Pith. sign in

REVIEW 3 major objections 4 minor 85 references

Toward Malicious Clients Detection in Federated Learning

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SafeFL detects malicious federated-learning clients by scoring their local models on a synthetic dataset generated from the global model trajectory.

desk verdict The detection results in Table 1 are arithmetically impossible under SafeFL-ML's own median-loss rule, so the paper's empirical claims cannot be trusted as written—but the trajectory-condensation idea is new enough to warrant refereeing. read the letter →

arxiv 2505.09110 v2 pith:YCNTSINV submitted 2025-05-14 cs.CR cs.DCcs.LG

Zhihao Dou , Jiaqi Wang , Wei Sun , Zhuqing Liu , Minghong Fang This is my paper · ORCID
classification cs.CRcs.DCcs.LG
keywords federatedlearningpoisoningattacksmaliciousclientdetectionsyntheticdatasetgenerationmodeltrajectorybackdoorByzantinerobustnessserver-sidedefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes SafeFL, a detection-based defense in federated learning that lets the server identify malicious clients without holding a clean sample of the clients' data. The server collects the first few global models, condenses them into a synthetic dataset, and then scores every submitted local model on that dataset: malicious models are claimed to incur noticeably different, usually higher, loss than benign ones. Two variants are given, one thresholding at the median loss and one clustering the losses and keeping the largest cluster. On five datasets including CIFAR-10, FEMNIST, STL-10, and Tiny-ImageNet, and against eleven attacks including an adaptive full-knowledge attack, SafeFL-CL is reported to reach detection accuracy near 1.00 while preserving benign-client accuracy. If correct, this removes a key unrealistic assumption of prior server-based detectors: the server no longer needs a validation set drawn from the clients' distribution.

What carries the argument

The central object is a synthetic dataset produced by trajectory matching. The server treats pairs $(w_\alpha, w_{\alpha+\Delta})$ from the collected global-model trajectory as input-output targets and trains synthetic data so that starting from $w_\alpha$ and training for $\Delta$ steps on the synthetic set reproduces $w_{\alpha+\Delta}$. The resulting synthetic set $D_{\mathrm{syn}}$ is then the evaluation instrument: the loss of each local model on $D_{\mathrm{syn}}$ is what separates malicious from benign behavior. The machinery also includes the largest-cluster aggregation used during trajectory collection, plus the two detection rules, median-loss weighting and loss clustering.

What would settle it

Run SafeFL with 50 percent or more of clients malicious while keeping the same clustering and loss rules, so the largest-cluster assumption in Eq. (1) is violated; detection accuracy should drop sharply if the mechanism is what the paper claims. A sharper test is to craft malicious local models that carry a backdoor but are explicitly optimized to have loss close to the benign median on $D_{\mathrm{syn}}$, then check whether both SafeFL-ML and SafeFL-CL still flag them.

Watch

Extended reading notes

Core claim

SafeFL's central claim is that the trajectory of global models alone, with no access to client data, can be turned into a usable test set for client screening. During the first epsilon rounds the server clusters received local models, aggregates only the largest cluster to form each global model, and then uses those global models as targets in a dataset-condensation optimization that produces synthetic images and labels. Once the synthetic set exists, each client's local model is evaluated on it; benign models are those whose loss falls below the median (SafeFL-ML) or in the largest loss cluster (SafeFL-CL). The paper reports that malicious local models show loss clearly separated from benign ones across all tested attacks, and that SafeFL-CL achieves near-perfect detection while keeping final global-model accuracy comparable to no-attack training.

Load-bearing premise

During the first $\epsilon$ rounds, clustering local models into the largest cluster isolates the benign clients, so the global-model trajectory used to make the synthetic dataset is uncontaminated; if malicious clients form the largest cluster or approach half the participants, the synthetic dataset is poisoned and detection fails.

Editorial extensions

If this is right

  • Detection no longer requires the server to hold a clean validation dataset drawn from the clients' distribution, so it applies in highly heterogeneous or data-free settings.
  • Because clients are re-assessed every round and only excluded from that round's aggregation, benign clients that occasionally exhibit high loss are not permanently removed from the system.
  • SafeFL-CL's loss-clustering rule yields near-perfect detection accuracy and low false-positive rates across the tested attacks, keeping final global-model accuracy close to the no-attack FedAvg baseline.
  • The detection filter remains effective when different aggregation rules such as Median, Trimmed Mean, or Krum are applied after filtering, making it compatible with prevention-based defenses.
  • Longer global-model trajectories and larger synthetic datasets improve detection, with diminishing returns after roughly 25 trajectory rounds and 100 synthetic samples.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the loss-separation result generalizes, the same synthetic-trajectory trick could screen for other deviant client behavior, such as buggy or stale local models, using only the model updates themselves.
  • A direct stress test of the mechanism would be an attack that explicitly optimizes malicious local models to keep their loss inside the benign cluster on $D_{\mathrm{syn}}$ while still implanting a backdoor; the paper's adaptive attack is full-knowledge, but this specific objective is not reported.
  • Because the synthetic set is built from the largest cluster in the first $\epsilon$ rounds, the method has a natural threshold near 50 percent malicious clients; adding a small trusted anchor set during trajectory collection could push that threshold higher and is a testable extension.
  • The paper's privacy discussion suggests a concrete follow-up: measuring how much the synthetic dataset leaks about client data, and whether differentially private global models still separate malicious from benign losses.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes SafeFL, a server-side detection method for malicious clients in federated learning. The server records the first epsilon global models (aggregated from the largest cluster of local models), synthesizes a dataset D_syn from this trajectory via the SynGen algorithm, and then in each subsequent round evaluates every client's local model on D_syn. SafeFL-ML aggregates only clients whose loss is at or below the median loss; SafeFL-CL instead keeps clients in the largest loss cluster. Experiments compare SafeFL with seven detection-based and three prevention-based baselines on five datasets under six attack types, plus ablations and additional attacks in the appendix, and report near-perfect detection accuracy for SafeFL.

Significance. The core idea of replacing a clean server-side validation set with a synthetic dataset distilled from the global-model trajectory is original and potentially useful, since one of the main criticisms of existing defenses such as FLTrust is the unrealistic assumption that the server holds a representative clean dataset. The paper also provides a broad evaluation grid covering five datasets, several attacks, and numerous ablations. However, the central empirical claim is invalidated by an internal arithmetic inconsistency in SafeFL-ML's decision rule, and the paper's 'adaptive attack' evaluation does not exercise the full-knowledge threat model stated in Section 3. The positive contributions are the synthetic-dataset formulation and the breadth of the experimental design, but the manuscript in its current form does not support its headline detection results.

major comments (3)
  1. [§4.4, Eq. (4) and Table 1] The reported SafeFL-ML metrics are arithmetically inconsistent with the stated decision rule. Eq. (4) sets r_i^t = 0 for every client whose loss is strictly greater than the median l_Med^t, and the text and Algorithm 2 confirm that such clients are treated as malicious. For n = 100 clients, at most 50 clients can have loss above the median, so at most 50 clients can be flagged in any round. In the default setting with 30% malicious and 70% benign clients, even if the 30 malicious clients are exactly the 30 highest losses, 20 benign clients must also be flagged; this gives DACC = (30 + 50) / 100 = 0.80, FPR = 20 / 70 ≈ 0.286, and FNR = 0 as the best possible outcome. With no attack, the rule flags half the benign clients, giving DACC = 0.50. Table 1 reports SafeFL-ML no-attack DACC values of 0.92–0.99 and attack-row DACC values up to 1.00 with FPR as low as 0.00; for example, the CIFAR-10 Trim attack row reports DACC 0.90, FPR 0.03, and FNR 0.13. These numbers are impossible under Eq. (4): the reported FPR/FNR pair implies only about 28 flagged clients (26.1 true positives plus 2.1 false positives), whereas the median rule forces about 50 flagged clients. The same discrepancy appears in Tables 13 and 15 and in the SafeFL-ML curves of Figures 1–2. Either a different, unspecified threshold rule produced the tables, or the metrics were computed differently from the stated procedure; as written, the method cannot produce the headline detection results.
  2. [§5.1.2 and Appendix A.2] The Adaptive attack, which the contributions describe as a 'strong adaptive attack,' is not adaptive to SafeFL. Section 3 states that the full-knowledge attacker knows the aggregation rule and designs an attack to deceive the FL process, and Section 5.1.2 says the attacker 'designs an adaptive attack to disrupt and deceive the FL process' with SafeFL as the target. However, Appendix A.2 says only that the attack is implemented 'following the methodology outlined in [60]'; reference [60] (Shejwalkar and Houmansadr) constructs attacks against robust aggregation rules such as median and trimmed mean, not against a defense that evaluates local models on a synthetic dataset. The Adaptive-attack rows in Tables 1–3, 10, and 12 therefore do not test the full-knowledge threat model stated in Section 3, and the claim that SafeFL resists a worst-case adversary that knows SafeFL's detection mechanism is unsupported by the reported experiments.
  3. [§4.2, Eq. (1), and Algorithm 2, lines 14–17] The global model trajectory used for synthetic data generation is collected by aggregating only the largest cluster of local models for the first epsilon rounds, but the paper provides no correctness argument and no dedicated experiment establishing that this cluster is benign. Because the threat model in Section 3 lets malicious clients transmit arbitrary local models, an adversary that knows the clustering mechanism could attempt to place malicious updates inside the largest cluster during the trajectory-collection phase; the default 30% malicious setting and the tested attacks do not rule this out. Since D_syn is generated from this trajectory, poisoning the trajectory would poison the synthetic dataset and invalidate the subsequent loss-based separation. The paper should either prove a separation condition under which the largest cluster is guaranteed to be benign, or empirically evaluate trajectory poisoning by an adversary that is actually adaptive to SafeFL.
minor comments (4)
  1. [Appendix A.2] The bullet numbering in Appendix A.2 uses the label 'e)' twice, first for the Scaling+DBA attack and then for the Adaptive attack; the numbering should be corrected.
  2. [Table 10(b)] The rows for Scaling+DBA and Trim+DBA in Table 10(b) are identical for every defense and every client count, which appears to be a copy-paste error and should be verified.
  3. [Figures 10(c)–(f)] Figures 10(c)–(f) in the appendix appear to be empty, with only captions and no plotted data or axes; these subfigures should be filled in or removed.
  4. [§4.2] The first sentence of Section 4.2 says 'the server possesses its own distinct dataset' before explaining that the server will generate a synthetic dataset; this wording is confusing and should be revised to avoid implying the server has a clean validation set.

Circularity Check

0 steps flagged · score 1.0 of 10

No circularity found: SafeFL's synthetic dataset is fitted to the model trajectory, not to the detection labels, and its reported detection is benchmarked externally; the median-rule metrics raise a reproducibility concern, not a circularity one.

full rationale

I walked the derivation chain: Eq. (2) and Algorithm 1 optimize the synthetic dataset D_syn to minimize the squared distance between a model trained on D_syn and a target global model from the trajectory, with no term involving the benign/malicious labels of clients, so there is no fitted-input-called-prediction loop. Detection in Section 4.4 then compares client losses on this fixed D_syn against ground-truth attack membership from external attack implementations (Trim, Scaling, DBA, hybrid, Neurotoxin, and others), and the reported DACC/FPR/FNR are direct confusion-matrix quantities rather than restatements of the optimization objective. The trajectory itself is built under the stated benign-majority clustering assumption in Eq. (1) of Section 4.2; that assumption is an input threat-model premise, not a result SafeFL derives, so it is not circular. The authors' own FedREDefense [69] appears only as a comparison baseline, and the threat model cites prior attacks including the authors' [24] only as benchmark definitions; neither citation carries the derivation. Separately, the paper's own text says SafeFL-ML 'identifies half of the clients as suspicious in each round' (Section 4.4, after Eq. (4)), which is arithmetically incompatible with Table 1's near-zero FPR and DACC near 1.00 under 30% malicious clients; this is an internal-consistency or reproducibility defect, not a reduction of a prediction to its inputs, so it does not increase the circularity score.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method's central claim rests on two empirical premises: that benign models cluster in parameter space during early rounds, and that malicious models have higher loss on the synthetic dataset. The remaining free parameters are hand-tuned per dataset, and the clustering implementation is underspecified.

free parameters (6)
  • Trajectory length epsilon = 25 for MNIST/CIFAR-10/FEMNIST, 30 for STL-10/Tiny-ImageNet
    Chosen by hand; Figure 1 shows DACC grows with epsilon and plateaus at 25, so the value is tuned to performance.
  • SynGen iterations Psi = 5000 (CIFAR-10/STL-10/MNIST), 8500 (FEMNIST), 10000 (Tiny-ImageNet)
    Chosen per dataset to control synthetic-data quality; larger values increase computation but no sensitivity analysis is provided.
  • Step parameter Delta = 15
    Fixed for all datasets; determines the number of training steps used in the trajectory-matching objective Eq. (2).
  • Synthetic dataset size = 100
    Chosen by hand; Figure 2 shows detection accuracy depends strongly on this size, with SafeFL-CL rising from 0.72 to 0.98 as size grows from 10 to 150.
  • Learning rate gamma for SynGen = 0.1
    Fixed gradient descent learning rate for updating synthetic features and labels in Algorithm 1.
  • Clustering algorithm pair = K-means for trajectory, Mean-shift for loss clustering
    Table 5 shows detection accuracy varies by more than 0.2 depending on this choice, so the choice is load-bearing and not derived from first principles.
assumptions (5)
  • domain assumption The majority of clients are honest and their local models cluster together in parameter space.
    Used in Eq. (1), Section 4.2, to build the global trajectory from the largest cluster; if malicious models form the largest cluster, the trajectory is poisoned.
  • domain assumption Malicious local models incur higher loss on the synthetic dataset than benign models.
    Assumed in Section 4.4 and supported only by the empirical loss plots in Figures 3-12, with no formal argument or guarantee.
  • domain assumption Dataset condensation from a global-model trajectory produces a synthetic dataset that separates malicious from benign behavior.
    The optimization in Eq. (2) is inherited from Cazenavette et al. and DynaFed; the paper provides no proof that the resulting synthetic dataset preserves the loss-separation property.
  • domain assumption Attack implementations from cited papers behave as described when transplanted into this evaluation.
    Attacks such as Trim, Scaling, DBA, and Adaptive are adopted from prior references with no independent verification of their strength or parameter settings in the main text.
  • ad hoc to paper The server can run K-means and Mean-shift clustering without knowing the number of clusters in advance.
    Algorithm 2 calls Cluster() with no specification for K or bandwidth; the paper uses largest cluster but never states how many clusters are formed, leaving an unstated implementation detail.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Toward Malicious Clients Detection in Federated Learning." pith.science (2026). https://pith.science/paper/YCNTSINV

@misc{pith2026250509110,
  author       = {Pith},
  title        = {Pith review of: Toward Malicious Clients Detection in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YCNTSINV}},
  note         = {Machine review of arXiv:2505.09110}
}
read the original abstract

Federated learning (FL) enables multiple clients to collaboratively train a global machine learning model without sharing their raw data. However, the decentralized nature of FL introduces vulnerabilities, particularly to poisoning attacks, where malicious clients manipulate their local models to disrupt the training process. While Byzantine-robust aggregation rules have been developed to mitigate such attacks, they remain inadequate against more advanced threats. In response, recent advancements have focused on FL detection techniques to identify potentially malicious participants. Unfortunately, these methods often misclassify numerous benign clients as threats or rely on unrealistic assumptions about the server's capabilities. In this paper, we propose a novel algorithm, SafeFL, specifically designed to accurately identify malicious clients in FL. The SafeFL approach involves the server collecting a series of global models to generate a synthetic dataset, which is then used to distinguish between malicious and benign models based on their behavior. Extensive testing demonstrates that SafeFL outperforms existing methods, offering superior efficiency and accuracy in detecting malicious clients.

Figures

Figures reproduced from arXiv: 2505.09110 by the authors.

Figure 1
Figure 1. Impact of length of trajectory, where CIFAR-10 dataset is considered. [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 3
Figure 3. The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-ML with the CIFAR-10 dataset. 0 20 40 60 80 100 Client index 6 8 10 12 14 16 18 20 Loss Malicious client Benign client (a) Trim attack 0 20 40 60 80 100 Client index 0 20 40 60 80 100 120 140 Loss Malicious client Benign client (b) Scaling attack 0 20 40 60 80 100 Client index 0 20 40 60 80 100 Loss Maliciou… view at source ↗
Figure 4
Figure 4. The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-ML with the MNIST dataset. observation that benign clients follow the FL algorithm and their local data, while malicious clients deviate by crafting inconsistent models across training rounds. c) FLTrust [14]: FLTrust assumes the server has a clean validation dataset from the same distribution as the clients… view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-ML with the FEMNIST dataset [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-ML with the STL-10 dataset. 0 100 200 300 400 Client index 5 10 15 20 25 Loss Malicious client Benign client (a) Trim attack 0 100 200 300 400 Client index 0 5…
Figure 7
Figure 7. Figure 7: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-ML with the Tiny-ImageNet dataset. 0 20 40 60 80 100 Client index 0 10 20 30 40 50 Loss Malicious client Benign client (a) Trim attack 0 20 40 60 80 100 Client…
Figure 8
Figure 8. Figure 8: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-CL with the CIFAR-10 dataset. 0 20 40 60 80 100 Client index 4 6 8 10 12 14 16 Loss Malicious client Benign client (a) Trim attack 0 20 40 60 80 100 Client ind…
Figure 9
Figure 9. Figure 9: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-CL with the MNIST dataset. 0 50 100 150 200 250 300 Client index 5 10 15 20 25 30 35 Loss Malicious client Benign client (a) Trim attack 0 50 100 150 200 250 3…
Figure 10
Figure 10. Figure 10: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-CL with the FEMNIST dataset. 0 20 40 60 80 100 Client index 5 10 15 20 25 30 35 40 Loss Malicious client Benign client (a) Trim attack 0 20 40 60 80 100 Clien…
Figure 11
Figure 11. Figure 11: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-CL with the STL-10 dataset [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: The loss values of benign and malicious clients’ local models computed on the synthetic dataset, using SafeFL-CL with the Tiny-ImageNet dataset. 0 100 200 300 400 500 Time (minute) FedAvg FLAME FLDetector FLTrust DeepSight BackdoorIndicator FreqFed FedREDefense SafeFL…
Figure 13
Figure 13. Figure 13: Computation costs of different methods [PITH_FULL_IMAGE:figures/full_fig_p022_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

85 extracted references · 58 canonical work pages

  1. [60]

    Virat Shejwalkar and Amir Houmansadr. 2021. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS

    2021

  2. [1]

    d.].Federated Learning: Collaborative Machine Learning without Central- ized Training Data

    [n. d.].Federated Learning: Collaborative Machine Learning without Central- ized Training Data. https://ai.googleblog.com/2017/04/federated-learning- collaborative.html

    2017

  3. [2]

    d.].Utilization of FATE in Risk Management of Credit in Small and Micro Enter- prises

    [n. d.].Utilization of FATE in Risk Management of Credit in Small and Micro Enter- prises. https://www.fedai.org/cases/utilization-of-fate-in-risk-management-of- credit-in-small-and-micro-\enterprises/

  4. [3]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In CCS

    2016

  5. [4]

    Maryam Badar, Sandipan Sikdar, Wolfgang Nejdl, and Marco Fisichella. 2024. Fairtrade: Achieving pareto-optimal trade-offs between balanced accuracy and fairness in federated learning. InAAAI

    2024

  6. [5]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. InAISTATS

    2020

  7. [6]

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. 2019. A little is enough: Circumventing defenses for distributed learning. InNeurIPS

    work page 2019

  8. [7]

    Enrique Tomás Martínez Beltrán, Mario Quiles Pérez, Pedro Miguel Sánchez Sánchez, Sergio López Bernal, Gérôme Bovet, Manuel Gil Pérez, Grego- rio Martínez Pérez, and Alberto Huertas Celdrán. 2022. Decentralized Federated Learning: Fundamentals, State-of-the-art, Frameworks, Trends, and Challenges. InarXiv preprint arXiv:2211.08413

    work page Pith review arXiv 2022

Show all 85 references
  1. [8]

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo

  2. [9]

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer

  3. [10]

    Keith Bonawitz. 2019. Towards federated learning at scale: System design. In SysML

    2019

  4. [11]

    Beyza Bozdemir, Sébastien Canard, Orhan Ermis, Helen Möllering, Melek Önen, and Thomas Schneider. 2021. Privacy-preserving density-based clustering. In ASIACCS

    2021

  5. [12]

    Brendan Mcmahan, Virginia Smith, and Ameet Talwalkar

    Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konen, H. Brendan Mcmahan, Virginia Smith, and Ameet Talwalkar. 2019. LEAF: A Benchmark for Federated Settings. InNeurIPS

    2019

  6. [13]

    Ricardo JGB Campello, Davoud Moulavi, and Jörg Sander. 2013. Density-based clustering based on hierarchical density estimates. InPAKDD

    2013

  7. [14]

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2021. FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. InNDSS

    2021

  8. [15]

    Xiaoyu Cao and Neil Zhenqiang Gong. 2022. Mpaf: Model poisoning attacks to federated learning based on fake clients. InCVPR Workshops

    2022

  9. [16]

    George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. 2022. Dataset distillation by matching training trajectories. In CVPR

    2022

  10. [17]

    Hongyan Chang and Reza Shokri. 2023. Bias propagation in federated learning. InICLR

    2023

  11. [18]

    Min Chen, Yang Xu, Hongli Xu, and Liusheng Huang. 2023. Enhancing de- centralized federated learning for non-iid data on heterogeneous devices. In ICDE

    2023

  12. [19]

    Yizong Cheng. 1995. Mean shift, mode seeking, and clustering. InIEEE transac- tions on pattern analysis and machine intelligence

    1995

  13. [20]

    Adam Coates, Andrew Ng, and Honglak Lee. 2011. An analysis of single-layer networks in unsupervised feature learning. InAISTATS

    2011

  14. [21]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. InCVPR

    2009

  15. [22]

    Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. 2012. Fairness through awareness. InITCS

    2012

  16. [23]

    El Mahdi El-Mhamdi, Sadegh Farhadkhani, Rachid Guerraoui, Arsany Guirguis, Lê-Nguyên Hoang, and Sébastien Rouault. 2021. Collaborative learning in the jungle (decentralized, byzantine, heterogeneous, asynchronous and nonconvex learning). InNeurIPS

    2021

  17. [24]

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to Byzantine-robust federated learning. InUSENIX Security Symposium

    2020

  18. [25]

    Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Elizabeth S Bentley. 2022. Aflguard: Byzantine-robust asynchronous federated learning. InACSASC

    2022

  19. [26]

    Minghong Fang, Zhuqing Liu, Xuecen Zhao, and Jia Liu. 2025. Byzantine-Robust Federated Learning over Ring-All-Reduce Distributed Computing. InThe Web Conference

    2025

  20. [27]

    Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sun- dararaja Sitharama Iyengar, and Haibo Yang. 2025. Do We Really Need to Design New Byzantine-robust Aggregation Rules?. InNDSS

    2025

  21. [28]

    Minghong Fang, Xilong Wang, and Neil Zhenqiang Gong. 2025. Provably Robust Federated Reinforcement Learning. InThe Web Conference

    2025

  22. [29]

    Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. 2024. Byzantine-robust decentralized federated learning. InCCS

    2024

  23. [30]

    Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. 2024. FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning. InNDSS

    2024

  24. [31]

    Moritz Hardt, Eric Price, and Nati Srebro. 2016. Equality of opportunity in supervised learning. InNeurIPS

    2016

  25. [32]

    John A Hartigan and Manchek A Wong. 1979. Algorithm AS 136: A k-means clustering algorithm. InJournal of the royal statistical society. series c (applied statistics)

    1979

  26. [33]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InCVPR

    2016

  27. [34]

    Shivam Kalra, Junfeng Wen, Jesse C Cresswell, Maksims Volkovs, and HR Tizhoosh. 2023. Decentralized federated learning through proxy model sharing. InNature Communications

    2023

  28. [35]

    Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. 2022. Byzantine-robust learning on heterogeneous datasets via bucketing. InICLR

    2022

  29. [36]

    Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebas- tian Stich, and Ananda Theertha Suresh. 2020. Scaffold: Stochastic controlled averaging for federated learning. InICML

    2020

  30. [37]

    Jang-Hyun Kim, Jinuk Kim, Seong Joon Oh, Sangdoo Yun, Hwanjun Song, Joon- hyun Jeong, Jung-Woo Ha, and Hyun Oh Song. 2022. Dataset condensation via efficient synthetic-data parameterization. InICML

    2022

  31. [38]

    Krizhevsky and G

    A. Krizhevsky and G. Hinton. 2009. Learning multiple layers of features from tiny images.Handbook of Systemic Autoimmune Diseases(2009)

    2009

  32. [39]

    Kavita Kumari, Phillip Rieger, Hossein Fereidooni, Murtuza Jadliwala, and Ahmad- Reza Sadeghi. 2023. BayBFed: Bayesian Backdoor Defense for Federated Learning. InIEEE Symposium on Security and Privacy

    2023

  33. [40]

    Yann LeCun, Corinna Cortes, and CJ Burges. 1998. MNIST handwritten digit database.A vailable: http://yann. lecun. com/exdb/mnist(1998)

    1998

  34. [41]

    Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. 2019. RSA: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. InAAAI

    2019

  35. [42]

    Songze Li and Yanbo Dai. 2024. BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning. InUSENIX Security Sympo- sium

    2024

  36. [43]

    Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. 2021. Ditto: Fair and robust federated learning through personalization. InICML

    2021

  37. [44]

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. 2020. Federated optimization in heterogeneous networks. In MLSys

    2020

  38. [45]

    Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. 2020. Fair resource allocation in federated learning. InICLR

    2020

  39. [46]

    Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. 2020. On the convergence of fedavg on non-iid data. InICLR

    2020

  40. [47]

    Songhua Liu, Jingwen Ye, Runpeng Yu, and Xinchao Wang. 2023. Slimmable dataset condensation. InCVPR

    2023

  41. [48]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. 2017. Communication-Efficient Learning of Deep Net- works from Decentralized Data. InAISTATS

    2017

  42. [49]

    Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. 2019. Agnostic federated learning. InICML

    2019

  43. [50]

    Hamid Mozaffari, Virat Shejwalkar, and Amir Houmansadr. 2023. Every Vote Counts: Ranking-Based Training of Federated Learning to Resist Poisoning At- tacks. InUSENIX Security Symposium

    2023

  44. [51]

    Luis Muñoz-González, Kenneth T Co, and Emil C Lupu. 2019. Byzantine-robust federated machine learning through adaptive model averaging.arXiv preprint arXiv:1909.05125(2019)

    2019 arXiv

  45. [52]

    Mohammad Naseri, Yufei Han, Enrico Mariconti, Yun Shen, Gianluca Stringhini, and Emiliano De Cristofaro. 2022. Cerberus: Exploring Federated Prediction of Security Events. InCCS

    2022

  46. [53]

    Thuy Dung Nguyen, Tuan A Nguyen, Anh Tran, Khoa D Doan, and Kok-Seng Wong. 2023. Iba: Towards irreversible backdoor attacks in federated learning. In NeurIPS

    2023

  47. [54]

    Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Bran- denburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. 2022. FLAME: Taming backdoors in federated learning. InUSENIX Security Symposium

    2022

  48. [55]

    Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. 2021. Defending against backdoors in federated learning with robust learning rate. InAAAI

    2021

  49. [56]

    Matthias Paulik, Matt Seigel, Henry Mason, Dominic Telaar, Joris Kluivers, Rogier van Dalen, Chi Wai Lau, Luke Carlson, Filip Granqvist, Chris Vandevelde, et al

  50. [57]

    Renjie Pi, Weizhong Zhang, Yueqi Xie, Jiahui Gao, Xiaoyu Wang, Sunghun Kim, and Qifeng Chen. 2023. Dynafed: Tackling client data heterogeneity with global dynamics. InCVPR

    2023

  51. [58]

    Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos

  52. [59]

    Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi

  53. [61]

    Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. 2022. Back to the drawing board: A critical evaluation of poisoning attacks on produc- tion federated learning. InIEEE Symposium on Security and Privacy

    2022

  54. [62]

    InNeurIPS

    DETOX: A redundancy-based framework for faster and more robust gradient aggregation. InNeurIPS. ASIA CCS ’25, August 25–29, 2025, Hanoi, Vietnam Zhihao Dou, Jiaqi Wang, Wei Sun, Zhuqing Liu, and Minghong Fang

    2025

  55. [63]

    Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. 2020. Tackling the objective inconsistency problem in heterogeneous federated opti- mization.NeurIPS

    2020

  56. [64]

    Kai Wang, Bo Zhao, Xiangyu Peng, Zheng Zhu, Shuo Yang, Shuo Wang, Guan Huang, Hakan Bilen, Xinchao Wang, and Yang You. 2022. Cafe: Learning to condense dataset by aligning features. InCVPR

    2022

  57. [65]

    Ning Wang, Yang Xiao, Yimin Chen, Yang Hu, Wenjing Lou, and Y Thomas Hou

  58. [66]

    Wenbin Wang, Qiwen Ma, Zifan Zhang, Yuchen Liu, Zhuqing Liu, and Minghong Fang. 2025. Poisoning Attacks and Defenses to Federated Unlearning. InThe Web Conference

    2025

  59. [67]

    Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. Data poisoning attacks against federated learning systems. InESORICS

    2020

  60. [68]

    Cong Xie, Sanmi Koyejo, and Indranil Gupta. 2019. Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance. InICML

    2019

  61. [69]

    Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. 2024. FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error. InICML

    2024

  62. [70]

    Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter Bartlett. 2018. Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. In ICML

    2018

  63. [71]

    InASIACCS

    Flare: defending federated learning against model poisoning attacks via latent space representations. InASIACCS

  64. [72]

    Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia

  65. [73]

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2020. Dba: Distributed backdoor attacks against federated learning. InICLR

    2020

  66. [74]

    Zifan Zhang, Minghong Fang, Jiayuan Huang, and Yuchen Liu. 2024. Poisoning attacks on federated learning-based wireless traffic prediction. InIFIP Networking Conference

    2024

  67. [75]

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Ma- honey, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. 2022. Neuro- toxin: Durable backdoors in federated learning. InICML

    2022

  68. [76]

    Bo Zhao and Hakan Bilen. 2023. Dataset condensation with distribution matching. InW ACV

    2023

  69. [77]

    Ming Yin, Yichang Xu, Minghong Fang, and Neil Zhenqiang Gong. 2024. Poison- ing federated recommender systems with fake users. InThe Web Conference

    2024

  70. [78]

    BDIndicator

    Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. 2021. Data-free knowledge distillation for heterogeneous federated learning. InICML. Table 8: The CNN architecture. Layer Size Input 28×28×1 Convolution+ReLU 3×3×30 Max Pooling 2×2 Convolution+ReLU 3×3×5 Max Pooling 2×2 Fully Connect...

    2021

  71. [80]

    Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2022. FLDetector: Defending federated learning against model poisoning attacks via detecting malicious clients. InKDD

    2022

  72. [84]

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2021. Dataset condensation with gradient matching. InICLR

    2021

  73. [2017]

    In NeurIPS

    Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS

  74. [2019]

    Analyzing federated learning through an adversarial lens. InICML

  75. [2021]

    Federated evaluation and tuning for on-device personalization: System design & applications.arXiv preprint arXiv:2102.08503(2021)

    2021 arXiv

  76. [2022]

    Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. InNDSS

  77. [2023]

    Narcissus: A practical clean-label backdoor attack with limited information. InCCS

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.