses defensive aggregation.

desk verdict First systematic poisoning study for LDP federated learning; the no-defense attacks are convincing, but the robust-aggregation headline rests on a strong eavesdropping assumption and the evaluation needs more rigor. read the letter →

arxiv 2509.05265 v1 pith:TZ7W6VUM submitted 2025-09-05 cs.CR cs.LG

Zijian Wang , Wei Tong , Tingxuan Han , Haoyu Chen , Tianling Zhang , Yunlong Mao , Sheng Zhong This is my paper · ORCID
classification cs.CRcs.LG
keywords federatedlearninglocaldifferentialprivacymodelpoisoningadaptiveattacksMulti-Krumtrimmedmeanbudgetnon-IIDdata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that locally differentially private federated learning is not inherently resistant to model poisoning: a small fraction of malicious clients can drive the global model to near-random accuracy. The attacks work by reversing the local loss or by solving for poisoned uploads that steer the aggregate to a chosen target model. When the server relies on Multi-Krum or trimmed mean, an adaptive version fits the poisoned updates inside the defense's accepted region. Experiments on three protocols, three datasets, and two network architectures report error rates around 90 percent with roughly 10 to 20 percent malicious clients.

What carries the argument

The load-bearing object is the adversarial report constructor: a reverse training loop that maximizes global loss, together with the target-manipulation identity $\hat{\theta}_{\mathrm{adv}} = (N\theta_{\mathrm{target}} - (N-n)\theta_{\mathrm{est}})/n$ for TMMA. For adaptive attacks, each adversarial training epoch ends with a projection step that either clips the poisoned update to a fixed distance from the geometric median of benign updates or clamps it inside the per-dimension bounds that survive trimmed mean. This projection is what lets poisoned updates evade Multi-Krum and trimmed mean selection.

What would settle it

Run the same attacks with secure aggregation or authenticated channels that hide benign LDP reports from the attacker; if the global model keeps its no-attack accuracy with 10 to 20 percent malicious clients, the collapse result depends on report interception rather than on the LDP mechanisms themselves.

Watch

Extended reading notes

Core claim

The paper establishes that client-side privacy noise does not by itself protect federated learning from poisoning; it can even give attackers cover. Under the assumption that the attacker sees the exact LDP reports benign clients upload, compromised clients can compute uploads from the formula $\hat{\theta}_{\mathrm{adv}} = (N\theta_{\mathrm{target}} - (N-n)\theta_{\mathrm{est}})/n$, placing the aggregated global model exactly on an adversarial target. Against defensive aggregators, adversarial training with a constraint-fitting projection keeps the poisoned updates close to the accepted region while still damaging the model. Across LDPSGD, PrivateFL, and LDP-FL, the strongest variants consistently degrade the global model to error rates near 90 percent, indicating that existing LDPFL protocols are vulnerable to model poisoning.

Load-bearing premise

The attacker must be able to read the exact LDP reports that benign clients send to the server, because the targeted and adaptive attacks derive their poisoned uploads from those precise values.

Editorial extensions

If this is right

  • Under plain aggregation in LDPSGD and PrivateFL, two compromised clients out of twenty push error rates to about 90 percent on MNIST, Fashion-MNIST, and CIFAR-10, meaning the global model becomes effectively random.
  • Against Multi-Krum, 10 to 20 percent compromised clients cause model collapse for LDPSGD and PrivateFL, while LDP-FL needs 20 to 25 percent on simple datasets but only 5 to 10 percent on CIFAR-10.
  • Against trimmed mean, 15 percent compromised clients can produce error rates up to 90 percent on MNIST for both LDPSGD and PrivateFL.
  • Stronger non-IID data generally makes Multi-Krum-defended systems more vulnerable, whereas trimmed mean behaves differently and can reject uneven poisoned updates under highly skewed data.
  • Privacy budget is not a reliable defense: for LDP-FL the paper reports a sharp threshold near $\epsilon=0.674$ where training fails to converge even without attacks, and at small $\epsilon$ values LDPSGD and PrivateFL remain attackable with only 5 to 10 percent malicious clients.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct untested corollary is that secure aggregation or authenticated channels that hide benign LDP reports from the attacker would likely blunt TMMA and AdaPA, because both rely on precise knowledge of benign uploads; the local-knowledge LLRA would remain the residual threat.
  • The same constraint-fitting machinery could be redirected from loss maximization to targeted misclassification or backdoor insertion, since the optimization loop only needs a different objective inside the adversarial training step.
  • The sharp threshold behaviors in client fraction and privacy budget suggest that round-to-round monitoring of the aggregate's loss or of selected-update statistics could serve as an anomaly signal, though the paper does not evaluate such a defense.
  • The formulas assume the attacker knows N and n; testing the attacks under uncertain client counts or with clients that drop out mid-round would clarify how much of the reported effectiveness depends on precise system knowledge.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper studies model poisoning attacks on federated learning with local differential privacy (LDP-FL). The authors propose three attack families: Local Loss Reversal Attack (LLRA), Targeted Model Manipulation Attack (TMMA), and Adaptive Poisoning Attack (AdaPA), the last being designed to evade Multi-Krum and trimmed mean by fitting malicious updates to constraints computed from intercepted benign reports. They evaluate the attacks on LDPSGD, PrivateFL, and LDP-FL over MNIST, Fashion-MNIST, and CIFAR-10, reporting that their attacks drive error rates to roughly 90% in many settings and that AdaPA substantially degrades accuracy under robust aggregation. They also study the effect of data heterogeneity and privacy budget, and they release their code.

Significance. If the empirical claims held in the stated threat model, the paper would be a useful contribution: it is, to the authors' knowledge, the first systematic study of model poisoning on LDP-FL under robust aggregation, and the derivation of TMMA for the real-valued FedAvg case is clean and self-contained. The evaluation covers three protocols, three datasets, and two architectures, and the released code supports reproducibility. The significance is limited by the fact that the most novel results (AdaPA against Multi-Krum and trimmed mean) depend on exact interception of all benign LDP reports, by the absence of any variance analysis or repeated trials, and by the lack of strong attack baselines beyond random poisoning. With revisions that close these gaps, the paper could be a solid assessment of LDP-FL poisoning robustness under a strong adversary.

major comments (4)
  1. [III-A, III-C, Algorithms 2-4, Table IV] The central claim that adaptive attacks can degrade the global model under Multi-Krum and trimmed mean is contingent on a man-in-the-middle capability. Section III-A assumes the attacker intercepts the exact LDP reports of benign clients, and Section III-C notes that the cited prior work with this assumption focuses on federated learning without LDP. Algorithms 2-4 use those intercepted reports to compute the geometric median, the nearest-benign distance, and the trim bounds; without this information, FitOnDef has no input. The only local-knowledge attack that remains under robust aggregation is LLRA-I, and Table IV shows it is weak in that regime (e.g., LDPSGD-MK on Fashion-MNIST: 30.58% error with 15% malicious clients versus 22.37% with no attack). This is not a circularity, because the assumption is stated explicitly, but it makes the headline 'critical vulnerability' claim conditional on a capability the attacker may not possess. Please add a partial-knowledge ablation or clearly reposition the robust-aggregation claims as valid only for an adversary who can eavesdrop on all benign reports.
  2. [III-B, Algorithm 1 lines 20-23] The TMMA formula, theta_adv = (N*theta_target - (N-n)*theta_est)/n, is exact only when malicious clients upload theta_adv unchanged and the server averages the raw real-valued vectors. For LDP-FL, Algorithm 1 then applies DataPerturbation or Clip2Val, which maps every coordinate to one of two discrete values, so the actually uploaded vector is not theta_adv and the aggregated model does not equal theta_target. The paper nevertheless reports TMMA-I and TMMA-O as strong attacks on LDP-FL in Table II. Please analyze the expected aggregate under the discretization, or present TMMA for LDP-FL as a heuristic and state explicitly that exact target manipulation is not achieved in that protocol.
  3. [IV-A, IV-C, Table II, Figures 2-3] All empirical comparisons are point estimates from single runs, although the setup has multiple randomness sources: Dirichlet data partitioning, Poisson sampling, Gaussian noise, and random client selection. With N=20 and only 2-5 malicious clients, the differences among LLRA-I, AdaPA, and RPA in Figures 2-3 are reported without error bars, confidence intervals, or significance tests; Table II even repeats identical values (e.g., 88.65 and 90.00) across many settings. To support the claimed 'consistently outperforms' conclusions, the paper needs repeated seeds, variance reporting, and statistical comparisons. The attack baseline is also only RPA; including an existing optimization-based FL poisoning attack adapted to the LDP setting would substantially strengthen the comparison.
  4. [Algorithm 2, Algorithm 4, Section IV-A] FitOnDef in Algorithm 4 multiplies the Multi-Krum clipping radius by the scale zoom factor SCAL, but Section IV-A never reports the SCAL values used, nor does it report the ATE values for each experiment. SCAL directly controls the distance of adversarial updates from the geometric median and is therefore load-bearing for the results in Figure 2. If SCAL was tuned per protocol or dataset, the comparison to LLRA-I (which has no analogous free parameter) is not apples-to-apples. Please report all hyperparameters and include a sensitivity study over SCAL.
minor comments (6)
  1. [Algorithm 1, line 2; Section IV-C] The abbreviation 'ARE' appears where 'ATE' (adversarial training epoch) is intended, and Section IV-C uses 'ARE=e' without defining ARE; please unify the notation.
  2. [Throughout] The adaptive attack is called 'AdvPA' in Section IV-C but 'AdaPA' in Sections III-C and IV-A; use a single acronym consistently.
  3. [Table II] Identical error-rate values (such as 88.65 and 90.00) appear for many different protocols and attack families; without variance information this may be a rounding artifact or a copy-paste error and should be clarified in a footnote.
  4. [Section IV-B] The RPA scale factor t is set to 50 in the non-robust experiments and to 1 in the robust-aggregation experiments, but no justification or sensitivity analysis is given for either choice.
  5. [Section IV-C, Multi-Krum discussion] The phrase 'the highest accuracy (lower is better for attacks) achieved by AdvPA is 0.173' is confusing because the plots report error rate; please label all quantities consistently as error rates or accuracies.
  6. [References] References [23] and [32] appear to be the same paper (Cao, Jia, and Gong, USENIX Security 21, 'Data Poisoning Attacks to Local Differential Privacy Protocols') and should be merged.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack framework is self-contained and its effectiveness is measured against external benchmarks.

full rationale

The paper's central claim is an empirical one: adaptive model poisoning attacks degrade the global model in LDP federated learning, including under robust aggregation. The attack constructions are not fitted to the experimental outcomes. The TMMA formula θadv = (N·θtarget - (N-n)·θest)/n is an algebraic recipe that, given an estimate θest of benign updates, makes the FedAvg aggregate equal the attacker's chosen target θtarget; it is a construction used to generate inputs, not a prediction derived from the data used to evaluate it. Its success is then measured on held-out test sets, so the reported error rates are not forced by the formula. Similarly, AdaPA's FitOnDef step (Algorithm 4) projects adversarial parameters toward the geometric median of intercepted benign updates or within trimmed-mean bounds; these are threat-model inputs, not parameters fitted to the attack's measured outcome. The only self-citation is the use of the authors' prior work [24] in Section III-A to support the eavesdropping assumption, alongside the independent reference [33]; that assumption is a stated capability, not a derived conclusion, and the robust-aggregation section also invokes external precedents [32], [34]. No equation in the paper reduces to its own inputs, and no fitted constant is renamed as a prediction. The derivation chain is therefore self-contained with respect to circularity, and the paper's main vulnerability claims stand or fall on the realism of its threat model rather than on any circular argument.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the standard LDPFL protocol definitions and on the paper's threat model assumptions, especially the ability to intercept benign reports and to bypass perturbation. No new physical or mathematical entities are introduced. The main free parameters are the adversarial training epoch and the scale factor SCAL, which are not systematically tuned or reported.

free parameters (3)
  • ATE (adversarial training epoch) = set equal to benign epochs e
    In Section IV-C, the authors state 'we select the LLRA-I with ARE=e'; this controls how many adversarial training steps are used and is hand-chosen.
  • SCAL (scale zoom factor) = not specified
    Used in Algorithm 4 to scale the distance threshold for Multi-Krum; no value is given in the paper, leaving the attack under-specified.
  • RPA scalar t = 1 for robust aggregation, 50 for non-robust
    A hyperparameter for the random poisoning baseline; chosen by the authors, affects comparison strength.
assumptions (4)
  • domain assumption The attacker can intercept benign clients' LDP reports.
    Stated in Section III-A; needed for TMMA and AdaPA.
  • domain assumption The server applies the specified aggregation rule (FedAvg, Multi-Krum with f=8 and k=10, or trimmed mean with beta=5) exactly as described.
    Assumed throughout Section IV; attacks are designed to exploit these specific rules.
  • standard math LDP perturbation mechanisms in LDPSGD, PrivateFL, and LDP-FL behave as described in Section II-C.
    The attacks rely on the functional form of the noise and clipping, and on the two-point output set of LDP-FL.
  • ad hoc to paper Malicious clients can bypass LDP perturbation (LLRA-O, TMMA-O) without the server rejecting their reports.
    Assumed in the threat model and Table I; the server does not validate that reports satisfy LDP.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy." pith.science (2026). https://pith.science/paper/TZ7W6VUM

@misc{pith2026250905265,
  author       = {Pith},
  title        = {Pith review of: On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TZ7W6VUM}},
  note         = {Machine review of arXiv:2509.05265}
}
read the original abstract

Federated learning (FL) combined with local differential privacy (LDP) enables privacy-preserving model training across decentralized data sources. However, the decentralized data-management paradigm leaves LDPFL vulnerable to participants with malicious intent. The robustness of LDPFL protocols, particularly against model poisoning attacks (MPA), where adversaries inject malicious updates to disrupt global model convergence, remains insufficiently studied. In this paper, we propose a novel and extensible model poisoning attack framework tailored for LDPFL settings. Our approach is driven by the objective of maximizing the global training loss while adhering to local privacy constraints. To counter robust aggregation mechanisms such as Multi-Krum and trimmed mean, we develop adaptive attacks that embed carefully crafted constraints into a reverse training process, enabling evasion of these defenses. We evaluate our framework across three representative LDPFL protocols, three benchmark datasets, and two types of deep neural networks. Additionally, we investigate the influence of data heterogeneity and privacy budgets on attack effectiveness. Experimental results demonstrate that our adaptive attacks can significantly degrade the performance of the global model, revealing critical vulnerabilities and highlighting the need for more robust LDPFL defense strategies against MPA. Our code is available at https://github.com/ZiJW/LDPFL-Attack

Figures

Figures reproduced from arXiv: 2509.05265 by the authors.

Figure 1
Figure 1. Distribution of label in each client with [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Error rate against Multi-Krum defend. (a)-(d) LDPSGD. (e)-(h) PrivateFL. (i)-(l) LDP-FL. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Attack against trimmed mean defend (a)-(d) LDPSGD. (e)-(f) PrivateFL. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Client label distribution under different [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: (a)-(e): Impact of α with different fractions of compromised clients. (f): 15% compromised clients with different α among different LDP federated learning protocols. E. Impact of Privacy Budget ϵ In this section, we analyze the impact of the privacy budget on attack ef…
Figure 6
Figure 6. Figure 6: Influence of ϵ with different proportions of compromised clients. (f) Error rate of different methods with 10% compromised clients Various defense mechanisms have been proposed in recent studies, with most strategies implemented during the aggrega￾tion process. Through…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 26 canonical work pages

  1. [1]

    Federated learning for mobile keyboard prediction,

    A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Beaufays, S. Augen- stein, H. Eichner, C. Kiddon, and D. Ramage, “Federated learning for mobile keyboard prediction,”arXiv preprint arXiv:1811.03604, 2018

    arXiv 2018

  2. [2]

    Multi- institutional deep learning modeling without sharing patient data: A feasibility study on brain tumor segmentation,

    M. J. Sheller, G. A. Reina, B. Edwards, J. Martin, and S. Bakas, “Multi- institutional deep learning modeling without sharing patient data: A feasibility study on brain tumor segmentation,” inBrainlesion: Glioma, Multiple Sclerosis, Stroke and Traumatic Brain Injuries. Cham: Springer International Publishing, 2019, pp. 92–104

    work page 2019

  3. [5]

    A profit-maximizing data marketplace with differentially private federated learning under price competition,

    P. Sun, L. Wu, Z. Wang, J. Liu, J. Luo, and W. Jin, “A profit-maximizing data marketplace with differentially private federated learning under price competition,”Proc. ACM Manag. Data, vol. 2, no. 4, Sep. 2024. [Online]. Available: https://doi.org/10.1145/3677127

    work page doi:10.1145/3677127 2024

  4. [8]

    Federatedscope: A flexible federated learning platform for heterogeneity,

    Y . Xie, Z. Wang, D. Gao, D. Chen, L. Yao, W. Kuang, Y . Li, B. Ding, and J. Zhou, “Federatedscope: A flexible federated learning platform for heterogeneity,”Proc. VLDB Endow., vol. 16, no. 5, p. 1059–1072, Jan

    work page

  5. [9]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 739–753

    2019

  6. [10]

    Maskcrypt: Federated learning with selective ho- momorphic encryption,

    C. Hu and B. Li, “Maskcrypt: Federated learning with selective ho- momorphic encryption,”IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 1, pp. 221–233, 2025

    work page 2025

  7. [11]

    One parameter de- fense—defending against data inference attacks via differential privacy,

    D. Ye, S. Shen, T. Zhu, B. Liu, and W. Zhou, “One parameter de- fense—defending against data inference attacks via differential privacy,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 1466–1480, 2022

    work page 2022

  8. [12]

    Uldp-fl: Federated learning with across-silo user-level differential privacy,

    F. Kato, L. Xiong, S. Takagi, Y . Cao, and M. Yoshikawa, “Uldp-fl: Federated learning with across-silo user-level differential privacy,”Proc. VLDB Endow., vol. 17, no. 11, p. 2826–2839, Jul. 2024. [Online]. Available: https://doi.org/10.14778/3681954.3681966

    arXiv 2024

Show all 50 references
  1. [13]

    User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization ,

    K. Wei, J. Li, M. Ding, C. Ma, H. Su, B. Zhang, and H. V . Poor, “ User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization ,”IEEE Transactions on Mobile Computing, vol. 21, no. 09, pp. 3388–3401, Sep. 2022. [Online]. Available: https://doi.ieeec...

    2022

  2. [14]

    Local and central differential privacy for robustness and privacy in federated learning,

    M. Naseri, J. Hayes, and E. D. Cristofaro, “Local and central differential privacy for robustness and privacy in federated learning,” inProceedings of the 2022 Network and Distributed System Security Symposium (NDSS). Internet Society, Feb. 2022. [Online]. Available: https://w...

    2022

  3. [15]

    PrivateFL: Accurate, differentially private federated learning via personalized data transformation,

    Y . Yang, B. Hui, H. Yuan, N. Gong, and Y . Cao, “PrivateFL: Accurate, differentially private federated learning via personalized data transformation,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 1595–1612. [Online]. A...

    2023

  4. [16]

    Ldp-fl: Practical private aggregation in federated learning with local differential privacy,

    L. Sun, J. Qian, and X. Chen, “Ldp-fl: Practical private aggregation in federated learning with local differential privacy,” inProceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, Z.-H. Zhou, Ed. International Joint Conferences on A...

    2021 doi

  5. [17]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS’16. ACM, Oct. 2016. [Online]. Available: http://dx...

    2016

  6. [18]

    Data poisoning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” inComputer security–ESORICs 2020: 25th European symposium on research in computer security, ESORICs 2020, guildford, UK, September 14–18, 2020, proceedings, part i 25...

    2020

  7. [19]

    A novel data poisoning attack in federated learning based on inverted loss function,

    P. Gupta, K. Yadav, B. B. Gupta, M. Alazab, and T. R. Gadekallu, “A novel data poisoning attack in federated learning based on inverted loss function,”Computers & Security, vol. 130, p. 103270, 2023

    2023

  8. [20]

    Gan-driven data poisoning attacks and their mitiga- tion in federated learning systems,

    K. Psychogyios, T.-H. Velivassaki, S. Bourou, A. V oulkidis, D. Skias, and T. Zahariadis, “Gan-driven data poisoning attacks and their mitiga- tion in federated learning systems,”Electronics, vol. 12, no. 8, p. 1805, 2023

    2023

  9. [21]

    Can you really backdoor federated learning?

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?”arXiv preprint arXiv:1911.07963, 2019

    1911 arXiv

  10. [22]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inInternational conference on artificial intelligence and statistics. PMLR, 2020, pp. 2938–2948

    2020

  11. [23]

    Data poisoning attacks to local differential privacy protocols,

    X. Cao, J. Jia, and N. Z. Gong, “Data poisoning attacks to local differential privacy protocols,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 947–964

    2021

  12. [24]

    Data poisoning attacks to locally differentially private frequent itemset mining protocols,

    W. Tong, H. Chen, J. Niu, and S. Zhong, “Data poisoning attacks to locally differentially private frequent itemset mining protocols,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York, NY , USA: Association for ...

    2024

  13. [25]

    Poisoning attacks to local differential privacy protocols for Key-Value data,

    Y . Wu, X. Cao, J. Jia, and N. Z. Gong, “Poisoning attacks to local differential privacy protocols for Key-Value data,” in31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 519–536. [Online]. Available: https: //www.usenix.org/c...

    2022

  14. [26]

    Robustness of locally differentially private graph analysis against poisoning,

    J. Imola, A. R. Chowdhury, and K. Chaudhuri, “Robustness of locally differentially private graph analysis against poisoning,” 2022. [Online]. Available: https://arxiv.org/abs/2210.14376

    2022 arXiv

  15. [27]

    Data Poisoning Attacks to Local Differential Privacy Protocols for Graphs ,

    X. He, K. Huang, Q. Ye, and H. Hu, “ Data Poisoning Attacks to Local Differential Privacy Protocols for Graphs ,” in2025 IEEE 41st International Conference on Data Engineering (ICDE). Los Alamitos, CA, USA: IEEE Computer Society, May 2025, pp. 987–

    2025

  16. [28]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems, vol. 30, 2017

    2017

  17. [29]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inInternational conference on machine learning. Pmlr, 2018, pp. 5650–5659

    2018

  18. [30]

    Communication-Efficient Learning of Deep Networks from Decentralized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” inProceedings of the 20th International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Rese...

    2017

  19. [31]

    Rappor: Randomized aggregatable privacy-preserving ordinal response,

    U. Erlingsson, V . Pihur, and A. Korolova, “Rappor: Randomized aggregatable privacy-preserving ordinal response,” inProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’14. New York, NY , USA: Association for Computing Machinery, 201...

    2014

  20. [32]

    Data poisoning attacks to local differential privacy protocols,

    X. Cao, J. Jia, and N. Z. Gong, “Data poisoning attacks to local differential privacy protocols,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 947–964. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity21/present...

    2021

  21. [33]

    Fine-grained poisoning attack to local differential privacy protocols for mean and variance estimation,

    X. Li, N. Li, W. Sun, N. Z. Gong, and H. Li, “Fine-grained poisoning attack to local differential privacy protocols for mean and variance estimation,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 1739–1756. [Online]. Av...

    2023

  22. [34]

    Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,

    V . Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 1354–1371

    2022

  23. [35]

    Gradient-based learning applied to document recognition,

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  24. [36]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,”CoRR, vol. abs/1708.07747, 2017. [Online]. Available: http://arxiv.org/abs/1708. 07747

    2017 arXiv

  25. [37]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,”

  26. [38]

    Vgg-s: Improved small sample image recog- nition model based on vgg16,

    X. Jin, X. Du, and H. Sun, “Vgg-s: Improved small sample image recog- nition model based on vgg16,” in2021 3rd International Conference on Artificial Intelligence and Advanced Manufacture (AIAM), 2021, pp. 229–232

    2021

  27. [39]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  28. [40]

    Opacus: User-friendly differential privacy library in PyTorch,

    A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testuggine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao, G. Cormode, and I. Mironov, “Opacus: User-friendly differential privacy library in PyTorch,”arXiv preprint arXiv:2109.12298, 2021

    2021 arXiv

  29. [41]

    Robust Aggregation for Federated Learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust Aggregation for Federated Learning,”IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022

    2022

  30. [42]

    Practical differentially private and byzantine-resilient federated learning,

    Z. Xiang, T. Wang, W. Lin, and D. Wang, “Practical differentially private and byzantine-resilient federated learning,”Proceedings of the ACM on Management of Data, vol. 1, no. 2, pp. 1–26, 2023

    2023

  31. [43]

    Local differential privacy for federated learning

    P. C. Mahawaga Arachchige, D. Liu, S. Camtepe, S. Nepal, M. Grobler, P. Bertok, and I. Khalil, “Local differential privacy for federated learning.” Berlin, Heidelberg: Springer-Verlag, 2022, p. 195–216. [Online]. Available: https://doi.org/10.1007/978-3-031-17140-6 10

    2022 doi

  32. [44]

    Deep model poisoning attack on federated learning,

    X. Zhou, M. Xu, Y . Wu, and N. Zheng, “Deep model poisoning attack on federated learning,”Future Internet, vol. 13, no. 3, p. 73, 2021

    2021

  33. [45]

    Mpaf: Model poisoning attacks to federated learning based on fake clients,

    X. Cao and N. Z. Gong, “Mpaf: Model poisoning attacks to federated learning based on fake clients,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 3396–3404

    2022

  34. [46]

    Fedrecattack: Model poisoning attack to federated recommendation,

    D. Rong, S. Ye, R. Zhao, H. N. Yuen, J. Chen, and Q. He, “Fedrecattack: Model poisoning attack to federated recommendation,” in2022 IEEE 38th International Conference on Data Engineering (ICDE). IEEE, 2022, pp. 2643–2655

    2022

  35. [47]

    Model poisoning attacks to federated learning via multi-round consistency,

    Y . Xie, M. Fang, and N. Z. Gong, “Model poisoning attacks to federated learning via multi-round consistency,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) 2025, ser. CVPR, Jun. 2025. [Online]. Available: https://cvpr.thecvf.com/vi...

    2025

  36. [48]

    Robfl: Robust federated learning via feature center separation and malicious center detection,

    T. Zhou, N. Liu, B. Song, H. Lv, D. Guo, and L. Liu, “Robfl: Robust federated learning via feature center separation and malicious center detection,” in2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 2024, pp. 926–938

    2024

  37. [49]

    Privacy and robustness in federated learning: Attacks and defenses,

    L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and S. Y . Philip, “Privacy and robustness in federated learning: Attacks and defenses,”IEEE transactions on neural networks and learning systems, 2022

    2022

  38. [50]

    Dp-gsgld: A bayesian optimizer inspired by differential privacy defending against privacy leakage in federated learning,

    C. Yang, K. Jia, D. Kong, J. Qi, and A. Zhou, “Dp-gsgld: A bayesian optimizer inspired by differential privacy defending against privacy leakage in federated learning,”Computers & Security, vol. 142, p. 103839, 2024

    2024

  39. [51]

    Ldprecover: Recovering frequencies from poisoning attacks against local differential privacy,

    X. Sun, Q. Ye, H. Hu, J. Duan, T. Wo, J. Xu, and R. Yang, “Ldprecover: Recovering frequencies from poisoning attacks against local differential privacy,” in2024 IEEE 40th International Conference on Data Engi- neering (ICDE). IEEE, 2024, pp. 1619–1631

    2024

  40. [1000]

    Available: https://doi.ieeecomputersociety.org/10.1109/ ICDE65448.2025.00079

    [Online]. Available: https://doi.ieeecomputersociety.org/10.1109/ ICDE65448.2025.00079

    2025

  41. [2009]

    Available: https://api.semanticscholar.org/CorpusID: 18268744

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 18268744

  42. [2023]

    Available: https://doi.org/10.14778/3579075.3579081

    [Online]. Available: https://doi.org/10.14778/3579075.3579081

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.