Pith. sign in

REVIEW 4 major objections 4 minor 27 references

Adaptive poison hides in benign updates, defeating robust aggregation

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

An adaptive federated-learning backdoor attack uses membership-inference feedback on the global model to keep malicious updates statistically similar to benign ones, evading nine robust aggregation defenses in two image datasets.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Novel adaptive feedback attack worth a serious referee, but the 'break all RA defenses' claim depends on per-defense metric selection and the release has no code or seeds. the 4 major comments →

arxiv 2509.08746 v1 pith:6GHCM3WC submitted 2025-09-03 cs.CR

Stealth by Conformity: Evading Robust Aggregation through Adaptive Poisoning

Ryan McGaughey , Jesus Martinez del Rincon , Ihsen Alouani This is my paper
classification cs.CR
keywords federated learningbackdoor attackrobust aggregationmodel poisoningmembership inferenceadaptive attackside-channel inferencechameleon poisoning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that robust aggregation defenses in federated learning rest on a false premise: that malicious updates are statistical outliers. It introduces Chameleon Poisoning (CHAMP), an attack in which a malicious client reads the published global model as feedback to tell whether its earlier poisoned update was accepted, then reweights its local loss between poisoning and camouflage so its update looks normal. Across two datasets and nine defenses, CHAMP raises attack success rate by 47.07% on average over vanilla backdoor poisoning, and in the strongest configurations matches or exceeds poisoning with no defense. A sympathetic reader should care because CHAMP reframes the security question: defending aggregation may require detecting adaptivity over time, not just filtering per-round outliers.

Core claim

CHAMP's central claim is that a backdoor can be inserted into a federated global model while the malicious update remains statistically indistinguishable from benign updates, so robust aggregation filters cannot exclude it. The attack runs a closed loop each round: it trains a lightweight membership-inference classifier (the Backdoor Side-Channel Inference, or BSCI) on locally backdoored reference models, queries the newly published global model on backdoored samples to estimate whether the previous update was incorporated, and uses that estimate to set a balance coefficient alpha_t. The malicious local loss is L = L_pois + alpha_t L_prox, where L_prox penalizes distance from the previous gl

What carries the argument

Backdoor Side-Channel Inference (BSCI): a small SVM classifier trained on the output vectors of locally backdoored reference models, then applied to the global model's outputs on backdoored samples to produce a membership estimate v_t of whether the backdoor is present. v_t drives alpha_t = 1 - average(previous k v values), which balances the malicious term L_pois against the camouflage/proximity term L_prox in the malicious client's local loss; this closed loop lets a black-box attacker steer updates into the aggregator's acceptance region without knowing the aggregation rule.

Load-bearing premise

The attack collapses if the backdoor side-channel signal does not reliably tell the attacker whether its previous poisoned update was incorporated into the global model, because every adaptive choice in the loss balance depends on that signal.

What would settle it

Measure CHAMP's per-round side-channel estimate v_t against ground-truth knowledge of whether the malicious update was actually accepted by the aggregator; if the correlation is near zero, or if replacing BSCI with random alpha values preserves the attack's success-rate gain, the central claim is not supported. A simpler test: a defense that adds enough calibrated noise to the released global model to push BSCI accuracy to chance should also eliminate CHAMP's advantage over vanilla poisoning.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Robust aggregation alone does not stop an adaptive adversary that can observe the published global model; per-round outlier filtering misses updates that look normal.
  • On two datasets and nine defenses, CHAMP improves attack success rate by 47.07% on average over vanilla data poisoning, and in five defenses reaches near-total backdoor success.
  • The attack needs no white-box access to the server or aggregation rule, because the global model broadcast each round supplies the feedback signal.
  • The BSCI side channel is more informative than raw attack success rate for guiding the attack, as it detects early signs of backdoor incorporation before the backdoor appears in predictions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same feedback principle likely generalizes beyond backdoors: any malicious objective whose effect is observable in the global model's outputs (targeted misclassification, class imbalance, fairness drift) could be steered with a similar membership-style probe.
  • A defense that injects calibrated noise or obfuscation into the released global model specifically to break BSCI-style membership inference would force the attacker back to vanilla poisoning; testing this is a direct extension of the paper's experiments.
  • The paper's setup uses IID data, ten clients, one malicious client, and full client participation each round; whether the attack survives non-IID distributions, larger client pools, or partial participation is left open and is the natural next test.
  • If robust aggregation is to survive such adversaries, it may need to move from static per-round outlier rejection to consistency checks across rounds, for example detecting clients whose updates alternate between conformity and attack in response to feedback.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes Chameleon Poisoning (CHAMP), an adaptive model-poisoning attack for federated learning. A malicious client trains a Backdoor Side-Channel Inference (BSCI) model on poisoned reference models and uses the global model's responses on backdoored samples to estimate whether its malicious update was incorporated in aggregation. This estimate vt is converted into an adaptive balance coefficient alpha_t that weights a malicious loss L_pois against a camouflage/proximity loss L_prox. The attack is evaluated against nine robust aggregation defenses on Fashion-MNIST and CIFAR-10, reporting large ASR gains over a vanilla data-poisoning baseline and claiming that, under suitable configuration, all surveyed RA defenses can be broken.

Significance. The core idea is valuable and timely: using membership-inference-like feedback from the published global model to adaptively trade off poisoning strength against statistical conformity directly challenges the out-of-distribution assumption underlying most robust aggregation schemes. The paper is also broad in scope, covering nine defenses, two datasets, trigger-size ablations, multiple proximity metrics, and an ablation of the side-channel signal. If the central claim were established under a genuinely black-box threat model, this would be a notable contribution to the FL security literature. However, the headline result currently rests on per-defense selection of the proximity metric after observing results, and the load-bearing BSCI signal is validated only in a centralized, fully backdoored setting; both issues need to be resolved before the central claim is supported.

major comments (4)
  1. [§VI.A, Table I and §VI.C, Table II] The main table selects, for each defense, the best of three proximity metrics after observing the results, while the threat model in §III explicitly denies white-box knowledge of the aggregation rule. This is post hoc selection, not black-box evaluation. The problem is visible in Table II: the paper's own recommended black-box metric, Huber loss, gives RLR a 5x5 CIFAR-10 ASR of 3.2% and FoolsGold 15.1%, both below the vanilla baseline's 39.6% and 60.2% on the same configuration. Thus the claim in §VIII that 'it is possible, under a suitable configuration, to break all RA defences' is an overstatement: the experiments demonstrate that each defense can be broken by some tuned proximity metric, not that a single black-box CHAMP adversary evades all of them. The headline evaluation must be redone with a fixed proximity metric (or with a principled online selection mechanism that does not use
  2. [§IV.A, Algorithm 1 and Appendix A] The entire adaptive loop depends on the BSCI signal vt: it sets alpha_t in Eq. (9) and balances L_pois and L_prox in Eq. (10). However, Appendix A validates the underlying membership-inference intuition only on centralized MNIST models that are fully backdoored. It does not test whether the signal remains reliable when the global model is produced by aggregating one malicious update with nine benign updates and then filtering through a robust aggregator. If vt is noisy or weakly correlated with actual inclusion of the malicious update under RA, CHAMP degenerates into vanilla poisoning and the central mechanism collapses. The manuscript needs direct evidence, e.g., measuring vt against the actual selection outcome (as in Krum/Multi-Krum) or against the eventual ASR under each RA defense, before the side-channel can be considered load-bearing.
  3. [§V and §VI, Tables I–II and Figures 4–8] All reported results appear to be single runs with no seeds, confidence intervals, or variance estimates. Federated learning is stochastic, and ASR values for strong defenses can fluctuate substantially across runs; the difference between, for example, Krum baseline ASR 3.07 and CHAMP ASR 100 in Table I could be affected by run-to-run variation. Given the paper's strong empirical claims, the core tables and central comparisons should be repeated with multiple seeds and reported with means and standard deviations or confidence intervals.
  4. [§VI.C and §VIII] Section VI.C states that 'in a blackbox setting where no knowledge of the aggregation rule is available, Huber loss seems the more robust approach, while efficacy gains are possible in a white-box threat model.' This directly undermines the unqualified conclusion in §VIII that all RA defenses are broken. The manuscript should either present the fixed-Huber results as the black-box headline and acknowledge which defenses are and are not evaded under that configuration, or relax the threat model and clearly label the per-defense metric selection as white-box/defense-specific tuning. As written, the conclusion and the experimental setup are not consistent.
minor comments (4)
  1. [Global] There are numerous typos and formatting artifacts, e.g., 'wiht', 'isntead', 'ocnductedon', and malformed equations (Eq. 14, Eq. 21, Eq. 22). A careful proofreading pass is needed.
  2. [§I and Abstract] The abstract and introduction report 'an average increase of 47.07% in attack success rate' but do not define the averaging convention (over defenses? datasets? configurations?) nor connect it to a specific table. Please state the exact aggregation and reference baseline.
  3. [Algorithm 1 / §IV.A] Notation is inconsistent about whether BSCI is applied to G_t or G_{t-1}: the algorithm input is 'G_t' while the text says the adversary probes the 'newly published G_{t-1}'. This makes it hard to reproduce the timing of the feedback loop.
  4. [§VII and Eq. (15)-(22)] Several related-work and defense descriptions contain missing subscripts, stray characters, and undefined symbols (e.g., 'gt n,1' vs 'gt n,k'). Please revise for precision.

Circularity Check

0 steps flagged

No significant circularity: the adaptive attack loop is an empirical feedback mechanism and no reported success measure is used to define the attack's inputs.

full rationale

The paper's core mechanism is a closed-loop attack: vt is the average BSCI membership prediction over backdoored samples on the published global model (Algorithm 1), alpha_t is defined as 1 minus the average vt over k rounds (Eq. 9), and the local loss is L_t = L_pois + alpha_t L_prox (Eq. 10). The reported attack success rate ASR is measured separately on the trigger set (Eq. 11). There is no equation in which ASR is substituted back into vt, alpha_t, or L_prox, and no parameter is fitted to the reported ASR. The BSCI detector is trained on reference models with known poison percentages, which is an independent side-channel model rather than a quantity derived from the final attack results. The ablation comparing BSCI with an ASR-driven alpha (Eq. 12) is an alternative control, not the main method, and does not define the main attack. The per-defense selection of the best proximity metric in Table I is post hoc oracle selection and is a threat-model validity concern, not circular reasoning: the metric is an input configuration, not a quantity derived from the attack-success numbers it is used to produce. The paper invokes no load-bearing self-citations; the cited MIA, backdoor, and robust-aggregation works are external, and none of the authors' prior results are used to justify the central claim. Therefore no circular step is identifiable under the required standard.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central claim rests on the empirical assumption that a backdoored global model leaks a detectable side-channel, plus many hand-set attack parameters. No physical or ontological entities are introduced; BSCI is an algorithmic component rather than a postulated entity.

free parameters (4)
  • alpha window k = 5 for CIFAR-10, 3 for Fashion-MNIST
    Hand-chosen in Section V.A; alpha_t averages vt over the last k rounds in Eq. 9. Adaptation speed depends on this window.
  • BSCI reference model count and poisoning ratios p = R=6, p={0.3,0.2,0.1,0.0,0.0,0.0}
    Section V defines the BSCI training set with these values; no sensitivity analysis is reported for the attack's central feedback component.
  • Proximity metric for L_prox = Euclidean, cosine, or Huber, best per defense
    Section VI.A reports CHAMP using the best of three metrics after observing results. This is a post hoc selection that violates the black-box threat model unless the attacker knows the defense in advance.
  • Backdoor trigger size = 3x3 default; 1x1 and 5x5 in ablations
    Trigger strength is a central attack knob; attack success varies strongly with size in Figures 4 and 5.
axioms (4)
  • domain assumption Benign client updates form a distribution and RA acceptance regions are based on deviation from that distribution.
    Sections I and VII rely on this to justify L_prox steering malicious updates into the aggregator's acceptance region.
  • domain assumption A backdoored global model is detectable by membership inference on the attacker's own poisoned samples.
    Section IV.A and Appendix A support this only on centralized MNIST with fully backdoored models, not on FL with a single malicious update.
  • domain assumption The adversary can train R=6 reference models every round on local data and query the global model arbitrarily.
    Threat model in Sections III and IV; adds significant compute and data requirements beyond a simple poisoning attacker.
  • domain assumption Evaluation uses IID data with all 10 clients participating in every round.
    Section V.A; RA robustness is known to degrade under non-IID and partial participation, so this favorable setup is load-bearing for the generality claim.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Stealth by Conformity: Evading Robust Aggregation through Adaptive Poisoning." pith.science (2026). https://pith.science/paper/6GHCM3WC

@misc{pith2026250908746,
  author       = {Pith},
  title        = {Pith review of: Stealth by Conformity: Evading Robust Aggregation through Adaptive Poisoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6GHCM3WC}},
  note         = {Machine review of arXiv:2509.08746}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated Learning (FL) is a distributed learning paradigm designed to address privacy concerns. However, FL is vulnerable to poisoning attacks, where Byzantine clients compromise the integrity of the global model by submitting malicious updates. Robust aggregation methods have been widely adopted to mitigate such threats, relying on the core assumption that malicious updates are inherently out-of-distribution and can therefore be identified and excluded before aggregating client updates. In this paper, we challenge this underlying assumption by showing that a model can be poisoned while keeping malicious updates within the main distribution. We propose Chameleon Poisoning (CHAMP), an adaptive and evasive poisoning strategy that exploits side-channel feedback from the aggregation process to guide the attack. Specifically, the adversary continuously infers whether its malicious contribution has been incorporated into the global model and adapts accordingly. This enables a dynamic adjustment of the local loss function, balancing a malicious component with a camouflaging component, thereby increasing the effectiveness of the poisoning while evading robust aggregation defenses. CHAMP enables more effective and evasive poisoning, highlighting a fundamental limitation of existing robust aggregation defenses and underscoring the need for new strategies to secure federated learning against sophisticated adversaries. Our approach is evaluated in two datasets reaching an average increase of 47.07% in attack success rate against nine robust aggregation defenses.

Figures

Figures reproduced from arXiv: 2509.08746 by Ihsen Alouani, Jesus Martinez del Rincon, Ryan McGaughey.

Figure 1
Figure 1. Figure 1: Conceptual description of our adaptive poison [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Figure outlining a model trained an clean data and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Outline of our CHAMP attack with one malicious client. It depicts 3 steps: (1) the backdoor side channel inference to estimate the membership of a backdoor attack in the global model, (2) Adapting the poisoning with the malicious and the camouflage components, (3) implement model poisoning in local model. MIA-style test to a small set of triggered examples yields a side-channel signal indicating whether th… view at source ↗
Figure 4
Figure 4. Figure 4: ASR comparison between our adaptive attack C [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Global model accuracy and ASR for a vanilla [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Krum score for a malicious client performing [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Figure showing both the backdoor side channel information leakage value [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Figure showing the α score and ASR calculated for each RA scheme at every training round using Eq. 9 starting from training round k for Fashion-MNIST. feedback to measure its own success. Furthermore, much like the observation on affecting the loss of specific samples in the gradient ascent approach, we observe that outlier samples (here backdoored samples) are easier to detect by a membership inference mo… view at source ↗
Figure 9
Figure 9. Figure 9: Confusion matrix for MIAs against backdoored [PITH_FULL_IMAGE:figures/full_fig_p015_9.png] view at source ↗
Figure 11
Figure 11. Figure 11: Visualization of the classic backdoor attack [PITH_FULL_IMAGE:figures/full_fig_p016_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: TSNE plots for all clients updates to a central [PITH_FULL_IMAGE:figures/full_fig_p016_12.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

27 extracted references · 15 canonical work pages · 4 internal anchors

  1. [1]

    Communication-Efficient Learning of Deep Networks from Decentralized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics . PMLR, Apr. 2017, pp. 1273–1282, iSSN: 2640-3498. [Online]. Available: https://proceedings.mlr.press/v54/mcmahan17a.html

    work page 2017

  2. [2]

    How To Backdoor Federated Learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How To Backdoor Federated Learning,” in Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics . PMLR, Jun. 2020, pp. 2938–2948, iSSN: 2640-3498. [Online]. Available: https://proceedings.mlr.press/ v108/bagdasaryan20a.html

    work page 2020

  3. [3]

    Local Model Poisoning Attacks to {Byzantine-Robust} Federated Learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local Model Poisoning Attacks to {Byzantine-Robust} Federated Learning,” 2020, pp. 1605–1622. [Online]. Available: https://www.usenix. org/conference/usenixsecurity20/presentation/fang

    work page 2020

  4. [4]

    Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021. [Online]. Available: https://par.nsf. gov/servlets/purl/10286354

    arXiv 2021

  5. [5]

    DBA: Distributed Backdoor Attacks against Federated Learning,

    C. Xie, K. Huang, P.-Y . Chen, and B. Li, “DBA: Distributed Backdoor Attacks against Federated Learning,” Sep. 2019. [On- line]. Available: https://openreview.net/forum?id=rkgyS0VFvr

    work page 2019

  6. [6]

    Machine learning with adversaries: byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: byzantine tolerant gradient descent,” in Proceedings of the 31st International Conference on Neural Information Processing Systems , ser. NIPS’17. Red Hook, NY , USA: Curran Associates Inc., Dec. 2017, pp. 118– 128

    work page 2017

  7. [7]

    The Hidden Vulnerability of Distributed Learning in Byzantium,

    E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “The Hidden Vulnerability of Distributed Learning in Byzantium,” Jul. 2018, arXiv:1802.07927 [stat]. [Online]. Available: http: //arxiv.org/abs/1802.07927

    Pith/arXiv arXiv 2018

  8. [8]

    Byzantine- Robust Distributed Learning: Towards Optimal Statistical Rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine- Robust Distributed Learning: Towards Optimal Statistical Rates,” in Proceedings of the 35th International Conference on Machine Learning . PMLR, Jul. 2018, pp. 5650–5659, iSSN: 2640-3498. [Online]. Available: https://proceedings.mlr. press/v80/yin18a.html

    work page 2018

  9. [9]

    BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain,” Mar. 2019, arXiv:1708.06733 [cs]. [Online]. Available: http: //arxiv.org/abs/1708.06733

    Pith/arXiv arXiv 2019

  10. [10]

    Membership Inference Attacks against Machine Learning Models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership Inference Attacks against Machine Learning Models,” Mar. 2017, arXiv:1610.05820 [cs, stat]. [Online]. Available: http: //arxiv.org/abs/1610.05820

    Pith/arXiv arXiv 2017

  11. [11]

    Membership Inference Attacks From First Principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership Inference Attacks From First Principles,” Apr. 2022, arXiv:2112.03570. [Online]. Available: http://arxiv.org/ abs/2112.03570

    Pith/arXiv arXiv 2022

  12. [12]

    Low-Cost High-Power Membership Inference Attacks,

    S. Zarifzadeh, P. Liu, and R. Shokri, “Low-Cost High-Power Membership Inference Attacks,” Jun. 2024, arXiv:2312.03262. [Online]. Available: http://arxiv.org/abs/2312.03262

    Pith/arXiv arXiv 2024

  13. [13]

    Enhanced Membership Inference Attacks against Machine Learning Models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced Membership Inference Attacks against Machine Learning Models,” Sep. 2022, arXiv:2111.09679. [Online]. Available: http://arxiv.org/abs/2111.09679

    Pith/arXiv arXiv 2022

  14. [14]

    Imperceptible backdoor attack: From input space to feature representation,

    N. Zhong, Z. Qian, and X. Zhang, “Imperceptible backdoor attack: From input space to feature representation,” in Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22 , L. D. Raedt, Ed. International Joint Conferences on Artificial Intelligence Organization, 7 2022, pp. 1736–1742, main Track. [Online]. Availab...

    work page doi:10.24963/ijcai.2022/242 2022

  15. [15]

    Robust Estimation of a Location Parameter,

    P. J. Huber, “Robust Estimation of a Location Parameter,” The Annals of Mathematical Statistics , vol. 35, no. 1, pp. 73–101, Mar. 1964, publisher: Institute of Mathematical Statistics. [Online]. Available: https: //projecteuclid.org/journals/annals-of-mathematical-statistics/ volume-35/issue-1/Robust-Estimation-of-a-Location-Parameter/ 10.1214/aoms/11777...

    arXiv 1964

  16. [16]

    CIFAR-10 and CIFAR-100 datasets

    “CIFAR-10 and CIFAR-100 datasets.” [Online]. Available: https://www.cs.toronto.edu/∼kriz/cifar.html

    work page

  17. [17]

    ImageNet Classification with Deep Convolutional Neural Networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “ImageNet Classification with Deep Convolutional Neural Networks,” in Advances in Neural Information Processing Systems, vol. 25. Curran Associates, Inc., 2012. [Online]. Available: https://papers.nips.cc/paper files/paper/ 2012/hash/c399862d3b9d6b76c8436e924a68c45b-Abstract.html

    work page 2012

  18. [18]

    Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms,” Sep. 2017, arXiv:1708.07747 [cs]. [Online]. Available: http://arxiv.org/abs/1708.07747

    Pith/arXiv arXiv 2017

  19. [19]

    Attack of the Tails: Yes, You Really Can Backdoor Federated Learning,

    H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the Tails: Yes, You Really Can Backdoor Federated Learning,” in Advances in Neural Information Processing Systems, vol. 33. Curran Associates, Inc., 2020, pp. 16 070– 16 084. [Online]. Available: https://proceedings.neurips.cc/paper/ 2020/...

    work page 2020

  20. [20]

    Can You Really Backdoor Federated Learning?

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can You Really Backdoor Federated Learning?” Dec. 2019, arXiv:1911.07963 [cs, stat]. [Online]. Available: http://arxiv.org/ abs/1911.07963

    Pith/arXiv arXiv 2019

  21. [21]

    Deep Model Poisoning Attack on Federated Learning,

    X. Zhou, M. Xu, Y . Wu, and N. Zheng, “Deep Model Poisoning Attack on Federated Learning,” Future Internet, vol. 13, no. 3, p. 73, Mar. 2021, number: 3 Publisher: Multidisciplinary Digital Publishing Institute. [Online]. Available: https://www.mdpi.com/ 1999-5903/13/3/73

    work page 2021

  22. [22]

    DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning

    M. T. Hossain, S. Islam, S. Badsha, and H. Shen, “DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning,” Sep. 2021, arXiv:2109.09955 [cs]. [Online]. Available: http://arxiv.org/abs/2109.09955

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  23. [23]

    Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning,” Jun. 2020, arXiv:1812.00910. [Online]. Available: http://arxiv.org/abs/1812.00910

    Pith/arXiv arXiv 2020

  24. [24]

    Robust Aggregation for Federated Learning

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust Aggre- gation for Federated Learning,” IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022, arXiv:1912.13445 [cs, stat]. [Online]. Available: http://arxiv.org/abs/1912.13445

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  25. [25]

    Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection

    J. Xu, Z. Zhang, and R. Hu, “Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection,” Mar. 2025, arXiv:2503.07978 [cs]. [Online]. Available: http: //arxiv.org/abs/2503.07978

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  26. [26]

    Defending against Backdoors in Federated Learning with Robust Learning Rate

    M. S. Ozdayi, M. Kantarcioglu, and Y . R. Gel, “Defending against Backdoors in Federated Learning with Robust Learning Rate,” Jul. 2021, arXiv:2007.03767 [cs]. [Online]. Available: http://arxiv.org/abs/2007.03767

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  27. [27]

    Mitigating Sybils in Federated Learning Poisoning,

    C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating Sybils in Federated Learning Poisoning,” Jul. 2020, arXiv:1808.04866 [cs, stat]. [Online]. Available: http://arxiv.org/abs/1808.04866 In Out Predicted Label In Out True Label 5423 500 69 911 Backdoored T arget Model In Out Predicted Label In Out True Label 1227 4696 193 787 Non-Backdoored T arget Mo...

    Pith/arXiv arXiv 2020

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.