Pith. sign in

REVIEW 3 major objections 5 minor 68 references

The paper claims that benign clients' training hyperparameters—learning rate, batch size, local epochs, and weight decay—strongly modulate backdoor attack success in horizontal federated learning, and that a well-chosen configuration reduce

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Benign clients' training hyperparameters act as a backdoor-defense lever: choosing higher learning rates, more local epochs, and smaller batch sizes substantially reduces backdoor attack success in horizontal federated learning.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Benign hyperparameters matter — the qualitative finding holds; the quantitative no-sacrifice/universality claims are in-sample and too strong. the 3 major comments →

arxiv 2509.05192 v2 pith:7G55RVGC submitted 2025-09-05 cs.CR

On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning

Simon Lachnit , Ghassan Karame This is my paper
classification cs.CR
keywords horizontal federated learningbackdoor attackshyperparameter tuningbenign clientslearning ratelocal epochsbatch sizeadaptive adversaries
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that in horizontal federated learning—a distributed setup where many clients train a shared model on their own private data—the hyperparameters chosen by honest clients are a first-order factor in whether backdoor attacks succeed, not just a detail of model accuracy. Through a recursive model of the global update and extensive measurements, it argues that a higher honest-client learning rate, more local training epochs, a smaller batch size, and higher weight decay each reduce backdoor accuracy and shorten backdoor lifespan, and that these honest choices cap attack success even when the adversary adapts its own settings. The practical upshot is one recommended benign configuration (learning rate 0.15, momentum 0.9, weight decay 0.0005, 10 local epochs, batch size 32) that yields across-the-board robustness improvements against four state-of-the-art attacks, with little clean-accuracy cost. If the claim is right, many published backdoor success rates are inflated by ad-hoc benign settings, and defenders have a zero-overhead proactive lever they can set before any attack starts.

Core claim

The paper's central claim is that the choice of training hyperparameters by benign clients—learning rate, momentum, weight decay, number of local epochs, and batch size—materially changes the success and persistence of backdoor attacks in horizontal federated learning, and that a careful choice can suppress attack effectiveness regardless of the malicious clients' hyperparameters. The paper demonstrates this both analytically, through a recursion for the malicious loss under FedAvg with a two-group benign/malicious abstraction, and empirically across the A3FL, Chameleon, DarkFed, and FCBA attacks under several defenses and adaptive adversaries. The recommended benign configuration (η_b=0.15,

What carries the argument

The load-bearing object is a recursive equation for the malicious loss under the standard FedAvg aggregation rule: F_m(θ^t)=F_m(θ^{t-1} − (1−α)Δ_b^t − αΔ_m^t), in which Δ_b and Δ_m are the benign and malicious model updates, each determined by learning rate, momentum, local epochs, batch size, and weight decay. The paper instantiates the two loss functions F_b and F_m with small diagonal linear networks on a toy classification problem plus a backdoor task, which lets it derive the qualitative behavior: raising the benign learning rate or the number of benign gradient steps raises the malicious loss (that is, lowers backdoor accuracy), and the effect saturates as the malicious learning rate g

Load-bearing premise

The recommendation assumes that the simplified model of training as two client groups—benign and malicious—plus the four tested attacks captures how backdoor resistance responds to benign hyperparameters in real deployments and future attacks.

What would settle it

Evaluate a held-out backdoor attack (e.g., a semantic-trigger attack on CIFAR-100) under the recommended benign configuration with the same attack budget; if peak backdoor accuracy or lifespan is not substantially lower than under the paper's default benign settings, the claim that benign tuning caps attack success regardless of attack is falsified.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Reported backdoor success rates in HFL are inflated when benign clients use the ad-hoc settings common in the literature; under the recommended benign configuration, backdoor accuracy and lifespan drop across all four tested attacks, in several cases to near-zero.
  • A proactive, zero-overhead defense exists: choosing benign hyperparameters before deployment requires no runtime computation and can outperform at least one commonly used defense (Krum) when used alone.
  • Adaptive adversaries—including those that greedily or stochastically tune malicious hyperparameters in response—are capped by well-chosen benign settings; against the stochastic adversary, average backdoor accuracy and post-attack backdoor accuracy fall by about 31 and 30 percentage points even without a defense.
  • The effects hold across several model architectures (ResNet20, MobileNetV2, VGG17) and Tiny-ImageNet, so the qualitative guidance is not an artifact of one setup.
  • Defenses such as FoolsGold combine usefully with tuned benign hyperparameters, while some defenses show less benefit than originally reported once benign settings are fixed.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, if the asymptotic-cap result holds, future HFL security evaluations should publish and control benign hyperparameter choices; attack-defense comparisons without a tuned benign baseline would be hard to interpret.
  • Beyond the paper, the mechanism suggests a deployment-time optimization loop: since the server already selects hyperparameters, it could run a small search (cheap proxy tasks) before deployment to find a config for its specific model, granting even stronger robustness than the paper's one-size-fits-all recommendation.
  • Beyond the paper, the same reasoning predicts that heterogeneity in benign hyperparameters across clients destabilizes training and should be avoided—the paper validates this in four of six tested combinations; a natural extension is to quantify how much heterogeneity is tolerable before robustness degrades.
  • Beyond the paper, the observed trend that model capacity increases backdoor persistence (VGG17) suggests larger models may need even more aggressive benign regularization, a testable prediction for transformer-scale federated models.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies how the hyperparameters of benign clients in horizontal federated learning (HFL) affect the success of backdoor attacks and the effectiveness of defenses. It provides an analytical recursion on a toy diagonal-linear-network model (Eqs. (3)–(6)), an empirical ablation across five benign hyperparameters (learning rate, momentum, weight decay, local epochs, batch size) under four state-of-the-art attacks (A3FL, Chameleon, DarkFed, FCBA), four defenses, multiple architectures and datasets, and two adaptive adversary models. Based on a Pareto/NSGA-II search over a discrete grid, it recommends a single benign configuration (η_b=0.15, λ_b=0.0005, E_b=10, B_b=32) and claims that this configuration curbs backdoor effectiveness 'regardless of the malicious clients' settings' and 'without sacrificing main task accuracy,' e.g., reducing the A3FL 50%-lifespan by 98.6%.

Significance. If the central quantitative claims held, this would be an important result: benign hyperparameters would be a first-order, defender-controlled variable in HFL security evaluations, and many published attack/defense comparisons would need to be revisited. The paper has notable strengths: a systematic survey of 15 prior attacks, a unified evaluation framework, reproducible public code with fixed seeds, consistent qualitative trends across four attacks, multiple architectures, and multiple datasets, and an analytical recursion that is non-circular (it is a FedAvg update identity rather than an assumption smuggled into the conclusion). The direction of the effect — higher benign learning rate, more local epochs, smaller batch size, and higher weight decay reduce backdoor accuracy and lifespan — is consistently supported by the measurements. However, the stress-test concern lands: the recommended configuration is selected on the same attack/defense grid on which the headline numbers are reported, and Table V shows a concrete counterexample to the 'no sacrifice' claim. The strength of the paper is in the qualitative finding and the evaluation methodology; the current overclaims and the l

major comments (3)
  1. The abstract claims the recommended benign configuration yields 'across-the-board improvements in robustness without sacrificing main task accuracy' and works 'regardless of the malicious clients' settings.' This is not established. The configuration (η_b=0.15, λ_b=0.0005, E_b=10, B_b=32) is selected via grid search/NSGA-II on the same attack/defense combinations that are later reported as results, so the headline figures are in-sample selections. Table V, DarkFed/None row, shows the recommended configuration under the unconstrained greedy BDA-maximizing adversary yields MTA=11.4% versus 84.2% with the original parameters — a 72.8 percentage-point collapse. The MTA-constrained adversary (MTA_c) is listed as N.A. for this combination, so it does not rescue the claim. The 'regardless of malicious settings' claim fails for the unconstrained adversary. The revision should either restrict the
  2. The OLS regressions report R²=0.191 for BDA, 0.163 for BDA*, and 0.166 for Span50. These fits explain only a small fraction of the variance, so the benign hyperparameters are statistically significant but not dominant. The Pareto/NSGA-II selection over a 24-point grid then picks a single configuration; with such low explanatory power, the selected point is likely one of many near-equivalent solutions and is at risk of overfitting to the specific four attacks and four defenses evaluated. The paper needs cross-validation or a held-out evaluation to support the stability of the recommended configuration, and the quantitative claims (e.g., the 98.6% lifespan reduction) should be reported with error bars or across multiple seeds rather than as point estimates from the selection grid.
  3. The analytical recursion is a FedAvg update identity and is not circular, which I acknowledge as a strength. However, the paper uses a 2D classification task on a diagonal linear network as a 'faithful surrogate' for F_b and F_m, and then uses the asymptotic behavior of the toy model to argue that benign hyperparameters can lower-bound malicious loss 'irrespective of the malicious learning rate' and, by extension, 'regardless of the malicious clients' settings.' This is a strong conclusion drawn from a model with a hand-designed backdoor, full-batch gradient descent, no defenses, and no adaptive adversary. The empirical results support a qualitative direction, but the analytic model does not by itself establish the across-the-board, attacker-agnostic claim. I recommend reframing the analytical part as an illustrative mechanism and relying on the empirical evaluation for the quantitative
minor comments (5)
  1. [Abstract] The phrase 'reduced by 98.6%, respectively' contains a stray 'respectively' and should be reworded.
  2. [§IV-A] The notation 'Fm(θt)−Fm(θ*_m)∼Fm(θt)' is ambiguous; the '∼' is not defined. Please clarify what quantity is plotted in Figure 3.
  3. [§VI-C] The search space Ω is very small (η_b∈{0.1,0.15,0.2}, λ_b∈{0.0005,0.001}, E_b∈{10,20}, B_b∈{16,32}). The word 'Pareto frontier' is used for a frontier over a discrete grid; this is fine, but the recommended configuration's optimality is only within this grid. The paper should state this limitation explicitly in the main text, not only in the limitations section.
  4. [§VI-C] The paper states that grid search gave 'nearly identical' results to NSGA-II but reports only the NSGA-II outcome. Please provide the grid-search results or a direct comparison, since the reproducibility of the recommended configuration depends on this claim.
  5. [§III-B] The threat model states that malicious clients 'do observe the benign clients' training hyperparameters' and can estimate the impact of their choices. The adaptive adversary is then evaluated only on the same hyperparameter grid as the benign clients. This is a reasonable design, but the relation between the greedy/stochastic adversaries and the real-world 'informed manner' assumption should be discussed more carefully, especially since the stochastic adversary is much more computationally expensive than the greedy one.

Circularity Check

0 steps flagged

No circular derivation found: the recursion equations are FedAvg update identities, and the headline results are measurements, not quantities defined by the fitted hyperparameters. The recommended configuration is selected on the same evaluation grid, which is a generalization/overfitting concern rather than a circularity.

full rationale

The paper's analytical section (Eqs. 3-6) recursively states how the global model is updated under FedAvg with benign and malicious client updates; these are identities describing the update rule, not definitions that smuggle in the conclusion that higher benign learning rates reduce backdoor accuracy. The subsequent claims about BDA, BDA*, and lifespan are supported by direct measurements on the selected attacks and defenses, so the attack-success metrics are not defined by the hyperparameters being varied. The recommended benign configuration is found by Pareto/grid/NSGA-II search over the same attack-defense combinations later reported in Tables IV and V, so the headline improvement numbers are in-sample and may not generalize; Table V even shows DarkFed/None MTA collapsing to 11.4% under the unconstrained greedy adversary, contradicting the blanket 'without sacrificing main task accuracy' phrasing. However, this is a statistical selection/generalization caveat, not a case where the prediction reduces to its own input by construction. No self-citation chain or uniqueness theorem is load-bearing, and no equation is defined in terms of the quantity it is supposed to predict. The paper is therefore not significantly circular, though the strength of the quantitative claims should be tempered by the lack of out-of-sample validation.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 0 invented entities

The central claim rests on the FedAvg recursion structure, the assumption that benign clients share one hyperparameter configuration, a threat model in which attackers observe and adapt to benign settings, and the choice of toy-model instantiations and search grids. No new physical or mathematical entities are introduced.

free parameters (5)
  • Recommended benign learning rate eta_b = 0.15
    Selected from Omega_eta_b = {0.1, 0.15, 0.2} as a Pareto-optimal compromise; headline reductions are measured with this in-sample choice.
  • Recommended benign local epochs E_b = 10
    Selected from {10, 20} in the Pareto search; higher E_b reduces BDA but can affect MTA.
  • Recommended benign batch size B_b = 32
    Selected from {16, 32}; smaller B_b increases SGD noise and reduces backdoor persistence.
  • Recommended benign weight decay lambda_b = 0.0005
    Selected from {0.0005, 0.001}; lambda_b has significant effect on BDA* and lifespan.
  • Learning-rate decay factor gamma = 0.999
    Chosen by hand to satisfy the FedAvg convergence criterion from Li et al. [32]; used throughout the main experiments.
axioms (6)
  • domain assumption All honest clients use one shared hyperparameter configuration broadcast by the server.
    Section III-B; empirically justified by Figure 14 where randomized per-client hyperparameters cause divergence in 4 of 6 cases.
  • domain assumption The two-group abstraction: a single loss F_b and F_m represents all benign and malicious clients, respectively.
    Section IV-A; used to derive Equations 3 to 6; ignores within-group heterogeneity and client sampling.
  • domain assumption Adversaries observe the benign hyperparameters and may adapt malicious ones via greedy or stochastic (NSGA-II) search.
    Section III-B and VI-B; the adaptive-adversary results depend on this.
  • ad hoc to paper A diagonal linear network on a 2D classification task with a designed backdoor is a faithful surrogate for F_b and F_m.
    Section IV-A; produces Figures 3 and 6; qualitative, not a rigorous bound for arbitrary losses.
  • ad hoc to paper The search grid Omega covers the practically relevant benign hyperparameter space.
    Section VI-C; the recommended configuration is Pareto-optimal only within this grid.
  • standard math FedAvg update recursion and SGD update rules in Equations 3 to 6.
    Standard distributed optimization identities; the paper's analytical conclusions follow from simulating these recurrences on the toy model.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning." pith.science (2026). https://pith.science/paper/7G55RVGC

@misc{pith2026250905192,
  author       = {Pith},
  title        = {Pith review of: On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7G55RVGC}},
  note         = {Machine review of arXiv:2509.05192}
}
Share X Bluesky LinkedIn Reddit HN
abstract

Horizontal Federated Learning (HFL) is particularly vulnerable to backdoor attacks as adversaries can easily manipulate both the training data and processes to execute sophisticated attacks. In this work, we study the impact of training hyperparameters on the effectiveness of backdoor attacks and defenses in HFL. More specifically, we show both analytically and by means of measurements that the choice of hyperparameters by benign clients does not only influence model accuracy but also significantly impacts backdoor attack success. This stands in sharp contrast with the multitude of contributions in the area of HFL security, which often rely on custom ad-hoc hyperparameter choices for benign clients$\unicode{x2013}$leading to more pronounced backdoor attack strength and diminished impact of defenses. Our results indicate that properly tuning benign clients' hyperparameters$\unicode{x2013}$such as learning rate, batch size, and number of local epochs$\unicode{x2013}$can significantly curb the effectiveness of backdoor attacks, regardless of the malicious clients' settings. We support this claim with an extensive robustness evaluation of state-of-the-art attack-defense combinations, showing that carefully chosen hyperparameters yield across-the-board improvements in robustness without sacrificing main task accuracy. For example, we show that the 50%-lifespan of the strong A3FL attack can be reduced by 98.6%, respectively$\unicode{x2013}$all without using any defense and while incurring only a 2.9 percentage points drop in clean task accuracy.

Figures

Figures reproduced from arXiv: 2509.05192 by Ghassan Karame, Simon Lachnit.

Figure 1
Figure 1. Figure 1: The schedule of A3FL [63]’s benign learning rate [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of our empirical evaluation. a computing cluster providing compute nodes equipped with two AMD EPYC 9254, three NVIDIA A30 GPUs, and 384 GB RAM, and bigger nodes equipped with two AMD EPYC 9454, eight NVIDIA H100 GPUs, and 1152GB RAM. D. Comparison to related work Shejwalkar et al. [48] examine how system-level parameters—such as the number of clients—influence the success of poisoning attacks. Th… view at source ↗
Figure 3
Figure 3. Figure 3: Average malicious loss for various benign and mali [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Impact of ηb and β on the BDA of SoTA attacks. 200 rounds—the longest among evaluated attacks. To assess backdoor persistence, training continues for an additional 4000 rounds. Our experiments focus on evaluating the impact of the learning rate η 7 , while fixing the other hyperparameters to default values, derived from commonly used values in Table II, i.e., ηb = 0.1, µb = 0.9, λb = 0.0005, Bb = 64, and E… view at source ↗
Figure 5
Figure 5. Figure 5: Impact of ηb and β on the BDA of the FCBA attacks when using MobileNetV2 or VGG17 as the model, when using the dataset Tiny-ImageNet, or when using a uniform learning rate schedule. ResNet20—has greater capacity to learn both the primary and backdoor tasks simultaneously. This results in a significantly higher maximum Span50 for ηb = 0.05. However, this ad￾vantage diminishes further as ηb increases. Due to… view at source ↗
Figure 6
Figure 6. Figure 6: Average malicious loss for various values of [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Impact of µb and µm on the BDA of SoTA attacks. 5 10 15 20 Em 0 20 40 60 80 100 BDA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (a) A3FL [63] 5 10 15 20 Em 0 20 40 60 80 100 BDA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (b) Chameleon [15] 5 10 15 20 Em 0 20 40 60 80 100 BDA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (c) DarkFed [31] 5 10 15 20 Em 0 20 40 60 80 100 BDA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (d) FCBA [33] [PITH_FULL_IMAGE… view at source ↗
Figure 8
Figure 8. Figure 8: Impact of Eb and Em on the BDA of SoTA attacks. The momentum, however, considerably impacts the MTA, as shown in [PITH_FULL_IMAGE:figures/full_fig_p011_8.png] view at source ↗
Figure 10
Figure 10. Figure 10: Pareto frontiers of benign hyperparameter configurations for each attack against existing defenses. Here, we assume [PITH_FULL_IMAGE:figures/full_fig_p013_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Overview of backdoor attacks published at A/A* [PITH_FULL_IMAGE:figures/full_fig_p017_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Overview of which selected attacks were evaluated [PITH_FULL_IMAGE:figures/full_fig_p018_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: FCBA with malicious clients using randomized (in [PITH_FULL_IMAGE:figures/full_fig_p018_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: MTA for different attack/defense combinations when diversifying hyperparameters randomly across clients. in the original FedAvg paper [37] and was fixed in a later revision [38]. We use the corrected version and also apply this to the results of the DarkFed attack under its original hyperparameters to ensure comparability. Chameleon. In its original setup, the Chameleon [15] attack uses a learning rate sc… view at source ↗
Figure 17
Figure 17. Figure 17: Impact of ηb and β on the MTA of SoTA attacks if a uniform learning schedule is applied. instead of ηb · 0.9991000 ≈ ηb · 0.368 in the first round of the attack—resulting in the SGD optimization dynamics being much less stable. This, however, impacts the MTA negatively, as it is shown in [PITH_FULL_IMAGE:figures/full_fig_p020_17.png] view at source ↗
Figure 16
Figure 16. Figure 16: Impact of ηb and β on the BDA∗ of SoTA attacks if a uniform learning schedule is applied. 0 2 4 6 8 10 β 0 20 40 60 80 100 MTA [%] ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (a) A3FL [63] 0 2 4 6 8 10 β 0 20 40 60 80 100 MTA [%] ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (b) Chameleon [15] 0 2 4 6 8 10 β 0 20 40 60 80 100 MTA [%] ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (c) DarkFed [31] 0 2 4 6 8 10 β 0 20 40 60 80 100 M… view at source ↗
Figure 18
Figure 18. Figure 18: Impact of ηb and β on the FCBA attack on Tiny￾Imagenet. 10, 000 64×64 RGB images in 200 different classes, resulting in 500 and 50 images per class in the training and test set, respectively. Despite the much higher complexity of the classification task, our results in [PITH_FULL_IMAGE:figures/full_fig_p021_18.png] view at source ↗
Figure 20
Figure 20. Figure 20: Impact of ηb and β on the FCBA attack when using VGG17 as the model. can upper-bound the attack success. For the maximum BDA∗ , we see similar decreases of 5.4 percentage points, and 48.2 percentage points, respectively. Here, it is interesting to note that for ηb = 0.05, the maximum achievable BDA∗ and Span50 is significantly higher for the more complex VGG17 model than for MobileNetV2 or the simpler Res… view at source ↗
Figure 21
Figure 21. Figure 21: Impact of ηb and β on the baseline attack. model updates. APPENDIX I ANALYSIS OF THE BASELINE ATTACK The most basic backdoor attack is a dirty-label data poi￾soning attack [5, 48, 23, 8]. Here, the attacker changes the labels of a fraction of the training data to implant the desired backdoor behavior. We now present our results for such a baseline data poisoning attack. A. Learning Rate In [PITH_FULL_IMA… view at source ↗
Figure 23
Figure 23. Figure 23: Impact of Eb and Em on the baseline attack. 40 60 80 100 120 Bm 0 20 40 60 80 100 BDA [%] Bb = 32 Bb = 64 Bb = 128 (a) BDA 40 60 80 100 120 Bm 0 20 40 60 80 100 BDA ∗ [%] Bb = 32 Bb = 64 Bb = 128 (b) BDA∗ 40 60 80 100 120 Bm 0 50 100 150 200 250 300 350 Span50 Bb = 32 Bb = 64 Bb = 128 (c) Span50 40 60 80 100 120 Bm 0 20 40 60 80 100 MTA [%] Bb = 32 Bb = 64 Bb = 128 (d) MTA [PITH_FULL_IMAGE:figures/full_f… view at source ↗
Figure 24
Figure 24. Figure 24: Impact of Bb and Bm on the baseline attack [PITH_FULL_IMAGE:figures/full_fig_p022_24.png] view at source ↗
Figure 25
Figure 25. Figure 25: Impact of λb and λm on the baseline attack. decreasing the batch size Bb (from 128 to 32) consistently reduce BDA, BDA∗ , and Span50. Specifically, we observe reduc￾tions of up to 70.69 percentage points, 1.66 percentage points, and 100% for higher Eb, and 36.15 percentage points, 10.79 percentage points, and 97.05% for smaller Bb, respectively. We also report negligible deviations in MTA and MTA∗ of up t… view at source ↗
Figure 27
Figure 27. Figure 27: Impact of µb and µm on the IBA attack. 5 10 15 20 Em 0 20 40 60 80 100 BDA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (a) BDA 5 10 15 20 Em 0 20 40 60 80 100 BDA ∗ [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (b) BDA∗ 5 10 15 20 Em 1000 1500 2000 2500 3000 3500 4000 Span50 Eb = 2 Eb = 5 Eb = 10 Eb = 20 (c) Span50 5 10 15 20 Em 0 20 40 60 80 100 MTA [%] Eb = 2 Eb = 5 Eb = 10 Eb = 20 (d) MTA [PITH_FULL_IMAGE:figures/full_fig_… view at source ↗
Figure 28
Figure 28. Figure 28: Impact of Eb and Em on the IBA attack. C. Batch Size & Local Epochs In [PITH_FULL_IMAGE:figures/full_fig_p024_28.png] view at source ↗
Figure 31
Figure 31. Figure 31: Impact of ηb and β on the BDA∗ of SoTA attacks. 0 2 4 6 8 10 β 0 200 400 600 800 1000 1200 1400 Span50 ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (a) A3FL [63] 0 2 4 6 8 10 β 0 50 100 150 200 250 Span50 ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (b) Chameleon [15] 0 2 4 6 8 10 β 0 50 100 150 200 Span50 ηb = 0.05 ηb = 0.1 ηb = 0.2 ηb = 0.5 (c) DarkFed [31] 0 2 4 6 8 10 β 0 25 50 75 100 125 150 Span50 ηb = 0.05 ηb = 0.… view at source ↗
Figure 32
Figure 32. Figure 32: Impact of ηb and β on the Span50 of SoTA attacks. APPENDIX K ADDITIONAL FIGURES A. Impact of Learning Rate In Figures 31 and 32, we show the BDA∗ and Span50 for the A3FL [63], Chameleon [15], DarkFed [31], and FCBA [33] attacks for varying benign and malicious learning rates, com￾plementing our results from Section IV. In [PITH_FULL_IMAGE:figures/full_fig_p025_32.png] view at source ↗
Figure 35
Figure 35. Figure 35: Impact of µb and µm on the Span50 of SoTA attacks [PITH_FULL_IMAGE:figures/full_fig_p025_35.png] view at source ↗
Figure 36
Figure 36. Figure 36: Impact of µb and µm on the MTA of SoTA attacks. varying benign and malicious number of local epochs and batch sizes, complementing our results from Section V-B. Further, [PITH_FULL_IMAGE:figures/full_fig_p026_36.png] view at source ↗
Figure 39
Figure 39. Figure 39: Impact of Eb and Em on the Span50 of SoTA attacks. 40 60 80 100 120 Bm 0 1000 2000 3000 4000 Span50 Bb = 32 Bb = 64 Bb = 128 (a) A3FL [63] 40 60 80 100 120 Bm 0 250 500 750 1000 1250 1500 1750 Span50 Bb = 32 Bb = 64 Bb = 128 (b) Chameleon [15] 40 60 80 100 120 Bm 0 20 40 60 Span50 Bb = 32 Bb = 64 Bb = 128 (c) DarkFed [31] 40 60 80 100 120 Bm 0 50 100 150 200 250 300 Span50 Bb = 32 Bb = 64 Bb = 128 (d) FCB… view at source ↗
Figure 40
Figure 40. Figure 40: Impact of Bb and Bm on the Span50 of SoTA attacks [PITH_FULL_IMAGE:figures/full_fig_p026_40.png] view at source ↗
Figure 44
Figure 44. Figure 44: Impact of λb and λm on the BDA∗ of SoTA attacks. 0.0002 0.0004 0.0006 0.0008 0.0010 λm 0 500 1000 1500 2000 2500 3000 Span50 λb = 0.001 λb = 0.0005 λb = 0.0001 (a) A3FL [63] 0.0002 0.0004 0.0006 0.0008 0.0010 λm 40 60 80 100 120 140 Span50 λb = 0.001 λb = 0.0005 λb = 0.0001 (b) Chameleon [15] 0.0002 0.0004 0.0006 0.0008 0.0010 λm 0.0 2.5 5.0 7.5 10.0 12.5 15.0 Span50 λb = 0.001 λb = 0.0005 λb = 0.0001 (c)… view at source ↗
Figure 45
Figure 45. Figure 45: Impact of λb and λm on the Span50 of SoTA attacks. 0.0002 0.0004 0.0006 0.0008 0.0010 λm 0 20 40 60 80 100 MTA [%] λb = 0.001 λb = 0.0005 λb = 0.0001 (a) A3FL [63] 0.0002 0.0004 0.0006 0.0008 0.0010 λm 0 20 40 60 80 100 MTA [%] λb = 0.001 λb = 0.0005 λb = 0.0001 (b) Chameleon [15] 0.0002 0.0004 0.0006 0.0008 0.0010 λm 0 20 40 60 80 100 MTA [%] λb = 0.001 λb = 0.0005 λb = 0.0001 (c) DarkFed [31] 0.0002 0.0… view at source ↗
Figure 46
Figure 46. Figure 46: Impact of λb and λm on the MTA of SoTA attacks [PITH_FULL_IMAGE:figures/full_fig_p027_46.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

68 extracted references · 50 canonical work pages · 1 internal anchor

  1. [1]

    Maksym Andriushchenko, Aditya Vardhan Varre, Loucas Pillaud- Vivien, and Nicolas Flammarion. 2023. SGD with Large Step Sizes Learns Sparse Features. InICML

    work page 2023

  2. [2]

    Apple. 2019. Designing for Privacy - WWDC19 - Videos. (2019). htt ps://developer.apple.com/videos/play/wwdc2019/708

    work page 2019

  3. [3]

    Eugene Bagdasarian and Vitaly Shmatikov. 2024. Mithridates: Audit- ing and boosting backdoor resistance of machine learning pipelines. InACM CCS. doi:10.1145/3658644.3690337

    work page arXiv 2024

  4. [4]

    Eugene Bagdasaryan and Vitaly Shmatikov. 2021. Blind backdoors in deep learning models. InUSENIX Security

    work page 2021

  5. [5]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How To Backdoor Federated Learning. In AISTATS

    work page 2020

  6. [6]

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. 2019. A Little Is Enough: Circumventing Defenses For Distributed Learning. In NeurIPS

    work page 2019

  7. [7]

    Beutel et al

    Daniel J. Beutel et al. 2022. Flower: A Friendly Federated Learning Research Framework. (2022). doi:10.48550/arXiv.2007.14390

    Pith/arXiv arXiv doi:10.48550/arxiv.2007.14390 2022

  8. [8]

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. 2019. Analyzing Federated Learning through an Ad- versarial Lens. InICML

    work page 2019

  9. [9]

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. InNeurIPS

    work page 2017

  10. [10]

    Xiaoyu Cao, Jinyuan Jia, Zaixi Zhang, and Neil Zhenqiang Gong

    work page

  11. [11]

    1998.Statistical Power Analysis for the Behavioral Sciences

    Jacob Cohen. 1998.Statistical Power Analysis for the Behavioral Sciences. (2nd Edition ed.)

    work page 1998

  12. [12]

    Zico Kolter, and Ameet Talwalkar

    Jeremy Cohen, Simran Kaur, Yuanzhi Li, J. Zico Kolter, and Ameet Talwalkar. 2021. Gradient descent on neural networks typically occurs at the edge of stability. InICLR

    work page 2021

  13. [13]

    Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InICML

    work page 2020

  14. [14]

    Francesco D’Angelo, Maksym Andriushchenko, Aditya Vardhan Varre, and Nicolas Flammarion. 2024. Why do we need weight decay in modern deep learning? InNeurIPS

    work page 2024

  15. [15]

    Yanbo Dai and Songze Li. 2023. Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning. InICML

    work page 2023

  16. [16]

    Federated Learning in Practice: Reflections and Projections

    Katharine Daly, Hubert Eichner, Peter Kairouz, H. Brendan McMahan, Daniel Ramage, and Zheng Xu. 2024. Federated Learning in Practice: Reflections and Projections. (2024). http://arxiv.org/abs/2410.08892

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  17. [17]

    Meyarivan

    Kalyanmoy Deb, Samir Agrawal, Amrit Pratap, and T. Meyarivan

    work page

  18. [18]

    Pei Fang and Jinghui Chen. 2023. On the vulnerability of backdoor defenses for federated learning. InAAAI. doi:10.1609/aaai.v37i10.263 93

    work page doi:10.1609/aaai.v37i10.263 2023

  19. [19]

    Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John Stephan. 2022. Byzantine machine learning made easy by resilient averaging of momentums. InICML

    work page 2022

  20. [20]

    Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. 2024. FreqFed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning. InNDSS. doi:10.14722/ndss.2024.23620

    work page arXiv 2024

  21. [21]

    Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. 2020. The Limitations of Federated Learning in Sybil Settings. InRAID

    work page 2020

  22. [22]

    2016.Deep Learning

    Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016.Deep Learning. https://www.deeplearningbook.org/

    work page 2016

  23. [23]

    Tianyu Gu, Brendan Dolan-Gavitt, and S. Garg. 2017. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.CoRR. http://arxiv.org/abs/1708.06733

    Pith/arXiv arXiv 2017

  24. [24]

    Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Franc ¸oise Beaufays, Sean Augenstein, Hubert Eichner, Chlo´e Kiddon, and Daniel Ramage. 2019. Federated Learning for Mobile Keyboard Prediction. (2019). doi:10.48550/arXiv.1811.03604

    Pith/arXiv arXiv doi:10.48550/arxiv.1811.03604 2019

  25. [25]

    Fengxiang He, Tongliang Liu, and Dacheng Tao. 2019. Control batch size and learning rate to generalize well: Theoretical and empirical evidence. InNeurIPS

    work page 2019

  26. [26]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InCVPR. doi:10.1109/CV PR.2016.90

    doi:10.1109/cv 2016

  27. [27]

    James Kirkpatrick et al. 2017. Overcoming catastrophic forgetting in neural networks.Proceedings of the National Academy of Sciences. doi:10.1073/pnas.1611835114

    doi:10.1073/pnas.1611835114 2017

  28. [28]

    Krizhevsky

    A. Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. Tech. rep. https://www.semanticscholar.org/paper/Learning- Multiple-Layers-of-Features-from-Tiny-Krizhevsky/5d90f06bb70a0a 3dced62413346235c02b1aa086

    work page 2009

  29. [29]

    Anders Krogh and John A. Hertz. 1991. A simple weight decay can improve generalization. InNeurIPS

    work page 1991

  30. [30]

    Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 2023. 3DFed: Adaptive and Extensible Framework for Covert Backdoor Attack in Federated Learning. InIEEE S&P. doi:10.1109/SP46215.2023.10179401

    arXiv 2023

  31. [31]

    Minghui Li, Wei Wan, Yuxuan Ning, Shengshan Hu, Lulu Xue, Leo Yu Zhang, and Yichen Wang. 2024. DarkFed: A data-free backdoor attack in federated learning. InIJCAI

    work page 2024

  32. [32]

    Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. 2020. On the Convergence of FedAvg on Non-IID Data. In ICLR

    work page 2020

  33. [33]

    Tao Liu, Yuhang Zhang, Zhu Feng, Zhiqin Yang, Chen Xu, Dapeng Man, and Wu Yang. 2024. Beyond traditional threats: A persistent backdoor attack on federated learning. InAAAI. doi:10.1609/AAAI.V3 8I19.30131

    doi:10.1609/aaai.v3 2024

  34. [34]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning Attack on Neural Networks. InNDSS

    work page 2018

  35. [35]

    Bing Luo, Wenli Xiao, Shiqiang Wang, Jianwei Huang, and Leandros Tassiulas. 2022. Tackling system and statistical heterogeneity for federated learning with adaptive client sampling. InINFOCOM. doi:1 0.1109/INFOCOM48880.2022.9796935

    arXiv 2022

  36. [36]

    Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang, Jiqiang Liu, and Xiangliang Zhang. 2023. Poisoning with cerberus: stealthy and colluded backdoor attack against federated learning. InAAAI. doi:1 0.1609/aaai.v37i7.26083

    work page 2023

  37. [37]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. InAISTATS

    work page 2017

  38. [38]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag ¨uera y Arcas

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag ¨uera y Arcas. 2023. Communication-Efficient Learning of Deep Networks from Decentralized Data. (2023). doi:10.48550/ar Xiv.1602.05629

    Pith/arXiv arXiv doi:10.48550/arxiv.1602.05629 2023

  39. [39]

    El Mahdi El Mhamdi, Rachid Guerraoui, and S ´ebastien Rouault. 2018. The Hidden Vulnerability of Distributed Learning in Byzantium. In ICML

    work page 2018

  40. [40]

    Philipp Moritz et al. 2018. Ray: A distributed framework for emerging AI applications. InOSDI

    work page 2018

  41. [41]

    Doan, and Kok Seng Wong

    Dung Thuy Nguyen, Tuan Minh Nguyen, Anh Tuan Tran, Khoa D. Doan, and Kok Seng Wong. 2023. IBA: Towards Irreversible Backdoor Attacks in Federated Learning. InNeurIPS

    work page 2023

  42. [42]

    Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R. Gel. 2021. Defending against Backdoors in Federated Learning with Robust Learning Rate. InAAAI. doi:10.1609/aaai.v35i10.17118

    work page doi:10.1609/aaai.v35i10.17118 2021

  43. [43]

    Matthias Paulik et al. 2021. Federated Evaluation and Tuning for On- Device Personalization: System Design & Applications. (2021). doi:1 0.48550/arXiv.2102.08503

    Pith/arXiv arXiv doi:10.48550/arxiv.2102.08503 2021

  44. [44]

    Phillip Rieger, Torsten Krauß, Markus Miettinen, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. 2024. CrowdGuard: Federated Backdoor Detection in Federated Learning. InNDSS Symposium

    work page 2024

  45. [45]

    Dazhong Rong, Qinming He, and Jianhai Chen. 2022. Poisoning deep learning based recommender model in federated learning scenarios. In IJCAI. doi:10.24963/IJCAI.2022/306

    work page doi:10.24963/ijcai.2022/306 2022

  46. [46]

    Dazhong Rong, Shuai Ye, Ruoyan Zhao, Hon Ning Yuen, Jianhai Chen, and Qinming He. 2022. FedRecAttack: Model poisoning attack to federated recommendation. InICDE. doi:10.1109/ICDE53745.2022 .00243

    arXiv 2022

  47. [47]

    Howard, Menglong Zhu, Andrey Zhmogi- nov, and Liang-Chieh Chen

    Mark Sandler, Andrew G. Howard, Menglong Zhu, Andrey Zhmogi- nov, and Liang-Chieh Chen. 2018. MobileNetV2: Inverted residuals and linear bottlenecks. InCVPR. doi:10.1109/CVPR.2018.00474

    arXiv 2018

  48. [48]

    Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ra- mage. 2022. Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning. InIEEE S&P. doi:10.1109/SP46214.2022.9833647

    arXiv 2022

  49. [49]

    Eli Sherman and Ilya Shpitser. 2018. Identification and Estimation of Causal Effects from Dependent Data. InNeurIPS

    work page 2018

  50. [50]

    Karen Simonyan and Andrew Zisserman. 2015. Very deep convolu- tional networks for large-scale image recognition. InICLR

    work page 2015

  51. [51]

    Stanford. 2015. Tiny ImageNet Visual Recognition Challenge. (2015). https://cs231n.stanford.edu/2015/project.html

    work page 2015

  52. [52]

    David Stutz, Matthias Hein, and Bernt Schiele. 2019. Disentangling adversarial robustness and generalization. InCVPR. doi:10.1109/CVP R.2019.00714

    work page arXiv 2019

  53. [53]

    Brendan McMahan

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMahan. 2019. Can You Really Backdoor Federated Learning? (2019). doi:10.48550/arXiv.1911.07963

    Pith/arXiv arXiv doi:10.48550/arxiv.1911.07963 2019

  54. [54]

    Dahl, and Geoffrey E

    Ilya Sutskever, James Martens, George E. Dahl, and Geoffrey E. Hinton. 2013. On the importance of initialization and momentum in deep learning. InICML

    work page 2013

  55. [55]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. InICLR. doi:10.48550/arXiv.1312.6199

    Pith/arXiv arXiv doi:10.48550/arxiv.1312.6199 2014

  56. [56]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y . Zhao. 2019. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In IEEE S&P. doi:10.1109/SP.2019.00031

    arXiv 2019

  57. [57]

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vish- wakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dim- itris Papailiopoulos. 2020. Attack of the tails: yes, you really can backdoor federated learning. InNeurIPS

    work page 2020

  58. [58]

    Wikipedia

    2025. Wikipedia. (2025). https://en.wikipedia.org/w/index.php?title =Wikipedia&oldid=1301258677

    work page 2025

  59. [59]

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2020. DBA: Distributed Backdoor Attacks against Federated Learning. InICLR

    work page 2020

  60. [60]

    Gonzalez, Kannan Ramchandran, and Michael W

    Yaoqing Yang, Rajiv Khanna, Yaodong Yu, Amir Gholami, Kurt Keutzer, Joseph E. Gonzalez, Kannan Ramchandran, and Michael W. Mahoney. 2020. Boundary thickness and robustness in learning models. InNeurIPS. Optim [61] FCBA [33] DarkFed [31] IBA [41] A3FL [63] Chameleon [15] 3DFed [30] CerP [36] F3BA [18] Neurotoxin [65] Tails [57] Model Replacement [5] DBA [5...

    work page 2020

  61. [61]

    Yuxin Yang, Qiang Li, Chenfei Nie, Yuan Hong, and Binghui Wang

    work page

  62. [62]

    Ki Yoon Yoo and Nojun Kwak. 2022. Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling. InEMNLP. doi:10.18653/v1/2022.emnlp-main.6

    work page doi:10.18653/v1/2022.emnlp-main.6 2022

  63. [63]

    Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Di Wu

    work page

  64. [64]

    Shijie Zhang, Hongzhi Yin, Tong Chen, Zi Huang, Quoc Viet Hung Nguyen, and Lizhen Cui. 2022. PipAttack: Poisoning federated rec- ommender systems for manipulating item promotion. InWSDM. doi:1 0.1145/3488560.3498386

    arXiv 2022

  65. [65]

    Stochastic

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. 2022. Neurotoxin: Durable Backdoors in Federated Learn- ing. InICML. APPENDIXA SELECTION OFREPRESENTATIVEBACKDOORATTACKS We visually sorted all initially-selected 15 backdoor attacks (cf. Section III-C) in Figure 11. Here, ...

    work page 2022

  66. [67]

    InNeurIPS

    A3FL: Adversarially Adaptive Backdoor Attacks to Federated Learning. InNeurIPS

    work page

  67. [2002]

    IEEE Transactions on Evolutionary Computation

    A fast and elitist multiobjective genetic algorithm: NSGA-II. IEEE Transactions on Evolutionary Computation. doi:10.1109/4235.9 96017

    work page doi:10.1109/4235.9

  68. [2024]

    Breaking state-of-the-art poisoning defenses to federated learn- ing: An optimization-based attack framework. InCIKM. doi:10.1145 /3627673.3679566

    arXiv

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.