Pith. sign in

REVIEW 4 major objections 5 minor 44 references

How to Defend Against Large-scale Model Poisoning Attacks in Federated Learning: A Vertical Solution

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that federated learning can be defended against model poisoning even when 80–90% of participating users are compromised, by predicting each user's gradient from historical rounds and aggregating only the users whose…

desk verdict VERT's vertical prediction idea is plausible and the experiments are extensive, but the 80–90% robustness claim rests on a predictability assumption that adaptive attackers can break, and the evaluation lacks variance reporting. read the letter →

arxiv 2411.10673 v1 pith:BIHBH2SP submitted 2024-11-16 cs.LG cs.CR

Jinbo Wang , Ruijin Wang , Fengli Zhang This is my paper · ORCID
classification cs.LGcs.CR
keywords federatedlearningmodelpoisoningattackgradientpredictionautoregressiveverticaldefensenon-IIDdatamaliciousdetectionByzantine-tolerantaggregation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning is vulnerable to model poisoning because its aggregation server must trust the gradients uploaded by users. The paper argues that existing defenses reason 'horizontally,' comparing all users' gradients within a single communication round, and that this approach collapses when more than half the users are malicious because the malicious gradients dominate the comparison. VERT instead reasons 'vertically': it treats each user's gradient sequence across rounds as a predictable trajectory, trains an autoregressive predictor on historical user and global gradients, and keeps for aggregation only the top-k users whose current gradient is most similar to the predicted one. The paper's central claim is that honest gradients are predictable while malicious ones are not, and its experiments report that this gap makes VERT effective against four model-poisoning attacks on MNIST, CIFAR10, and CIFAR100 when 80–90% of users are compromised, under both IID and non-IID data, without assuming a clean server dataset or knowledge of the attacker. A low-dimensional projector keeps the added computational cost at O(ds) with s << d, so the defense scales to models with tens of millions of parameters.

What carries the argument

The central object is the 'vertical solution' (Definition 4.3): using global communication rounds as the vertical axis so that each user's gradient is judged against its own history and the global gradient history, not against other users' current gradients, thereby bypassing the malicious-gradient dominance problem (Definition 4.2) that breaks horizontal solutions. The carrying mechanism is an autoregressive predictor f_pred, fed with the optimizable combination A⊙g_{t-1}^k + B⊙g_{t-1} of the user's previous gradient and the previous global gradient, trained to minimize the squared distance to the projected next gradient, followed by cosine-similarity ranking rho_k = cos(tilde_p_t^k, f_proj(g_t^k)) and top-k selection. A low-dimensional vector projector f_proj maps gradients from dimension d to s with s << d, reducing the predictor's parameter count and runtime from O($d^{2}$) to O(ds).

What would settle it

Run the paper's MNIST setup with 90% compromised users, but let malicious users train the same autoregressive predictor VERT uses on the public global-gradient history and set their malicious gradient to the predictor's current-round output, as the paper's threat model grants the attacker full knowledge of honest gradients; if VERT's top-k selection then lets global-model accuracy fall to the no-defense level (roughly 10–15% under Gaussian noise), the predictability-gap claim is falsified.

Watch

Extended reading notes

Core claim

VERT establishes, on the paper's own terms, that the convergence process of a federated model is highly predictable: the gradient of user k in round t can be inferred from the user's own previous gradient and the previous global gradient, g_t^k = f_infer(g_{t-1}^k, g_{t-1}). The defense trains an autoregressive predictor f_pred, with element-wise learnable coefficient matrices A and B, to approximate f_infer, projects all gradients through a low-dimensional linear projector f_proj, and ranks users by the cosine similarity between predicted and actual projected gradients, selecting the top-k as the aggregation set. The paper reports the best global model accuracy on MNIST, CIFAR10, and CIFAR100 under Gaussian noise, model replacement, Min-Max distance, and 'a little is enough' attacks at 80% and 90% compromise rates, including in non-IID settings, and reports a computational cost orders of magnitude below the closest vertical defense.

Load-bearing premise

The defense rests on the assumption that honest gradients follow a learnable trajectory across communication rounds while malicious gradients do not; if an attacker crafts gradients that match that trajectory, or poisons the global gradient fed to the predictor, the cosine-similarity ranking no longer separates honest from malicious users.

Editorial extensions

If this is right

  • At 80–90% compromise rates, where Krum, Median, and FedAvg degrade to near-random accuracy, VERT maintains usable global model accuracy on MNIST, CIFAR10, and CIFAR100, showing the regime of large-scale poisoning is not inherently undefendable.
  • The defense imposes no assumption of a clean server dataset, no requirement to know the number of compromised users, and no restriction on the attacker's knowledge; only the server-side deployment of VERT is needed.
  • The low-dimensional projector makes the defense feasible for large models: the paper estimates a naive predictor for ResNet would require about 400,000 GB of memory, while VERT's projected version runs in seconds.
  • The successive aggregation method matters: VERT+Krum handles Min-Max and ALIE attacks better, while VERT+FedAvg handles Gaussian noise better, so VERT can be combined with existing robust aggregators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: an adaptive attacker who trains the same autoregressive predictor on the public global-gradient history and emits gradients that follow the predicted honest trajectory could erode the cosine-similarity gap; the paper does not analyze such an attack.
  • Editorial inference: because under large-scale attack the global gradient itself is poisoned, feeding it to the predictor may bias what VERT learns to call 'honest'; the paper's replacement of suspicious gradients with the global gradient could propagate that bias rather than remove it.
  • Editorial inference: the vertical-axis principle transfers to other settings with smooth convergent trajectories, such as decentralized or personalized training, where the same predictability check could serve as an anomaly detector.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes VERT, a defense for federated learning against large-scale model poisoning attacks. Unlike horizontal defenses that aggregate from current-round gradients (Krum, Median, FLTrust), VERT uses a vertical perspective: for each user it trains an autoregressive predictor on the user's historical gradients and the global gradient, projects gradients to a low-dimensional space, and in each round selects the top-κ users whose predicted gradient has the highest cosine similarity to the actual gradient. The selected gradients are then aggregated by FedAvg or Krum. Experiments on MNIST, CIFAR10, and CIFAR100 under Gaussian noise, model replacement, Min-Max, and 'a little is enough' attacks with 80% and 90% compromised users report that VERT achieves the highest peak global-model accuracy compared with FedAvg, Krum, Median, and FLDetector. A complexity analysis claims a reduction from O(d^2) to O(ds) with s << d.

Significance. The vertical-solution idea is a worthwhile conceptual departure: it decouples the defense from the current-round majority, which is the fundamental failure mode of horizontal defenses, and the low-dimensional projector addresses a real scalability problem of gradient-prediction defenses. The paper also reports a broad benchmark across three datasets, four attacks, two data distributions, and two compromise rates, and it claims to release code. These strengths make the work potentially useful if the central predictability assumption is validated under the stated threat model. However, the validation as presented is not yet convincing: the evaluated attacks are non-adaptive, the reported metric is peak accuracy without variance or seeds, and the training procedure contains a circular dependence on the defense's own selections. The significance of the claimed '≥80% defense' therefore remains conditional.

major comments (4)
  1. [Section 3.2; Sections 2.2 and 4.1; Section 4.2.2] The threat model in Section 3.2 grants the attacker all knowledge about compromised users, including training code, and 'even knows the user gradient of other honest users.' Sections 2.2 and 4.1 assume honest gradients satisfy g_t^k = f_infer(g_{t-1}^k, g_{t-1}) while malicious gradients 'lack predictability.' Under this threat model, an attacker can submit g_t^k = g_t^h + ε·v, where g_t^h is an honest gradient the attacker already knows and v is a fixed poisoning direction. For small ε this gradient follows the same autoregressive trajectory as honest gradients, so its cosine similarity ρ_k to the VERT prediction in Section 4.2.2 will be comparable to that of honest users, and the top-κ selection in Eq. (2) will admit it at the tested compromise rates (κ=15 out of 80 or κ=8 out of 90). None of the four evaluated attacks (GN, MR, AGR, ALIE) optimizes against the predictor or copies honest trajectories. Thus the headline claim of effective defense at 80–90% compromise is not established for attackers within the paper's own threat model. The self-reported separation in Figure 3 and Section 6.2.1 (honest similarity ≈1.0 vs. malicious ≈0.86–0.88) is also small enough that a tailored attack could close it.
  2. [Section 4.2.2; Pseudocode 1, line 7] The exception-handling step replaces any user gradient not in C_t^opt with the global gradient before training the predictor. Since C_t^opt is the output of VERT's own cosine-similarity ranking, the predictor's training labels depend on the defense's previous selections. The similarity separation reported in Section 6.2.1 is therefore not an independent measure of honest-vs-malicious predictability; it may partly reflect that the training set has already been filtered by VERT. This circularity should be addressed by an ablation: train the predictor on raw historical gradients without replacement, or on a held-out set of known honest gradients, and report whether the separation persists. Without this, the claimed mechanism for why VERT separates honest from malicious gradients is not fully supported.
  3. [Tables 2 and 4; Section 6.2.2] The reported metric is the highest global-model accuracy over 200 rounds, with no error bars, no number of seeds, and no final-round accuracy. Because a defense that eventually diverges can still have a high transient peak, the comparison is not statistically grounded. The MNIST GN results are also non-monotonic in the compromise rate (58.29% at pr=80% vs. 81.11% at pr=90%, Table 2), which is counterintuitive and should be explained or verified with repeated trials. Please report mean ± std over at least five seeds, the accuracy at the final communication round, and representative learning curves for the main comparisons.
  4. [Section 5.2; Appendix B, Eqs. (16)–(20)] The closed-form solution for the coefficient matrices is not derived correctly. Setting the product (2X−2Y) f'_pred f'_proj g^this_k to zero in Eq. (17) only yields X=Y under the additional assumption that the activation derivatives are nonzero; the product also vanishes when f'_pred or f'_proj is zero, and the denominator √(X^TX − X^TY − Y^TX + Y^TY) in Eq. (16) depends on X and Y and cannot be discarded without justification. Moreover, Eq. (20) divides by the vector g^this_k, which is not well-defined for arbitrary gradient entries. As written, Section 5.2 does not prove that the optimization objective in Eq. (6) is minimized; this section should be corrected or replaced with a heuristic justification.
minor comments (5)
  1. [Section 6.2.2] The claim that 'the optimal aggregation gradients selected by VERT only contains a few or even no malicious gradients' is not directly verified; reporting a selection-precision metric (e.g., the fraction of top-κ selections that are honest users) would make the defense mechanism transparent.
  2. [Contributions; Section 6.1] The contributions state that implementation code is released, but the manuscript does not provide a repository link or an availability statement; please add one so the claim is verifiable.
  3. [Definition 4.3] There are typographical issues in the definition: 'C t}' should be 'C^t', and 'g can obtain the k gradients' should read 'top-κ can obtain the κ gradients with the highest probability.'
  4. [Section 6.2.1; Figure 3] The similarity curves for compromised users stay in a narrow band (0.86–0.88), and the discussion speculates that the predictor captures the distribution of malicious gradients; this speculation should be tested, for example by reporting similarity on a held-out set of never-seen malicious gradients.
  5. [Section 6.2.3; Table 3] The runtime for FLANDERS is estimated by scaling VERT's runtime by the number of optimized parameters rather than measured; this should be stated more prominently in the main text so the comparison is not mistaken for an empirical benchmark.

Circularity Check

1 steps flagged · score 6.0 of 10

VERT's predictability-gap evidence is self-referential: malicious gradients are replaced with the global gradient in the predictor's training set, so the reported honest-vs-malicious similarity gap is partly manufactured by VERT's own selection.

  1. self definitional [Section 4.2.2 (Exception handling); Algorithm 1 line 7; evaluation in Section 6.2.1]
    "In addition, we also use global gradient to replace user gradients that are considered malicious gradients in the t-th round, avoiding interference from malicious gradients in the training of matrix coefficients A, B, and predictor fpred."

    The predictor's training labels are not raw user gradients: any gradient that VERT's own top-k selection previously judged malicious is overwritten with the global gradient. For those users, the predictor is trained to output the global gradient rather than their actual gradient. The subsequent cosine-similarity comparison in Section 6.2.1 therefore measures how well VERT predicts a label it constructed, not an intrinsic 'lack of predictability' of malicious gradients. The loop is: VERT selects users by similarity to its predictor; the predictor is trained on the gradients of the selected users, with all others replaced by the global gradient; then the same comparison is offered as evidence that malicious gradients are less predictable.

full rationale

The core circularity is in the exception-handling step: the training set for fpred is filtered by VERT's own prior selections, replacing 'malicious' user gradients with the global gradient. This makes the predictor's low similarity to raw malicious gradients partly a consequence of the defense's own label construction rather than an independent measurement of a predictability gap. The paper uses this gap as the load-bearing justification for its vertical-solution premise (Sections 2.2 and 4.1), so the derivation chain is partially circular. However, the empirical defense results against the four evaluated attacks are still measured on real data and are not a formal equality with the training inputs; an attacker who does not adapt to the predictor cannot exploit the circularity directly. The Section 5.2 closed-form solutions for A and B are ordinary normal equations fitted to historical labels, so they are not treated here as an additional circular step. There are no load-bearing self-citations by the present authors, and the paper is self-contained against the standard attack benchmarks. The circularity affects the theoretical premise and its evidence, but not the entire empirical claim, yielding a score of 6 rather than higher.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

VERT introduces no new physical or conceptual entities; the projector and coefficient matrices are trainable components of the method, not independent postulates with separate falsifiable predictions. The main load-bearing elements are the domain assumptions listed above, particularly the predictability gap and the non-adaptive attacker.

free parameters (4)
  • kappa (κ): number of selected gradients per round = 15 for |Ct|=80, 8 for |Ct|=90
    Hand-set in Section 6.1 and directly controls the optimization objective in Eq. 2; the paper does not study sensitivity to κ.
  • history window m = 10 rounds
    Number of past rounds used to train the predictor (Section 6.1); assumed sufficient for predictability but not justified by analysis.
  • projector output dimension s = 128 for MNIST, 256 for CIFAR10 and CIFAR100
    Chosen per dataset in Table 1; trades off the O(ds) complexity against prediction fidelity.
  • predictor training epochs and optimizer learning rate = 5 epochs, Adam with lr=0.001
    Set in Section 6.1 for all experiments; no ablation or tuning analysis is provided.
assumptions (5)
  • domain assumption Honest user gradients are predictable from m past rounds via g_t^k = f_infer(g_{t-1}^k, g_{t-1})
    Key insight stated in Sections 2.2 and 4.1; supported only by the experiments, not by a theorem.
  • domain assumption Malicious gradients are substantially less predictable than honest gradients for the considered attacks
    Needed for the top-k cosine similarity to separate honest from malicious gradients; the paper itself notes malicious similarity can reach 0.86 to 0.88 (Section 6.2.1).
  • domain assumption The attacker does not adapt to VERT
    The threat model in Section 3.2 grants attackers knowledge of honest gradients, but the evaluated attacks are static; adaptive attacks that mimic the predictor's expected trajectory are not considered.
  • ad hoc to paper The global gradient, even when majority-poisoned, remains a useful predictor input
    VERT feeds g^{t-1} into the predictor (Eq. 3), yet when more than 50 percent of users are malicious this global gradient is dominated by malicious updates; the paper provides no analysis of how this affects prediction quality.
  • domain assumption Top-k cosine similarity selection recovers a set of gradients that is mostly honest
    This is the optimization objective in Eq. 2 and the crux of the defense; its validity is empirical only.

how reviews work

0 comments
Cite this review

Pith. "Pith review of How to Defend Against Large-scale Model Poisoning Attacks in Federated Learning: A Vertical Solution." pith.science (2026). https://pith.science/paper/BIHBH2SP

@misc{pith2026241110673,
  author       = {Pith},
  title        = {Pith review of: How to Defend Against Large-scale Model Poisoning Attacks in Federated Learning: A Vertical Solution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BIHBH2SP}},
  note         = {Machine review of arXiv:2411.10673}
}
read the original abstract

Federated learning (FL) is vulnerable to model poisoning attacks due to its distributed nature. The current defenses start from all user gradients (model updates) in each communication round and solve for the optimal aggregation gradients (horizontal solution). This horizontal solution will completely fail when facing large-scale (>50%) model poisoning attacks. In this work, based on the key insight that the convergence process of the model is a highly predictable process, we break away from the traditional horizontal solution of defense and innovatively transform the problem of solving the optimal aggregation gradients into a vertical solution problem. We propose VERT, which uses global communication rounds as the vertical axis, trains a predictor using historical gradients information to predict user gradients, and compares the similarity with actual user gradients to precisely and efficiently select the optimal aggregation gradients. In order to reduce the computational complexity of VERT, we design a low dimensional vector projector to project the user gradients to a computationally acceptable length, and then perform subsequent predictor training and prediction tasks. Exhaustive experiments show that VERT is efficient and scalable, exhibiting excellent large-scale (>=80%) model poisoning defense effects under different FL scenarios. In addition, we can design projector with different structures for different model structures to adapt to aggregation servers with different computing power.

Figures

Figures reproduced from arXiv: 2411.10673 by the authors.

Figure 1
Figure 1. The direction of user gradients in all communica [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. VERT framework. During the training phase, VERT utilizes historical gradients information to train the coefficient [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The performance of VERT in predicting user gra [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: The performance of VERT in predicting user [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]
Figure 6
Figure 6. Figure 6: The performance of VERT in predicting user [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 9
Figure 9. Figure 9: The performance of VERT in predicting user [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: The performance of VERT in predicting user [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 22 canonical work pages

  1. [1]

    Communication-efficient learning of deep networks from decentral- ized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282

    2017

  2. [2]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  3. [3]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 691–706

    2019

  4. [4]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems , vol. 33, pp. 16 937–16 947, 2020

    2020

  5. [5]

    Wild patterns reloaded: A survey of machine learning security against training data poisoning,

    A. E. Cin `a, K. Grosse, A. Demontis, S. Vascon, W. Zellinger, B. A. Moser, A. Oprea, B. Biggio, M. Pelillo, and F. Roli, “Wild patterns reloaded: A survey of machine learning security against training data poisoning,” ACM Computing Surveys , vol. 55, no. 13s, pp. 1–39, 2023

    work page 2023

  6. [6]

    A novel data poisoning attack in federated learning based on inverted loss function,

    P. Gupta, K. Yadav, B. B. Gupta, M. Alazab, and T. R. Gadekallu, “A novel data poisoning attack in federated learning based on inverted loss function,” Computers & Security , vol. 130, p. 103270, 2023

    work page 2023

  7. [7]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  8. [8]

    Mpaf: Model poisoning attacks to federated learning based on fake clients,

    X. Cao and N. Z. Gong, “Mpaf: Model poisoning attacks to federated learning based on fake clients,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 3396–3404

    2022

Show all 44 references
  1. [9]

    Backdoor attacks and defenses in federated learning: State-of-the-art, taxonomy, and future directions,

    X. Gong, Y . Chen, Q. Wang, and W. Kong, “Backdoor attacks and defenses in federated learning: State-of-the-art, taxonomy, and future directions,” IEEE Wireless Communications, vol. 30, no. 2, pp. 114– 121, 2022

    2022

  2. [10]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948

    2020

  3. [11]

    Manipulating the byzantine: Op- timizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Op- timizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021

    2021

  4. [12]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30, 2017

    2017

  5. [13]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in International conference on machine learning . Pmlr, 2018, pp. 5650–5659

    2018

  6. [14]

    The hidden vulnerability of dis- tributed learning in byzantium,

    R. Guerraoui, S. Rouault et al. , “The hidden vulnerability of dis- tributed learning in byzantium,” in International Conference on Ma- chine Learning. PMLR, 2018, pp. 3521–3530

    2018

  7. [15]

    Auror: Defending against poisoning attacks in collaborative deep learning systems,

    S. Shen, S. Tople, and P. Saxena, “Auror: Defending against poisoning attacks in collaborative deep learning systems,” in Proceedings of the 32nd annual conference on computer security applications , 2016, pp. 508–519

    2016

  8. [16]

    Privacy- enhanced federated learning against poisoning adversaries,

    X. Liu, H. Li, G. Xu, Z. Chen, X. Huang, and R. Lu, “Privacy- enhanced federated learning against poisoning adversaries,” IEEE Transactions on Information Forensics and Security , vol. 16, pp. 4574–4588, 2021

    2021

  9. [17]

    Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,

    Z. Ma, J. Ma, Y . Miao, Y . Li, and R. H. Deng, “Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 1639–1654, 2022

    2022

  10. [18]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” 2022. [Online]. Available: https://arxiv.org/abs/2012.13995

    2022 arXiv

  11. [19]

    Protecting federated learning from extreme model poisoning attacks via multidimensional time series anomaly detection,

    E. Gabrielli, D. Belli, V . Miori, and G. Tolomei, “Protecting federated learning from extreme model poisoning attacks via multidimensional time series anomaly detection,” 2024. [Online]. Available: https://arxiv.org/abs/2303.16668

    2024

  12. [20]

    Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,

    Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 2545–2555

    2022

  13. [21]

    Deep gen- erative modelling: A comparative review of vaes, gans, normalizing flows, energy-based and autoregressive models,

    S. Bond-Taylor, A. Leach, Y . Long, and C. G. Willcocks, “Deep gen- erative modelling: A comparative review of vaes, gans, normalizing flows, energy-based and autoregressive models,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 44, no. 11, pp. 7327–7347, 2022

    2022

  14. [22]

    Very deep vaes generalize autoregressive models and can outperform them on images,

    R. Child, “Very deep vaes generalize autoregressive models and can outperform them on images,” 2021. [Online]. Available: https://arxiv.org/abs/2011.10650

    2021 arXiv

  15. [23]

    Scaling autoregressive models for content-rich text-to-image generation,

    J. Yu, Y . Xu, J. Y . Koh, T. Luong, G. Baid, Z. Wang, V . Vasudevan, A. Ku, Y . Yang, B. K. Ayan, B. Hutchinson, W. Han, Z. Parekh, X. Li, H. Zhang, J. Baldridge, and Y . Wu, “Scaling autoregressive models for content-rich text-to-image generation,” 2022. [Online]. Available:...

    2022 arXiv

  16. [24]

    Convergence analysis of two-layer neural net- works with relu activation,

    Y . Li and Y . Yuan, “Convergence analysis of two-layer neural net- works with relu activation,” ser. NIPS’17. Red Hook, NY , USA: Curran Associates Inc., 2017, p. 597–607

    2017

  17. [25]

    A convergence analysis of gradient descent for deep linear neural networks,

    S. Arora, N. Cohen, N. Golowich, and W. Hu, “A convergence analysis of gradient descent for deep linear neural networks,” 2019. [Online]. Available: https://arxiv.org/abs/1810.02281

    2019 arXiv

  18. [26]

    On the convergence of fedavg on non-iid data,

    X. Li, K. Huang, W. Yang, S. Wang, and Z. Zhang, “On the convergence of fedavg on non-iid data,” 2020. [Online]. Available: https://arxiv.org/abs/1907.02189

    2020 arXiv

  19. [27]

    Untargeted attack against federated recommendation systems via poisonous item embeddings and the defense,

    Y . Yu, Q. Liu, L. Wu, R. Yu, S. L. Yu, and Z. Zhang, “Untargeted attack against federated recommendation systems via poisonous item embeddings and the defense,” 2022. [Online]. Available: https://arxiv.org/abs/2212.05399

    2022 arXiv

  20. [28]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” 2017. [Online]. Available: https://arxiv.org/abs/1712.05526

    2017 arXiv

  21. [29]

    A dual stealthy backdoor: From both spatial and frequency perspectives,

    Y . Gao, H. Chen, P. Sun, J. Li, A. Zhang, and Z. Wang, “A dual stealthy backdoor: From both spatial and frequency perspectives,”

  22. [30]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,”

  23. [31]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition , 2009, pp. 248–255

    2009

  24. [32]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervision,” 2021. [Online]. Available: https: //arxiv.org/abs/2103.00020

    2021 arXiv

  25. [33]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016, pp. 770–778

    2016

  26. [34]

    Baruch, G

    M. Baruch, G. Baruch, and Y . Goldberg, A little is enough: circum- venting defenses for distributed learning . Red Hook, NY , USA: Curran Associates Inc., 2019

    2019

  27. [35]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” 2017. [Online]. Available: https://arxiv.org/abs/1412. 6980

    2017

  28. [36]

    A stochastic approximation method,

    N. K. Sinha and M. P. Griscik, “A stochastic approximation method,” IEEE Transactions on Systems, Man, and Cybernetics , vol. SMC-1, no. 4, pp. 338–344, 1971

    1971

  29. [37]

    Representations of quasi-newton matrices and their use in limited memory methods,

    R. H. Byrd, J. Nocedal, and R. B. Schnabel, “Representations of quasi-newton matrices and their use in limited memory methods,” Mathematical Programming, vol. 63, no. 1, pp. 129–156, 1994. Appendix

    1994

  30. [40]

    Algorithm 1 Execution of VERT

    Pseudocode of VERT Below we provide the pseudocode 1 for VERT. Algorithm 1 Execution of VERT. 1: Input: Gradients uploaded by the selected user in the t-th round {gt k|k ∈ Ct}, the selected user’s histor- ical m rounds gradients {{gthis k }this=t−1 this=t−m|k ∈ Ct}, the aggreg...

  31. [41]

    Let the partial derivative is 0, then: ∂Φ(A; B; fpred; fproj ) ∂A = 0

    Theoretical Analysis on Coefficient Matrix and Predictor Calculate the partial derivative of the optimization ob- jective on A. Let the partial derivative is 0, then: ∂Φ(A; B; fpred; fproj ) ∂A = 0. (11) Let X = fpred(fproj (A ⊙ gthis k + B ⊙ gthis )), Y = fproj (gthis+1 k ), ...

  32. [42]

    Model Poisoning Attacks Below, we provide a detailed introduction to the four types of model poisoning attacks used in the experiment. • Gaussian noise attack (GN) [19]: The attacker con- trols compromised users to sample noise from the N (0, 1) Gaussian distribution as malici...

  33. [43]

    Prediction Performance of VERT Figure 4-10 shows the Prediction performance of VERT for different model poisoning attacks on different datasets

  34. [44]

    TABLE 4: The defense effectiveness of different defenses against large-scale model poisoning attacks in non-IID scenarios

    Defense Effectiveness TABLE 4 shows the defense effectiveness of different defenses against large-scale model poisoning attacks in non- IID scenarios. TABLE 4: The defense effectiveness of different defenses against large-scale model poisoning attacks in non-IID scenarios. Met...

  35. [2022]

    Available: https://arxiv.org/abs/2204.05255

    [Online]. Available: https://arxiv.org/abs/2204.05255

    arXiv

  36. [2023]

    Available: https://arxiv.org/abs/2307.10184

    [Online]. Available: https://arxiv.org/abs/2307.10184

    arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.