Pith. sign in

REVIEW 4 major objections 6 minor 54 references

TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Federated learning backdoors can be neutralized without detecting malicious clients, by continually re-activating dormant neurons with out-of-distribution data.

desk verdict A genuinely new detection-free FL backdoor defense with strong experiments, but the flood-data quality dependence is real and should be central to the revision. read the letter →

arxiv 2504.15674 v1 pith:UUIT44SC submitted 2025-04-22 cs.CR cs.LG

Yanbo Dai , Songze Li , Zihan Gan , Xueluan Gong This is my paper · ORCID
classification cs.CRcs.LG
keywords federatedlearningbackdoorattackdefenseout-of-distributiondataredundantneuronsproactiverobustificationdetection-freeTrojanDam
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks in federated learning succeed because the neurons that carry the backdoor are rarely touched by ordinary training, so malicious updates can slip through aggregation without conflicting with benign ones. This paper argues that the fix is to make those dormant neurons active by having the server continuously train the global model on out-of-distribution data, a mechanism it calls TrojanDam. Each round, the server injects fresh OOD mappings into a small set of key convolution kernels, so that backdoor updates now collide with benign updates during aggregation and their effect is canceled. The defense never inspects or filters client updates, which matters for stealthy adversaries whose poisoned updates are statistically close to benign ones. If it holds, it gives FL servers a detection-free route to resisting long-term backdoor injection while keeping main-task accuracy close to its original level.

What carries the argument

The load-bearing object is the redundant neuron: a unit, or in this paper a convolution kernel, that benign training leaves almost untouched and that therefore offers a conflict-free place for backdoor features to land. TrojanDam's mechanism has three parts. A flood dataset is built from OOD images plus fresh random noise masks and random labels, refreshed every round to keep the model learning new mappings. A shadow dataset is built from OOD images labeled by the current global model's own predictions, which the paper shows cluster with genuine main-task features, so it substitutes for the client data the server never sees. An identification step ranks convolution kernels by the difference between gradients computed on flood-plus-shadow data and gradients on shadow data alone, and the server updates only the top $\epsilon$ fraction of those kernels, regularized toward the current global model, with batch-normalization statistics restored afterward. These projected OOD-mapping updates are what activate redundant neurons, and norm clipping at aggregation then lets the benign updates cancel the backdoor.

What would settle it

Run the CIFAR10 blended-backdoor Neurotoxin setting used in the paper's Table V but with the key-kernel selection replaced by a random selection of the same fraction of kernels; if backdoor accuracy stays near random-guess, then the paper's claim that identifying and robustifying the most backdoor-relevant redundant neurons is what cancels the attack would be falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that the durability of backdoors in federated learning comes from a lack of conflict: adversarial updates that exploit redundant neurons do not interfere with benign updates because those neurons are almost never updated by the main task. TrojanDam reverses this by robustifying the redundant neurons before each round of local training, using a mixture of two OOD datasets: flood data, which are OOD samples with fresh random noise masks and random labels from the main task's label space, and shadow data, which are OOD samples labeled by the current global model's predictions to stand in for the missing main-task data. The server computes gradients on this mixture and projects them onto the top fraction of convolution kernels ranked by their OOD sensitivity, then broadcasts the robustified model. The paper reports that across CIFAR10, CIFAR100 and EMNIST with several architectures, this continuous activation brings mean backdoor accuracy down to near random-guess levels for long-lasting attacks that defeat detection-based defenses.

Load-bearing premise

The decisive assumption is that the server can obtain out-of-distribution images with enough visual structure that repeatedly training the key kernels on them genuinely activates redundant neurons; when the OOD source is feature-poor, such as EMNIST or pure noise, backdoor accuracy climbs back to 55-72 percent.

Editorial extensions

If this is right

  • Long-term backdoor injection (600+ rounds) can be held near random-guess accuracy (roughly 10-30 percent BA in the evaluated settings) without any client-level detection.
  • The defense is robust across model architectures (VGG16, ResNet18, ResNet34), datasets (CIFAR10, CIFAR100, EMNIST), attack types (blended, semantic, edge-case, TaCT), training algorithms (PGD, Neurotoxin, Chameleon), and collaborative attacks (DBA).
  • Main-task accuracy decreases only mildly (about 1.5-3.5 percent in the reported flood-size study), and the drop can be tuned by the size of the flood dataset and the key-kernel ratio.
  • The source of OOD data is decisive: rich visual sources keep BA near 22-28 percent, while feature-poor sources (EMNIST, noise) push BA to 55-72 percent, showing the defense's practical reliance on auxiliary data quality.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same redundant-neuron activation idea could be applied in centralized training as a general poison-robustness regularizer, periodically 'waking up' dormant units with OOD-like augmentations rather than only defending against backdoors in FL.
  • Because the mechanism depends on overparameterization, its effectiveness should shrink as models are compressed or pruned; testing on pruned or narrower networks would delimit the regime where the defense applies.
  • The shadow-data labeling technique, which uses the global model's own predictions on OOD samples to imitate the main-task distribution, is a reusable trick for server-side tasks that need a data proxy without seeing client data.
  • A natural next test is whether an adaptive adversary can align its backdoor updates with the OOD mappings during the server's robustification step, effectively 'hiding' the backdoor inside the activated neurons; the paper does not evaluate that alignment attack.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper proposes TrojanDam, a server-side backdoor defense for federated learning that avoids detecting or filtering malicious client updates. Instead, the server proactively modifies the global model before each broadcast: it constructs a 'flood' dataset of OOD samples with random labels and noise masks and a 'shadow' dataset of OOD samples labeled by the current global model, selects a small fraction of convolution kernels and batch-normalization parameters as 'key kernels' using a gradient-difference heuristic, and performs several projected-gradient steps on those parameters with a regularization penalty. The authors argue that this activates redundant neurons so that backdoor updates no longer have a silent region in which to accumulate. The paper supports this with experiments on CIFAR10, CIFAR100, and EMNIST across multiple attack types (PGD, Neurotoxin, Chameleon, CerP, PFedBA, DBA) and compares against eight existing defenses, reporting that TrojanDam keeps backdoor accuracy near the random-guess level in most evaluated settings without substantially degrading main-task accuracy.

Significance. The paper introduces a genuinely different defense paradigm—proactive robustification instead of post-hoc detection—and the empirical coverage is unusually broad: nine baselines, five attack training algorithms, four backdoor types, three datasets, and three model architectures, with code released. The key mechanism is falsifiable: the authors' Table V demonstrates that the defense's effectiveness collapses when the flood dataset lacks visual richness, which is exactly the kind of conditional dependence a reader needs to see. If the mechanism were backed by a formal statement about when OOD mappings activate redundant neurons, and if the main comparison tables carried multiple-seed statistics, the contribution would be a strong candidate for a security venue. At present the evidence is suggestive but not conclusive: the central claim is contingent on data-quality assumptions, the defense onset is tuned to the attack schedule, and the abstract's 'prove' language is not supported by a proof.

major comments (4)
  1. [§IV-C, Table V] The defense's central claim is conditional on the visual richness of the flood dataset, and the paper does not state this condition in the threat model. In Table V, replacing the default flood source (CIFAR100) with EMNIST raises backdoor accuracy to 64.97%–72.11%, and using random noise yields 55.65%–63.31%, even when the shadow source is the same. The threat model in §III-A only requires that the server 'could collect a number of OOD samples from the public dataset' with a disjoint label space, which is satisfied by EMNIST and by random noise. The advertised property that backdoor accuracy stays near random guess without detecting malicious clients is therefore not a property of the aggregation mechanism alone; it holds only when a sufficiently rich auxiliary dataset is available. This should be elevated to an explicit assumption with a quantifiable criterion, or the central claim must be weakened.
  2. [§IV-A, TrojanDam settings] The server begins injecting OOD mappings at global round 400, exactly 30 rounds before the attack onset at round 430, with the justification that earlier rounds produce large benign updates. Under the stated threat model, the adversary 'could continuously participate in the FL training process starting from any global round' (§III-A), so the defense must be robust to attack starts that precede the chosen onset. No experiment varies the defense start round or considers an attack that begins at round 0. Without such an ablation, the reported near-random-guess backdoor accuracy cannot be separated from the favorable timing choice. This is a load-bearing gap for the claim of effective defense against continuous, long-term injection.
  3. [Abstract and §III-C] The abstract states that the authors 'prove the feasibility of activating redundant neurons utilizing out-of-distribution (OOD) samples in centralized settings,' but the evidence provided is an empirical gradient histogram (Figure 4) and a number-of-active-neurons plot (Figure 5). No formal statement, theorem, or proof appears anywhere in the manuscript. Either a precise mathematical statement that can be checked must be added, or the wording should be changed to 'demonstrate empirically.' This matters because the entire method rests on the claim that mixing OOD and main-task data activates redundant neurons; an unproven assertion in the abstract overstates the result.
  4. [Tables I–IV vs. V–IX] The headline comparison tables (Tables I–IV) report a single run per configuration, with no standard deviations or seed counts, while the hyperparameter analysis (Tables V–IX) reports mean±std. Given the high variance typical of backdoor benchmarks (e.g., Table V reports standard deviations of 2–4 percentage points), the claimed margins over the second-best defense in Tables I and II cannot be assessed for statistical significance. The paper should report at least three seeds with error bars for the main comparisons, or explicitly state that the headline tables are single-seed illustrative results.
minor comments (6)
  1. [§I] There are typos: 'exitsing' should be 'existing', and 'SOAT' should be 'SOTA'.
  2. [Figure 1] The two panels are labeled UPPER and LOWER, but the axes and legend do not make it immediately clear whether the orange line shows backdoor accuracy or detection percentage; add a legend entry for each line.
  3. [§III-E, Algorithm 1] The shadow dataset labels are assigned using the current global model's predictions on OOD samples; since the paper itself notes these predictions are overconfident, a sentence on sensitivity to model calibration in early training rounds would help.
  4. [Table II] The backdoor type is spelled 'TacT' in the table but 'TaCT' in the text and elsewhere; make the spelling consistent.
  5. [§V, Table IX] The abbreviation 'NCD' is used in the table but is not defined at first use; the text refers to 'norm-clipping component' earlier, so define NCD explicitly before Table IX.
  6. [Figure 5] The lower panel caption says '300 flood samples' but the figure shows several dataset sizes; clarify which curves correspond to which sizes in the legend.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the defense is evaluated on externally constructed backdoor attacks; the one self-citation to [31] supplies motivation, not a fitted prediction.

full rationale

The paper's central claim is that server-side OOD flood mappings robustify redundant neurons and suppress backdoor accuracy. This is not derived from its inputs by construction: Algorithm 1 performs standard gradient computation, projection onto selected kernels, and FedAvg-style aggregation, and the reported backdoor accuracy is measured on independently constructed attack tasks (PGD, Neurotoxin, Chameleon, CerP, PFedBA, DBA), not computed from the flood-data fit. The key design premise, that backdoor samples behave as OOD samples, is cited to the authors' own BackdoorIndicator paper ([31], Section III-C: 'The idea of activating redundant neurons utilizing OOD data is motivated by the recently revealed property of backdoor tasks[31]...'). This is a self-citation, but it functions as motivation for choosing OOD flood data rather than as the proof of the defense; the empirical evaluation is self-contained against external attack benchmarks. The observed sensitivity to flood-data quality (Table V, where EMNIST or random-noise flood data raises BA to 55-72%) is a genuine robustness limitation and a correctness risk, but it is an empirical contingency, not a circularity. The abstract's phrase 'prove the feasibility' overstates the gradient-histogram evidence in Section III-C, which is empirical rather than a formal proof; this is a rigor concern, not a circularity. No equation in the paper equates the defense output to its input, and no fitted parameter is renamed as a prediction. Overall, no significant circularity; only one minor self-citation is present.

Assumptions & free parameters 6 free parameters · 4 assumptions · 2 invented entities

The central claim rests on several empirical premises about redundant neurons, the OOD nature of backdoors, and ReLU overconfidence, as well as on hand-set hyperparameters. The defense's sensitivity to OOD source (Table V) and to the attack schedule is a key fragility.

free parameters (6)
  • flood_dataset_size = 800 (default)
    Controls defense effectiveness and main task accuracy; Table VI shows 200 to 800 samples strongly change effective length and MA.
  • shadow_dataset_size = 300 (default)
    Used to identify key kernels; no sensitivity analysis is reported for this value.
  • key_kernel_ratio_epsilon = 0.15 (default)
    Table VII shows non-monotonic effect; 0.15 is best with 400 flood samples, while 0.25 performs better with 800 samples.
  • regularization_weight_lambda = 0.8
    Controls deviation from the original global model; no sensitivity analysis is provided.
  • server_start_round = 400 (30 rounds before known attack onset at 430)
    Chosen based on the known attack schedule; the authors explicitly state they did not start earlier because backdoor effects are weak then.
  • server_training_iterations_E_and_learning_rate_eta = not reported
    Algorithm 1 takes these as inputs, but the paper never specifies their values, which hurts exact reproducibility.
assumptions (4)
  • domain assumption Deep networks contain redundant neurons that are rarely updated by benign training.
    Invoked in Section III-B to explain why backdoors can be planted without conflict; supported by citations [10], [21], [46], [26].
  • domain assumption Backdoor samples are essentially OOD samples with respect to benign samples of the target class.
    Motivates the use of flood data; cited to the authors' own BackdoorIndicator paper [31] in Section III-C.
  • domain assumption ReLU networks make overconfident predictions on OOD samples, so model-assigned labels of shadow data approximate main-task labels.
    Used in Section III-E for constructing the shadow dataset; relies on the property from [23] and Figure 6.
  • domain assumption The defender can collect OOD samples with a label space disjoint from the main task.
    Stated in the threat model in Section III-A; necessary for constructing flood and shadow datasets.
invented entities (2)
  • Flood data independent evidence
    purpose: OOD samples with random noise masks and random labels, injected into the global model each round to activate redundant neurons.
    Empirically validated in Figures 4 and 5 and Tables V-VII; effectiveness depends on the visual richness of the source.
  • Shadow data independent evidence
    purpose: OOD samples labeled by the current global model's predictions, used as a substitute for main-task data during key-kernel identification.
    Supported by the feature-space visualization in Figure 6 and by the empirical performance of TrojanDam.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data." pith.science (2026). https://pith.science/paper/UUIT44SC

@misc{pith2026250415674,
  author       = {Pith},
  title        = {Pith review of: TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UUIT44SC}},
  note         = {Machine review of arXiv:2504.15674}
}
read the original abstract

Federated learning (FL) systems allow decentralized data-owning clients to jointly train a global model through uploading their locally trained updates to a centralized server. The property of decentralization enables adversaries to craft carefully designed backdoor updates to make the global model misclassify only when encountering adversary-chosen triggers. Existing defense mechanisms mainly rely on post-training detection after receiving updates. These methods either fail to identify updates which are deliberately fabricated statistically close to benign ones, or show inconsistent performance in different FL training stages. The effect of unfiltered backdoor updates will accumulate in the global model, and eventually become functional. Given the difficulty of ruling out every backdoor update, we propose a backdoor defense paradigm, which focuses on proactive robustification on the global model against potential backdoor attacks. We first reveal that the successful launching of backdoor attacks in FL stems from the lack of conflict between malicious and benign updates on redundant neurons of ML models. We proceed to prove the feasibility of activating redundant neurons utilizing out-of-distribution (OOD) samples in centralized settings, and migrating to FL settings to propose a novel backdoor defense mechanism, TrojanDam. The proposed mechanism has the FL server continuously inject fresh OOD mappings into the global model to activate redundant neurons, canceling the effect of backdoor updates during aggregation. We conduct systematic and extensive experiments to illustrate the superior performance of TrojanDam, over several SOTA backdoor defense methods across a wide range of FL settings.

Figures

Figures reproduced from arXiv: 2504.15674 by the authors.

Figure 2
Figure 2. The overview of FL systems with TrojanDam. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Accuracies of FL global model on the main task and the [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. The magnitude distribution of model gradients which [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: The number of neurons with gradients larger than [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Feature space visualization of the shadow and in [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: BA (MA) achieved by the injection of (UPPER) semantic backdoors trained using Neurotoxin, (MIDDLE) blended backdoors trained using Chameleon, and (LOWER) optimized trigger using PFedBA under various backdoor de￾fense mechanisms. indicator tasks embedded by the server, …
Figure 8
Figure 8. Figure 8: Backdoor accuracy and the percentage of detected [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 36 canonical work pages

  1. [1]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics , pages 2938–2948. PMLR, 2020

    2020

  2. [2]

    Analyzing federated learning through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning, pages 634–643. PMLR, 2019

    work page 2019

  3. [3]

    Machine learning with adversaries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems , 30, 2017

    work page 2017

  4. [4]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995, 2020

    arXiv 2012

  5. [5]

    Provably secure federated learning against malicious clients

    Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 6885–6893, 2021

    work page 2021

  6. [6]

    Tar- geted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Tar- geted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017

    arXiv 2017

  7. [7]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent

    Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems , 1(2):1–25, 2017

    work page 2017

  8. [8]

    Emnist: Extending mnist to handwritten letters

    Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (IJCNN) , pages 2921–2926. IEEE, 2017

    work page 2017

Show all 54 references
  1. [9]

    Chameleon: Adapting to peer images for planting durable backdoors in federated learning

    Yanbo Dai and Songze Li. Chameleon: Adapting to peer images for planting durable backdoors in federated learning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th International Conferenc...

    2023

  2. [10]

    Exploiting linear structure within convolutional networks for efficient evaluation

    Emily L Denton, Wojciech Zaremba, Joan Bruna, Yann LeCun, and Rob Fergus. Exploiting linear structure within convolutional networks for efficient evaluation. Advances in neural information processing systems, 27, 2014

    2014

  3. [11]

    Local model poisoning attacks to byzantine-robust federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Local model poisoning attacks to byzantine-robust federated learning. In Proceedings of the 29th USENIX Conference on Security Symposium , pages 1623–1640, 2020

    2020

  4. [12]

    On the vulnerability of backdoor defenses for federated learning

    Pei Fang and Jinghui Chen. On the vulnerability of backdoor defenses for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 11800–11808, 2023

    2023

  5. [13]

    Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning

    Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning. arXiv preprint arXiv:2312.04432 , 2023

    2023 arXiv

  6. [14]

    Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020) , pages 301–316, San Sebastian, October 2020. USENIX Association

    2020

  7. [15]

    The limitations of federated learning in sybil settings

    Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In RAID, pages 301–316, 2020

    2020

  8. [16]

    Inverting gradients-how easy is it to break privacy in fed- erated learning? Advances in Neural Information Processing Systems , 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dr ¨oge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in fed- erated learning? Advances in Neural Information Processing Systems , 33:16937–16947, 2020

    2020

  9. [17]

    Atteq-nn: Attention-based qoe-aware evasive backdoor attacks

    Xueluan Gong, Yanjiao Chen, Jianshuo Dong, and Qian Wang. Atteq-nn: Attention-based qoe-aware evasive backdoor attacks. In NDSS, 2022

    2022

  10. [18]

    Defense-resistant backdoor attacks against deep neural networks in outsourced cloud environment

    Xueluan Gong, Yanjiao Chen, Qian Wang, Huayang Huang, Lingshuo Meng, Chao Shen, and Qian Zhang. Defense-resistant backdoor attacks against deep neural networks in outsourced cloud environment. IEEE Journal on Selected Areas in Communications , 39(8):2617–2631, 2021

    2021

  11. [19]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019

    2019

  12. [20]

    The hidden vulnerability of distributed learning in byzantium

    Rachid Guerraoui, S ´ebastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pages 3521–3530. PMLR, 2018

    2018

  13. [21]

    Learning both weights and connections for efficient neural network

    Song Han, Jeff Pool, John Tran, and William Dally. Learning both weights and connections for efficient neural network. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 28. Curran Associates, Inc., 2015

    2015

  14. [22]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770–778, 2016

    2016

  15. [23]

    Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem

    Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 41–50, 2019

    2019

  16. [24]

    Measuring the ef- fects of non-identical data distribution for federated visual classification

    Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the ef- fects of non-identical data distribution for federated visual classification. arXiv preprint arXiv:1909.06335 , 2019

    1909 arXiv

  17. [25]

    Batch normalization: Accelerating deep network training by reducing internal covariate shift

    Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In Interna- tional conference on machine learning , pages 448–456. pmlr, 2015

    2015

  18. [26]

    Communication-efficient distributed sgd with sketching

    Nikita Ivkin, Daniel Rothchild, Enayat Ullah, Ion Stoica, Raman Arora, et al. Communication-efficient distributed sgd with sketching. Advances in Neural Information Processing Systems , 32, 2019

    2019

  19. [27]

    Mesas: Poisoning defense for federated learning resilient against adaptive attackers

    Torsten Krauß and Alexandra Dmitrienko. Mesas: Poisoning defense for federated learning resilient against adaptive attackers. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1526–1540, 2023

    2023

  20. [28]

    Automatic adversarial adaption for stealthy poisoning attacks in federated learning

    Torsten Krauß, Jan K ¨onig, Alexandra Dmitrienko, and Christian Kan- zow. Automatic adversarial adaption for stealthy poisoning attacks in federated learning. In To appear soon at the Network and Distributed System Security Symposium (NDSS) , 2024

    2024

  21. [29]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  22. [30]

    Baybfed: Bayesian backdoor defense for federated learning

    Kavita Kumari, Phillip Rieger, Hossein Fereidooni, Murtuza Jadliwala, and Ahmad-Reza Sadeghi. Baybfed: Bayesian backdoor defense for federated learning. In 2023 IEEE Symposium on Security and Privacy (SP), pages 737–754. IEEE, 2023

    2023

  23. [31]

    BackdoorIndicator: Leveraging OOD data for proactive backdoor detection in federated learning

    Songze Li and Yanbo Dai. BackdoorIndicator: Leveraging OOD data for proactive backdoor detection in federated learning. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 4193–4210, Philadelphia, PA, August 2024. USENIX Association

    2024

  24. [32]

    Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning

    Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang, Jiqiang Liu, and Xiangliang Zhang. Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 37, pages 9020–9028, 2023

    2023

  25. [33]

    Lurking in the shadows: Unveiling stealthy backdoor attacks against personalized fed- erated learning

    Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Yongsheng Zhu, Guangquan Xu, Jiqiang Liu, and Xiangliang Zhang. Lurking in the shadows: Unveiling stealthy backdoor attacks against personalized fed- erated learning. In 33rd USENIX Security Symposium (USENIX Security 24), pages ...

    2024

  26. [34]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017. 14

    2017

  27. [35]

    H. B. McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private language models without losing accuracy. ArXiv, abs/1710.06963, 2017

    2017 arXiv

  28. [36]

    Byzantine- robust federated machine learning through adaptive model averaging

    Luis Mu ˜noz-Gonz´alez, Kenneth T Co, and Emil C Lupu. Byzantine- robust federated machine learning through adaptive model averaging. arXiv preprint arXiv:1909.05125 , 2019

    1909 arXiv

  29. [37]

    Local and central differential privacy for robustness and privacy in federated learning

    Mohammad Naseri, Jamie Hayes, and Emiliano De Cristofaro. Local and central differential privacy for robustness and privacy in federated learning. Proceedings 2022 Network and Distributed System Security Symposium, 2020

    2022

  30. [38]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP) , pages 739–753. IEEE, 2019

    2019

  31. [39]

    {FLAME}: Taming backdoors in federated learning

    Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen M¨ollering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security 2...

    2022

  32. [40]

    Revisiting the assumption of latent separability for backdoor defenses

    Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the assumption of latent separability for backdoor defenses. In The eleventh international conference on learning repre- sentations, 2022

    2022

  33. [41]

    Crowdguard: Federated backdoor detection in federated learning

    Phillip Rieger, Torsten Krauß, Markus Miettinen, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Crowdguard: Federated backdoor detection in federated learning. arXiv preprint arXiv:2210.07714 , 2022

    2022 arXiv

  34. [42]

    Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection

    Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi. Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. In NDSS, 2022

    2022

  35. [43]

    Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning

    Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021

    2021

  36. [44]

    Auror: Defending against poisoning attacks in collaborative deep learning systems

    Shiqi Shen, Shruti Tople, and Prateek Saxena. Auror: Defending against poisoning attacks in collaborative deep learning systems. In Proceedings of the 32nd Annual Conference on Computer Security Applications , pages 508–519, 2016

    2016

  37. [45]

    Very deep convolu- tional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolu- tional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  38. [46]

    Spar- sified sgd with memory

    Sebastian U Stich, Jean-Baptiste Cordonnier, and Martin Jaggi. Spar- sified sgd with memory. Advances in neural information processing systems, 31, 2018

    2018

  39. [47]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    1911 arXiv

  40. [48]

    Demon in the variant: Statistical analysis of dnns for robust backdoor contam- ination detection

    Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of dnns for robust backdoor contam- ination detection. In USENIX Security Symposium , pages 1541–1558, 2021

    2021

  41. [49]

    Attack of the tails: Yes, you really can backdoor federated learning

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vish- wakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems, 33:16070–16...

    2020

  42. [50]

    Rflbat: A robust federated learning algorithm against backdoor attack, 2022

    Yongkang Wang, Dihua Zhai, Yufeng Zhan, and Yuanqing Xia. Rflbat: A robust federated learning algorithm against backdoor attack, 2022

    2022

  43. [51]

    Dba: Distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations , 2019

    2019

  44. [52]

    Bartlett

    Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter L. Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning , 2018

    2018

  45. [53]

    Neurotoxin: Durable backdoors in federated learning

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. In International Conference on Machine Learning , pages 26429–26446. PMLR, 2022

    2022

  46. [54]

    Shielding collaborative learning: Mitigating poisoning attacks through client-side detection

    Lingchen Zhao, Shengshan Hu, Qian Wang, Jianlin Jiang, Chao Shen, Xiangyang Luo, and Pengfei Hu. Shielding collaborative learning: Mitigating poisoning attacks through client-side detection. IEEE Trans- actions on Dependable and Secure Computing , 18(5):2029–2041, 2020. APPEND...

    2020

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.