Detection of Physiological Data Tampering Attacks with Quantum Machine Learning

Himanshu Thapliyal; Md. Saif Hassan Onim

REVIEW 5 major objections 5 minor 20 references

Detection of Physiological Data Tampering Attacks with Quantum Machine Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hybrid quantum kernel SVMs detect label-flipping tampering in physiological data with 75%-95% accuracy, beating classical SVMs on two of three datasets.

desk verdict First-to-apply benchmark of quantum hybrid SVM for physiological tampering detection; the QML advantage on label-flipping is real only for the Stress dataset and the multi-class one-class SVM protocol is underspecified. read the letter →

arxiv 2502.05966 v1 pith:KRFOHEO3 submitted 2025-02-09 quant-ph cs.LG

Md. Saif Hassan Onim , Himanshu Thapliyal This is my paper · ORCID

classification quant-phcs.LG

keywords quantummachinelearningphysiologicaldatatamperingpoisoninglabel-flippingattackadversarialperturbationone-classSVMkernelhealthcarecybersecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that hybrid quantum machine learning can detect tampering in physiological sensor data better than classical machine learning, at least for one class of attack. Using a quantum kernel one-class SVM, it reports 75%-95% detection accuracy for label-flipping data poisoning across a one-class ECG dataset, a two-class ECG/PCG dataset, and a three-class stress dataset; the quantum model beats the classical baseline on two of the three and matches it on the third. The paper also argues that adversarial perturbation attacks are much harder for both paradigms, with quantum detection accuracy around 45%-65%. A sympathetic reader would care because cloud-connected medical devices depend on trustworthy data, and a detector that catches poisoning before it contaminates retraining would improve patient safety.

What carries the argument

The load-bearing object is the quantum kernel one-class SVM. Classical features are first reduced with PCA to 12 dimensions, then each pair of features is encoded into one of 6 qubits using Rx and Ry rotation gates; CNOT layers entangle the qubits, and the overlap (fidelity) of the encoded states serves as the kernel k(xi,xj) inside the one-class SVM objective. This lets the decision boundary operate in a quantum feature Hilbert space that a classical dot-product kernel cannot directly reach, which is the mechanism the paper credits for the label-flipping advantage.

What would settle it

Re-run the pipeline on EPHNOGRAM and Stress with an explicitly documented protocol: train the one-class SVM only on clean samples of each class, test it on that class plus attacked samples, and report per-class accuracy and macro-averaged accuracy; if the resulting scores fall well below Table III or near random guessing, the 75%-95% label-flipping claim is an artifact of the unspecified evaluation.

Watch

Extended reading notes

Core claim

The central claim is that a hybrid quantum-classical one-class SVM, whose kernel is the quantum fidelity between Rx/Ry-encoded and CNOT-entangled feature states, detects label-flipping and targeted-poisoning tampering in physiological time-series data more accurately than a classical dot-product SVM. The reported detection accuracies for label flipping are 75.03% on RESTINGECG, 75.23% on EPHNOGRAM, and 95.11% on the three-class Stress dataset, versus 67.67%, 75.01%, and 80.75% for the classical baseline. The quantum model also does better on targeted poisoning for EPHNOGRAM (66.66% vs 50.36%) but worse on targeted poisoning for Stress (49.96% vs 65.23%). Both models perform poorly on FGSM adversarial perturbation, with quantum accuracy between 45.99% and 60.09%, and the paper attributes this to perturbations that preserve statistical properties.

Load-bearing premise

The results assume that a detector trained on only one class can be fairly scored on datasets with two or three classes, but the paper never says how that was done.

Editorial extensions

If this is right

If the results hold, a quantum kernel detector could be added as a screening layer in physiological data pipelines to flag label-flipped samples before models are retrained.
The roughly 15-point gain on the three-class Stress dataset suggests the quantum advantage may grow as label structure and feature count increase, though the paper does not test this trend directly.
The large classical accuracy drops after attack (for example, EPHNOGRAM label flipping falls from 99.975% to 49.556%) support the need for a separate tamper-detection step rather than relying on the trained model.
Both quantum and classical detectors miss most adversarial perturbations, so this attack type should be treated as an open threat in cloud-based physiological monitoring.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural next experiment the paper leaves implicit is to ablate the CNOT entangling layers in the quantum kernel; if the label-flipping advantage persists without entanglement, the benefit comes from the rotation encoding rather than from quantum correlations.
The 6-qubit, 12-feature setting is a small-scale test; scaling to more qubits and features could change the comparison, and the paper does not address how the quantum kernel cost grows.
The same one-class quantum kernel protocol could be evaluated on other medical time-series with known label noise, such as PPG-only wearables or ICU vital signs, to see whether the 75%-95% range transfers.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a first-to-apply empirical benchmark, not a new method. The headline claim that QML models are better at detecting label-flipping attacks is supported mainly by one dataset (Stress: 95.11% vs 80.75%). On EPHNOGRAM the gap is 0.22 points (75.23% vs 75.01%), which is noise without error bars, and on RESTINGECG it's about 7.4 points. So the abstract overstates a real but uneven result.

What's new and worth credit: the authors took the quantum hybrid kernel SVM from their prior work and ran it against a classical SVM baseline for label-flipping and FGSM perturbation on three public physiological datasets. That specific comparison is new. The threat model is clearly laid out, the datasets are public, and the classical baseline uses the same framework with a classical kernel. This is a legitimate, if modest, benchmark study.

The soft spots are significant. The load-bearing one is the evaluation of the one-class SVM on multi-class data. Section III-E defines the detector as trained on one class; Section IV says accuracy was calculated class-wise and averaged over folds, but never says how the detector is applied to two-class EPHNOGRAM and three-class Stress data. Label-flipping changes labels while leaving features unchanged, so a feature-only anomaly detector needs an explicit per-class assignment protocol. Without that protocol, the Stress and EPHNOGRAM detection numbers cannot be interpreted. Second, there are no error bars or significance tests; the five-fold averages alone do not support the claims. Third, attack parameters (flip fraction, FGSM epsilon, poisoning fraction) are not reported, so the experiments cannot be reproduced. Fourth, Eq. (1) is not the standard one-class SVM decision function, and the abstract's statement that quantum 'still outperformed classical algorithms in some cases' for adversarial perturbation is contradicted by Table III, where quantum is below classical on all three perturbation rows. These are fixable, but they are real.

Who this is for: people working on QML for healthcare data security, especially anyone who wants a baseline for quantum kernel anomaly detection. The paper deserves a serious referee: the question is legitimate, the setup is close to standard, and a major revision requiring error bars, attack parameters, a clear multi-class protocol, and a corrected abstract could make the result publishable.

Referee Report

5 major / 5 minor

Summary. This manuscript studies the use of a hybrid quantum kernel one-class SVM for detecting two types of white-box tampering attacks—label-flipping/poisoning and adversarial perturbation—on three physiological datasets (RESTINGECG, EPHNOGRAM, Stress). The authors report 5-fold cross-validation detection accuracies for both a classical SVM baseline and the proposed quantum hybrid model, claim that the quantum model achieves 75%–95% accuracy on label-flipping attacks, and attribute this to the quantum feature map's ability to handle high-dimensional data. The paper also reports that both models perform poorly on adversarial perturbation, with the abstract claiming that quantum still outperformed classical in some cases.

Significance. If the reported results are taken at face value, this would be one of the first demonstrations of quantum machine learning for detecting tampering in physiological sensor data, and the 95.11% versus 80.75% result on the three-class Stress dataset for label flipping would be a practically meaningful advantage. The use of three public datasets with different label structures and the direct comparison to a classical SVM baseline are strengths. However, the current manuscript does not supply enough experimental detail to evaluate the central claim: the one-class SVM protocol on multi-class data is unspecified, attack parameters are absent, and no measures of variability are reported. The work is potentially salvageable, but the evidence as written does not yet support the abstract's strong superiority claim.

major comments (5)

[III-E and IV] The one-class SVM training and evaluation protocol for the multi-class datasets is not specified. One-class SVM is naturally trained on data from a single class, yet Table III reports detection accuracy for the two-class EPHNOGRAM and three-class Stress datasets and states only that accuracy was 'calculated class-wise and averaged on 5-folds.' The manuscript does not state whether one one-class SVM is trained per class, how a sample is labeled as attacked versus clean, or how per-class scores are aggregated into the reported percentages. This is load-bearing because the label-flipping results for EPHNOGRAM (75.23% versus 75.01%) and Stress (95.11% versus 80.75%) cannot be interpreted without this protocol, and an inappropriate protocol could make the reported accuracies measure something other than tampering detection.
[Table III and IV] All reported accuracies are single 5-fold means with no standard deviations, confidence intervals, or significance tests. This is particularly problematic for the EPHNOGRAM label-flipping row, where the quantum and classical results differ by only 0.22 percentage points (75.23% versus 75.01%); such a gap is within typical fold-to-fold variation and does not support the claim that QML models are 'better' on this dataset. The authors should report per-fold results or at least error bars, and should either avoid claiming superiority where the difference is not statistically resolvable or support it with an appropriate test.
[III-D and Table II] The attack parameters are not reported. The abstract states that detection accuracy depends on 'attack severity,' but the manuscript never defines the label-flip fraction, the FGSM perturbation size epsilon, or the fraction of poisoned samples used for the targeted poisoning attacks. Without these values, the experiments cannot be reproduced, and the cross-dataset variation in Table III cannot be attributed to data properties rather than to differing attack intensities.
[III-E, Eq. (1)] Equation (1) is not the standard one-class SVM decision function. The expression contains a double sum over training data pairs, k(x_i, x_j), and no dependency on a test point x, whereas a one-class SVM decision function should be of the form sign(sum_i alpha_i k(x_i, x) + b - rho) (or an equivalent kernel expansion). The equation also does not match the optimization formulation in Eqs. (2)–(3). This needs to be corrected because the method description is the basis for the reported experiments.
[Abstract and Section V] The abstract's statement that for adversarial perturbation the quantum model 'still outperformed classical algorithms in some cases' is contradicted by Table III: for all three datasets the quantum accuracy is lower than the classical accuracy on the perturbation rows (55.16% vs. 60.52% for RESTINGECG, 60.09% vs. 68.99% for EPHNOGRAM, and 45.99% vs. 58.95% for Stress). Section V repeats this incorrect claim. This discrepancy must be fixed because it directly affects the paper's stated conclusions.

minor comments (5)

[Table I] The RESTINGECG entry says 'They recorded continuous EEG signals across 72 channels,' but the dataset is named as an ECG dataset and the table lists it under 'Signals: ECG.' Please clarify whether the raw data are EEG or ECG, and correct the description accordingly.
[II-B] The adversarial perturbation definition writes x' = x + delta and f_theta(x') != f_theta, but the notation x' is introduced and f_theta is left without an argument. This should be written as x' = x + delta and f_theta(x') != f_theta(x), or similar.
[II-A and Table II] Targeted poisoning appears as a separate attack type in Table II and Table III, but Section II-A only briefly mentions it without specifying how it differs operationally from label flipping or what fraction of samples is targeted. Please provide a precise definition.
[III-E and IV] The term 'class-wise accuracy' is ambiguous. Please state whether the reported numbers are macro-averaged (average per-class recall) or micro-averaged (global accuracy), and how the one-class detector's output is converted into a class prediction for multi-class data.
[Throughout] A few typographical and formatting issues should be corrected: the 'Index Terms' line appears to contain an extra space, and some equations (e.g., the moving average formula) are not cleanly typeset. These do not affect the science but should be cleaned up.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is a direct empirical comparison of hybrid quantum-kernel SVMs against classical SVMs on public physiological datasets, with no fitted parameter renamed as a prediction.

full rationale

The central claim — that hybrid quantum kernel SVMs achieve 75%–95% detection accuracy on label-flipping attacks and outperform classical SVMs on some datasets — is supported by direct measurements reported in Table III after applying the pipeline described in Sections III-A through III-E (preprocessing, PCA to 12 features, 6-qubit Rx/Ry encoding with CNOT entangling gates, kernel-based One-Class SVM, 5-fold cross-validation). No prediction is derived from a fitted parameter: the detection accuracies are outputs of a training/evaluation run, not values reconstructed from inputs by construction. The kernel circuit and One-Class SVM equations are standard and are not defined in terms of the reported results. The abstract's mechanistic explanation ('due to the ability of quantum algorithms to handle complex and high-dimensional data') is speculative but not a circular step, because the numerical results do not reduce to that explanation. The paper cites prior work by the same authors for the Stress dataset (refs. [17]–[19]) and for QML anomaly-detection context (ref. [11]), but these citations are data sources and background motivation, not the load-bearing justification for the reported accuracies; the empirical comparison is self-contained against the public datasets. The main weakness — the unspecified protocol for training and scoring a One-Class SVM on the two-class EPHNOGRAM and three-class Stress datasets, mentioned in Sections III-E and IV — is a correctness and reproducibility concern, not circularity: even if the protocol is inappropriate, the numbers are not circularly forced by construction, they are uninterpretable or mismeasured. Likewise, the absence of confidence intervals and the inconsistency between the abstract and Table III for adversarial perturbation are reporting issues, not circular-derivation issues. Therefore the appropriate finding is no significant circularity (score 0).

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claim rests on several unreported hyperparameters (attack intensities, SVM nu, PCA dimension) and on an unexplained evaluation protocol for one-class SVM on multi-class data. No new entities are introduced; the method is borrowed from prior work.

free parameters (4)

PCA target dimension = 12
Chosen to match 6 qubits (2 features per qubit), not derived from data; affects the kernel geometry.
Quantum kernel circuit ansatz = Rx-Ry encoding with CNOT entangling and inverse operations
Chosen without comparison to other feature maps; the accuracy gains are specific to this ansatz.
One-class SVM nu = Not reported
Controls the expected outlier fraction and directly affects detection accuracy; not specified.
Attack intensity parameters = Not reported (label flip fraction, FGSM epsilon, targeted poisoning fraction)
Detection accuracy depends heavily on attack strength; without these, results cannot be interpreted or reproduced.

assumptions (3)

domain assumption The three public datasets (RESTINGECG, EPHNOGRAM, Stress) are representative physiological sensor data and their class labels are correct.
The conclusion about real-world performance depends on the quality and representativeness of these datasets (Section III-A).
domain assumption One-class SVM trained on a dataset can detect both label-flipped and perturbed samples as anomalies.
The method assumes anomalous samples become outliers in the kernel feature space after the attack; no evidence is provided for this separability (Section III-E).
standard math Standard PCA and Z-score normalization preserve the information needed for tampering detection.
Feature reduction to 12 dimensions is applied to all datasets; the paper does not check whether tampering signatures are preserved after PCA (Section III-B).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Detection of Physiological Data Tampering Attacks with Quantum Machine Learning." pith.science (2026). https://pith.science/paper/KRFOHEO3

@misc{pith2026250205966,
  author       = {Pith},
  title        = {Pith review of: Detection of Physiological Data Tampering Attacks with Quantum Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KRFOHEO3}},
  note         = {Machine review of arXiv:2502.05966}
}

read the original abstract

The widespread use of cloud-based medical devices and wearable sensors has made physiological data susceptible to tampering. These attacks can compromise the reliability of healthcare systems which can be critical and life-threatening. Detection of such data tampering is of immediate need. Machine learning has been used to detect anomalies in datasets but the performance of Quantum Machine Learning (QML) is still yet to be evaluated for physiological sensor data. Thus, our study compares the effectiveness of QML for detecting physiological data tampering, focusing on two types of white-box attacks: data poisoning and adversarial perturbation. The results show that QML models are better at identifying label-flipping attacks, achieving accuracy rates of 75%-95% depending on the data and attack severity. This superior performance is due to the ability of quantum algorithms to handle complex and high-dimensional data. However, both QML and classical models struggle to detect more sophisticated adversarial perturbation attacks, which subtly alter data without changing its statistical properties. Although QML performed poorly against this attack with around 45%-65% accuracy, it still outperformed classical algorithms in some cases.

Figures

Figures reproduced from arXiv: 2502.05966 by the authors.

**Figure 2.** Kernel Computation Circuit. (0 − 5) are the qubits, H is the Hadamard gate, Rx and Ry are the rotation gates, ⊕ denotes the C-NOT gates and † represents the reverse operations (a) Clean Dataset before the Attack (b) Adversarial Dataset after the Attack [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** 2D Projection of EPHNOGRAM Dataset before and [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 18 canonical work pages

[1]

A systematic review of adver- sarial machine learning attacks, defensive controls, and technologies,

J. Malik, R. Muthalagu, and P. M. Pawar, “A systematic review of adver- sarial machine learning attacks, defensive controls, and technologies,” IEEE Access , vol. 12, pp. 99 382–99 421, 2024

work page 2024
[2]

Data security and privacy in wireless body area networks,

M. Li, W. Lou, and K. Ren, “Data security and privacy in wireless body area networks,” IEEE Wireless Communications , vol. 17, no. 1, pp. 51–58, 2010

work page 2010
[3]

Security issues in biomedical wireless sensor networks,

T. Dimitriou and K. Ioannis, “Security issues in biomedical wireless sensor networks,” in 2008 First International Symposium on Applied Sciences on Biomedical and Communication Technologies , 2008, pp. 1–5

work page 2008
[4]

Anomaly detection using machine learning to discover sensor tampering in iot systems,

A. K. Pathak, S. Saguna, K. Mitra, and C. ˚Ahlund, “Anomaly detection using machine learning to discover sensor tampering in iot systems,” in ICC 2021 - IEEE International Conference on Communications , 2021, pp. 1–6

work page 2021
[5]

Anomaly behavior analysis for iot sensors,

J. Pacheco and S. Hariri, “Anomaly behavior analysis for iot sensors,” Transactions on Emerging Telecommunications Technologies , vol. 29, no. 4, p. e3188, 2018, e3188 ETT-16-0338.R1

work page 2018
[6]

Hybrid anomaly detection model on trusted iot devices,

P. D. Rosero-Montalvo, Z. Istv ´an, P. T¨oz¨un, and W. Hernandez, “Hybrid anomaly detection model on trusted iot devices,”IEEE Internet of Things Journal, vol. 10, no. 12, pp. 10 959–10 969, 2023

work page 2023
[7]

Data poisoning attacks on federated machine learning,

G. Sun, Y . Cong, J. Dong, Q. Wang, L. Lyu, and J. Liu, “Data poisoning attacks on federated machine learning,” IEEE Internet of Things Journal , vol. 9, no. 13, pp. 11 365–11 375, 2022

work page 2022
[8]

Data poisoning attacks against machine learning algorithms,

F. A. Yerlikaya and S ¸erif Bahtiyar, “Data poisoning attacks against machine learning algorithms,” Expert Systems with Applications , vol. 208, p. 118101, 2022

2022

Show all 20 references

[9]

Quantum machine learning in feature hilbert spaces,

M. Schuld and N. Killoran, “Quantum machine learning in feature hilbert spaces,” Phys. Rev. Lett. , vol. 122, p. 040504, Feb 2019

2019
[10]

Supervised learning with quantum- enhanced feature spaces,

V . Havl ´ıˇcek, A. D. C ´orcoles, K. Temme, A. W. Harrow, A. Kandala, J. M. Chow, and J. M. Gambetta, “Supervised learning with quantum- enhanced feature spaces,” Nature, vol. 567, no. 7747, pp. 209–212, Mar 2019

2019
[11]

Anomaly detection for real-world cyber-physical security using quantum hybrid support vector machines,

T. Cultice, M. S. H. Onim, A. Giani, and H. Thapliyal, “Anomaly detection for real-world cyber-physical security using quantum hybrid support vector machines,” in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI) . IEEE, 2024, pp. 619–624

2024
[12]

Automated security test generation with formal threat models,

D. Xu, M. Tu, M. Sanford, L. Thomas, D. Woodraska, and W. Xu, “Automated security test generation with formal threat models,” IEEE Transactions on Dependable and Secure Computing , vol. 9, no. 4, pp. 526–540, 2012

2012
[13]

Univer- sal adversarial perturbations,

S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Univer- sal adversarial perturbations,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2017, pp. 1765–1773

2017
[14]

The effect of electroen- cephalogram (eeg) reference choice on information-theoretic measures of the complexity and integration of eeg signals,

L. T. Trujillo, C. T. Stanfield, and R. D. Vela, “The effect of electroen- cephalogram (eeg) reference choice on information-theoretic measures of the complexity and integration of eeg signals,” Frontiers in Neuro- science, vol. 11, 2017

2017
[15]

Ephnogram: A simulta- neous electrocardiogram and phonocardiogram database,

A. Kazemnejad, P. Gordany, and R. Sameni, “Ephnogram: A simulta- neous electrocardiogram and phonocardiogram database,” 2021

2021
[16]

Physiobank, physiotoolkit, and physionet: Components of a new research resource for complex physiologic signals,

A. L. Goldberger, L. A. N. Amaral, L. Glass, J. M. Hausdorff, P. C. Ivanov, R. G. Mark, J. E. Mietus, G. B. Moody, C.-K. Peng, and H. E. Stanley, “Physiobank, physiotoolkit, and physionet: Components of a new research resource for complex physiologic signals,” Circulation, vol...

2000
[17]

Machine learning based stress monitoring in older adults using wearable sensors and cortisol as stress biomarker,

R. K. Nath, H. Thapliyal, and A. Caban-Holt, “Machine learning based stress monitoring in older adults using wearable sensors and cortisol as stress biomarker,” Journal of Signal Processing Systems , pp. 1–13, 2022

2022
[18]

Utilizing machine learning for context-aware digital biomarker of stress in older adults,

M. S. H. Onim, H. Thapliyal, and E. K. Rhodus, “Utilizing machine learning for context-aware digital biomarker of stress in older adults,” Information, vol. 15, no. 5, p. 274, 2024

2024
[19]

Predicting stress in older adults with rnn and lstm from time series sensor data and cortisol,

M. S. H. Onim and H. Thapliyal, “Predicting stress in older adults with rnn and lstm from time series sensor data and cortisol,” in 2024 IEEE Computer Society Annual Symposium on VLSI (ISVLSI) , 2024, pp. 300– 306

2024
[20]

Principal component analysis: A natural approach to data exploration,

F. L. Gewers, G. R. Ferreira, H. F. D. Arruda, F. N. Silva, C. H. Comin, D. R. Amancio, and L. D. F. Costa, “Principal component analysis: A natural approach to data exploration,” vol. 54, no. 4, May 2021

2021

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

A systematic review of adver- sarial machine learning attacks, defensive controls, and technologies,

J. Malik, R. Muthalagu, and P. M. Pawar, “A systematic review of adver- sarial machine learning attacks, defensive controls, and technologies,” IEEE Access , vol. 12, pp. 99 382–99 421, 2024

work page 2024

[2] [2]

Data security and privacy in wireless body area networks,

M. Li, W. Lou, and K. Ren, “Data security and privacy in wireless body area networks,” IEEE Wireless Communications , vol. 17, no. 1, pp. 51–58, 2010

work page 2010

[3] [3]

Security issues in biomedical wireless sensor networks,

T. Dimitriou and K. Ioannis, “Security issues in biomedical wireless sensor networks,” in 2008 First International Symposium on Applied Sciences on Biomedical and Communication Technologies , 2008, pp. 1–5

work page 2008

[4] [4]

Anomaly detection using machine learning to discover sensor tampering in iot systems,

A. K. Pathak, S. Saguna, K. Mitra, and C. ˚Ahlund, “Anomaly detection using machine learning to discover sensor tampering in iot systems,” in ICC 2021 - IEEE International Conference on Communications , 2021, pp. 1–6

work page 2021

[5] [5]

Anomaly behavior analysis for iot sensors,

J. Pacheco and S. Hariri, “Anomaly behavior analysis for iot sensors,” Transactions on Emerging Telecommunications Technologies , vol. 29, no. 4, p. e3188, 2018, e3188 ETT-16-0338.R1

work page 2018

[6] [6]

Hybrid anomaly detection model on trusted iot devices,

P. D. Rosero-Montalvo, Z. Istv ´an, P. T¨oz¨un, and W. Hernandez, “Hybrid anomaly detection model on trusted iot devices,”IEEE Internet of Things Journal, vol. 10, no. 12, pp. 10 959–10 969, 2023

work page 2023

[7] [7]

Data poisoning attacks on federated machine learning,

G. Sun, Y . Cong, J. Dong, Q. Wang, L. Lyu, and J. Liu, “Data poisoning attacks on federated machine learning,” IEEE Internet of Things Journal , vol. 9, no. 13, pp. 11 365–11 375, 2022

work page 2022

[8] [8]

Data poisoning attacks against machine learning algorithms,

F. A. Yerlikaya and S ¸erif Bahtiyar, “Data poisoning attacks against machine learning algorithms,” Expert Systems with Applications , vol. 208, p. 118101, 2022

2022