Pith. sign in

REVIEW 4 major objections 4 minor 58 references

Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Crafted gradient angles let malicious clients infer which samples trained a federated model, and an angular-trimming defense reduces that leakage.

desk verdict Full-knowledge attack is a genuine improvement over AGREvader and ATM is a plausible defense, but the partial-knowledge results are unsupported by the described algorithm and the 'all scenarios' claim overreaches. read the letter →

arxiv 2507.00423 v1 pith:FCN32TGQ submitted 2025-07-01 cs.CR cs.DCcs.LG

Wenjin Mo , Zhiyuan Li , Minghong Fang , Mingwei Fang This is my paper
classification cs.CRcs.DCcs.LG
keywords federatedlearningmembershipinferenceattackpoisoningByzantine-robustaggregationgradientangulardeviationprivacydefensetrimmedmeanmasking
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning is supposed to keep client data local, but this paper tries to show that a handful of malicious clients can still learn whether a specific sample sits in another client's training set. Its attack, FedPoisonMIA, crafts a local gradient from mislabeled copies of the target samples plus a greedily chosen set of clean masking samples, and then constrains the crafted gradient's angle so it falls within the angular spread of benign updates. The paper claims this attack beats passive membership inference, gradient ascent, AGREvader, and an adaptive attack across four datasets and several Byzantine-robust defenses, and that it keeps working when the attacker does not see benign gradients. It then proposes Angular Trimmed-mean (ATM), which removes the updates with the largest average angular deviation from the rest, and claims this reduces attack accuracy, especially for the new attack, without degrading global model test accuracy.

What carries the argument

The load-bearing object is the angular envelope of the benign updates. The malicious update is $g_{\text{malicious}} = \alpha g_{\text{attack}} + g_{\text{mask}}$, where $g_{\text{attack}}$ is computed on mislabeled attack samples and $g_{\text{mask}}$ on a mask set; the attack chooses $\alpha$ and $\hat{D}_{\text{mask}}$ so that $\max_{i \in B} \angle(g_{\text{malicious}}, g_i) \le \max_{i,j \in B} \angle(g_i, g_j)$, i.e., it stays inside the widest benign angular separation. Because the mask-selection problem is NP-hard, the paper uses a greedy algorithm that adds the sample minimizing the resulting maximum angle until $\lfloor \gamma |D_{\text{mask}}| \rfloor$ samples are chosen. The defense ATM inverts the same geometry: it computes the mean angle from each gradient to all others and removes the $2b$ gradients with the largest mean angle before averaging the rest.

What would settle it

Run the partial-knowledge FedPoisonMIA on a dataset like Texas100 while measuring the angle between each crafted malicious update and the actual benign updates; if a non-negligible fraction of rounds violates the Eq. (5) bound yet attack accuracy stays high, the constraint is not the operative mechanism, and if accuracy collapses when the bound is enforced, the partial-knowledge claim needs a description of how the attacker estimates benign geometry.

Watch

Extended reading notes

Core claim

The central claim is that membership information in federated learning leaks through the angular geometry of client updates. A malicious client trains on target samples whose labels have been randomly replaced, producing an attack gradient that pushes the global model toward misclassifying those samples; if the sample is present with its correct label inside a benign client's training set, that benign gradient cancels part of the attack and the sample keeps high accuracy, which is the membership signal. To avoid being filtered, the attacker mixes the attack gradient with gradients from carefully selected clean samples and scales the mixture so its angle to every benign update is no larger than the largest angle between two benign updates. As a result, a robust aggregator that trims outliers by distance or angle discards a benign 'scapegoat' update instead of the malicious one. The authors state in Section 6.2 that the attack consistently achieves the highest accuracy across all datasets and scenarios, and that ATM restricts the attack's accuracy, with the Texas100 IID case dropping to 80.3% compared to 89.1% under Top-k.

Load-bearing premise

The attack's success depends on the attacker satisfying the angular constraint, which requires knowing the largest pairwise angle among benign gradients; the paper never explains how a partial-knowledge attacker, who does not see benign gradients, obtains this value.

Editorial extensions

If this is right

  • If the attack claim holds, a federated system using FedAvg, Median, Trimmed-mean, Top-k, DP, Multi-Krum, Fang, or DeepSight can have client membership disclosed without the server's aggregation rule being known.
  • The partial-knowledge version, with no access to benign gradients, retains most of the full-knowledge attack's accuracy, with at most an 8.0% drop in the reported settings.
  • Greedy mask selection adds more than 20 percentage points of attack accuracy over random mask selection on Texas100, so the choice of masking samples is a primary driver of evading detection.
  • ATM reduces FedPoisonMIA accuracy across most settings while keeping global test accuracy close to the no-attack baseline, and it does so at lower server-side computational cost than Median or Trimmed-mean because it sorts over clients rather than parameter dimensions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An unstated consequence is that any defense that trims by angle or distance is vulnerable in the same way: the scapegoat mechanism does not depend on the specific aggregation rule, only on the existence of a benign update at the angular extreme, so defenses that randomize the trim set or add directional noise may be the natural next step.
  • The paper's full-knowledge success supports a testable extension: attack accuracy should be predictable from the empirical width of the benign angular envelope, so a defender could estimate residual risk by monitoring that width.
  • The attack assumes the attacker knows the model architecture and loss, so secure aggregation or gradient compression that hides per-client directions could block the Eq. (5) design; this is an editorial inference, not an experiment in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces FedPoisonMIA, an active poisoning membership inference attack for federated learning in which malicious clients craft local model updates by combining mislabeled attack samples with a greedily selected mask set, subject to an angular-deviation constraint relative to benign updates. It also proposes a defense, Angular Trimmed-mean (ATM), which computes pairwise angles between client updates, ranks clients by mean angular deviation, discards the 2b most deviating updates, and averages the remainder. The authors evaluate the attack against FedAvg, Median, Trimmed-mean, DP, Top-k, Multi-Krum, Fang, and DeepSight on Texas100, CIFAR-10, STL10, and FER2013, in IID and Non-IID settings, synchronous and asynchronous, and report that FedPoisonMIA consistently outperforms Passive, GA, AGREvader, and Adaptive attacks, while ATM reduces attack accuracy. A theoretical bound for the trimmed mean of angles is stated in Section 5.2 and proved in Appendix A.

Significance. If the claims are supported, the paper addresses a practically important privacy threat: malicious clients can infer membership of target samples in other clients' data even when the server uses Byzantine-robust aggregation, and an angular-trimming defense can partially mitigate this threat. The empirical breadth is a clear strength: four datasets, multiple defenses, IID/Non-IID splits, synchronous/asynchronous settings, and full precision/recall tables in the appendix. The full-knowledge attack's geometric intuition is coherent, and the comparison against AGREvader and other baselines is informative. However, the partial-knowledge attack is not actually specified, the comparison between full- and partial-knowledge results is confounded, and the theoretical guarantee does not bound the quantity that ATM actually aggregates. These issues materially affect the central claim that the attack 'consistently achieves the highest accuracy across all datasets and scenarios.'

major comments (4)
  1. The partial-knowledge attack is not implementable as described. Table 1 defines the partial-knowledge attacker as having no access to benign clients' gradients, and Section 3 states that the attacker uses only malicious clients' updates. However, the attack construction in Eq. (5), the greedy selection in Algorithm 1, and Step II of Section 4.2 all require the quantities max_{i in B} angle(g_malicious, g_i_benign) and max_{i,j in B} angle(g_i_benign, g_j_benign), where B is the set of benign gradients. The manuscript never explains how these quantities are estimated from malicious updates alone, nor why the constraint may be dropped. Table 3 reports that FedPoisonMIA retains near-full-knowledge accuracy, with a claimed maximum degradation of only 8.0%, but the published procedure cannot produce those numbers without some unstated source of benign gradient geometry. Because the Section 6.2 claim covers 'all datasets and scenarios,' including the partial-knowledge scenario, this is a load-bearing gap: the reported partial-knowledge results are not supported by the described algorithm.
  2. The claimed 'maximum performance degradation of merely 8.0%' between partial- and full-knowledge attacks compares incompatible configurations. Appendix E states that the full-knowledge scenario uses 10 clients with 1 malicious client, while the partial-knowledge scenario uses 50 clients with 10 malicious clients. Figure 4 shows that attack accuracy decreases as the total number of clients increases, so the degradation in Table 3 relative to Table 2 is confounded by client count and cannot be attributed solely to the loss of benign-gradient knowledge. In addition, Table 3 reports results only for Texas100, so the partial-knowledge claim is not demonstrated for CIFAR-10, STL10, or FER2013 despite the 'all datasets and scenarios' wording.
  3. Theorem 1 does not establish a convergence guarantee for the ATM defense as defined. ATM's final output is an aggregated gradient vector obtained by averaging selected gradients (Algorithm 2, Step 10), but Theorem 1 bounds the mean of scalar angles theta_g after trimming, i.e., a quantity of the form E[|| (1/|G'|) sum theta_g - omega ||^2]. No argument connects this angle-mean bound to the aggregated gradient vector, to the resulting global model, or to attack accuracy. Furthermore, the theorem assumes the n angles are i.i.d. draws from a distribution Omega, but the adversarial setting is precisely one where m angles are maliciously crafted and therefore not i.i.d.; the proof's Lemma 1 only uses order statistics and does not repair this mismatch. The bound is a standalone trimmed-mean concentration statement, not a robustness guarantee for the proposed defense.
  4. The optimization over the scaling factor alpha is not specified. Step III states that after selecting the mask set (with alpha held constant), the attacker solves argmax_alpha in Eq. (6), but the manuscript gives no search procedure, no range for alpha, no stopping criterion, and no statement of whether a closed-form solution exists. Since alpha directly determines g_malicious = alpha*g_attack + g_mask and is one of the free parameters in the attack, the reported attack accuracies cannot be reproduced from the paper as written. The sensitivity of the attack to mask selection shown in Table 4 makes it especially important to specify how alpha is chosen.
minor comments (4)
  1. The text says gradients are arranged in ascending order by mean angle and then 'the top 2b gradients exhibiting the largest absolute values of mean angles' are removed; this phrasing is ambiguous because mean angles are nonnegative and 'largest absolute values' could be read as a separate condition. Algorithm 2's Step 9, which discards the 2b gradients with largest mean angle, is clearer and should be used in the main text.
  2. The reported improvements over baselines (e.g., '15.6%, 11.6%, 5.7%, 16.0%, 10.3%, and 8.0%') are not labeled as absolute or relative improvements; specifying this would make the table comparisons easier to interpret.
  3. The adaptive attack against ATM is defined with an input 'a set of benign gradients GB,' so it is a full-knowledge attack. The text should state this explicitly and clarify that the adaptive-attack results in Table 2 do not apply to the partial-knowledge scenario.
  4. The assumptions on b are stated inconsistently: Lemma 1 assumes m < b <= floor(n/2)-1, while Theorem 1 only states 2m < n; the relationship between b, m, and n needed for the denominator in the final bound should be stated before the theorem.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack and defense form an adversarial pair, the ATM bound is a standalone proof, and the reported results are measurements rather than fitted predictions.

full rationale

The paper's central claims are that FedPoisonMIA crafts malicious gradients by maximizing angular deviation subject to staying within the benign angular envelope (Eqs. 4-6 and Algorithm 1), and that the ATM defense trims gradients with the largest mean angular deviation (Algorithm 2 and Eq. 8). Neither claim is circular: the attack objective is defined in terms of the attacker's loss and the benign gradients it is allowed to know, while the defense is defined independently as a trimmed mean over pairwise angles. The reported attack-accuracy numbers are empirical measurements under fixed settings, not quantities fitted to a target and then re-reported as predictions. Theorem 1 is a standalone probabilistic bound on trimmed means, proved in Appendix A with a self-contained argument (Lemma 1 plus a variance bound); it does not assume the attack's effectiveness or import a conclusion from a self-citation. The paper contains many self-citations (e.g., [14], [15], [16]-[19]), but they are used for standard threat-model assumptions, non-IID partitioning, and asynchronous simulation details, not as a load-bearing uniqueness or derivation chain. The most serious weakness is a completeness gap rather than circularity: the partial-knowledge scenario (Table 1) is defined as having no benign gradients, while Algorithm 1 and Eq. (5) require max-over-benign angle constraints; the paper never explains how the attacker estimates or drops these quantities. This makes the partial-knowledge results under-specified, but it is not an equation-to-equation circular reduction. Therefore the circularity score is low.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central attack depends on two tunable hyperparameters (α, γ) and the defense on an undisclosed trim parameter b. The membership signal and the i.i.d. angle assumption are unverified domain assumptions.

free parameters (3)
  • α (scaling factor) = not reported
    Optimized in Step III (Eq. 6) to maximize angular deviation while staying within the benign angular spread; no value or sensitivity analysis is reported.
  • γ (mask proportion) = 0.1 (default)
    Controls the size of the selected mask set in Algorithm 1; no ablation across γ is shown.
  • b (ATM trim parameter) = not reported
    Number of gradients trimmed per side in ATM (Algorithm 2); no value, sensitivity, or adaptive selection is given, making the defense's reported performance hard to reproduce.
assumptions (3)
  • domain assumption Mislabeled target samples' loss on the aggregated global model is a reliable membership signal.
    Section 4.1: the attack infers membership by observing whether the loss of a mislabeled sample is low (member) or high (non-member); this requires the global model to exhibit such separation.
  • ad hoc to paper Angles in Theorem 1 are i.i.d. with finite variance.
    Section 5.2: the convergence bound assumes {θ_i} are independent and identically distributed, but angles between client gradient vectors are dependent and directional; no justification is provided.
  • ad hoc to paper The attacker can estimate benign gradient geometry without seeing benign gradients.
    The partial-knowledge setting (Table 1) denies benign gradients, yet Eq. (5) and Algorithm 1 require benign gradients; the paper does not explain an estimation procedure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learning." pith.science (2026). https://pith.science/paper/FCN32TGQ

@misc{pith2026250700423,
  author       = {Pith},
  title        = {Pith review of: Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FCN32TGQ}},
  note         = {Machine review of arXiv:2507.00423}
}
read the original abstract

Federated learning (FL) allows multiple clients to collaboratively train a global machine learning model with coordination from a central server, without needing to share their raw data. This approach is particularly appealing in the era of privacy regulations like the GDPR, leading many prominent companies to adopt it. However, FL's distributed nature makes it susceptible to poisoning attacks, where malicious clients, controlled by an attacker, send harmful data to compromise the model. Most existing poisoning attacks in FL aim to degrade the model's integrity, such as reducing its accuracy, with limited attention to privacy concerns from these attacks. In this study, we introduce FedPoisonMIA, a novel poisoning membership inference attack targeting FL. FedPoisonMIA involves malicious clients crafting local model updates to infer membership information. Additionally, we propose a robust defense mechanism to mitigate the impact of FedPoisonMIA attacks. Extensive experiments across various datasets demonstrate the attack's effectiveness, while our defense approach reduces its impact to a degree.

Figures

Figures reproduced from arXiv: 2507.00423 by the authors.

Figure 1
Figure 1. Overview of our attack: Malicious gradients target spe [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Impact of fraction of malicious clients. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Impact of degree of Non-IID. distribution, our attack improves attack accuracy by 15.6%, 11.6%, 5.7%, 16.0%, 10.3%, and 8.0% compared to the best baseline attacks under different defense mechanisms. The results also show higher attack accuracy in IID settings compared to Non-IID, indicating that the consistency of up￾dates in IID data facilitates the attack. For instance, in the IID setting with C = 0.8, our attack … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Impact of total number of clients. 100 200 300 400 500 Num. of attack samples 0.5 0.6 0.7 0.8 0.9 1.0 Attack Accuracy (a) FedAvg 100 200 300 400 500 Num. of attack samples 0.5 0.6 0.7 0.8 0.9 1.0 Attack Accuracy (b) Trimmed-mean Passive GA AGREvader Adaptive FedPoisonM…
Figure 5
Figure 5. Figure 5: Impact of number of target samples [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

58 extracted references · 49 canonical work pages

  1. [1]

    https://www.dshs.texas.gov/THCIC/Hospitals/Download.shtm. 5, 12

    work page

  2. [2]

    Sparse commu- nication for distributed gradient descent

    Alham Fikri Aji and Kenneth Heafield. Sparse commu- nication for distributed gradient descent. arXiv preprint arXiv:1704.05021, 2017. 2, 3, 6, 12

    arXiv 2017

  3. [3]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In AISTATS, 2020. 1

    work page 2020

  4. [4]

    A little is enough: Circumventing defenses for distributed learning

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In NeurIPS, 2019. 1

    work page 2019

  5. [5]

    Analyzing federated learning through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In ICML, 2019. 3

    work page 2019

  6. [6]

    Poisoning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In ICML, 2012. 1

    work page 2012

  7. [7]

    Machine learning with adversaries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS, 2017. 2, 3, 6, 12

    work page 2017

  8. [8]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021. 2

    work page 2021

Show all 58 references
  1. [9]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In IEEE Symposium on Security and Privacy, 2022. 1

    2022

  2. [10]

    Gan- leaks: A taxonomy of membership inference attacks against generative models

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan- leaks: A taxonomy of membership inference attacks against generative models. In CCS, 2020. 3

    2020

  3. [11]

    Label-only membership in- ference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership in- ference attacks. In ICML, 2021. 1

    2021

  4. [12]

    An analysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In AISTATS, 2011. 5, 12

    2011

  5. [13]

    Differential privacy: A survey of results

    Cynthia Dwork. Differential privacy: A survey of results. In TAMC, 2008. 2, 3, 6, 12

    2008

  6. [14]

    Local model poisoning attacks to byzantine-robust federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In USENIX Security Symposium, 2020. 1, 3, 6, 12

    2020

  7. [15]

    Aflguard: Byzantine-robust asynchronous federated learning

    Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Eliza- beth S Bentley. Aflguard: Byzantine-robust asynchronous federated learning. In ACSAC, 2022. 6

    2022

  8. [16]

    Byzantine- robust decentralized federated learning

    Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. Byzantine- robust decentralized federated learning. In CCS, 2024

    2024

  9. [17]

    Byzantine-robust federated learning over ring-all-reduce dis- tributed computing

    Minghong Fang, Zhuqing Liu, Xuecen Zhao, and Jia Liu. Byzantine-robust federated learning over ring-all-reduce dis- tributed computing. In The Web Conference, 2025

    2025

  10. [18]

    Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025

    Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sundararaja Sitharama Iyengar, and Haibo Yang. Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025

    2025

  11. [19]

    Provably robust federated reinforcement learning

    Minghong Fang, Xilong Wang, and Neil Zhenqiang Gong. Provably robust federated reinforcement learning. In The Web Conference, 2025. 2

    2025

  12. [20]

    Active inference against federated learning: Attacks and solutions

    Ana Catarina da Silva Costa Gomes. Active inference against federated learning: Attacks and solutions. 2024. 3

    2024

  13. [21]

    Chal- lenges in representation learning: A report on three machine learning contests

    Ian J Goodfellow, Dumitru Erhan, Pierre Luc Carrier, Aaron Courville, Mehdi Mirza, Ben Hamner, Will Cukierski, Yichuan Tang, David Thaler, Dong-Hyun Lee, et al. Chal- lenges in representation learning: A report on three machine learning contests. In ICONIP, 2013. 5, 12

    2013

  14. [22]

    Membership inference at- tacks on machine learning: A survey

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Membership inference at- tacks on machine learning: A survey. In ACM Computing Surveys, 2022. 3

    2022

  15. [23]

    Advances and open problems in federated learn- ing

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aur´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cum- mings, et al. Advances and open problems in federated learn- ing. In F oundations and trends® in machine learni...

    2021

  16. [24]

    Maximizing the spread of influence through a social network

    David Kempe, Jon Kleinberg, and ´Eva Tardos. Maximizing the spread of influence through a social network. In KDD,

  17. [25]

    Adam: A method for stochastic opti- mization

    Diederik P Kingma. Adam: A method for stochastic opti- mization. arXiv preprint arXiv:1412.6980, 2014. 13

    2014 arXiv

  18. [26]

    Federated learning: Strategies for improving communication efficiency

    Jakub Kone ˇcn`y. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 2016. 1

    2016 arXiv

  19. [27]

    Federated optimization: Distributed ma- chine learning for on-device intelligence

    Jakub Kone ˇcn`y, H Brendan McMahan, Daniel Ramage, and Peter Richt ´arik. Federated optimization: Distributed ma- chine learning for on-device intelligence. arXiv preprint arXiv:1610.02527, 2016. 1

    2016 arXiv

  20. [28]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 5, 12, 13

    2009

  21. [29]

    Stolen memories: Leverag- ing model memorization for calibrated white-box member- ship inference

    Klas Leino and Matt Fredrikson. Stolen memories: Leverag- ing model memorization for calibrated white-box member- ship inference. In USENIX security symposium , 2020. 3, 5

    2020

  22. [30]

    Learning to at- tack federated learning: A model-based reinforcement learn- ing attack framework

    Henger Li, Xiaolin Sun, and Zizhan Zheng. Learning to at- tack federated learning: A model-based reinforcement learn- ing attack framework. In NeurIPS, 2022. 1

    2022

  23. [31]

    Open challenges and opportunities in federated founda- tion models towards biomedical healthcare

    Xingyu Li, Lu Peng, Yuping Wang, and Weihua Zhang. Open challenges and opportunities in federated founda- tion models towards biomedical healthcare. arXiv preprint arXiv:2405.06784, 2024. 3

    2024 arXiv

  24. [32]

    Loden: Making every client in federated learning a defender against the poisoning membership infer- ence attacks

    Mengyao Ma, Yanjun Zhang, Pathum Chamikara Mahawaga Arachchige, Leo Yu Zhang, Mohan Baruwal Chhetri, and Guangdong Bai. Loden: Making every client in federated learning a defender against the poisoning membership infer- ence attacks. In ASIACCS, 2023. 1

    2023

  25. [33]

    Prop- erty inference from poisoning

    Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. Prop- erty inference from poisoning. In IEEE Symposium on Secu- rity and Privacy, 2022. 1

    2022

  26. [34]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag ¨uera y Arcas

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag ¨uera y Arcas. Communication- efficient learning of deep networks from decentralized data. In AISTATS, 2017. 1, 2, 6, 12

    2017

  27. [35]

    Towards poisoning of deep learning algorithms with back-gradient optimization

    Luis Mu ˜noz-Gonz´alez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In AISec, 2017. 3

    2017

  28. [36]

    Compre- hensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Compre- hensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In IEEE symposium on security and privacy , 2019. 3, 5, 12

    2019

  29. [37]

    On the difficulty of member- ship inference attacks

    Shahbaz Rezaei and Xin Liu. On the difficulty of member- ship inference attacks. In CVPR, 2021. 6

    2021

  30. [38]

    Deepsight: Mitigating backdoor at- tacks in federated learning through deep model inspection

    Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi. Deepsight: Mitigating backdoor at- tacks in federated learning through deep model inspection. In NDSS, 2022. 3, 6, 12

    2022

  31. [39]

    Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning

    Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021. 1, 3

    2021

  32. [40]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE symposium on security and pri- vacy, 2017. 1, 6

    2017

  33. [41]

    Membership inference attacks against adversarially robust deep learning models

    Liwei Song, Reza Shokri, and Prateek Mittal. Membership inference attacks against adversarially robust deep learning models. In IEEE Security and Privacy Workshops, 2019. 6

    2019

  34. [42]

    Privacy risks of securing machine learning models against adversarial ex- amples

    Liwei Song, Reza Shokri, and Prateek Mittal. Privacy risks of securing machine learning models against adversarial ex- amples. In CCS, 2019. 3, 12

    2019

  35. [43]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019. 3

    1911 arXiv

  36. [44]

    Data poisoning attacks against federated learning systems

    Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In ESORICS, 2020. 1, 3

    2020

  37. [45]

    Towards demystifying membership inference attacks

    Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei. Towards demystifying membership inference attacks. arXiv preprint arXiv:1807.09173, 2018. 1

    2018 arXiv

  38. [46]

    Poisoning attacks and defenses to federated unlearning

    Wenbin Wang, Qiwen Ma, Zifan Zhang, Yuchen Liu, Zhuqing Liu, and Minghong Fang. Poisoning attacks and defenses to federated unlearning. In The Web Conference ,

  39. [47]

    Privacy back- doors: Enhancing membership inference through poisoning pre-trained models

    Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geip- ing, Tom Goldstein, and Nicholas Carlini. Privacy back- doors: Enhancing membership inference through poisoning pre-trained models. arXiv preprint arXiv:2404.01231, 2024. 1

    2024 arXiv

  40. [48]

    Generalized byzantine-tolerant sgd

    Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Generalized byzantine-tolerant sgd. arXiv preprint arXiv:1802.10116, 2018. 2

    2018 arXiv

  41. [49]

    Phocas: dimensional byzantine-resilient stochastic gradient descent

    Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Phocas: dimensional byzantine-resilient stochastic gradient descent. arXiv preprint arXiv:1805.09682, 2018. 11

    2018 arXiv

  42. [50]

    Fe- dredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error

    Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Fe- dredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. In ICML, 2024. 2

    2024

  43. [51]

    Robust federated learning mitigates client-side train- ing data distribution inference attacks

    Yichang Xu, Ming Yin, Minghong Fang, and Neil Zhenqiang Gong. Robust federated learning mitigates client-side train- ing data distribution inference attacks. In The Web Confer- ence, 2024. 2

    2024

  44. [52]

    Federated machine learning: Concept and applications

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. In ACM Transactions on Intelligent Systems and Technology ,

  45. [53]

    Enhanced membership in- ference attacks against machine learning models

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership in- ference attacks against machine learning models. In CCS,

  46. [54]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In IEEE computer security foun- dations symposium, 2018. 1, 3

    2018

  47. [55]

    Byzantine-robust distributed learning: Towards op- timal statistical rates

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards op- timal statistical rates. In ICML, 2018. 2, 3, 5, 6, 12

    2018

  48. [56]

    Poisoning federated recommender systems with fake users

    Ming Yin, Yichang Xu, Minghong Fang, and Neil Zhenqiang Gong. Poisoning federated recommender systems with fake users. In The Web Conference, 2024. 1

    2024

  49. [57]

    Agrevader: Poisoning membership inference against byzantine-robust federated learning

    Yanjun Zhang, Guangdong Bai, Mahawaga Arachchige Pathum Chamikara, Mengyao Ma, Liyue Shen, Jingwei Wang, Surya Nepal, Minhui Xue, Long Wang, and Joseph Liu. Agrevader: Poisoning membership inference against byzantine-robust federated learning. In The Web Conference, 2023. 3, 5, 12

    2023

  50. [58]

    Pn−b i=b+1(θi − ω) n − 2b #2 ≤ max   

    Zifan Zhang, Minghong Fang, Jiayuan Huang, and Yuchen Liu. Poisoning attacks on federated learning-based wireless traffic prediction. In IFIP Networking Conference, 2024. 1 A. Convergence Analysis of Angular Trimmed- mean Aggregation (ATM) Before proving Theorem 1, we first pr...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.