Pith. sign in

REVIEW 3 major objections 7 minor 56 references

FL-OA: A Byzantine-Robust Federated Learning Framework with Outsourced Auditing for Intelligent Devices

T0 review · 3 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Federated learning can outsource its update auditing to a third party that holds a clean root dataset, and the paper claims this removes the need for a benign majority or a server-owned dataset.

desk verdict Broad, well-executed empirical study undermined by a convergence theorem that contradicts its own assumptions and a central claim that overstates the framework's assumptions. read the letter →

arxiv 2608.01095 v1 pith:KJBKK3NK submitted 2026-08-02 cs.LG cs.AI

Hongliang Zhang , Zhongyuan Yu , Fenghua Xu , Teng Hu , Jian Meng , Jiguo Yu This is my paper · ORCID
classification cs.LGcs.AI
keywords federatedlearningByzantineattacksoutsourcedauditingtrustscorenon-IIDdatacurseofdimensionalitygradientascentcorrectionterm
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes FL-OA, a federated learning defense that hands the job of auditing device updates to a separate outsourced server holding a clean root dataset. The claim is that the task server can then aggregate updates safely without owning a root dataset itself and without assuming that less than half the devices are malicious. To make auditing reliable, FL-OA reshapes local training with a gradient ascent step and a correction term that pull benign updates closer together, and it audits only a selected fraction of coordinates using a parameter importance indicator, sidestepping the curse of dimensionality. A convergence theorem gives a bound on the distance from the learned model to the optimum, and experiments on CIFAR10, CIFAR100, and other benchmarks report higher accuracy than several existing defenses. The load-bearing condition is that the auditor's data and the devices' data come from the same distribution: under a two-class partition with disjoint classes, accuracy drops below 60% even with no attackers.

What carries the argument

The load-bearing object is the outsourced audit pipe: the outsourced server's root update $u^t_{\mathrm{root}}$ is the reference vector; the Parameter Importance Indicator $\mathrm{PII}^t_k[j] = |u^t_k[j]| + \frac{|u^t_k[j]| - \mathrm{med}(\{|u^t_i[j]|\})}{\mathrm{med}(\{|u^t_i[j]|\}) + \epsilon}$ picks the top-$\kappa$ coordinates per device, and the trust score $s_k^t = \mathrm{ReLU}(\cos(u_k^t \odot M_k^t, u_{\mathrm{root}}^t))$ converts directional agreement into an aggregation weight. The aggregation rule $W^{t+1} = W^t + \mu \frac{\sum_k s_k^t \hat{u}_k^t}{\sum_k s_k^t}$ then suppresses any update that disagrees with the root direction. Alongside it, the local-training formula combines a flat-minimum-seeking gradient ascent step with a correction term $\hat{b}_k^t$ that accumulates historical local offset, which the paper claims makes the set of benign updates cohesive enough that cosine similarity against the root can distinguish malicious from benign.

What would settle it

Run FL-OA on CIFAR10 with a two-class non-IID partition in which each device owns two disjoint classes and the outsourced server owns a different pair of classes (the paper's Root2 configuration): Table VI reports test accuracy below 60% even with no malicious devices, so the claim that robust aggregation holds without strong assumptions is contradicted in exactly this distribution-shift regime.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes that Byzantine-robust federated aggregation can be outsourced: a third-party server holding a root dataset computes a root update, then scores every device update by the relu-clipped cosine similarity between the root update and the device update restricted to the most important coordinates, normalizes each update to the root norm, and returns the trust scores and normalized updates to the task server, which aggregates them as a trust-weighted average. The paper argues that this removes the server's need to hold a root dataset and removes the benign-majority assumption. It also claims that the local-training modification, a lookahead gradient ascent step combined with a momentum correction term, reduces divergence among benign updates, and that the parameter importance indicator selects coordinates on which benign and malicious updates separate most clearly. Theorem 1 states that, under the paper's assumptions, the global model satisfies the deviation bound $\|W^t - W^*\| \le (1-\tau)^t \|W^{\mathrm{init}} - W^*\| + 12\mu \Delta_1/\tau$, so after many rounds the model stays within a bounded neighborhood of the optimum.

Load-bearing premise

The scheme treats the outsourced server's root dataset as drawn from the same distribution as every device's local data; if the auditor's data does not overlap with what the devices actually hold, the trust scores lose their meaning and the defense collapses.

Editorial extensions

If this is right

  • A task server can contract auditing out to any third party with a suitable clean dataset, so the practical bar for root-dataset defenses drops from 'server must own the data' to 'some organization must own the data and be reachable over the network.'
  • Defense no longer relies on a benign majority: experiments in the paper report usable accuracy when 50%, 60%, and 70% of devices are malicious, unlike statistical methods that degrade near the 50% mark.
  • Because only the top-$\kappa$ coordinates are compared, the audit cost and the chance of two high-dimensional updates looking artificially similar both shrink; the paper's ablation shows auditing 30% of coordinates beats auditing 100%.
  • Without any attacker, FL-OA's accuracy remains close to plain averaged aggregation, so the defense does not buy robustness at the cost of degraded clean training.
  • The convergence bound implies the final model stays within a constant-radius ball around the optimum whose radius is controlled by the root dataset size, giving a concrete knob: larger clean root datasets tighten the achievable error floor.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The trust-score mechanism is direction-only after normalization: because each update is rescaled to the root norm, an attacker who can estimate the root direction could copy a benign direction while biasing the data it was trained on, a subtle poisoning strategy the paper does not analyze.
  • Since the PII masks are computed from the current batch of updates, a coordinated adversary that knows the audit protocol can in principle craft updates whose selected coordinates match benign statistics while poisoning the remaining coordinates; running an adaptive attack that optimizes against the exact mask would test whether the scheme's security holds against informed adversaries.
  • The paper's Theorem 1 error floor contains terms that grow with model dimension and shrink with the square root of the root dataset size, so for very large models the bound weakens; measuring whether FL-OA's empirical accuracy on ResNet50 still tracks the bound would clarify how the curse of dimensionality re-enters through the theory even if the audit uses fewer coordinates.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes FL-OA, a Byzantine-robust federated learning framework in which the task server collaborates with an outsourced server that holds a root dataset. The outsourced server audits each device update by extracting critical parameters via a parameter-importance indicator, computing a ReLU-cosine trust score against the root update, and normalizing update magnitudes; the task server then performs a trust-weighted aggregation. During local training, FL-OA adds a gradient-ascent step and a correction term intended to reduce divergence among benign updates. The manuscript claims theoretical guarantees in Theorem 1 (bounded deviation of the global model from the optimum under Byzantine attacks) and Theorem 2 (characterization of the correction term), and presents extensive experiments on CIFAR10, CIFAR100, SVHN, CINIC, and Tiny-ImageNet under Gaussian, Neurotoxin, and Focused-Flip attacks, with up to 70% malicious devices, plus ablations, sensitivity studies, scalability, stability, and complexity measurements.

Significance. If the theoretical claims were corrected and the missing appendices supplied, the paper would make a useful contribution: it combines outsourced root-dataset auditing with local-training modifications, and the PII-based coordinate selection is an interesting response to the curse of dimensionality. The empirical evaluation is broad and mostly consistent, showing FL-OA outperforming five baselines across several datasets and attack types. The paper is also honest about important limitations, including the two-class non-IID breakdown and the OS-collusion/privacy caveats. However, the formal anchor Theorem 1 is currently false as stated, the proofs are in absent appendices, and Assumption 2 limits the advertised 'without strong assumptions' claim. The paper is promising but not publishable without substantial revision.

major comments (3)
  1. [Section V, Theorem 1 (Eq. (13))] The displayed contraction bound is internally inconsistent under Assumption 1. Since the global loss is both γ-strongly convex and L1-smooth, we have γ ≤ L1. Let x = μL1 > 0. The parenthesized quantity τ = 1 − (√(1+μ²L1²−μγ) + 2μL1 + 24μΔ2) satisfies τ < 0 because √(1+x²−x) + 2x > 1 for every x > 0, and 24μΔ2 is positive. Hence (1−τ)^t is exponentially growing in t, so Eq. (13) does not bound the deviation to a neighborhood of W*. Moreover, Eq. (7) shows that the aggregated update depends on attack-dependent trust scores s_t^k, but the theorem statement contains no quantity that encodes the effect of malicious updates; without such a term, or an explicit bound on it in the proof, Theorem 1 cannot support the Byzantine-robustness claim in Discussion 1. The proof is said to be in Appendix I, which is not present in the manuscript. The authors must correct the theorem statement and supply a complete proof.
  2. [Section V, Theorem 2 and Algorithm 2] The proof of Theorem 2 is relegated to an 'Appendix II' that is not included in the manuscript. Since Discussion 2 uses Theorem 2 to justify the correction-term design and to claim that the correction term estimates the local offset, this is a load-bearing theoretical claim. The algebra in Section V is partially checkable from Algorithm 2, but the manuscript must include the full derivation, including the indexing of λ(e) and the statement of the recurrence that leads to Eqs. (14) and (15).
  3. [Section V, Assumption 2 and Section VI.B.8, Table VI] Assumption 2 requires the root dataset and every device dataset to be independently sampled from the same training distribution χ, yet the abstract and Section I advertise robustness 'without strong assumptions.' The two-class non-IID experiment (Root2) in Table VI shows that when class sets are disjoint, FL-OA accuracy falls below 60% on CIFAR10 even without attacks, and drops to 26–52% under Gaussian and Neurotoxin attacks. The paper itself concludes that the framework is suited only to scenarios where classes overlap significantly. This is a load-bearing limitation of the outsourced-auditing trust mechanism, and the 'no strong assumptions' claim should be qualified accordingly in the abstract and introduction, or Assumption 2 should be weakened and the method adapted.
minor comments (7)
  1. [Section IV.C, Eq. (4)] The text alternates between 'PII' and 'PIF' (e.g., 'a corresponding PII vector' and 'A parameter with a large PIF value'); please use a single consistent abbreviation.
  2. [Section VI.A.3] The three attack types are numbered (i), (ii), (ii); the third should be (iii).
  3. [Section VI.B.8, Table VI] The Neurotoxin rows appear to be missing the Att=30% entries for Root2, Root10, and DIR(0.1): only nine percentages are shown for the twelve columns. Please complete the table.
  4. [Section VI.B.2] The fidelity discussion says FL-OA should be close to Baseline, but then states that under DIR(0.1) FL-OA is significantly higher than Baseline; this apparent tension should be clarified.
  5. [Section V, Discussion 2] The sentence 'the inconsistency of model updates is independent the local learning rate η and the importance α' should read 'independent of the local learning rate ... and ...'; also, 'exponential average' is used loosely.
  6. [Table IV] The header contains the typo 'RseNet18'; it should be 'ResNet18'.
  7. [Algorithm 3 and Section IV.C] The notation for the critical-parameter selection function is inconsistent: Algorithm 3 uses 'Top(PII,κ)' while the text defines 'top(PII,κ)'; please harmonize.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: FL-OA's claims are evaluated against external benchmarks and no prediction reduces to a fitted input or load-bearing self-citation.

full rationale

The derivation chain is self-contained against external benchmarks, so no circular step is present. The trust-score rule (Eq. 6), parameter importance indicator (Eq. 4), normalization, and aggregation update (Eq. 7) are tested on CIFAR10, CIFAR100, SVHN, CINIC, and Tiny-ImageNet and compared with Krum, FLTrust, FL-Auditor, AlignIns, and FLgym, so the robustness claims are not fitted to the target result. The only self-citation, reference [6] in Related Work, describes prior model-contrastive federated learning and is not load-bearing for FL-OA's convergence or defense claims. Theorem 1 is asserted with its proof deferred to a missing Appendix I; that is an omitted-proof and correctness risk, not circularity, because Eq. (13) is not definitionally equal to Assumptions 1-3 or to the aggregation update. Assumption 2, which requires distributional overlap between root and local data, is a stated modeling condition rather than a suppressed conclusion, and Section VI.B.8 explicitly reports that accuracy collapses below 60% on two-class disjoint Non-IID data, showing that the paper itself flags the boundary of its assumption. No step in the paper reduces by construction to its own inputs, and no externally fitted parameter is renamed as a prediction.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The central robustness claim rests on several explicit assumptions and hand-set hyperparameters. The most fragile is Assumption 2 (root dataset distribution matches device data), which the paper's own experiments show is load-bearing. No invented physical entities are introduced.

free parameters (8)
  • alpha (correction-term weight) = 0.1
    Controls strength of the proximal/correction term in Algorithm 2; sensitivity shown in Fig. 8; chosen by hand.
  • beta (gradient-ascent weight) = 0.1
    Balances original and ascent gradients in local training; small beta hurts accuracy (Fig. 8); chosen by hand.
  • kappa (critical-parameter ratio) = 30%
    Fraction of coordinates kept by PII for auditing; ablation in Table IV shows 30% often beats 70% and 100%; chosen by hand.
  • epsilon (PII denominator stabilizer) = not specified
    Avoids division by zero in Eq. (4); value not reported.
  • local learning rate eta = 0.1
    Local SGD step size; standard but hand-set.
  • global learning rate mu = 1.0
    Server aggregation step size in Eq. (7); hand-set.
  • local iterations E = 5
    Number of local epochs per round; hand-set.
  • client participation rate = 20%
    Fraction of devices selected per round; hand-set.
assumptions (4)
  • domain assumption L(W) is gamma-strongly convex and differentiable over Phi with L1-Lipschitz gradient; empirical loss l(W) is L2-Lipschitz probabilistically (Eqs. 8-10).
    Used to prove Theorem 1's convergence bound. Strong convexity is not satisfied by ResNet18 or CIFAR models used in experiments, so the theory may not apply to the evaluated setting.
  • domain assumption Local datasets D_k and root dataset D_root are independently sampled from the same training distribution chi (Assumption 2).
    The entire trust-score pipeline assumes the root update is a reliable reference. Section VI.B.8 shows accuracy collapses when class sets are disjoint, indicating the assumption is load-bearing.
  • domain assumption Gradient of empirical loss at the optimum and centered differences are sub-exponential with constants sigma1, gamma1, sigma2, gamma2 (Assumption 3).
    Used for concentration inequalities in the bound; standard in FL theory but unverified for the benchmark tasks.
  • domain assumption Task server and outsourced server execute the protocol honestly and are not compromised (Section III.B and Section VII).
    The abstract claims robustness without strong assumptions, but the defense fails if OS colludes with malicious devices, as the authors acknowledge in the conclusion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FL-OA: A Byzantine-Robust Federated Learning Framework with Outsourced Auditing for Intelligent Devices." pith.science (2026). https://pith.science/paper/KJBKK3NK

@misc{pith2026260801095,
  author       = {Pith},
  title        = {Pith review of: FL-OA: A Byzantine-Robust Federated Learning Framework with Outsourced Auditing for Intelligent Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KJBKK3NK}},
  note         = {Machine review of arXiv:2608.01095}
}
abstract

Federated learning (FL) enables multiple intelligent devices to collaboratively train a high-accuracy model without sharing raw data. However, due to its distributed nature, FL is vulnerable to Byzantine attacks. Existing defense methods rely on strong assumptions, such as the proportion of malicious devices not exceeding 50\%, or the server having an additional root dataset that matches the training task. Moreover, they show limited efficacy as they overlook $(i)$ the divergence among benign updates and $(ii)$ the curse of dimensionality involved in comparing two high-dimensional updates. To solve these concerns, we propose FL-OA, a Byzantine-robust federated learning framework utilizing outsourced auditing. In FL-OA, the server collaborates with third-party organization that holds an additional root dataset to perform outsourced auditing, thereby enabling the server to achieve robust aggregation without strong assumptions. Additionally, FL-OA introduces a gradient ascent step and a correction term during local training to mitigate the divergence among benign updates, and designs a parameter importance indicator to extract critical parameters for auditing, alleviating the curse of dimensionality. We further provide a detailed theoretical analysis of FL-OA. Extensive experiments demonstrate that FL-OA outperforms existing defense methods against Byzantine attacks.

Figures

Figures reproduced from arXiv: 2608.01095 by the authors.

Figure 1
Figure 1. A typical FL architecture. The server, operated by a tech￾nology company (e.g., Huawei or Apple), coordinates global model training, while multiple intelligent devices (e.g., cell phones, laptops, and desktops) collaboratively train the model in edge scenarios. To this end, federated learning (FL) has emerged as a distributed computing paradigm that enables multiple intelligent devices to collaboratively train a glo… view at source ↗
Figure 2
Figure 2. The relative maximum difference with respect to di￾mensionality. Notably, existing works [3]– [13], [21]–[23] confront the curse of dimensionality with increasing model scales, regardless of whether they rely on statistical knowl￾edge or an additional root dataset. Specifically, when model updates have high dimensionality, the Eu￾clidean distance or cosine similar￾ity computed by these works yields the curse of dime… view at source ↗
Figure 3
Figure 3. System architecture of FL-OA. rule due to legal regulations and company reputation. However, the TS cannot guarantee that all intelligent devices follow the protocol. Thus, we assume that the intelligent devices consist of both benign and malicious devices. Specifically, each benign device honestly performs local training and uploads its model update. Instead, malicious devices disturb the global model by tampering … view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Divergence comparison between FL-OA and existing schemes in both IID and Non-IID settings without attacks. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Convergence of the proposed FL-OA over CIFAR10 and CIFAR100 in both IID and Non-IID settings. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Test accuracy of FL-OA for different numbers of malicious devices [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: (a) The distribution of parameter importance values. (b) Pairwise sim [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Test accuracy (%) of FL-OA under the coefficients [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Scalability of FL-OA against Gaussian attacks over CIFAR10 and [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Stability of FL-OA under both Gaussian and Neurotoxin attacks on [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: The transmission de￾lay between the TS and the OS in FL-OA. To emulate WAN scenarios under different bandwidth conditions, we limit both the uplink and downlink transmission bandwidths between the TS and the OS to 20 Mbps, 50 Mbps, 100 Mbps, and 200 Mbps, respectively…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 44 canonical work pages

  1. [1]

    Threats to training: A survey of poisoning attacks and defenses on machine learning systems,

    Z. Wang, J. Ma, X. Wang, J. Hu, Z. Qin, and K. Ren, “Threats to training: A survey of poisoning attacks and defenses on machine learning systems,”ACM Comput. Surv., vol. 55, no. 7, pp. 1–36, 2022

    work page 2022

  2. [2]

    The impact of adversarial attacks on federated learning: A survey,

    K. N. Kumar, C. K. Mohan, and L. R. Cenkeramaddi, “The impact of adversarial attacks on federated learning: A survey,”IEEE Trans. Pattern Anal. Mach. Intell., vol. 46, no. 5, pp. 2672–2691, 2024

    work page 2024

  3. [3]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” inProc. Adv. Neural Inf. Process. Syst., 2017, pp. 119–129

    work page 2017

  4. [4]

    Multi-metrics adaptively identifies backdoors in federated learning,

    S. Huang, Y . Li, C. Chen, L. Shi, and Y . Gao, “Multi-metrics adaptively identifies backdoors in federated learning,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 2023, pp. 4652–4662

    work page 2023

  5. [5]

    Mesas: Poisoning defense for federated learning resilient against adaptive attackers,

    T. Krauß and A. Dmitrienko, “Mesas: Poisoning defense for federated learning resilient against adaptive attackers,” inProc. ACM Conf. Com- put. Commun. Secur., 2023, pp. 1526–1540

    work page 2023

  6. [6]

    Toward model-contrastive federated learning with lightweight privacy preservation and poisoning attack detection,

    H. Zhang, Z. Yu, G. Wang, F. Xu, Y . Zhang, C. Hu, X. Wang, and J. Yu, “Toward model-contrastive federated learning with lightweight privacy preservation and poisoning attack detection,”IEEE Trans. Dependable Secure Comput., vol. 23, no. 2, pp. 1830–1846, 2026

    work page 2026

  7. [7]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inProc. Int. Conf. Mach. Learn., 2018, pp. 5650–5659

    work page 2018

  8. [8]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” inProc. NDSS Symposium, 2021

    work page 2021

Show all 56 references
  1. [9]

    Privacy-preserving byzantine-robust federated learning via blockchain systems,

    Y . Miao, Z. Liu, H. Li, K. Choo, and R. Deng, “Privacy-preserving byzantine-robust federated learning via blockchain systems,”IEEE Trans. Inf. Forensics Secur., vol. 17, pp. 2848–2861, 2022. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 15

    2022

  2. [10]

    Using third- party auditor to help federated learning: An efficient byzantine-robust federated learning,

    Z. Zhang, L. Wu, D. He, J. Li, N. Lu, and X. Wei, “Using third- party auditor to help federated learning: An efficient byzantine-robust federated learning,”IEEE Trans. Sustainable Comput., vol. 9, no. 6, pp. 848–861, 2024

    2024

  3. [11]

    Wmdefense: Using watermark to defense byzantine attacks in federated learning,

    X. Zheng, Q. Dong, and A. Fu, “Wmdefense: Using watermark to defense byzantine attacks in federated learning,” inProc. Conf. Comput. Commun. Workshops, 2022, pp. 1–6

    2022

  4. [12]

    Carefl: Contribution guided byzantine-robust federated learning,

    Q. Donget al., “Carefl: Contribution guided byzantine-robust federated learning,”IEEE Trans. Inf. Forensics Secur., vol. 19, pp. 9714–9729, 2024

    2024

  5. [13]

    Byzantine-resilient secure aggregation for federated learning without privacy compromises,

    Y . Xia, C. Hofmeister, M. Egger, and R. Bitar, “Byzantine-resilient secure aggregation for federated learning without privacy compromises,” arXiv preprint arXiv:2405.08698, 2024

    2024 arXiv

  6. [14]

    A systematic literature review of robust federated learning: Issues, solutions, and future research directions,

    M. P. Uddin, Y . Xiang, M. Hasan, J. Bai, Y . Zhao, and L. Gao, “A systematic literature review of robust federated learning: Issues, solutions, and future research directions,”ACM Comput. Surv., vol. 57, no. 10, pp. 1–62, 2025

    2025

  7. [15]

    Feddmc: Efficient and robust federated learning via detecting malicious clients,

    X. Muet al., “Feddmc: Efficient and robust federated learning via detecting malicious clients,”IEEE Trans. Dependable Secure Comput., vol. 21, no. 6, pp. 5259–5274, 2024

    2024

  8. [16]

    Federated learning with non-iid data: A survey,

    Z. Lu, H. Pan, Y . Dai, X. Si, and Y . Zhang, “Federated learning with non-iid data: A survey,”IEEE Internet Things J., vol. 11, no. 11, pp. 19 188–19 209, 2024

    2024

  9. [17]

    Federated learning for generalization, robustness, fairness: A survey and benchmark,

    W. Huanget al., “Federated learning for generalization, robustness, fairness: A survey and benchmark,”IEEE Trans. Pattern Anal. Mach. Intell., vol. 46, no. 12, pp. 9387–9406, 2024

    2024

  10. [18]

    A review of federated learning methods in heterogeneous scenarios,

    J. Pei, W. Liu, J. Li, L. Wang, and C. Liu, “A review of federated learning methods in heterogeneous scenarios,”IEEE Trans. Consum. Electron., vol. 70, no. 3, pp. 5983–5999, 2024

    2024

  11. [19]

    Non-iid free federated learning with fuzzy optimization for consumer electronics systems,

    J. Bai, D. Wu, S. Zeng, Y . Zhao, Y . Qu, and S. Yu, “Non-iid free federated learning with fuzzy optimization for consumer electronics systems,”IEEE Trans. Consum. Electron., vol. 71, no. 2, pp. 7032– 7044, 2025

    2025

  12. [20]

    Fedspeed: Larger local interval, less communication round, and higher generalization accuracy,

    Y . Sun, L. Shen, T. Huang, L. Ding, and D. Tao, “Fedspeed: Larger local interval, less communication round, and higher generalization accuracy,” inProc. Int. Conf. Learn. Represent., 2023

    2023

  13. [21]

    Byzantine- robust hierarchical aggregation for cross-device federated learning in consumer iot,

    J. Liu, Y . Wu, W. Du, R. Sun, G. Xu, L. Liu, and C. Wu, “Byzantine- robust hierarchical aggregation for cross-device federated learning in consumer iot,”IEEE Trans. Consum. Electron., vol. 71, no. 2, pp. 6359– 6370, 2025

    2025

  14. [22]

    Byzantine-resilient federated learning with trust-aware task scheduling for heterogeneous uav swarms,

    W. Guoet al., “Byzantine-resilient federated learning with trust-aware task scheduling for heterogeneous uav swarms,”IEEE Trans. Consum. Electron., pp. 1–1, 2026

    2026

  15. [23]

    Toward byzantine-resilient secure ai: A federated learning communication framework for 6g consumer electronics,

    J. Pei, R. Xue, C. Liu, and L. Wang, “Toward byzantine-resilient secure ai: A federated learning communication framework for 6g consumer electronics,”IEEE Trans. Consum. Electron., vol. 70, no. 3, pp. 5719– 5728, 2024

    2024

  16. [24]

    The curse of dimensionality in data mining and time series prediction,

    M. Verleysen and D. Franc ¸ois, “The curse of dimensionality in data mining and time series prediction,” inProc. Comput. Intell. Bioinspired Syst., 2005, pp. 758–770

    2005

  17. [25]

    When is “nearest neighbor

    K. Beyer, J. Goldstein, R. Ramakrishnan, and U. Shaft, “When is “nearest neighbor” meaningful?” inProc. Int. Conf. Database Theory, 1999, pp. 217–235

    1999

  18. [26]

    A survey of convolutional neural networks: Analysis, applications, and prospects,

    Z. Li, F. Liu, W. Yang, S. Peng, and J. Zhou, “A survey of convolutional neural networks: Analysis, applications, and prospects,”IEEE Trans. Neural Networks Learn. Syst., vol. 33, no. 12, pp. 6999–7019, 2022

    2022

  19. [27]

    Model-contrastive federated learning,

    Q. Li, B. He, and D. Song, “Model-contrastive federated learning,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 2021, pp. 10 713–10 722

    2021

  20. [28]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” inProc. Mach. Learn. Syst., vol. 2, 2020, pp. 429–450

    2020

  21. [29]

    Towards understanding sharpness-aware minimization,

    M. Andriushchenko and N. Flammarion, “Towards understanding sharpness-aware minimization,” inProc. Int. Conf. Mach. Learn., 2022, pp. 639–668

    2022

  22. [30]

    Generalized federated learning via sharpness aware minimization,

    Z. Qu, X. Li, R. Duan, Y . Liu, B. Tang, and Z. Lu, “Generalized federated learning via sharpness aware minimization,” inProc. Int. Conf. Mach. Learn., 2022, pp. 18 250–18 280

    2022

  23. [31]

    Penalizing gradient norm for efficiently improving generalization in deep learning,

    Y . Zhao, H. Zhang, and X. Hu, “Penalizing gradient norm for efficiently improving generalization in deep learning,” inProc. Int. Conf. Mach. Learn., 2022, pp. 26 982–26 992

    2022

  24. [32]

    Federated learning of a mixture of global and local models,

    F. Hanzely and P. Richt ´arik, “Federated learning of a mixture of global and local models,”arXiv preprint arXiv:2002.05516, 2020

    2002 arXiv

  25. [33]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in Proc. NDSS Symposium, 2021

    2021

  26. [34]

    Principal components analysis (pca),

    A. Ma ´ckiewicz and W. Ratajczak, “Principal components analysis (pca),” Computers & Geosciences, vol. 19, no. 3, pp. 303–342, 1993

    1993

  27. [35]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.”Journal of machine learning research, vol. 9, no. 11, 2008

    2008

  28. [36]

    Client selection in federated learning: Convergence analysis and power-of-choice selection strategies,

    Y . J. Cho, J. Wang, and G. Joshi, “Client selection in federated learning: Convergence analysis and power-of-choice selection strategies,”arXiv preprint arXiv:2010.01243, 2020

    2010 arXiv

  29. [37]

    Tackling the objective inconsistency problem in heterogeneous federated optimization,

    J. Wang, Q. Liu, H. Liang, G. Joshi, and H. Poor, “Tackling the objective inconsistency problem in heterogeneous federated optimization,” in Proc. Adv. Neural Inf. Process. Syst., vol. 33, 2020, pp. 7611–7623

    2020

  30. [38]

    Detecting backdoor attacks in federated learning via direction alignment inspection,

    J. Xu, Z. Zhang, and R. Hu, “Detecting backdoor attacks in federated learning via direction alignment inspection,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 2025, pp. 20 654–20 664

    2025

  31. [39]

    Resnet in resnet: Generalizing residual architectures,

    S. Targ, D. Almeida, and K. Lyman, “Resnet in resnet: Generalizing residual architectures,”arXiv preprint arXiv:1603.08029, 2016

    2016 arXiv

  32. [40]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hintonet al., “Learning multiple layers of features from tiny images,” 2009

    2009

  33. [41]

    On the dirichlet distribution,

    J. Lin, “On the dirichlet distribution,”Master’s thesis, Dept. Math. Statist., Queen’s Univ., vol. 40, 2016

    2016

  34. [42]

    Free-rider attacks on model aggregation in federated learning,

    Y . Fraboni, R. Vidal, and M. Lorenzi, “Free-rider attacks on model aggregation in federated learning,” inProc. Artif. Intell. Statist., 2021, pp. 1846–1854

    2021

  35. [43]

    Neurotoxin: Durable backdoors in federated learning,

    Z. Zhanget al., “Neurotoxin: Durable backdoors in federated learning,” inProc. Int. Conf. Mach. Learn., 2022, pp. 26 429–26 446

    2022

  36. [44]

    On the vulnerability of backdoor defenses for federated learning,

    P. Fang and J. Chen, “On the vulnerability of backdoor defenses for federated learning,” inProc. AAAI Conf. Artif. Intell., vol. 37, no. 10, 2023, pp. 11 800–11 808

    2023

  37. [45]

    Flgym: Toward robust and byzantine-resilient federated learning,

    K. Xiao, Q. Wang, and C. Anagnostopoulos, “Flgym: Toward robust and byzantine-resilient federated learning,”IEEE Trans. Inf. Forensics Secur., vol. 21, pp. 404–416, 2026

    2026

  38. [46]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProc. Artif. Intell. Statist., 2017, pp. 1273–1282

    2017

  39. [47]

    Federated learning based on dynamic regularization,

    D. Acar, Y . Zhao, R. Navarro, M. Mattina, P. Whatmough, and V . Saligrama, “Federated learning based on dynamic regularization,” arXiv preprint arXiv:2111.04263, 2021

    2021 arXiv

  40. [48]

    Fedfa: Federated learning with feature anchors to align features and classifiers for heterogeneous data,

    T. Zhou, J. Zhang, and D. H. K. Tsang, “Fedfa: Federated learning with feature anchors to align features and classifiers for heterogeneous data,” IEEE Trans. Mob. Comput., vol. 23, no. 6, pp. 6731–6742, 2024

    2024

  41. [49]

    Salvaging federated learning by local adaptation,

    T. Yu, E. Bagdasaryan, and V . Shmatikov, “Salvaging federated learning by local adaptation,”arXiv preprint arXiv:2002.04758, 2020

    2002 arXiv

  42. [50]

    Federated learning with non-iid data,

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra, “Federated learning with non-iid data,”arXiv preprint arXiv:1806.00582, 2018

    2018 arXiv

  43. [51]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzeret al., “Reading digits in natural images with unsupervised feature learning,” inNIPS Workshops., vol. 2011, no. 2, 2011, p. 4

    2011

  44. [52]

    Cinic-10 is not imagenet or cifar-10,

    L. N. Darlow, E. J. Crowley, A. Antoniou, and A. J. Storkey, “Cinic-10 is not imagenet or cifar-10,”arXiv preprint arXiv:1810.03505, 2018

    2018 arXiv

  45. [53]

    Tiny imagenet visual recognition challenge,

    Y . Le, X. Yanget al., “Tiny imagenet visual recognition challenge,”CS 231N, vol. 7, no. 7, p. 3, 2015

    2015

  46. [54]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” inProc. NIPS, vol. 32, 2019

    2019

  47. [55]

    Generative image reconstruction from gradients,

    E. Sotthiwat, L. Zhen, C. Zhang, Z. Li, and R. S. M. Goh, “Generative image reconstruction from gradients,”IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 21–31, 2025

    2025

  48. [56]

    Exploring threats, defenses, and privacy-preserving techniques in federated learning: A survey,

    R.-Y . Huang, D. Samaraweera, and J. M. Chang, “Exploring threats, defenses, and privacy-preserving techniques in federated learning: A survey,”Computer, vol. 57, no. 4, pp. 46–56, 2024

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.