A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning

Daniel Commey; Garth V. Crosby; Griffith S. Klogo; Rebecca A. Sarpong; Winful Bagyl-Bac

REVIEW 4 major objections 5 minor 1 cited by

A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that paying clients only for model updates that pass a small private validation set makes data poisoning economically losing, and it reports 96.7% accuracy on MNIST when half the clients attack.

desk verdict The IC proof assumes attackers only care about money, contradicting the paper's own threat model, so the economic deterrence claim collapses; the empirical filter is a minor FLTrust variant. read the letter →

arxiv 2507.12439 v1 pith:JLBNG7UB submitted 2025-07-16 cs.LG cs.CRcs.GT

Daniel Commey , Rebecca A. Sarpong , Griffith S. Klogo , Winful Bagyl-Bac , Garth V. Crosby This is my paper

classification cs.LGcs.CRcs.GT

keywords federatedlearningdatapoisoninglabel-flippingattackincentivemechanismBayesiangamedesigncompatibilityrobustaggregation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning lets many clients train a shared model without sharing raw data, but open participation invites data-poisoning attacks. This paper tries to show that a cheap economic filter can replace expensive, reactive robust-aggregation rules: the server keeps a small private validation set, tests each submitted update against it, pays a fixed reward only to updates whose loss is below a threshold, and aggregates only those updates. Under that rule, an honest client's expected payment minus training cost is positive, while a label-flipping attacker's update almost surely fails verification and yields negative utility, making poisoning a losing choice. The paper reports that this mechanism holds MNIST accuracy at 96.7% even with 50% adversaries, where standard FedAvg collapses, and that the same pattern holds on FashionMNIST. If the claim is right, poisoning resistance can be obtained with negligible extra computation and a bounded payment budget.

What carries the argument

The load-bearing object is the verification-and-payment rule combined with the utility function $u_i = p_i - C_i$. The server evaluates each update's loss on a private validation set $\mathcal{D}_y$ (200 samples in the experiments), pays a fixed reward $R$ when the loss is below threshold $\tau$, pays nothing otherwise, and aggregates only the accepted updates by averaging. This converts the aggregation problem into a market: honest updates clear the threshold with near-certainty, so participation has positive expected value, while label-flipping updates that maximize loss on the true labels fail verification with near-certainty, giving the attacker a negative payoff. The proofs of Individual Rationality and Incentive Compatibility rest entirely on those two probability estimates ($P^h_v \approx 1$, $P^m_v \approx 0$) and on the utility containing no term for the attacker's saboteur objective.

What would settle it

Run the paper's exact configuration (200-sample validation set, $\tau=2.5$, reward 10, cost 2) against an adversary whose utility adds a fixed bonus for every percentage point of global accuracy lost; for a large enough bonus the mechanism's accuracy will fall well below the reported 96.7%, showing that poisoning is not economically dominated when sabotage itself has value.

Watch

Extended reading notes

Core claim

In the paper's own terms, each training round is a Bayesian game in which clients are either benevolent or malicious, their type is private, and the server is a principal who verifies updates before paying. The payment rule is $p_i = R$ if $L(w_i; \mathcal{D}_y) < \tau$, and $0$ otherwise, with only the verified updates averaged into the next global model. Theorem 1 shows that a benevolent client's expected utility $P^h_v R - C$ is positive whenever $R > C/P^h_v$, and Theorem 2 shows that a poisoned update, whose loss on the clean validation set is high, has verification probability $P^m_v \approx 0$ and therefore expected utility $-C$, which is strictly worse than abstaining. The experiments then demonstrate the empirical counterpart: with 30%–50% label-flipping clients on non-IID MNIST and FashionMNIST, the mechanism stays above 96.7% and 80.3% accuracy respectively, while FedAvg degrades sharply and Krum fails outright on FashionMNIST.

Load-bearing premise

The incentive-compatibility proof treats the attacker as caring only about payment minus training cost, even though the paper's own threat model says malicious clients aim to degrade the global model.

Editorial extensions

If this is right

If the mechanism works as described, existing federated learning systems can gain poisoning resistance by adding only a forward pass on a 200-sample validation set per client per round, no change to local training.
With 50% label-flipping adversaries, the paper's MNIST experiments put the mechanism at 96.7% accuracy versus 43.5% for FedAvg and 81.6% for Krum, so the economic filter outperforms a standard Byzantine-robust aggregator in this setting.
Honest clients' average utility converges toward $R - C = 8$, and server expenditure stays between roughly 30.2k and 31.2k across runs, so deterrence is achieved within a bounded budget.
The mechanism's robustness scales with the attack fraction: increasing malicious clients from 30% to 50% lowers accuracy by only 0.24 points on MNIST and 1.22 points on FashionMNIST, whereas FedAvg loses 51.75 and 45.30 points respectively.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Extension: the dominance proof does not cover attackers who value the damage itself; if a malicious client's utility includes any positive term for the drop in global accuracy, the expected payoff of attacking is not necessarily $-C$, and the mechanism acts as a filter rather than a deterrent.
Extension: an adaptive attacker could tune a poisoned update to keep its validation loss under $\tau$ while still degrading test accuracy, for instance by interpolating between a benign update and a label-flipped one; the paper's experiments use a fixed label-flip offset and do not test this.
Extension: the threshold $\tau$ and the validation set size create a trade-off curve that the paper leaves implicit—raising $\tau$ admits more honest updates but also more poisoned ones, and shrinking the validation set widens the variance of $L(w; \mathcal{D}_y)$; sweeping these parameters would map the mechanism's real operating envelope.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: the paper's central claim is that the payment rule makes poisoning economically irrational, but Theorem 2 only works because the attacker's utility omits the one thing the threat model says they want. Once you add a value for degrading the model, the IC proof collapses. The empirical filter is real, but it's FLTrust with a binary threshold and a payment rule attached.

What's actually new: the mechanism is simple and the experiments are clean. The server keeps a small validation set, computes loss of each client update, accepts those below tau, and pays only them. The IR theorem is correct and the plots show honest client utility converging to R-C as expected. The robustness numbers on MNIST and FashionMNIST with 50% label flipping are impressive at first glance.

But the soft spots are load-bearing. The utility u_i = p_i - C_i has no term for the attacker's degradation objective, so Theorem 2 compares the poisoned update's expected money payout to non-participation, not to the attacker's actual payoff. If a malicious client values a successful attack at delta, they attack whenever delta > R; the paper never bounds delta. The 'Bayesian game' framing is decoration: there is no equilibrium analysis, just expected payout comparisons. The threshold tau=2.5 is hand-picked with no sensitivity analysis, and the experiments lack error bars, seeds, and any comparison to FLTrust, the closest prior method that already does validation-set reweighting. The revenue and utility numbers are consequences of the payment rule, not evidence of a strategic deterrent.

Who should read this? Someone building a practical FL defense might find the filtering approach worth testing, but the economic claims should be ignored until the utility includes the attacker's objective. This is not a serious game-theoretic contribution.

My recommendation: reject without peer review. The authors could resubmit an empirical-only version with a proper FLTrust baseline and threshold sensitivity study, and that might be a workshop-level paper. As is, the load-bearing theorem is wrong.

Referee Report

4 major / 5 minor

Summary. The paper proposes a validation-set-based filtering and payment mechanism for federated learning. In each training round, the server evaluates every client update on a small private clean validation set, pays a fixed reward R only to updates whose loss is below a manually chosen threshold τ, and aggregates only the verified updates. The authors model the process as a Bayesian game and claim Individual Rationality (IR) for honest clients and Incentive Compatibility (IC) that makes data poisoning an economically dominated strategy. They report experiments on non-IID partitions of MNIST and FashionMNIST with 30%, 40%, and 50% label-flipping malicious clients, showing that the mechanism maintains high accuracy while FedAvg and Krum degrade sharply.

Significance. If the incentive-theoretic claims were sound, this would be a useful contribution: it combines robust aggregation with an economic sustainability argument, and the mechanism itself is simple, computationally light, and easy to integrate into existing FL pipelines. The paper provides pseudocode, clear tables, and economic metrics such as honest-client utility and server expenditure. However, the central theorem does not establish its conclusion: the attacker's utility function omits the sabotage objective that the paper's own threat model assigns to malicious clients, and the key probability P_m^v≈0 is assumed rather than derived. The experimental claims are also weakened by the absence of multiple seeds, error bars, or threshold sensitivity analysis. As it stands, the paper is closer to an empirical study of a threshold-based trusted-root aggregator than to a validated mechanism-design result.

major comments (4)

[Section IV-C, Theorem 2 and Eq. (5)-(6)] The proof of Theorem 2 uses the utility u_i = p_i - C_i defined in Section IV-A, which contains no term for the attacker's objective of degrading the global model, even though Section III-B states that malicious clients 'aim to degrade the global model's performance.' For any adversary whose utility assigns value δ > 0 to a successful degradation, the expected payoff of the poisoned action under the same P_m^v ≈ 0 assumption is approximately δ - C, making the attack strictly preferred to non-participation whenever δ > C. The proof compares the poisoned action only with non-participation (utility 0), not with the attacker's true objective, so the claimed domination does not follow; the IC statement is a restatement of the payment rule rather than a game-theoretic result.
[Section IV-C, Eq. (6)] The conclusion P_m^v ≈ 0 is the very property the mechanism is supposed to guarantee, not an assumption available in the proof. If a poisoning attack produces an update with low loss on the private validation set (for example, an adaptive attack tailored to the validation distribution), the proof provides no argument that such an update is rejected. The theorem therefore cannot support the abstract's claim that poisoning is an 'economically dominated strategy' for rational attackers.
[Section V and Tables I-II] All reported accuracies and economic metrics appear to come from single runs, with no seeds, error bars, or confidence intervals. The headline numbers (e.g., 96.7% vs 43.5% on MNIST at 50% malicious, or a degradation of 0.24 percentage points) are point estimates, so the reader cannot assess whether the differences are statistically meaningful or whether the results are stable across random initializations and data partitions.
[Section V, mechanism parameters] The verification threshold τ = 2.5 is hand-picked and no sensitivity analysis is provided. All robustness and economic results in Figures 3-5 and Tables I-II are conditional on this single value, and the paper does not show how the mechanism's accuracy, honest-client utility, or attack resistance vary with τ, nor how τ should be selected when the loss scale of the validation set is not known in advance. Section VII merely lists adaptive thresholds as future work.

minor comments (5)

[Section II-A and Section IV-B] The paper states that it does not rely on a 'trusted data source,' but the mechanism's private clean validation set D_y in Definition 1 is exactly a trusted root dataset of the kind used by FLTrust [10], which is discussed as a related approach. The positioning should be corrected, and FLTrust should be included as an experimental baseline.
[Table II and Figures 4-5] The column and panel labeled 'Total Revenue' actually report server expenditure (the total rewards paid out), which is misleading; use 'Total Expenditure' or a similar term.
[Section IV-A] The Bayesian formulation is not used after the game tuple is introduced: the prior p(θ_i) and the type space play no role in the payment rule, the verification step, or the proofs. Either the Bayesian machinery should be used to derive beliefs and best responses, or it should be removed to avoid overstating the theoretical framework.
[Algorithm 1] Line 16 says the rejected client 'incurs cost C,' but this cost is not actually transferred to anyone and is not observed by the mechanism; clarify whether C is an exogenously incurred computation cost and how it enters the client's utility.
[Figures 3-5] Several accuracy panels use y-axes that do not start at zero (e.g., the MNIST final-accuracy panel), which visually inflates the stability of the method; add explicit axis limits and tick labels for full transparency.

Circularity Check

2 steps flagged · score 7.0 of 10

Theorem 2's incentive-compatibility proof defines away the attacker's objective, so the economic deterrence claim is a restatement of the payment rule.

self definitional [Section IV-A (Game Formulation) and Section IV-C (Theorem 2)]
"ui: The utility function for client i. The utility is determined by the payment received from the server, pi, minus the operational cost incurred, Ci. Thus, ui = pi − Ci. ... E[ui|ai = ap] ≈ 0 · R − C = −C ... A rational agent will compare this negative utility to the utility of not participating (utility 0) or participating honestly (positive utility, from Theorem 1). Since −C < 0, the poisoning strategy is strictly dominated by non-participation. This demonstrates that the mechanism is incentive-compatible, as it disincentivizes the malicious action."

The threat model (Section III-B) states that malicious clients 'aim to degrade the global model's performance on the primary task,' but the utility in Section IV-A contains no term for that objective. The IC proof computes expected utility as payment minus cost, observes that the threshold-based payment rule rejects poisoned updates (P_m^v ≈ 0), and then declares poisoning dominated. Because rejection is built into the mechanism and the attacker's sabotage payoff is omitted from the utility by definition, the conclusion that poisoning is economically irrational is a restatement of the payment rule rather than a game-theoretic result. If a malicious client valued degradation at δ > 0, attacking would pay approximately δ - C, and the proof provides no bound on δ.
fitted input called prediction [Section VI-B (Detailed Analysis on MNIST)]
"Malicious clients, whose updates are consistently rejected, receive zero payment and incur the cost C, yielding a negative utility. This validates Theorem 2 (Incentive Compatibility), as attacking is an economically irrational choice."

The experimental 'validation' of Incentive Compatibility is the direct consequence of the hand-set verification threshold τ = 2.5 rejecting label-flipped updates; it is not evidence about how rational clients with the threat model's stated objective would behave. The negative utility for malicious clients is forced by the rejection rule in Definition 1, so presenting it as empirical confirmation of the game-theoretic claim treats the mechanism's input (the threshold filter) as if it were an independent prediction about strategic behavior. The accuracy results show that the filter works against one naive attack, but they do not test the economic deterrence hypothesis because the attacker's payoff function was set to omit the value of model degradation.

full rationale

The paper's central contribution is the claim that the mechanism makes poisoning an economically dominated strategy (Theorem 2, Section IV-C). Inspecting the derivation chain, this claim is definitionally forced: the utility function u_i = p_i - C_i contains no argument for the attacker's objective of degrading the global model, and the proof immediately substitutes P_m^v ≈ 0 into that utility to obtain -C, then compares against non-participation. Since P_m^v ≈ 0 is itself the assumed effect of the threshold-based rejection rule, the IC conclusion follows from the mechanism's definitions rather than from a strategic analysis of a game with the threat model described in Section III-B. The empirical section then recomputes the same forced outcome: rejected malicious clients get zero payment and negative utility, which is labeled as validating IC. The MNIST/FashionMNIST accuracy numbers are genuine benchmark results and are not circular by themselves, but they only demonstrate that a validation-set filter rejects label-flipping updates; they do not provide independent support for the economic deterrence claim. No load-bearing self-citation or imported uniqueness theorem appears, and the IR theorem is conditional rather than circular. Because the load-bearing theoretical guarantee reduces by construction to the payment rule, the circularity score is 7.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The mechanism's advertised guarantees rest on hand-picked economic parameters (R, C, tau) and on an attacker model that excludes the sabotage objective. The game-theoretic proofs do not establish IC under the stated threat model.

free parameters (4)

Reward R = 10
Set by hand; enters IR condition R > C/P_h^v; no economic justification given.
Operational cost C = 2
Assumed uniform across clients; chosen by hand; no measurement or calibration.
Verification threshold tau = 2.5
Hand-picked; determines which updates are accepted and paid; no sensitivity analysis and no procedure for setting it in practice; central to the mechanism's filtering effectiveness.
Validation set size = 200
Number of private labeled examples at the server; chosen without analysis; affects reliability of loss estimates.

assumptions (4)

domain assumption The server has access to a clean, labeled validation set Dy of 200 examples.
Invoked in Definition 1 and Algorithm 1; the entire verification step depends on this trusted data being available and representative.
domain assumption The loss L(w; Dy) reliably separates honest from poisoned updates.
Assumed in Theorem 2 (P_m^v ~ 0, P_h^v ~ 1); not proven or tested under adaptive attacks.
ad hoc to paper Clients are rational expected-utility maximizers with utility u_i = p_i - C_i.
This assumption is needed for the IC proof but contradicts the threat model in which malicious clients 'aim to degrade the global model'; it removes any utility for sabotage, making the 'dominance' of honest action a tautology.
domain assumption A common prior P(theta_i = malicious) = f is known to the server.
Assumed in Section IV-A; not used in the mechanism's verification or payment logic.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning." pith.science (2026). https://pith.science/paper/JLBNG7UB

@misc{pith2026250712439,
  author       = {Pith},
  title        = {Pith review of: A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JLBNG7UB}},
  note         = {Machine review of arXiv:2507.12439}
}

read the original abstract

Federated learning (FL) enables collaborative model training across decentralized clients while preserving data privacy. However, its open-participation nature exposes it to data-poisoning attacks, in which malicious actors submit corrupted model updates to degrade the global model. Existing defenses are often reactive, relying on statistical aggregation rules that can be computationally expensive and that typically assume an honest majority. This paper introduces a proactive, economic defense: a lightweight Bayesian incentive mechanism that makes malicious behavior economically irrational. Each training round is modeled as a Bayesian game of incomplete information in which the server, acting as the principal, uses a small, private validation dataset to verify update quality before issuing payments. The design satisfies Individual Rationality (IR) for benevolent clients, ensuring their participation is profitable, and Incentive Compatibility (IC), making poisoning an economically dominated strategy. Extensive experiments on non-IID partitions of MNIST and FashionMNIST demonstrate robustness: with 50% label-flipping adversaries on MNIST, the mechanism maintains 96.7% accuracy, only 0.3 percentage points lower than in a scenario with 30% label-flipping adversaries. This outcome is 51.7 percentage points better than standard FedAvg, which collapses under the same 50% attack. The mechanism is computationally light, budget-bounded, and readily integrates into existing FL frameworks, offering a practical route to economically robust and sustainable FL ecosystems.

Figures

Figures reproduced from arXiv: 2507.12439 by the authors.

**Figure 2.** The threat model. A fraction f of clients are malicious. They poison their local dataset Dj by flipping labels to create D′ j before training their local model. Benign clients train on their original, clean data Di. IV. BAYESIAN INCENTIVE MECHANISM A. Game Formulation We model each round of federated training as a Bayesian game of incomplete information, defined by the tuple Γ = ⟨N , {Θi}, {Ai}, {ui}, p⟩: • N : The … view at source ↗

**Figure 3.** Comprehensive performance analysis comparing FedAvg, Krum, and [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: Detailed performance and economic analysis on the FashionMNIST [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

ZKP-FedEval: Verifiable and Privacy-Preserving Federated Evaluation using Zero-Knowledge Proofs
cs.LG 2025-07 reject novelty 3.0 of 10

A threshold-based ZKP protocol for federated evaluation is proposed, but the implemented circuit only checks the threshold, not the loss computation, leaving the central guarantee unsupported.

Reference graph

Works this paper leans on

17 extracted references · 13 canonical work pages · cited by 1 Pith paper

[1]

Communication-efficient learning of deep networks from decentralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282. [Online]. Available: https://proceedings.mlr.press/ v54/mcmahan17a?ref=https://githubhelp.com

work page 2017
[2]

Federated learning: Challenges, methods, and future directions,

T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,” IEEE signal processing magazine, vol. 37, no. 3, pp. 50–60, 2020, publisher: IEEE. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/9084352/

work page arXiv 2020
[3]

Securing Health Data on the Blockchain: A Differential Privacy and Federated Learning Framework

D. Commey, S. Hounsinou, and G. V . Crosby, “Securing Health Data on the Blockchain: A Differential Privacy and Federated Learning Framework,” May 2024, arXiv:2405.11580 [cs]. [Online]. Available: http://arxiv.org/abs/2405.11580

work page Pith review arXiv 2024
[4]

Analyzing federated learning through an adversarial lens,

A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in International conference on machine learning . PMLR, 2019, pp. 634–643. [Online]. Available: https://proceedings.mlr.press/v97/bhagoji19a.html

work page 2019
[5]

How to backdoor federated learning,

E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948. [Online]. Available: https://proceedings.mlr.press/v108/bagdasaryan20a.html

work page 2020
[6]

Threats to Federated Learning: A Survey,

L. Lyu, H. Yu, and Q. Yang, “Threats to Federated Learning: A Survey,” Mar. 2020, arXiv:2003.02133 [cs]. [Online]. Available: http://arxiv.org/abs/2003.02133

arXiv 2020
[7]

Machine learning with adversaries: Byzantine tolerant gradient descent,

P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30,

work page
[8]

Byzantine-robust distributed learning: Towards optimal statistical rates,

D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in International conference on machine learning . Pmlr, 2018, pp. 5650–5659. [Online]. Available: https://proceedings.mlr.press/v80/yin18a

work page 2018

Show all 17 references

[9]

Robust aggregation for federated learning,

K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing , vol. 70, pp. 1142–1154, 2022, publisher: IEEE. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/9721118/

2022
[10]

FLTrust: Byzantine- robust Federated Learning via Trust Bootstrapping,

X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine- robust Federated Learning via Trust Bootstrapping,” Apr. 2022, arXiv:2012.13995 [cs]. [Online]. Available: http://arxiv.org/abs/2012. 13995

2022 arXiv
[11]

Draco: Byzantine-resilient distributed training via redundant gradients,

L. Chen, H. Wang, Z. Charles, and D. Papailiopoulos, “Draco: Byzantine-resilient distributed training via redundant gradients,” in International Conference on Machine Learning . PMLR, 2018, pp. 903–912. [Online]. Available: http://proceedings.mlr.press/v80/chen18l

2018
[12]

Incentive mechanism for reliable federated learning: A joint optimization approach to combining reputation and contract theory,

J. Kang, Z. Xiong, D. Niyato, S. Xie, and J. Zhang, “Incentive mechanism for reliable federated learning: A joint optimization approach to combining reputation and contract theory,” IEEE Internet of Things Journal, vol. 6, no. 6, pp. 10 700–10 714, 2019, publisher: IEEE. [Onli...

2019
[13]

A learning-based incentive mechanism for federated learning,

Y . Zhan, P. Li, Z. Qu, D. Zeng, and S. Guo, “A learning-based incentive mechanism for federated learning,” IEEE Internet of Things Journal , vol. 7, no. 7, pp. 6360–6368, 2020, publisher: IEEE. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/8963610/

2020
[14]

Incentive Mechanism for Horizontal Federated Learning Based on Reputation and Reverse Auction,

J. Zhang, Y . Wu, and R. Pan, “Incentive Mechanism for Horizontal Federated Learning Based on Reputation and Reverse Auction,” in Proceedings of the Web Conference 2021 . Ljubljana Slovenia: ACM, Apr. 2021, pp. 947–956. [Online]. Available: https://dl.acm.org/doi/10. 1145/3442...

2021
[15]

FedCoin: A Peer-to-Peer Payment System for Federated Learning,

Y . Liu, Z. Ai, S. Sun, S. Zhang, Z. Liu, and H. Yu, “FedCoin: A Peer-to-Peer Payment System for Federated Learning,” in Federated Learning, Q. Yang, L. Fan, and H. Yu, Eds. Cham: Springer International Publishing, 2020, vol. 12500, pp. 125–138, series Title: Lecture Notes in ...

2020 doi
[16]

VeriFL: Communication-Efficient and Fast Verifiable Aggregation for Federated Learning,

X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T. Baker, “VeriFL: Communication-Efficient and Fast Verifiable Aggregation for Federated Learning,” IEEE Transactions on Information Forensics and Security , vol. 16, pp. 1736–1751, 2021. [Online]. Available: https://ieeexplo...

2021
[2017]

Available: https://proceedings.neurips.cc/paper/2017/ hash/f4b9ec30ad9f68f89b29639786cb62ef-Abstract.html

[Online]. Available: https://proceedings.neurips.cc/paper/2017/ hash/f4b9ec30ad9f68f89b29639786cb62ef-Abstract.html

2017

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Communication-efficient learning of deep networks from decentralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282. [Online]. Available: https://proceedings.mlr.press/ v54/mcmahan17a?ref=https://githubhelp.com

work page 2017

[2] [2]

Federated learning: Challenges, methods, and future directions,

T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,” IEEE signal processing magazine, vol. 37, no. 3, pp. 50–60, 2020, publisher: IEEE. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/9084352/

work page arXiv 2020

[3] [3]

Securing Health Data on the Blockchain: A Differential Privacy and Federated Learning Framework

D. Commey, S. Hounsinou, and G. V . Crosby, “Securing Health Data on the Blockchain: A Differential Privacy and Federated Learning Framework,” May 2024, arXiv:2405.11580 [cs]. [Online]. Available: http://arxiv.org/abs/2405.11580

work page Pith review arXiv 2024

[4] [4]

Analyzing federated learning through an adversarial lens,

A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in International conference on machine learning . PMLR, 2019, pp. 634–643. [Online]. Available: https://proceedings.mlr.press/v97/bhagoji19a.html

work page 2019

[5] [5]

How to backdoor federated learning,

E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948. [Online]. Available: https://proceedings.mlr.press/v108/bagdasaryan20a.html

work page 2020

[6] [6]

Threats to Federated Learning: A Survey,

L. Lyu, H. Yu, and Q. Yang, “Threats to Federated Learning: A Survey,” Mar. 2020, arXiv:2003.02133 [cs]. [Online]. Available: http://arxiv.org/abs/2003.02133

arXiv 2020

[7] [7]

Machine learning with adversaries: Byzantine tolerant gradient descent,

P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , vol. 30,

work page

[8] [8]

Byzantine-robust distributed learning: Towards optimal statistical rates,

D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in International conference on machine learning . Pmlr, 2018, pp. 5650–5659. [Online]. Available: https://proceedings.mlr.press/v80/yin18a

work page 2018