Pith. sign in

REVIEW 3 major objections 5 minor 31 references

Robust Reputation-Driven Crowdsourced Federated Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read In crowdsourced federated learning, deriving worker reputation from the acceptance decisions of a robust filtering defense prevents stealthy attackers from accumulating trust, and makes reputation scores mirror the defense's TPR/FPR.

desk verdict A solid, incremental NNM variant whose headline reputation-fidelity claim is validated by a simulation that assumes the answer; end-to-end reputation trajectories would settle it. read the letter →

arxiv 2608.08574 v2 pith:V3E46F77 submitted 2026-08-09 cs.LG cs.CRcs.DC

Mouhamed Amine Bouchiha , Gregory Blanc This is my paper · ORCID
classification cs.LGcs.CRcs.DC
keywords federatedlearningcrowdsourcingreputationsystemsByzantineattacksbackdoorrobustaggregationnearestneighbormixingstealthyadversaries
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes R2CFL, a reputation-driven framework for crowdsourced federated learning in which worker trust is updated from the same robust statistical filter that decides which model updates get aggregated. The central claim is that tying reputation to the acceptance and rejection decisions of a detect-and-filter defense stops stealthy attackers from gradually building credibility, because each failed poisoning attempt pushes their reputation down. If correct, reputation becomes an empirical estimate of the probability that a worker's update would be accepted by a robust aggregation rule, giving task publishers a principled signal for worker selection. Experiments on three image datasets under three adaptive attacks show that the proposed R2-NNM defense matches state-of-the-art defenses in detection while keeping false positives low, and that the reputation scores it produces closely track the defense's true and false positive rates.

What carries the argument

The central object is R2-NNM, the Robust Reputation-Aware Nearest Neighbor Mixing defense. Each local update is first smoothed by a weighted average of its k nearest neighbors, where the weights blend uniform mixing with reputation-derived weights modulated by a warm-up factor; the smoothed updates are then passed through Multi-Krum, which retains the m updates with the smallest pairwise distances. The reputation signal is computed without any external validation data: each client receives a binary acceptance flag from the filter and a soft sigmoid-transformed median/MAD deviation score, and the two are combined and updated with an exponential moving average. This makes reputation an empirical estimate of the probability of being consistently selected by the robust aggregation rule, which is the mechanism that couples filtering outcomes to future trust.

What would settle it

Run R2CFL end-to-end with a stealthy attacker who monitors its own reputation and alternates between clean and poisoned updates, then check whether malicious reputation stays below roughly 0.3 while benign reputation stays above 0.7 after 100 rounds; alternatively, measure the autocorrelation of the acceptance indicator and show that substantial positive autocorrelation is present, which would violate the independent-Bernoulli assumption behind the reported separation.

Watch

Extended reading notes

Core claim

The paper's discovery is that reputation in CrowdFL can be derived from the statistical behavior of the robust aggregation filter itself, rather than from external performance signals such as validation accuracy. The authors build a closed loop: a reputation-aware nearest neighbor mixing step smooths each update using neighbors weighted by current reputation, then a Multi-Krum selection chooses the trusted subset; clients accepted by the filter gain reputation and rejected clients lose it. Under adaptive stealthy attacks (OMP, Neurotoxin, and A3FL), the proposed R2-NNM matches the detection trade-off of plain NNM and achieves low false positives, while the final reputation gap between benign and malicious workers (around 0.72 to 0.74) mirrors the defense's TPR and FPR. The authors claim this prevents stealthy attackers from accumulating influence and that, when attached to any detect-and-filter defense, the reputation model faithfully captures that defense's robustness.

Load-bearing premise

The claim that reputation faithfully mirrors a defense's TPR/FPR rests on simulating each client's acceptance as an independent coin flip with fixed probabilities across rounds, so if acceptance events are correlated over time or an attacker adapts to reputation feedback, the clean separation between benign and malicious scores may not hold.

Editorial extensions

If this is right

  • If a worker consistently fails the robust filter, reputation decays toward zero, so the worker loses selection priority and influence in future tasks even when an individual poisoned update is not flagged in a given round.
  • Reputation becomes a defense-calibrated quantity: a benign worker's score approaches 1 minus the false positive rate, while a malicious worker's score approaches 1 minus the true positive rate, giving task publishers a stated likelihood of acceptance rather than an opaque heuristic.
  • Because the loop is closed, an attacker that occasionally succeeds pays a long-term cost, making gradual trust-accumulation strategies less sustainable than in reputation systems decoupled from filtering.
  • The reputation update rule can be attached to other detect-and-filter defenses, and the final reputation gap then reflects that defense's TPR/FPR, as the paper demonstrates for M-Krum, FLAME, and NNM.
  • Scaling the federation from 20 to 100 workers keeps the false positive rate roughly stable, while the reputation mechanism tracks the underlying detector without artificially improving or degrading its trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The independence assumption used to simulate reputation dynamics (each round's acceptance is an independent Bernoulli event with fixed probabilities) is likely the main fragility: in real runs, acceptance events are correlated over time, and a stealthy attacker who observes its own reputation could alternate between benign and poisoned updates to keep its score above the selection threshold.
  • A natural testable extension is to run the full selection loop end-to-end, using the computed reputation scores to choose which workers participate in future tasks, and measure whether long-term accuracy under intermittent attacks improves compared with a system that filters but ignores reputation.
  • The same 'reputation equals defense statistics' principle could be applied to defenses with round-varying randomized decisions, such as those that inject noise, where TPR and FPR fluctuate; the paper's current model assumes these rates are constant across rounds.
  • The authors note that the design does not adapt to round-varying adversarial pressure; learning the warmth and selection hyperparameters online, for instance with a reinforcement-learning controller, is a plausible way to maintain the robustness-fairness balance under non-stationary attacks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes R2CFL, a reputation-driven framework for crowdsourced federated learning that couples reputation evolution with a robust aggregation defense called R2-NNM. In R2-NNM, each client update is smoothed by mixing with its k nearest neighbors using reputation-dependent weights, followed by Multi-Krum selection. The reputation model is data-free: per-round acceptance by the defense (plus a soft geometric score) is combined into a local reputation via EMA with a warm-up, and a task-level asymmetric EMA update is defined. The paper claims that this mechanism prevents stealthy attackers from accumulating trust and that, when integrated with detect-and-filter defenses, the reputation scores faithfully reflect the underlying defense's TPR/FPR. Experiments compare R2-NNM with several Byzantine-robust and backdoor defenses on FashionMNIST, GTSRB, and CIFAR-10 under IID/non-IID settings, showing that R2-NNM closely matches NNM's detection performance. Section 4.3 then presents a simulation study that feeds defense-specific TPR/FPR into the reputation update (Eq. (14)) and reports final reputation separation in Table 2, which the paper interprets as confirming the reputation-fidelity claim.

Significance. If the central claim were fully supported, the paper would make a useful contribution: it links reputation to the statistical behavior of a robust aggregation rule, avoids external validation data, and provides a concrete feedback loop that could hinder stealthy attackers in open FL settings. The paper has tangible strengths: a public code repository, experiments across three datasets and multiple attacks, ablations of key parameters, and an honest concluding limitation about non-stationary attack pressure. However, the headline claim that reputation 'faithfully captures' the defense's TPR/FPR is currently validated only by a simulation that assumes the very statistics it purports to recover, so the main novelty is not yet established as an empirical fact about the proposed mechanism.

major comments (3)
  1. [§4.3, Eq. (14), Table 2] The reputation-fidelity claim is not independently validated because Table 2 is generated by simulating the acceptance indicator with Eq. (14): for benign clients the acceptance probability is 1-FPR and for malicious clients 1-TPR, and these samples are then fed into the EMA update of Eq. (10). With these inputs, high benign reputation and near-zero malicious reputation are a mathematical consequence of the EMA update, not a property of R2-NNM's actual acceptance behavior. The paper provides no end-to-end reputation trajectories from real R2-NNM runs where Reliable_i^t comes from the actual Multi-Krum selection of Eq. (5). The Bernoulli model of Eq. (14) is also not justified by the mechanism: acceptance is a deterministic function of update geometry, and the same clients, local data, and attack recipes recur across rounds, so acceptance events are likely correlated rather than independent. Table 4 itself shows FPR varying from 0.00 to 0.13 with attack onset, contradicting the constant-FPR assumption used in the simulation. To support the abstract's claim, the authors should report actual reputation dynamics from end-to-end runs and compare them with the TPR/FPR-based simulation.
  2. [§3.5, Eqs. (10)–(11), §4.3] The reputation model is underspecified at a load-bearing point. Eq. (10) defines a per-round local reputation L_t_rep,i, while Eq. (11) defines a task-level global reputation R_i updated using a quantity 'L_rep,i' that is never formally tied to the per-round sequence; no aggregation of the per-round values into the task-level signal is given. Section 4.3 says it 'simulates the robust local evaluation (Eq. (10)) over multiple FL rounds' and Table 2 reports final 'L_t_rep,i scores' at round 100 (with the text in §4.3 saying 'here T=50'), but the relationship between these reported scores and the task-level update of Eq. (11) is unclear. This makes it difficult to interpret the simulated results as predictions for the actual deployed reputation system, and it prevents the reader from reproducing Table 2 from the stated equations.
  3. [§4.2, Table 4, §5] The claimed security benefit of the reputation-aware mixing is not demonstrated by the experimental comparisons. R2-NNM's TPR/FPR are essentially identical to those of plain NNM in Table 1, and in Table 4 the ASR for R2-NNM remains around 0.096–0.098 under A3FL, i.e., the backdoor still has a measurable success rate; no statistical test or repeated-seed comparison is provided to show that the slight ASR differences are meaningful. The conclusion's own limitation statement concedes that the design 'does not adapt to round-varying adversarial pressure.' The paper's central defensive advantage—preventing stealthy attackers from gradually accumulating trust—is therefore supported only by the simulated reputation separation of Table 2, not by attack-success or reputation measurements in the actual system.
minor comments (5)
  1. [§4.3, Table 2 caption] The table caption says 'Final L_t_rep,i scores at round 100' while the text in §4.3 states 'T denotes the final round (here T=50)'; these numbers should be reconciled.
  2. [Eq. (2)] The normalization in the reputation-weighted term divides by sum over L_rep,l, but it is not stated whether L_rep denotes the local per-round score or the global task-level score; this should be clarified.
  3. [§4.1, baselines] In the AutoDFL baseline description, 'the top-m updates are selected' but the variable is then confusingly referred to as 'k' in the same paragraph; the notation should be aligned with the rest of the paper.
  4. [§4.2, Fig. 2] The legend in Figure 2 lists eight methods; the curves are difficult to distinguish in the gray-scale print, and the paper would benefit from labeled final-point markers or a table of final ACC/ASR values for each subplot.
  5. [§3.4, Eq. (3)] For t > T_warm the factor gamma_t = kappa * t / T_warm continues to grow beyond kappa, yet the text says reputation is 'increasingly influenced' only after warm-up; a cap or a different schedule should be stated explicitly.

Circularity Check

1 steps flagged · score 6.0 of 10

Reputation-fidelity claim is validated by simulating the assumption: Table 2 is an EMA transform of Bernoulli samples whose probabilities are the defense's measured TPR/FPR, so the 'prediction' restates its inputs.

  1. fitted input called prediction [Section 4.3, Eq. (14), Table 2]
    "For each trainer i, we simulate the robust local evaluation (Eq. (10)) over multiple FL rounds. The stochastic reliability indicator Reliability_t^i is sampled using the defense-specific TPR and FPR: P[Reliability_t^i = 1| i in B] = 1-FPR, P[Reliability_t^i = 1| i in M] = 1-TPR. (14) This models the probability that a benign or malicious trainer is considered trustworthy by the defense."

    Table 2, the only evidence offered for the Abstract's claim that the reputation model 'faithfully captures the statistical robustness of the underlying defense by producing reputation scores that closely reflect its true positive and false positive characteristics,' is produced by inserting each defense's measured TPR/FPR into Eq. (14) as Bernoulli acceptance probabilities and then feeding the resulting Reliable_i^t into the EMA update of Eq. (10). By construction, the expected reputation of a benign client is a smoothed version of 1-FPR and that of a malicious client is a smoothed version of 1-TPR, so the large separation in Table 2 is a mathematical consequence of the inputs rather than an independent validation.

full rationale

The paper's central novelty claim is that R2-NNM prevents stealthy attackers from accumulating trust and that, when paired with a detect-and-filter defense, the reputation model 'faithfully captures' that defense's TPR/FPR. The only support for this specific claim is Section 4.3, where Reliable_i^t is sampled as an independent Bernoulli variable with probabilities 1-FPR (benign) and 1-TPR (malicious), then smoothed by the EMA update Eq. (10) and averaged in Eq. (15). Given those inputs, benign-average reputation near 1-FPR and malicious-average reputation near 1-TPR are forced by the update equations, so Table 2 cannot independently establish that reputation scores reflect TPR/FPR; it merely displays a smoothed version of the inserted TPR/FPR values. The rest of the evaluation—convergence, ASR, TPR/FPR against external defenses, and ablation studies—is a genuine empirical comparison and is not circular. However, the advertised reputation-fidelity finding reduces by construction to the simulation's input probabilities. The conclusion's admission that the design 'does not adapt to round-varying adversarial pressure' further weakens the constant-TPR/FPR assumption but is not itself the circular step. Overall, this is a partial circularity centered on the headline reputation claim, not a fully circular paper; score 6.

Assumptions & free parameters 9 free parameters · 6 assumptions · 2 invented entities

The central contribution depends on a set of tuned hyperparameters (k, kappa, T_warm, alpha, beta0, and unreported tau, psi, xi, lambda) and on domain assumptions about honest aggregation and independence of acceptance events. The reputation scores are new state variables, but their evaluation is circular because the reliability signal is generated from the defense's own TPR/FPR.

free parameters (9)
  • k (number of nearest neighbors) = 5
    Controls mixing strength in Eq. (1); swept over [3,12] in Fig. 3, with FPR improving up to k=10.
  • kappa (reputation scaling factor) = 0.5
    Scales reputation influence in Eq. (3); swept over [0.25,1.0] in Appendix C, (T_warm=25, kappa=0.5) recommended.
  • T_warm (warm-up rounds) = 25
    Duration before reputation fully activates in Eq. (3); swept over [5,50] in Appendix C.
  • alpha (soft/binary blend) = 0.5
    Blends soft consistency and binary acceptance in Eq. (9); swept over [0,1] in Appendix B, recommended range [0.25,0.75].
  • beta0 (EMA base momentum) = 0.95
    Base momentum in Eq. (10); chosen to prioritize historical consistency.
  • tau (sigmoid temperature) = not specified
    Temperature in Eq. (8); not reported in the paper, only in code.
  • psi, xi (asymmetric EMA factors) = not specified
    Positive/negative feedback rates in Eq. (11); only the ordering psi>xi is given.
  • lambda (participation sensitivity) = not specified
    Controls task-participation weighting in Eq. (13); value not reported in the paper.
  • m (Multi-Krum selection count) = 13
    Number of selected updates for n=20 workers (also 10 in ablation); affects FPR strongly.
assumptions (6)
  • standard math Multi-Krum provides Byzantine robustness when the number of malicious clients is bounded
    Imported from [1,5] and used as the selection step in Eq. (5); no proof given here.
  • domain assumption The server is honest-but-curious, or the blockchain/oracle layer is secure
    Stated in Sec. 3.2; collusion involving aggregation entities is excluded from scope.
  • ad hoc to paper Acceptance by the defense is an independent Bernoulli process with fixed TPR/FPR (Eq. 14)
    This simulation assumption underlies the reputation-effectiveness results in Table 2 and is not validated against end-to-end runs.
  • ad hoc to paper Reputation should measure agreement with robust consensus, not task performance
    Design principle stated in Sec. 3.5; it justifies the data-free reputation model.
  • ad hoc to paper Gradual warm-up activation of reputation (gamma = kappa t / T_warm) improves stability
    Motivated by stability concerns in Sec. 3.4; no formal guarantee is provided.
  • ad hoc to paper Asymmetric EMA update (psi>xi) creates fast distrust and slow trust accumulation
    Regression Eq. (11) design; no proof of convergence under adversarial dynamics is provided.
invented entities (2)
  • Local reputation score L_rep,i
    purpose: Round-level trust signal used to weight nearest-neighbor mixing in Eq. (2).
    Internal state introduced by the paper; its claimed fidelity to defense TPR/FPR is tested only via simulation (Eq. 14), not independent data.
  • Global reputation score R_i
    purpose: Task-level trust record used for worker selection and incentives.
    A new ledger entry in the framework; the paper provides no external falsifiable handle beyond the same simulated TPR/FPR-based evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Reputation-Driven Crowdsourced Federated Learning." pith.science (2026). https://pith.science/paper/V3E46F77

@misc{pith2026260808574,
  author       = {Pith},
  title        = {Pith review of: Robust Reputation-Driven Crowdsourced Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V3E46F77}},
  note         = {Machine review of arXiv:2608.08574}
}
read the original abstract

Crowdsourced Federated Learning (CrowdFL) extends traditional federated learning by enabling open and heterogeneous participation through a crowdsourcing paradigm. In this setting, reputation-driven incentive mechanisms are commonly employed to guide worker selection and enhance trustworthiness. While such approaches improve participant reliability, existing frameworks largely overlook the quantification of their robustness against stealthy adversaries, particularly those capable of evading standard detection mechanisms. To fill this gap, this paper proposes R2CFL, a robust reputation-driven CrowdFL framework. R2CFL introduces a robust reputation model coupled with a nearest neighbor mixing (R2-NNM) defense mechanism that links reputation evolution with the filtering of updates during aggregation. The proposed mechanism prevents stealthy attackers from gradually accumulating trust and influencing future tasks. Experimental results demonstrate that R2-NNM matches or surpasses state-of-the-art Byzantine-robust and backdoor defense mechanisms against adaptive attackers. Furthermore, when integrated with existing detect-and-filter defenses, the proposed reputation model faithfully captures the statistical robustness of the underlying defense by producing reputation scores that closely reflect its true positive and false positive characteristics.

Figures

Figures reproduced from arXiv: 2608.08574 by the authors.

Figure 1
Figure 1. Overview of an L2-scalable deployment of R2CFL. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Convergence (ACC/LOSS) & robustness (ASR) performance under attacks. [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Impact of the mixing parameter k (top) and the number of workers n (bottom). Impact of the total number of workers n. To evaluate scalability, we fix k = 5 and increase the number of participants from 20 to 100. We see in [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 24 canonical work pages

  1. [1]

    In: International Conference on Artificial Intelligence and Statistics

    Allouah, Y., Farhadkhani, S., Guerraoui, R., Gupta, N., et al.: Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity. In: International Conference on Artificial Intelligence and Statistics. pp. 1232–1300. PMLR (2023)

    work page 2023

  2. [2]

    IEEE Transactions on Services Computing17(6), 3685–3698 (2024)

    An, J., Tang, S., Sun, X., Gui, X., He, X., Wang, F.: Freb: Participant selection in federated learning with reputation evaluation and blockchain. IEEE Transactions on Services Computing17(6), 3685–3698 (2024)

    work page 2024

  3. [3]

    In: Proceedings of the 23rd International Conference on Artifi- cial Intelligence and Statistics

    Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., Shmatikov, V.: How to backdoor federated learning. In: Proceedings of the 23rd International Conference on Artifi- cial Intelligence and Statistics. pp. 2938–2948 (2020)

    2020

  4. [4]

    In: IEEE Network Operations and Management Symposium (NOMS)

    Bellachia, A.A., Bouchiha, M.A., Ghamri-Doudane, Y., Rabah, M.: Verifbfl: Lever- aging zk-snarks for a verifiable blockchained federated learning. In: IEEE Network Operations and Management Symposium (NOMS). pp. 01–09. IEEE (2025)

    work page 2025

  5. [5]

    Advances in neural information processing systems30(2017)

    Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems30(2017)

    2017

  6. [6]

    IEEE Transactions on Services Computing pp

    Bouchiha, M.A., Rabah, M., Champagnat, R., Korba, A.A., Ghamri-Doudane, Y.: DARTIC: Decentralized anonymous reputation at scale for trustworthy crowdsourc- ing. IEEE Transactions on Services Computing pp. 1–16 (2026) 18 M. Bouchiha et al

    work page 2026

  7. [7]

    arXiv preprint arXiv:2404.13236 (2024)

    Bouchiha, M.A., Telnoff, Q., Bakkali, S., Champagnat, R., Rabah, M., Coustaty, M., Ghamri-Doudane, Y.: Llmchain: Blockchain-based reputation system for shar- ing and evaluating large language models. arXiv preprint arXiv:2404.13236 (2024)

    arXiv 2024

  8. [8]

    IEEE Transactions on Artificial Intelligence pp

    Chen, L., Zhao, D., Tao, L., Wang, K., Qiao, S., Zeng, X., Tan, C.W.: A credible and fair federated learning framework based on blockchain. IEEE Transactions on Artificial Intelligence pp. 1–15 (2024)

    work page 2024

Show all 31 references
  1. [9]

    In: IEEE Network Operations and Management Symposium (NOMS)

    Dif, M.M., Bouchiha, M.A., Rabah, M., Ghamri-Doudane, Y.: Autodfl: A scal- able and automated reputation-aware decentralized federated learning. In: IEEE Network Operations and Management Symposium (NOMS). pp. 1–9. IEEE (2025)

    2025

  2. [10]

    In: Proceedings of the AAAI conference on arti- ficial intelligence

    Feng, D., Helena, C., Lim, W.Y.B., Ng, J.S., et al.: Crowdfl: A marketplace for crowdsourced federated learning. In: Proceedings of the AAAI conference on arti- ficial intelligence. vol. 36, pp. 13164–13166 (2022)

    2022

  3. [11]

    Journal of Parallel and Distributed Computing 163, 283–299 (2022)

    Gao, L., Li, L., Chen, Y., Xu, C., Xu, M.: FGFL: A blockchain-based fair incentive governor for Federated Learning. Journal of Parallel and Distributed Computing 163, 283–299 (2022)

    2022

  4. [12]

    In: International Joint Conference on Neural Networks

    Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., Igel, C.: Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. In: International Joint Conference on Neural Networks. No. 1288 (2013)

    2013

  5. [13]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Huang, S., Li, Y., Chen, C., Shi, L., Gao, Y.: Multi-metrics adaptively identifies backdoors in federated learning. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 4652–4662 (2023)

    2023

  6. [14]

    IEEE Internet of Things Journal6(6), 10700–10714 (2019)

    Kang, J., Xiong, Z., Niyato, D., Xie, S., Zhang, J.: Incentive mechanism for reliable federated learning: A joint optimization approach to combining reputation and contract theory. IEEE Internet of Things Journal6(6), 10700–10714 (2019)

    2019

  7. [15]

    IEEE Transactions on Network and Service Management20, 2771–2782 (2023)

    Kasyap, H., Manna, A., Tripathy, S.: An Efficient Blockchain Assisted Reputa- tion Aware Decentralized Federated Learning Framework. IEEE Transactions on Network and Service Management20, 2771–2782 (2023)

    2023

  8. [16]

    IEEE Communications Letters24(6), 1279–1283 (2019)

    Kim, H., Park, J., Bennis, M., Kim, S.L.: Blockchained on-device federated learn- ing. IEEE Communications Letters24(6), 1279–1283 (2019)

    2019

  9. [17]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  10. [18]

    Discover Computing29(1), 111 (2026)

    Li, P., Grenn, M.: Robust federated learning through decentralized adaptive oracle consensus. Discover Computing29(1), 111 (2026)

    2026

  11. [19]

    arXiv preprint arXiv:2602.23167 (2026)

    Liang,S.,Hua,Y.,Jiang,L.,Yan,P.,Song,T.,Yao,B.,Guan,H.:Settlefl:Trustless and scalable reward settlement protocol for federated learning on permissionless blockchains (extended version). arXiv preprint arXiv:2602.23167 (2026)

    2026

  12. [20]

    In: Artificial intelligence and statistics

    McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. pp. 1273–1282. Pmlr (2017)

    2017

  13. [21]

    IEEE Communica- tions Surveys & Tutorials23, 1622–1658 (2021)

    Nguyen, D.C., Ding, M., Pathirana, P.N., Seneviratne, A., Li, J., Poor, H.V.: Fed- erated learning for internet of things: A comprehensive survey. IEEE Communica- tions Surveys & Tutorials23, 1622–1658 (2021)

    2021

  14. [22]

    In: 31st USENIX Security Symposium (USENIX Security)

    Nguyen, T.D., Rieger, P., Chen, H., Yalame, H., Möllering, H., et al.: FLAME: Taming backdoors in federated learning. In: 31st USENIX Security Symposium (USENIX Security). pp. 1415–1432 (2022)

    2022

  15. [23]

    In: Advances in Neural Information Processing Systems

    Nguyen, T.D., Nguyen, T.A., Tran, A., Doan, K.D., Wong, K.S.: Iba: Towards irre- versible backdoor attacks in federated learning. In: Advances in Neural Information Processing Systems. vol. 36, pp. 66364–66376. Curran Associates, Inc. (2023)

    2023

  16. [24]

    arXiv preprint arXiv:2201.00763 (2022) Robust Reputation-Driven Crowdsourced Federated Learning 19

    Rieger, P., Nguyen, T.D., Miettinen, M., Sadeghi, A.R.: Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. arXiv preprint arXiv:2201.00763 (2022) Robust Reputation-Driven Crowdsourced Federated Learning 19

    2022 arXiv

  17. [25]

    In: Ndss (2021)

    Shejwalkar, V., Houmansadr, A.: Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In: Ndss (2021)

    2021

  18. [26]

    arXiv preprint arXiv:1708.07747 (2017)

    Xiao, H., Rasul, K., Vollgraf, R.: Fashion-mnist: a novel image dataset for bench- marking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017)

    2017 arXiv

  19. [27]

    IEEE Trans

    Xu, G., Li, H., Liu, S., Yang, K., Lin, X.: Verifynet: Secure and verifiable federated learning. IEEE Trans. on Information Forensics and Security15, 911–926 (2019)

    2019

  20. [28]

    IEEE Internet of Things Journal10, 6561–6573 (2021)

    Xu, Y., Lu, Z., Gai, K., Duan, Q., Lin, J., Wu, J., Choo, K.K.R.: BESIFL: Blockchain-empowered secure and incentive federated learning paradigm in IoT. IEEE Internet of Things Journal10, 6561–6573 (2021)

    2021

  21. [29]

    IEEE Transactions on Network Sci- ence and Engineering11, 3969–3982 (2024)

    Yuan, Z., Tian, Y., Zhou, Z., Li, T., Wang, S., Xiong, J.: Trustworthy federated learning against malicious attacks in web 3.0. IEEE Transactions on Network Sci- ence and Engineering11, 3969–3982 (2024)

    2024

  22. [30]

    In: Advances in Neural Information Processing Systems

    Zhang, H., Jia, J., Chen, J., Lin, L., Wu, D.: A3fl: Adversarially adaptive back- door attacks to federated learning. In: Advances in Neural Information Processing Systems. vol. 36, pp. 61213–61233. Curran Associates, Inc. (2023)

    2023

  23. [31]

    In: Proceedings of the 39th International Confer- ence on Machine Learning (ICML)

    Zhang, Z., Panda, A., Song, L., Yang, Y., Mahoney, M., et al.: Neurotoxin: Durable backdoors in federated learning. In: Proceedings of the 39th International Confer- ence on Machine Learning (ICML). pp. 26429–26446. PMLR (2022) Appendices A. Time overhead.Since aggregation is ...

    2022

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.