Pith. sign in

REVIEW 5 major objections 6 minor 65 references

FL-CLEANER: byzantine and backdoor defense by CLustering Errors of Activation maps in Non-iid fedErated leaRning

T0 review · 5 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FL-CLEANER filters both Byzantine and backdoor attackers in non-IID federated learning, achieving 100% recall on tested Byzantine attacks with under 1% benign misclassification.

desk verdict A solid non-IID FL defense with strong results on static Byzantine attacks, but the 'first defense' claim outruns the evidence, and the adaptive-attacker gap is real. read the letter →

arxiv 2501.12123 v2 pith:OLRNJLLP submitted 2025-01-21 cs.CR cs.AI

Mehdi Ben Ghali , Gouenou Coatrieux , Reda Bellafqira This is my paper · ORCID
classification cs.CRcs.AI
keywords non-IIDfederatedlearningByzantineattacksbackdoorconditionalvariationalautoencoderactivationmapstrustpropagationclusteringpoisoningdefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning is vulnerable to malicious clients who send poisoned updates, and existing defenses often assume that client data are identically distributed, which fails in realistic non-IID settings. This paper proposes FL-CLEANER, a server-side defense that detects both Byzantine and backdoor attackers by analyzing how well each client's updated model reconstructs the activation maps of a small server-held trigger set. The central claim is that this method is the first to achieve, in non-IID environments, 100% detection of all tested Byzantine attacks in every round while misclassifying fewer than 1% of benign clients, and to suppress state-of-the-art backdoor attacks to near-zero success without hurting main-task accuracy. If true, this would give federated learning deployments a practical filtering defense that works under the heterogeneous data conditions common in real applications.

What carries the argument

The central object is the reconstruction error of a client's activation maps under a class-conditioned CVAE that the server trains before federated training begins. Activation maps are normalized by subtracting the geometric median and applying a sigmoid, yielding normalized activation maps (NAMs); the CVAE learns the distribution of benign NAMs from a small trigger set (250 images for Byzantine attacks, 500 for backdoor attacks). A trust-propagation clustering algorithm takes the sorted client reconstruction errors, starts with the lowest-error client, and sequentially accepts clients whose error is within delta = lambda(max - min) of the last accepted client, stopping at the first gap larger than delta; this single parameter lambda is the only tuning knob, and the gap marks the frontier between benign and malicious clients.

What would settle it

Craft an adaptive Byzantine update whose activation maps fall inside the benign reconstruction-error range (for example by optimizing the update to minimize CVAE reconstruction error on the same trigger set), or measure reconstruction-error gaps across a broad non-IID population and find rounds where honest clients' error differences exceed delta; if the trusted cluster then captures an attacker or drops a benign client, the central claim is refuted.

Watch

Extended reading notes

Core claim

The paper claims that a conditional variational autoencoder (CVAE), trained on GeoMed-normalized activation maps of a server-side trigger set with KLD annealing and warmup epochs, produces reconstruction errors that separate benign clients from malicious ones in non-IID federated learning. A trust-propagation clustering algorithm then sorts clients by error and accepts a chain of clients until the first gap larger than a data-adaptive threshold, forming one benign cluster and flagging the rest as attackers. The paper reports that this scheme detects 100% of Byzantine attackers (sign-flipping, additive noise, same-value, and scaling attacks) in all tested scenarios on MNIST and FashionMNIST under two non-IID distributions, with zero false positives when attackers are present and under 1% benign misclassification when they are absent. It further reports that the defense reduces the success rate of distributed backdoor attacks and Neurotoxin to near zero while preserving test accuracy close to the no-attack baseline.

Load-bearing premise

The defense assumes that in the reconstruction-error space there is always a clear, ordered gap between benign and malicious clients' scores, so that the first jump larger than the dynamic step size cleanly separates the two groups; if attackers can close that gap, or if benign clients' errors vary more than the chain step, the filter will admit an attacker or reject a benign client.

Editorial extensions

If this is right

  • If the central claim holds, a federated server can filter all tested Byzantine attackers in every round under non-IID data, satisfying the requirement that no malicious update reaches aggregation.
  • The defense preserves benign client inclusion, avoiding the roughly 50% false-positive rate that mean-threshold CVAE defenses incur in IID and non-IID settings alike.
  • Backdoor attacks such as distributed backdoors and Neurotoxin can be neutralized to near-zero attacker success rate while keeping main-task accuracy close to the no-defense baseline.
  • The server needs only a small trigger set (250–500 images), making the defense feasible in settings where the server lacks a large auxiliary dataset.
  • The single dynamic parameter delta is interpretable, allowing deployment without per-round threshold tuning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The trust-propagation step is essentially a gap-statistic heuristic: its correctness depends on a persistent, ordered gap in reconstruction-error space, and an adaptive adversary that crafts updates whose activation maps reconstruct like benign ones could plausibly shrink or eliminate that gap; the paper does not evaluate such an adversary.
  • The method's reliance on a server-held trigger set means that if the trigger set's class distribution drifts from the client data distribution over time, benign reconstruction errors could widen and inflate the false-positive rate; this is an implicit risk the paper does not test.
  • A natural extension would be to test FL-CLEANER on label-flipping and model-replacement attacks where the attacker can optimize updates to be close to benign in activation space, or to apply the scoring mechanism to regression and non-image tasks by defining a suitable activation-map representation.
  • One testable improvement would be to replace the fixed delta = lambda(max-min) rule with a statistical gap test that adapts to the variance of benign errors, which could make the defense robust to broader non-IID distributions than the two considered.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. FL-CLEANER is a server-side defense for non-IID federated learning. In each round, the server extracts activation maps from each client's updated model on a small trigger set, GeoMed-normalizes them, and uses a conditionally trained variational autoencoder to assign each client a reconstruction error. A one-parameter 'trust propagation' algorithm then clusters clients by walking through the sorted errors and stopping at the first gap larger than delta = lambda(max - min); all clients beyond the gap are rejected before FedAvg aggregation. The paper evaluates this method on MNIST and FashionMNIST under two non-IID distributions (Dirichlet label skew and a custom two-class quantity skew), against four Byzantine attacks (sign-flipping, additive noise, same-value, scaling) and two backdoor attacks (DBA and Neurotoxin), comparing with FedCAM, FedCVAE, FLEDGE, FedGuard, FLAME, and FLDetector. The reported results are 100% Byzantine recall in all tested cells, 0% FPR in most cells, less than 1% benign misclassification in attack-free settings, and near-zero backdoor ASR with preserved accuracy.

Significance. The intended contribution is timely and practically relevant: non-IID data are the rule in real FL deployments, and prior CVAE-based defenses such as FedCAM are shown here to fail in that regime. The design choices--using GeoMed-normalized activation maps rather than raw weights, KLD annealing and warmup to stabilize CVAE training on a small server-side trigger set, and a threshold-free clustering rule with a single interpretable parameter--are sensible and are tested against several relevant baselines. The paper also states clear security requirements (R1-R3) and reports recall, FPR, and accuracy separately, which is good experimental hygiene. However, the contribution is empirical rather than formal: no code or proofs are provided, and the central claims rest on single unseeded runs against non-adaptive attackers. The absence of an adaptive adversary under the paper's own white-box threat model, together with the uncontrolled accuracy baseline and test-set overlap, currently prevents the 'first defense' claim from being accepted at full strength. These are addressable with additional experiments and clearer reporting rather than a change of approach.

major comments (5)
  1. [§3.1.2, §4.3, §5.4] The white-box threat model in §3.1.2 grants the adversary full knowledge of the aggregation method and the deployed defense, but no adaptive attacker is evaluated. The detection mechanism rests on the §4.3 assertion that 'in the reconstruction error space, there is an identifiable relative error gap' between benign and malicious NAMs, and Algorithm 1 accepts clients while sorted_re[i+1] ≤ sorted_re[i] + δ, with δ = λ(max - min). The attacks tested in §5.4 are static recipes with fixed parameters (ξ = 1, σ = 0.1, c = 0.01, a = 10). An adversary with the assumed knowledge can, in principle, craft updates whose normalized activation-map reconstruction errors stay inside the benign chain while still poisoning the global model. To support the 100%-recall and 'first defense' claims, please either provide a formal bound on the benign/malicious error gap under the stated assumptions, or evaluate an adaptive attack that optimizes a malicious update subject to a reconstruction-error constraint.
  2. [§5.4] The accuracy comparison for requirement R2 is confounded. The text says that FL-CLEANER experiments use only 70% of the training data because 30% of clients are attackers, whereas the no-defense/no-attack benchmark uses 100% of the data. The claim that FL-CLEANER 'matches benchmark accuracy' (e.g., 95.4% vs. 95.6% on MNIST) is therefore not a clean measure of whether the defense disrupts training. Please add a no-attack control with the identical 70/30 client split and the same sampling, or explicitly quantify the accuracy loss attributable to the defense independent of the data split.
  3. [§5.4, Figures 6-7, Tables 1-2] All reported values are single point estimates with no seeds, standard deviations, or confidence intervals. The paper's headline claims are exact--100% recall, 0% FPR, and less than 1% benign misclassification--and the pipeline contains multiple stochastic components (client sampling, local SGD, CVAE training, trigger-set selection). A single run cannot establish these rates. Report results over at least five seeds, including the worst-case and average recall and FPR per attack and per distribution.
  4. [§5.1.3, Tables 1-2] The trigger set is drawn from the test set, and accuracy and ASR are then measured on that same test set. This creates a form of test-set leakage: the CVAE is trained on the evaluation distribution, which can inflate both the reconstruction-error separation and the reported accuracy preservation. Please use an auxiliary public set disjoint from the evaluation set, or explicitly hold out the trigger-set samples from all reported test metrics and verify that the results are unchanged.
  5. [§5.3, Tables 1-2] The backdoor evaluation covers only the Dirichlet non-IID distribution; the custom two-class distribution is used only for Byzantine attacks. Since the abstract and conclusion claim robustness in non-IID environments generally, either add backdoor experiments under the second distribution or restrict the backdoor claim to the tested distribution. This is a scope issue, but it is load-bearing for the breadth of the central claim.
minor comments (6)
  1. [§4.2, §4.3, §2.1.2] Several typos remain, including 'as whown in in Fig. 3' (§4.2), 'Additionnally' (§4.2), 'mdoel' (§4.3), and 'udpates' (§2.1.2); please proofread the manuscript.
  2. [§5.1.2] The symbol α is used both for the Dirichlet concentration parameter and for the scale factor of the custom inverse-law distribution; rename one of them to avoid ambiguity.
  3. [§4.1] In step 2(b)(ii), the CVAE condition is written as 'Yt, the label'; this should be the trigger-set labels YT, not the round index.
  4. [§5.1.3] Please specify which layers are used for activation maps and how the maps are vectorized for the CVAE; the current description 'we use all the layers of the model' is under-specified for replication.
  5. [Figure 4] The histogram in Figure 4 should state which attack, layer, trigger-set size, and normalization are used to produce the benign and attacker error distributions; otherwise it is only illustrative.
  6. [§1.1] The sentence about FLEDGE--'It focuses on backdoor attacks but provides results against Byzantine attacks but only a fraction of their data is non-IID'--is grammatically broken and should be rewritten.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: FL-CLEANER's claims are empirical benchmark results; the only self-citation (FedCAM) is a baseline, not a proof input.

full rationale

FL-CLEANER does not present a derivation chain that could collapse into its inputs. Its central claims—100% Byzantine recall, <1% benign misclassification, and backdoor ASR suppression—are empirical results measured against external baselines (FLEDGE, FedCVAE, FedGuard, FLAME, FLDetector) on MNIST and FashionMNIST, not consequences of a theorem or of a fitted quantity renamed as a prediction. The reconstruction-error 'gap' in Section 4.3 is an explicitly empirical assumption ('in the reconstruction error space, there is an identifiable relative error gap between the two'), and Algorithm 1's delta = lambda(max-min) is a hyperparameter, not a derived output. The trigger set is sampled from the server test set, which is a possible evaluation-leakage concern, but it does not make the test accuracy or recall definitionally equal to the defense's scoring. The only self-citation is FedCAM [16], which supplies the GeoMed-normalized CVAE anomaly-detection starting point; FedCAM is reported as failing in non-IID settings, so the current non-IID results cannot be forced by that citation. Overall, no circular step is exhibited; the score reflects only the minor, non-load-bearing self-citation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on empirical premises about activation-map distributions and anomaly detection, plus several hand-set hyperparameters; no new entities are introduced. The paper does not derive a formal guarantee for the trust-propagation stop condition.

free parameters (5)
  • lambda (trust propagation width) = 0.3
    Controls delta = lambda(max-error - min-error) in Algorithm 1; fixed in Section 5.1.3 without sensitivity analysis, and the cluster frontier depends directly on it.
  • Trigger set size = 250 samples for Byzantine, 500 for backdoor
    Server auxiliary labeled dataset drawn from the test set (Section 5.1.3); the authors state experiments showed 250/500 suffice, so these are empirically chosen configuration values rather than derived requirements.
  • CV AE warmup epochs = 10
    Activation maps are collected after 10 warmup epochs of the server model copy; the value is chosen to avoid noisy early-training activations (Section 5.1.3).
  • KLD annealing schedule = beta0 = 0, +0.5 after 10 of 20 epochs
    The regularization weight for posterior collapse is annealed on a hand-set schedule (Sections 4.2 and 5.1.3); no ablation is reported.
  • Number of CV AE training epochs = 20
    Fixed in Section 5.1.3; no ablation is reported.
assumptions (5)
  • domain assumption Activation maps of malicious model updates are out-of-distribution relative to benign updates and yield high CV AE reconstruction errors.
    Central detection premise, stated in Section 4.1: 'We assume that NAMs obtained with malicious model updates will correspond to outliers'. No proof or attack-adaptive analysis is given.
  • domain assumption There is an identifiable relative error gap between benign and malicious reconstruction-error scores.
    Section 4.3, used to justify the stop condition in Algorithm 1; the gap is assumed to be monotone along the sorted error list.
  • domain assumption The server has access to a small labeled trigger set from the test distribution and can train a model copy on it.
    Section 4.1 and Section 5.1.3 use 250 to 500 test-set samples; if the server lacks such data or the samples are not representative of benign clients, the CV AE is not calibrated.
  • domain assumption The attacker knows the defense but cannot modify its parameters and has no access to benign clients' updates.
    Threat model in Section 3.1.2 follows Shannon's maxim but excludes adaptive attackers who tune their updates to minimize reconstruction error.
  • domain assumption Out-of-distribution inputs produce higher CV AE reconstruction errors.
    Section 2.2 relies on this property of autoencoders; it is standard empirical ML knowledge, not a theorem.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FL-CLEANER: byzantine and backdoor defense by CLustering Errors of Activation maps in Non-iid fedErated leaRning." pith.science (2026). https://pith.science/paper/OLRNJLLP

@misc{pith2026250112123,
  author       = {Pith},
  title        = {Pith review of: FL-CLEANER: byzantine and backdoor defense by CLustering Errors of Activation maps in Non-iid fedErated leaRning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OLRNJLLP}},
  note         = {Machine review of arXiv:2501.12123}
}
read the original abstract

Federated Learning (FL) enables clients to collaboratively train a global model using their local datasets while reinforcing data privacy, but it is prone to poisoning attacks. Existing defense mechanisms assume that clients' data are independent and identically distributed (IID), making them ineffective in real-world applications where data are non-IID. This paper presents FL-CLEANER, the first defense capable of filtering both byzantine and backdoor attackers' model updates in a non-IID FL environment. The originality of FL-CLEANER is twofold. First, it relies on a client confidence score derived from the reconstruction errors of each client's model activation maps for a given trigger set, with reconstruction errors obtained by means of a Conditional Variational Autoencoder trained according to a novel server-side strategy. Second, it uses an original ad-hoc trust propagation algorithm we propose. Based on previous client scores, it allows building a cluster of benign clients while flagging potential attackers. Experimental results on the datasets MNIST and FashionMNIST demonstrate the efficiency of FL-CLEANER against Byzantine attackers as well as to some state-of-the-art backdoors in non-IID scenarios; it achieves a close-to-zero (<1%) benign client misclassification rate, even in the absence of an attack, and achieves strong performance compared to state of the art defenses.

Figures

Figures reproduced from arXiv: 2501.12123 by the authors.

Figure 1
Figure 1. A common online FL scenario with a central server [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Architecture of a Conditional Variational Autoencoder (CVAE), where [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Construction of the CVAE training set. 4.2 CVAE training As stated above, the CVAE model is trained by the server S considering a simulated benign model M ′ 0 G based on the server trigger set Ts. In this work we assume that Ts is of very small size compared to the client data. This ensures the real-life applicability of our solution as servers may not have access to the large datasets other methods in literature re… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Histogram of reconstruction error values measured for benign clients and attackers performing a Sign Flipping [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Examples of our Non-IID distributions of the MNIST training samples in a scenario with 20 total clients. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Defense Results on MNIST considering two non-IID distributions against Byzantine attacks: Additive noise, [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Defense Results on FashionMNIST considering two non-IID distributions against Byzantine attacks: Additive [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Backdoor Attacker Success rates on MNIST [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

65 extracted references · 44 canonical work pages

  1. [1]

    Federated learning for diabetic retinopathy detection 14 FL-CLEANER: byzantine and backdoor defense in Non-iid federated learning in a multi-center fundus screening network

    Sarah Matta, Mariem Ben Hassine, Clément Lecat, Laurent Borderie, Alexandre Le Guilcher, Pascale Massin, Béatrice Cochener, Mathieu Lamard, and Gwenolé Quellec. Federated learning for diabetic retinopathy detection 14 FL-CLEANER: byzantine and backdoor defense in Non-iid federated learning in a multi-center fundus screening network. In2023 45th Annual Int...

    work page 2023

  2. [2]

    Emerging trends in federated learning: From model fusion to federated x learning

    Shaoxiong Ji, Yue Tan, Teemu Saravirta, Zhiqin Yang, Yixin Liu, Lauri Vasankari, Shirui Pan, Guodong Long, and Anwar Walid. Emerging trends in federated learning: From model fusion to federated x learning. International Journal of Machine Learning and Cybernetics, pages 1–22, 2024

    work page 2024

  3. [3]

    Federated learning for medical image analysis: A survey

    Hao Guan, Pew-Thian Yap, Andrea Bozoki, and Mingxia Liu. Federated learning for medical image analysis: A survey. Pattern Recognition, page 110424, 2024

    work page 2024

  4. [4]

    When federated learning meets watermarking: A comprehensive overview of techniques for intellectual property protection

    Mohammed Lansari, Reda Bellafqira, Katarzyna Kapusta, Vincent Thouvenot, Olivier Bettan, and Gouenou Coatrieux. When federated learning meets watermarking: A comprehensive overview of techniques for intellectual property protection. Machine Learning and Knowledge Extraction, 5(4):1382–1406, 2023

    work page 2023

  5. [5]

    Federated learning for mobile keyboard prediction, 2018

    Andrew Hard, Chloé M Kiddon, Daniel Ramage, Francoise Beaufays, Hubert Eichner, Kanishka Rao, Rajiv Mathews, and Sean Augenstein. Federated learning for mobile keyboard prediction, 2018

    work page 2018

  6. [6]

    Federated learning of deep networks using model averaging

    H Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas. Federated learning of deep networks using model averaging. arXiv preprint arXiv:1602.05629, 2:2, 2016

    arXiv 2016

  7. [7]

    Poisoning attacks in federated learning: A survey

    Geming Xia, Jian Chen, Chaodong Yu, and Jun Ma. Poisoning attacks in federated learning: A survey. IEEE Access, 11:10708–10722, 2023

    work page 2023

  8. [8]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics , pages 1273–1282. PMLR, 2017

    2017

Show all 65 references
  1. [9]

    Byzantine-tolerant machine learning

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Byzantine-tolerant machine learning. arXiv preprint arXiv:1703.02757, 2017

    2017 arXiv

  2. [10]

    The hidden vulnerability of distributed learning in byzantium

    Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pages 3521–3530. PMLR, 2018

    2018

  3. [11]

    Federated learning attacks and defenses: A survey, 2022

    Yao Chen, Yijie Gui, Hong Lin, Wensheng Gan, and Yongdong Wu. Federated learning attacks and defenses: A survey, 2022

    2022

  4. [12]

    Detecting malicious model updates from federated learning on conditional variational autoencoder

    Zhipin Gu and Yuexiang Yang. Detecting malicious model updates from federated learning on conditional variational autoencoder. In 2021 IEEE international parallel and distributed processing symposium , pages 671–680. IEEE, 2021

    2021

  5. [13]

    Fedguard: Selective parameter aggregation for poisoning attack mitigation in federated learning

    Melvin Chelli, Cédric Prigent, René Schubotz, Alexandru Costan, Gabriel Antoniu, Loïc Cudennec, and Philipp Slusallek. Fedguard: Selective parameter aggregation for poisoning attack mitigation in federated learning. In IEEE Cluster 2023-IEEE International Conference on Cluster...

    2023

  6. [14]

    FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks, October 2023

    Jorge Castillo, Phillip Rieger, Hossein Fereidooni, Qian Chen, and Ahmad Sadeghi. FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks, October 2023. arXiv:2310.02113 [cs]

    2023 arXiv

  7. [15]

    DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection

    Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi. DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection. In Proceedings 2022 Network and Distributed System Security Symposium, 2022. arXiv:2201.00763 [cs]

    2022 arXiv

  8. [16]

    FedCAM - Identifying Malicious Models in Federated Learning Environments Conditionally to Their Activation Maps

    Reda Bellafqira, Gouenou Coatrieux, Mohammed Lansari, and Jilo Chala. FedCAM - Identifying Malicious Models in Federated Learning Environments Conditionally to Their Activation Maps. In 2024 19th Wireless On-Demand Network Systems and Services Conference (WONS), pages 49–56, C...

    2024

  9. [17]

    Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneity, October 2023

    Youssef Allouah, Rachid Guerraoui, Nirupam Gupta, Rafaël Pinot, and Geovani Rizk. Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneity, October 2023. arXiv:2309.13591 [cs, math]

    2023 arXiv

  10. [18]

    Network- level adversaries in federated learning, 2022

    Giorgio Severi, Matthew Jagielski, Gökberk Yar, Yuxuan Wang, Alina Oprea, and Cristina Nita-Rotaru. Network- level adversaries in federated learning, 2022

    2022

  11. [19]

    Federated optimization in heterogeneous networks

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020

    2020

  12. [20]

    Scaffold: Stochastic controlled averaging for federated learning

    Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning, pages 5132–5143. PMLR, 2020

    2020

  13. [21]

    Federated learning based on dynamic regularization

    Durmus Alp Emre Acar, Yue Zhao, Ramon Matas Navarro, Matthew Mattina, Paul N Whatmough, and Venkatesh Saligrama. Federated learning based on dynamic regularization. arXiv preprint arXiv:2111.04263, 2021. 15 FL-CLEANER: byzantine and backdoor defense in Non-iid federated learning

    2021 arXiv

  14. [22]

    Feddc: Federated learning with non-iid data via local drift decoupling and correction

    Liang Gao, Huazhu Fu, Li Li, Yingwen Chen, Ming Xu, and Cheng-Zhong Xu. Feddc: Federated learning with non-iid data via local drift decoupling and correction. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10112–10121, 2022

    2022

  15. [23]

    Learning to detect malicious clients for robust federated learning

    Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. Learning to detect malicious clients for robust federated learning. arXiv preprint arXiv:2002.00211, 2020

    2002 arXiv

  16. [24]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, and Vitaly Shmatikov. Membership inference attacks against machine learning models. CoRR, abs/1610.05820, 2016

    2016 arXiv

  17. [25]

    Detection of malicious clients in federated learning using graph neural network

    Anee Sharma and Ningrinla Marchang. Detection of malicious clients in federated learning using graph neural network. IEEE Access, PP:1–1, 01 2025

    2025

  18. [26]

    Pham, Khoa D

    Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H. Pham, Khoa D. Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions. Engineering Applications of Artificial Intelligence, 127:107166, 2024

    2024

  19. [27]

    Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. Mitigating sybils in federated learning poisoning, 2020

    2020

  20. [28]

    FLAME: Taming backdoors in federated learning

    Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, and Thomas Schneider. FLAME: Taming backdoors in federated learning. ...

    2022

  21. [29]

    Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients, 2022

    Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients, 2022

    2022

  22. [30]

    Mitigating backdoor attacks in federated learning, 2021

    Chen Wu, Xian Yang, Sencun Zhu, and Prasenjit Mitra. Mitigating backdoor attacks in federated learning, 2021

    2021

  23. [31]

    Federated unlearning with knowledge distillation, 2022

    Chen Wu, Sencun Zhu, and Prasenjit Mitra. Federated unlearning with knowledge distillation, 2022

    2022

  24. [32]

    Advances and open problems in federated learning

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and Trends® in Machine Learning, 14(1–...

    2021

  25. [34]

    Secure extraction of personal information from ehr by federated machine learning

    Mohamed El Azzouzi, Reda Bellafqira, Gouenou Coatrieux, Marc Cuggia, and Guillaume Bouzille. Secure extraction of personal information from ehr by federated machine learning. In Digital Health and Informatics Innovations for Sustainable Health Care Systems, pages 611–615. IOS ...

    2024

  26. [35]

    Yuen, and Dacheng Tao

    Mang Ye, Xiuwen Fang, Bo Du, Pong C. Yuen, and Dacheng Tao. Heterogeneous federated learning: State-of-the- art and research challenges, 2023

    2023

  27. [36]

    Federated learning with non-iid data

    Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint arXiv:1806.00582, 2018

    2018 arXiv

  28. [37]

    Badsfl: Backdoor attack against scaffold federated learning, 2024

    Xingshuo Han, Xuanye Zhang, Xiang Lan, Haozhao Wang, Shengmin Xu, Shen Ren, Jason Zeng, Ming Wu, Michael Heinrich, and Tianwei Zhang. Badsfl: Backdoor attack against scaffold federated learning, 2024

    2024

  29. [38]

    Technical report: Assisting backdoor federated learning with whole population knowledge alignment, 2022

    Tian Liu, Xueyang Hu, and Tao Shu. Technical report: Assisting backdoor federated learning with whole population knowledge alignment, 2022

    2022

  30. [39]

    Hinton and R.R

    G.E. Hinton and R.R. Salakhutdinov. Reducing the dimensionality of data with neural networks. Science (New York, N.Y.), 313:504–7, 08 2006

    2006

  31. [40]

    Autoen- coders for dimensionality reduction in molecular dynamics: Collective variable dimension, biasing, and transition states

    Zineb Belkacemi, Marc Bianciotto, Hervé Minoux, Tony Lelièvre, Gabriel Stoltz, and Paraskevi Gkeka. Autoen- coders for dimensionality reduction in molecular dynamics: Collective variable dimension, biasing, and transition states. The Journal of Chemical Physics, 159(2), July 2023

    2023

  32. [41]

    Bengio, and Pascal Vincent

    Dumitru Erhan, Aaron Courville, Y . Bengio, and Pascal Vincent. Why does unsupervised pre-training help deep learning? Journal of Machine Learning Research - Proceedings Track, 9:201–208, 01 2010

    2010

  33. [42]

    Bengio, Pascal Lamblin, Dan Popovici, and Hugo Larochelle

    Y . Bengio, Pascal Lamblin, Dan Popovici, and Hugo Larochelle. Greedy layer-wise training of deep networks. Adv. Neural Inf. Process. Syst., 19:153–160, 01 2007

    2007

  34. [43]

    Attribute2image: Conditional image generation from visual attributes, 2016

    Xinchen Yan, Jimei Yang, Kihyuk Sohn, and Honglak Lee. Attribute2image: Conditional image generation from visual attributes, 2016

    2016

  35. [44]

    Deep learning for anomaly detection: A review

    Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR), 54(2):1–38, 2021

    2021

  36. [45]

    Auto-encoding variational bayes

    Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013. 16 FL-CLEANER: byzantine and backdoor defense in Non-iid federated learning

    2013 arXiv

  37. [46]

    Tutorial on variational autoencoders

    Carl Doersch. Tutorial on variational autoencoders. arXiv preprint arXiv:1606.05908, 2016

    2016 arXiv

  38. [47]

    Anomaly detection with conditional variational autoencoders

    Adrian Alan Pol, Victor Berger, Cecile Germain, Gianluca Cerminara, and Maurizio Pierini. Anomaly detection with conditional variational autoencoders. In 2019 18th IEEE international conference on machine learning and applications (ICMLA), pages 1651–1657. IEEE, 2019

    2019

  39. [48]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent

    Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1(2):1–25, 2017

    2017

  40. [49]

    Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra

    Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In 2017 IEEE International Conference on Computer Vision (ICCV), pages 618–626, 2017

    2017

  41. [50]

    Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks

    Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Opera...

    2019

  42. [51]

    Diction: Dynamic robust white box watermarking scheme

    Reda Bellafqira and Gouenou Coatrieux. Diction: Dynamic robust white box watermarking scheme. arXiv preprint arXiv:2210.15745, 2022

    2022 arXiv

  43. [52]

    A high-load dnn watermarking scheme based on optimal embedding position

    Mingyang Zheng and Junling Ren. A high-load dnn watermarking scheme based on optimal embedding position. In 2024 5th International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE), pages 382–387. IEEE, 2024

    2024

  44. [53]

    Patel, Tan Nguyen, and Richard G

    Ankit B. Patel, Tan Nguyen, and Richard G. Baraniuk. A probabilistic theory of deep learning, 2015

    2015

  45. [54]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on artificial intelligence and statistics, pages 2938–2948. PMLR, 2020

    2020

  46. [55]

    Local model poisoning attacks to {Byzantine-Robust} federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to {Byzantine-Robust} federated learning. In 29th USENIX security symposium (USENIX Security 20), pages 1605–1622, 2020

    2020

  47. [56]

    beta-V AE: Learning basic visual concepts with a constrained variational framework

    Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-V AE: Learning basic visual concepts with a constrained variational framework. In International Conference on Learning Representations, 2017

    2017

  48. [57]

    Bowman, Luke Vilnis, Oriol Vinyals, Andrew M

    Samuel R. Bowman, Luke Vilnis, Oriol Vinyals, Andrew M. Dai, Rafal Jozefowicz, and Samy Bengio. Generating Sentences from a Continuous Space, May 2016. arXiv:1511.06349 [cs]

    2016 arXiv

  49. [58]

    Beyond vanilla variational autoencoders: Detecting posterior collapse in conditional and hierarchical variational autoencoders, 2024

    Hien Dang, Tho Tran, Tan Nguyen, and Nhat Ho. Beyond vanilla variational autoencoders: Detecting posterior collapse in conditional and hierarchical variational autoencoders, 2024

    2024

  50. [59]

    A comprehensive survey of clustering algorithms: State-of-the-art machine learning applications, tax- onomy, challenges, and future research prospects

    Absalom Ezugwu, Abiodun Ikotun, Oyelade Olaide, Laith Abualigah, Ovre Agushaka, Christopher Eke, and Ayo Akinyelu. A comprehensive survey of clustering algorithms: State-of-the-art machine learning applications, tax- onomy, challenges, and future research prospects. Engineerin...

    2022

  51. [60]

    The mnist database of handwritten digit images for machine learning research

    Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141–142, 2012

    2012

  52. [61]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    2017

  53. [62]

    Measuring the effects of non-identical data distribution for federated visual classification, 2019

    Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classification, 2019

    2019

  54. [63]

    Bayesian nonparametric federated learning of neural networks, 2019

    Mikhail Yurochkin, Mayank Agarwal, Soumya Ghosh, Kristjan Greenewald, Trong Nghia Hoang, and Yasaman Khazaeni. Bayesian nonparametric federated learning of neural networks, 2019

    2019

  55. [64]

    Distributed backdoor attacks on federated graph learning and certified defenses, 2024

    Yuxin Yang, Qiang Li, Jinyuan Jia, Yuan Hong, and Binghui Wang. Distributed backdoor attacks on federated graph learning and certified defenses, 2024

    2024

  56. [65]

    Mahoney, Joseph E

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael W. Mahoney, Joseph E. Gonzalez, Kannan Ramchandran, and Prateek Mittal. Neurotoxin: Durable backdoors in federated learning, 2022

    2022

  57. [66]

    Pham, Khoa Doan, and Kok-Seng Wong

    Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H. Pham, Khoa Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions, 2023. 17

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.