TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

Chen Lyu; Jingrong Huang; Yuhan Xie

REVIEW 6 major objections 6 minor 38 references

TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

T0 review · 6 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TOFD defends split federated learning by detecting poisoned smashed data at the server, filtering it per class, and decoupling residual attack influence.

desk verdict TOFD is a solid, architecture-aware SFL defense with strong empirical work, but the convergence proof is missing from the preprint and the baseline-drift feedback loop from undetected poisoned samples is a real unmodeled weakness. read the letter →

arxiv 2608.07274 v1 pith:CF7MDNPL submitted 2026-08-07 cs.LG cs.AI

Yuhan Xie , Jingrong Huang , Chen Lyu This is my paper · ORCID

classification cs.LGcs.AI

keywords splitfederatedlearningpoisoningdefensefeaturedecouplingsmasheddataadversarialguidancenon-IIDoutlierdetectionByzantineresilience

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Split federated learning (SFL) moves intermediate representations, called smashed data, from clients to the server, and every common poisoning attack — data, weight, smashed, label, or a combination — has to distort those representations to hurt the model. TOFD claims this architectural fact can be turned into an early defense checkpoint: it builds per-class safe zones from historical distributions of benign smashed data, uses a Margin Perturbation threshold to distinguish malicious clients from merely non-IID benign ones, filters poisoned samples only within suspected classes, and then trains an adversarial guidance model whose decoupling loss suppresses any residual attack influence in server-side optimization. If the framework works as described, SFL would gain a low-overhead detection layer that preserves benign data diversity while guaranteeing convergence at the usual stochastic-gradient rate. The paper's experiments across five image datasets report over 92% accuracy under single attacks and over 83% under composite attacks in uniform settings, consistently ahead of existing defenses.

What carries the argument

The load-bearing object is the per-class safe zone with its Margin Perturbation (MP) threshold: $\mathrm{MP}_k$ is the largest distributional shift, measured in 2-Wasserstein distance on compressed class-wise Gaussians, caused by deleting any one benign client from class $k$'s safe zone, and it serves as the yardstick that separates benign non-IID variation from adversarial manipulation. Around it sit the class-calibrated purification threshold $\tau_k$ (third quartile plus an IQR scaled by the min–max-normalized MP) and the adversarial guidance model $R$, which is fine-tuned on detected malicious smashed data and used in a decoupling loss $L_{\mathrm{MFD}} = -\mathbb{E}_{z\in Z^-} \mathrm{KL}\big( f(z;R) \,\|\, f(z;h_{\theta_s}) \big)$ so that the server model diverges from attack-induced feature patterns. The machinery is efficient because detection happens on compressed, per-class Gaussian statistics rather than raw high-dimensional features, and it is robust because the decoupling loss tolerates the poisoned samples that escape the filter.

What would settle it

Run the adaptive attack of Section 6.2.6 with a stronger steering objective: perturb smashed data so that each sample's induced distributional consistency score stays inside the Margin Perturbation threshold while still flipping the model's predictions on the target class. If the malicious-sample detection rate collapses toward zero and test accuracy falls to the undefended baseline, the outlier-detection premise of the central claim is falsified.

Watch

Extended reading notes

Core claim

TOFD's central claim is that the split paradigm itself provides a reliable early checkpoint: because server-side optimization is driven directly by client-transmitted smashed data, all five classes of poisoning attacks manifest as class-wise statistical anomalies in that intermediate representation before reaching aggregation. The defense accordingly builds, for each class, an initial safe zone from the median and median absolute deviation of clients' 2-Wasserstein distances to the maintained global class distribution, then refines it with the Margin Perturbation (MP) — the maximum distributional shift produced by removing any single benign client from the zone — and re-admits suspicious clients whose distributional consistency score stays within it. Malicious clients' samples are then purified per class against a threshold built from the third quartile and an interquartile range scaled by the cross-class min–max-normalized MP, and a guidance model trained on the detected malicious features supplies a KL-divergence decoupling objective that pushes the server model away from attack-induced patterns. The paper asserts this three-stage pipeline preserves clean accuracy, keeps over 92% and 83% accuracy under single and composite attacks in uniform settings, and converges at rate $O(1/\sqrt{T})$ plus a bias term bounded by the undetected-malicious fraction.

Load-bearing premise

The framework assumes benign class-wise smashed data are well approximated by diagonal Gaussians after the compression step, that the historical global class distributions remain a trustworthy baseline, and that every poisoning attack moves the attacked class's distribution far enough outside the safe zone to be caught as an outlier; if any attack hides inside the zone, detection degrades.

Editorial extensions

If this is right

SFL can be defended without throwing away entire clients: only anomalous samples in suspected classes are filtered, so benign data contributed by malicious clients is still used.
Per-class threshold calibration, not a fixed global threshold, is what keeps benign non-IID clients from being misclassified as attackers, which is exactly the regime where adapted-FL defenses break down.
The adversarial guidance model converges into a stable module that can be re-used across rounds as a plug-and-play component of the server-side objective.
The convergence guarantee implies TOFD does not destabilize training: with stepsize $O(1/\sqrt{T})$ the average gradient norm reaches the standard $O(1/\sqrt{T})$ rate plus an error term that shrinks with the fraction of undetected malicious samples.
Fine-grained purification preserves data diversity, which explains why TOFD stays accurate under composite attacks such as DP+SP where coarse-grained defenses fall to near-random accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The diagonal-Gaussian assumption is the natural first place to probe: on class-conditional features that are multimodal or heavy-tailed, the covariance estimate and the Mahalanobis-style distance of Eq. (9) could mis-rank samples, so extending the MP calibration to non-parametric density estimates is a testable next step.
The framework predicts a concrete trade-off curve between detection rate and false-positive rate as data heterogeneity increases (safe zones widen, MP grows); a follow-up could measure that curve explicitly rather than only reporting average accuracy.
The min–max-normalized IQR threshold recipe is portable: any per-class anomaly score could be calibrated the same way, which may benefit federated-learning defenses beyond the split architecture.
Because the decoupling loss is trained on detected malicious features, an attacker who can pollute the negative set through false positives could in principle reverse the sign of the guidance; the paper does not test this adversarial-coupling scenario.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about TOFD up front: the empirical core is more careful than most SFL defense papers, and the convergence guarantee in the preprint is not actually checkable because the appendix is absent. The adaptive attack experiment is also the most honest part of the paper, because it shows the defense degrades when the attacker stays inside the margin perturbation.

What's new: TOFD is the first SFL-specific defense I've seen that ties class-wise safe zones, a per-class purification threshold, and an adversarial guidance model into one pipeline. The components are standard outlier detection and KL-based decoupling, but the combination is tailored to the smashed-data checkpoint and the experiments back up each piece via ablations. Five datasets, non-IID sweeps, MSDR reporting, and a comparison against twelve baselines is solid work for a venue like ACM MM. The authors also don't oversell: they cite their own HealSplit and show TOFD beating it.

The real soft spot is the feedback loop the stress test identified. Eq. (11) updates the global class distribution P_G,k from Z+, which by construction contains any poisoned sample whose DCS lands below tau_k. Section 6.2.6 tells us such samples exist under the adaptive attack. So the baseline itself drifts toward the attack, and the bound in Lemma 2 treats alpha as a constant rather than modeling this contamination. The convergence theorem therefore doesn't cover the regime the paper claims robustness in. That doesn't sink the empirical claims, but it does mean the theory is weaker than presented.

Other issues are smaller: the compression map phi is never specified; lambda and beta are tuned on the same benchmark suite; Table 2 has no error bars (the ablation table does, which is odd). The missing proof appendix should be public before this is reviewed.

Who this is for: anyone working on split learning or FL poisoning defenses. It deserves a serious referee — send it out, but ask for the appendix, code, and an explicit treatment of baseline drift.

Referee Report

6 major / 6 minor

Summary. TOFD is a three-stage defense for split federated learning: class-wise attack target inference builds refined safe zones via margin perturbation; class-calibrated sample purification filters poisoned smashed data with adaptive thresholds; and a decoupling loss with an adversarial guidance model suppresses residual adversarial influence. The paper claims convergence guarantees for TOFD and reports extensive experiments on five datasets against twelve baselines under single, composite, and adaptive attacks.

Significance. The framework is timely and well motivated: it exploits the smashed-data checkpoint unique to SFL, and the evaluation is broad, covering five datasets, multiple backbones, seven attack configurations, non-IID settings, and an adaptive attack. The ablation study in Table 4 supports the contribution of each component, and the adaptive-attack experiment in Section 6.2.6 is an honest stress test that many defenses omit. If the convergence guarantee and the detection claims hold, TOFD would be a practically useful defense with modest overhead (Lemma 1). However, the main comparison table lacks error bars, the compression map phi is unspecified, the adaptive attack is shown to partially evade purification, and the formal proofs are deferred to an appendix absent from the preprint, so the central theoretical and robustness claims are not yet fully supported.

major comments (6)

[Section 5, Lemma 2 and Theorem 3] The convergence guarantee is load-bearing for the abstract's claim of 'theoretical guarantees,' but the proofs are deferred to Appendix A, which is not included in the preprint. The reader cannot verify Lemma 2's bound on the gradient bias or Theorem 3's O(1/sqrt(T)) + O(eps^2) rate. The appendix must be supplied, or the theorem statement must be accompanied by a complete proof sketch that identifies exactly where each assumption is used.
[Section 4.2, Eq. (11)] The EMA update of the global class distribution P_G,k uses Z+ = union of all samples that survive purification, including undetected poisoned samples. Section 6.2.6 demonstrates that an adaptive attacker can constrain DCS within MP_k so that poisoned samples pass purification and enter Z+. Those samples then contaminate P_G,k through Eq. (11), shifting the detection baseline toward the attack. Lemma 2 treats the undetected malicious fraction alpha as a constant and does not model this feedback loop, so the convergence theorem does not cover the regime in which the defense is claimed to be robust. The authors should either model the baseline drift, restrict the theorem's scope, or update P_G,k using only samples from clients that passed both safe-zone and sample-level verification.
[Definition 1 and Eq. (9)] The detection pipeline depends on the unspecified compression map phi and on the assumption that compressed class-wise smashed data are approximately diagonal Gaussian. The paper does not state what phi is (e.g., a fixed projection, a learned encoder, or a model layer), how its dimension S is chosen, or when the diagonal-Gaussian model is justified. Eq. (9) also requires the inverse of the diagonal covariance, which is ill-defined if any variance estimate is zero, a realistic risk with small class-wise batches under extreme non-IID partitions. A concrete definition of phi and a discussion of the validity of the Gaussian assumption are needed for the detection stage to be reproducible.
[Table 2] The main performance comparison reports a single accuracy value per method/attack/setting without standard deviations or confidence intervals, while Table 4 shows that the authors do compute such statistics for the ablation. Given random client partitions, initialization, and attack sampling, single-run comparisons are insufficient to support the claim that TOFD 'consistently outperforms' all baselines, especially in cases where the margin to the second-best method is small. Multiple seeds with mean and standard deviation should be reported for the central comparison table.
[Section 6.2.4 and Figure 7] The default hyperparameters lambda = beta = 0.2 are chosen from Figure 7, which plots accuracy against these values, and this same default is then used in all other experiments. The authors should clarify whether the tuning was performed on a held-out validation split or on the test set, and whether the reported accuracies in Table 2 and Figures 3-6 are affected by this selection. If the tuning used test accuracy, the reported numbers are optimistically biased and the generalization claim needs to be qualified.
[Section 6.2.6] The adaptive-attack experiment shows that attackers who constrain perturbations inside the margin perturbation partially evade purification, and the text acknowledges that residual adversarial patterns accumulate through aggregation. This directly qualifies the earlier claim that MP 'disentangles adversarial behavior from benign non-IID variation.' The paper should state explicitly which of the central claims (high MSDR, high accuracy under composite attacks, or the convergence guarantee) remain valid under this partial-evasion regime, rather than implying that the defense is uniformly robust.

minor comments (6)

[Section 4.1, Eq. (5)] The display equation for Delta(S1,S2,k) is missing a closing period; also, the notation 'dist' is used without a definition, although it appears to refer to the 2-Wasserstein distance introduced in Eq. (3).
[Section 4.2, Eq. (10)] The threshold formula is presented with a line break inside the parenthesized factor; please fix the typesetting so the expression is unambiguous. In addition, the definition of Q3,k and IQR_k as statistics over benign distances is correct, but the text should specify the sample size used to estimate these quantiles.
[Assumption 4] Assumption 4 states that discard-induced deviation delta vanishes as the threshold tau_k tends to infinity, which is almost tautological: as tau_k grows, no samples are discarded. The assumption would be more meaningful if delta were defined explicitly in terms of the fraction of discarded benign samples and their distance from the retained distribution.
[Figure 7] The x-axis label appears as 'Value of / ' rather than specifying lambda and beta separately; please clarify which curve corresponds to which hyperparameter and whether the two are varied independently.
[Table 1] The non-IID parameter list '0.1, 0.5, 0.3, 1 (Default), 5' has 0.3 out of ascending order and is inconsistent with the values reported in Figure 5; please reconcile this list.
[Algorithm 1] The input line indexes smashed data as B^{(t)}_{i,k} with subscripts N,K but the loop over j is not defined; please align the notation with the problem setup in Section 3.1.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: TOFD's central robustness claims are externally benchmarked and not forced by construction; the only self-citations are non-load-bearing.

full rationale

TOFD's claimed performance (e.g., Table 2, >92% accuracy under single attacks and >83% under composite attacks) is evaluated against twelve independent baselines on five external datasets, so the headline numbers are not by construction equal to any fitted parameter. The detection pipeline (Eqs. (3)-(10)) estimates class-wise safe zones from current smashed data and a historical global distribution, then uses the resulting thresholds to filter samples; the MSDR and accuracy outcomes are measured, not defined, by those thresholds. Hyperparameters lambda and beta are tuned in Figure 7 and fixed at 0.2, but they are regularizer/EMA weights, and the reported robustness is not a restatement of their fitted values. The paper's two self-citations ([31] HealSplit, [32] BESplit) are a comparison baseline and a background citation, respectively, and neither is used to justify TOFD's convergence or detection guarantees. The adaptive-attack experiment (Section 6.2.6) explicitly concedes that an attacker constraining DCS below MP_k partially evades purification; this is an honest boundary condition rather than a circular derivation. It does imply that the update of P_G,k in Eq. (11) can in principle be contaminated by undetected malicious samples, which is a limitation of the robustness argument but not a circularity in the derivation. No equation in the paper reduces the claimed prediction to its own input by definition.

Assumptions & free parameters 4 free parameters · 8 assumptions · 1 invented entities

The central detection and purification pipeline rests on statistical assumptions about class-wise smashed data: diagonal Gaussian form, temporal stability of global class distributions, and outlier manifestation of attacks. The convergence proof adds reconstruction, bounded-covariance, and discard-deviation assumptions. The only new component is the adversarial guidance model. The unspecified feature map phi and its compression dimension are hidden degrees of freedom that the experiments do not fix.

free parameters (4)

lambda (decoupling weight) = 0.2
Tuned to the peak in Figure 7 and adopted as the default across all experiments (Section 6.2.4).
beta (EMA coefficient) = 0.2
Tuned to the peak in Figure 7 and adopted as the default across all experiments (Section 6.2.4).
rho (MAD normalizer) = 0.6745
Fixed constant in the modified Z-score safe zone, Eq. (4), taken from Iglewicz and Hoaglin.
Z-score cutoff = 3 sigma
Fixed threshold in Eq. (4); chosen by convention rather than derived.

assumptions (8)

domain assumption Empirical Gaussian modeling: compressed class-wise smashed data are diagonal Gaussian.
Definition 1 and Eqs. (3), (5), (9) build all distances and thresholds on this model.
domain assumption Historical global class distribution P_G,k is a reliable baseline for current benign data.
Eqs. (3) and (9) compare current clients to the EMA-updated global distribution; bootstrap contamination is not analyzed.
domain assumption Poisoning attacks manifest as statistical outliers in class-wise feature space.
The whole detection stage in Section 4.1 assumes this; the adaptive attack study in Section 6.2.6 shows it can be partially violated.
standard math Assumption 1: gradients are L_z-Lipschitz in smashed data.
Used in Lemma 2 and Theorem 3.
domain assumption Assumption 2: compressed smashed data are reconstructable up to error sigma_sp.
Used in Lemma 2; no measurement of sigma_sp is provided.
domain assumption Assumption 3: class covariance matrices are uniformly bounded.
Used in Lemma 2; assumed finite.
ad hoc to paper Assumption 4: discard-induced deviation vanishes as the threshold tends to infinity.
A limiting statement that does not quantify finite thresholds; used in Lemma 2.
domain assumption Malicious clients form a minority.
Default malicious ratio is 20% and experiments range from 5% to 25%; safe-zone statistics require a benign majority.

invented entities (1)

Adversarial guidance model R
purpose: Trained on detected malicious smashed data Z- to capture attack-induced patterns; the server model is pushed to diverge from R via KL divergence (Eq. 12).
Its effectiveness is only validated internally in the paper's experiments; there is no external or formal verification.

how reviews work

0 comments

Cite this review

Pith. "Pith review of TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning." pith.science (2026). https://pith.science/paper/CF7MDNPL

@misc{pith2026260807274,
  author       = {Pith},
  title        = {Pith review of: TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CF7MDNPL}},
  note         = {Machine review of arXiv:2608.07274}
}

read the original abstract

Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min-max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.

Figures

Figures reproduced from arXiv: 2608.07274 by the authors.

**Figure 2.** The framework of TOFD. After the smashed data are transmitted to the server, TOFD first constructs an initial [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Comparison of accuracy and time cost. CIFAR10 [14], and CIFAR-100. To simulate realistic SFL scenarios, client data are partitioned in a non-IID manner according to a Dirichlet distribution 𝐷𝑖𝑟(𝜅), with smaller values of 𝜅 corresponding to higher data heterogeneity. Experiments are performed using three widely adopted backbone architectures: DenseNet121 [8], ResNet-18 [7], and ResNet-50. To assess TOFD’s robustness… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Comparison of metric 𝑈 ↓ across datasets for different defense strategies under various attacks. 0.1 0.3 0.5 1 5 Non-IID Parameter ( ) 0 30 60 90 Accuracy (%) FedAvg HealSplit Krum Median PRFL TOFD [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 6.** Figure 6: Comparison of MSDR under different Non-IID degrees (𝜅). 0.1 0.2 0.3 0.4 0.5 Value of / 40 60 80 Accuracy (%) [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 8.** Figure 8: Comparison of adaptive attacks. 6.2.6 Adaptive Attack. The sixth set of experiments evaluates the resilience of TOFD against adaptive attacks across five datasets. The accuracy results are presented in [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 21 canonical work pages

[1]

Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and don’ts of machine learning in computer security. In31st USENIX Security Symposium (USENIX Security 22). 3971–3988

2022
[2]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer
[3]

Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2020. Fltrust: Byzantine-robust federated learning via trust bootstrapping.arXiv preprint arXiv:2012.13995(2020)

arXiv 2020
[4]

Binbin Ding, Penghui Yang, and Sheng-Jun Huang. 2025. FedDLAD: A Federated Learning Dual-Layer Anomaly Detection Framework for Enhancing Resilience Against Backdoor Attacks. InProceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25. 5021–5029

work page 2025
[5]

Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to Byzantine-Robust federated learning. In29th USENIX security symposium (USENIX Security 20). 1605–1622

work page 2020
[6]

Rachid Guerraoui, Sébastien Rouault, et al . 2018. The hidden vulnerability of distributed learning in byzantium. InInternational conference on machine learning. PMLR, 3521–3530

work page 2018
[7]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

2016
[8]

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger

Show all 38 references

[9]

Wenke Huang, Mang Ye, Zekun Shi, Guancheng Wan, He Li, and Bo Du. 2024. Parameter disparities dissection for backdoor defense in heterogeneous federated learning.Advances in Neural Information Processing Systems37 (2024), 120951– 120973

2024
[10]

InProceedings of the IEEE conference on computer vision and pattern recognition

Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 4700–4708
[11]

Rishi Jha, Jonathan Hayase, and Sewoong Oh. 2023. Label poisoning is all you need.Advances in Neural Information Processing Systems36 (2023), 71029–71052

2023
[12]

1993.Volume 16: how to detect and handle outliers

Boris Iglewicz and David C Hoaglin. 1993.Volume 16: how to detect and handle outliers. Quality Press

1993
[13]

Torsten Krauß and Alexandra Dmitrienko. 2023. Mesas: Poisoning defense for federated learning resilient against adaptive attackers. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 1526–1540

2023
[14]

Xiaoqian Jiang and Jing Zhang. 2025. FedClean: A General Robust Label Noise Correction for Federated Learning. InForty-second International Conference on Machine Learning

2025
[15]

K Naveen Kumar, Ranjeet Ranjan Jha, C Krishna Mohan, and Ravindra Babu Tallamraju. 2025. Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution. InProceedings of the Computer Vision and Pattern Recognition Conferen...

2025
[16]

Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

2009
[17]

Wenqian Li, Shuran Fu, Fengrui Zhang, and Yan Pang. 2024. Data valuation and detections in federated learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12027–12036

2024
[18]

Yann LeCun, Corinna Cortes, and Christopher J. C. Burges. 1998. MNIST Hand- written Digit Database. Available: http://yann.lecun.com/exdb/mnist

1998
[19]

Ye Li, Yanchao Zhao, Chengcheng Zhu, and Jiale Zhang. 2025. Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning. InProceedings of the Computer Vision and Pattern Recognition Conference. 25770–25779

2025
[20]

Yehui Li, Dalin Qin, H Vincent Poor, and Yi Wang. 2024. Introducing edge intelligence to smart meters via federated split learning.Nature communications 15, 1 (2024), 9044

2024
[21]

Zhuoran Ma, Jianfeng Ma, Yinbin Miao, Yingjiu Li, and Robert H Deng. 2022. ShieldFL: Mitigating model poisoning attacks in privacy-preserving federated learning.IEEE Transactions on Information Forensics and Security17 (2022), 1639–1654

2022
[22]

Zheng Lin, Guangyu Zhu, Yiqin Deng, Xianhao Chen, Yue Gao, Kaibin Huang, and Yuguang Fang. 2024. Efficient parallel split learning over resource-constrained wireless edge networks.IEEE Transactions on Mobile Computing23, 10 (2024), 9224–9239

2024
[23]

Ashwinee Panda, Saeed Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, and Prateek Mittal. 2022. Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. InInternational Conference on Artificial Intelligence and Statistics. PMLR, 7587–7624

2022
[24]

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. InArtificial intelligence and statistics. PMLR, 1273–1282

2017
[25]

Virat Shejwalkar and Amir Houmansadr. 2021. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS

2021
[26]

Chamara Sandeepa, Bartlomiej Siniarski, Shen Wang, and Madhusanka Liyanage
[27]

Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. 2018. The HAM10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions.Scientific data5, 1 (2018), 1–9

2018
[28]

Xiaodong Wu, Henry Yuan, Xiangman Li, Jianbing Ni, and Rongxing Lu. 2024. Evaluating security and robustness for split federated learning against poisoning attacks.IEEE Transactions on Information Forensics and Security(2024)

2024
[29]

Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. 2022. Splitfed: When federated learning meets split learning. In Proceedings of the AAAI conference on artificial intelligence, Vol. 36. 8485–8493

2022
[30]

Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. 2024. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. International Conference on Machine Learning

2024
[31]

Yuhan Xie and Chen Lyu. 2026. Healsplit: Towards self-healing through adversar- ial distillation in split federated learning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 35931–35939

2026
[32]

Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.arXiv preprint arXiv:1708.07747(2017)

2017 arXiv
[33]

Abbas Yazdinejad, Ali Dehghantanha, Hadis Karimipour, Gautam Srivastava, and Reza M Parizi. 2024. A robust privacy-preserving federated learning model against model poisoning attacks.IEEE Transactions on Information Forensics and Security19 (2024), 6693–6708

2024
[34]

Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. InInter- national conference on machine learning. Pmlr, 5650–5659

2018
[35]

Yuhan Xie, Chen Lyu, and Jingrong Huang. 2026. BESplit: Bias-Compensated Split Federated Learning with Evidential Aggregation. InForty-third International Conference on Machine Learning

2026
[38]

Lixiang Yuan, Jiapeng Zhang, Mingxing Duan, Guoqing Xiao, Zhuo Tang, and Kenli Li. 2025. PRFL: Personalized and Robust Federated Learning for Non-IID Data with Malicious Participants.IEEE Transactions on Mobile Computing(2025)

2025
[2017]

Advances in neural information processing systems30 (2017)

Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems30 (2017)

2017
[2024]

In2024 IEEE Symposium on Security and Privacy (SP)

Sherpa: Explainable robust algorithms for privacy-preserved federated learning in future networks to defend against data poisoning attacks. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 4772–4790

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and don’ts of machine learning in computer security. In31st USENIX Security Symposium (USENIX Security 22). 3971–3988

2022

[2] [2]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer

[3] [3]

Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2020. Fltrust: Byzantine-robust federated learning via trust bootstrapping.arXiv preprint arXiv:2012.13995(2020)

arXiv 2020

[4] [4]

Binbin Ding, Penghui Yang, and Sheng-Jun Huang. 2025. FedDLAD: A Federated Learning Dual-Layer Anomaly Detection Framework for Enhancing Resilience Against Backdoor Attacks. InProceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25. 5021–5029

work page 2025

[5] [5]

Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to Byzantine-Robust federated learning. In29th USENIX security symposium (USENIX Security 20). 1605–1622

work page 2020

[6] [6]

Rachid Guerraoui, Sébastien Rouault, et al . 2018. The hidden vulnerability of distributed learning in byzantium. InInternational conference on machine learning. PMLR, 3521–3530

work page 2018

[7] [7]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

2016

[8] [8]

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger