Pith. sign in

REVIEW 4 major objections 4 minor 67 references

DROP: Poison Dilution via Knowledge Distillation for Federated Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that a federated learning server can neutralize stealthy targeted backdoors by distilling the global model against the consensus logits of benign clients, reporting an average attack success rate of 1.93% across ten…

desk verdict First KD-based FL defense with a broad configuration sweep, but the near-zero ASR claim rides on an untested assumption that the distillation GAN never synthesizes trigger-like inputs. read the letter →

arxiv 2502.07011 v2 pith:YUA4I7IP submitted 2025-02-10 cs.LG cs.CRcs.DC

Georgios Syros , Anshuman Suri , Farinaz Koushanfar , Cristina Nita-Rotaru , Alina Oprea This is my paper · ORCID
classification cs.LGcs.CRcs.DC
keywords federatedlearningbackdoorpoisoningknowledgedistillationrobustaggregationagglomerativeclusteringactivitymonitoringconfigurationnon-IIDdata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a federated-learning server can defend against stealthy targeted backdoor attacks without knowing the clients' learning rate, batch size, or number of local epochs. Its proposed defense, DROP, filters client updates by clustering and activity tracking, then rebuilds the global model by knowledge distillation: a GAN generates synthetic images and a clone network is trained to match the average logits of the supposedly benign clients, overwriting any backdoor that slipped through filtering. The authors report an average attack success rate of 1.93% across ten learning configurations where seven existing defenses fail, at a cost of several points of main-task accuracy. They also report that the distillation layer is the load-bearing part: the lightweight DROPlet without distillation fails against the stealthiest attacks, and under non-IID CIFAR-10 data DROP's own success rate climbs to 88.7–93.0%. The broader message is that configuration-agnostic defense is achievable when a clean consensus signal exists to distill, and remains open when it does not.

What carries the argument

The mechanism that carries the argument is logit-driven knowledge distillation. A generator network produces synthetic inputs, and a clone network is trained with an $\ell^1$ loss to match the averaged logits $\bar{z}_t$ of the clients that survived agglomerative clustering and activity monitoring; the distilled clone, not the aggregated update, becomes the next global model. This 'consensus overwrite' is what removes backdoors that the filters cannot see, and it is the reason DROP can claim configuration agnosticism. The other two components supply the trustworthiness of that consensus: Ward-linkage clustering isolates updates that deviate, and a penalty/reward score dilutes the influence of clients repeatedly flagged as suspicious, with an optional ban threshold. The paper's own DROPlet results make the machinery's role explicit: without the distillation step, clustering plus activity tracking leaves the Chameleon attack at 99.9% ASR on CIFAR-10 at 2.5% DPR.

What would settle it

Measure DROP on CIFAR-10 configuration C4 under a Dirichlet non-IID split with $\alpha=10$ at 1.25% DPR and 20% MCR: the paper reports 93.0% ASR, which already contradicts any reading of 'configuration-agnostic' that includes the data distribution. Alternatively, run the IID benchmark with the GAN's clean seed set replaced by out-of-distribution images, or removed entirely, and check whether ASR returns toward the undefended 85–100%; if it does, the distillation layer—not the clustering or activity monitor—is the load-bearing component.

Watch

Extended reading notes

Core claim

The paper's central claim is that the residual adversarial signal from a stealthy backdoor need not be detected in the update vectors; it can be overwritten by distilling the global model against the consensus logits of the clients that passed filtering. In each round, DROP clusters updates with Ward-linkage agglomerative clustering, tracks per-client penalty scores so repeat offenders lose influence, and then every K rounds trains a clone network on synthetic data generated by a GAN seeded with a small clean set, matching the ensemble logits $\bar{z}_t = \frac{1}{|C_b|} \sum_{c \in C_b} f(x; w_c^t)$ under an $\ell^1$ loss. This cleansed clone replaces the aggregated global model. On ten 'danger zone' configurations that are both accurate (MTA ≥ 80%) and attack-vulnerable (ASR ≥ 85%), DROP is reported to keep ASR at or below 5.5%, averaging 1.93%, while Median, Multi-Krum, FLTrust, FoolsGold, FLAME, FLARE, and FLIP each fail on at least one configuration. The claim is scoped to the settings tested: under non-IID data, DROP retains near-zero ASR on EMNIST but on CIFAR-10 the ASR rises to 88.7–93.0%, which the paper presents as an unsolved hardness challenge rather than a solved one.

Load-bearing premise

Every near-zero-ASR result rests on the server holding a small clean seed set drawn from the same distribution as client data, and on the clients that survive clustering having backdoor-free logits; if either condition fails, distillation can preserve or amplify the backdoor, and the paper's non-IID CIFAR-10 results (ASR 88.7–93.0%) show the collapse.

Editorial extensions

If this is right

  • If DROP works as reported, an FL server can keep targeted-backdoor ASR near zero across the ten danger-zone configurations without knowing the clients' local learning configuration, paying only a few points of MTA.
  • DROPlet gives a cheap plugin: clustering and activity monitoring alone reach near-zero ASR on less stealthy attacks with a reported ~30-minute non-IID run, versus ~57 hours reported for FLIP.
  • Improvements in generative distillation—better query synthesis, GANs, or distillation losses—can be swapped into DROP's Step 4 and should directly shrink the robustness-accuracy tradeoff.
  • The ten-configuration 'danger zone' table provides a concrete evaluation standard: a defense that cannot hold all ten configurations is not configuration-agnostic, and future defenses can be compared against DROP on this grid.
  • Non-IID data remains the frontier: the paper's CIFAR-10 results (ASR 88.7–93.0% at Dir(α)=1–10) imply that no defense it tested, including DROP, solves backdoor robustness under strong heterogeneity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A coordinated adversary could attack the consensus signal itself: if poisoned clients are spread so that they land in the 'benign' cluster, the ensemble logits used for distillation would be partially poisoned, and DROP would actively preserve the backdoor; this predicts DROP's ASR should rise as the per-round malicious share approaches 50%.
  • The clean seed set is a hidden deployment condition: in privacy-preserving federated learning where the server has no data from the client distribution, the GAN prior would be mismatched, and the paper's non-IID numbers suggest that mismatch—not the clustering—is what would break the defense.
  • The danger-zone analysis implies that operators without a defense can reduce backdoor risk by choosing configurations with higher learning rates or more local epochs, since those settings polarize updates and dilute the backdoor; this is a direct operational reading of the grid search, though the paper does not frame it as a defense.
  • Because DROP's MTA is higher in configurations C3, C9, and C10 (~80%), a practical operator might combine DROP with one of those configurations to recover accuracy; this is a testable extension not explored in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes DROP (Distillation-based Reduction Of Poisoning), a server-side defense for federated learning that combines agglomerative clustering, activity monitoring, and logit-driven knowledge distillation with GAN-generated synthetic data. It also introduces DROPlet, a lightweight variant without distillation. The authors evaluate DROP against Median, Multi-Krum, FLTrust, FoolsGold, FLAME, FLARE, and FLIP on CIFAR-10, CINIC-10, and EMNIST under BadNets, Neurotoxin, and Chameleon attacks, in IID and non-IID settings, and across ten learning configurations. The main claims are that DROP achieves near-zero attack success rate across diverse configurations and attack stealthiness levels, with an average ASR of 1.93%, and that it is therefore agnostic to learning configuration and adversary stealthiness. The paper also documents configurations where existing defenses fail and reports that non-IID CIFAR-10 remains challenging for all defenses including DROP.

Significance. If the near-zero-ASR results are reproducible and robust, DROP would be a useful contribution: it targets low-DPR, stealthy targeted backdoors, which are known to defeat many existing defenses, and it evaluates across a broader set of learning configurations than is common in the FL poisoning literature. The paper's release of a unified codebase for attacks and defenses is a concrete strength, as are the head-to-head comparisons against seven baselines and the explicit disclosure that non-IID CIFAR-10 remains unsolved. The central claim, however, depends on the knowledge-distillation layer operating on a backdoor-free teacher signal; that dependency is not experimentally validated and is the main risk to the paper's conclusions.

major comments (4)
  1. [§IV-C, Eqs. (8)–(9), Table IV] The central near-zero-ASR claim rests on the knowledge-distillation component, but the teacher signal used in Eq. (9) is not shown to be backdoor-free. For the stealthiest attacks, clustering cannot separate poisoned updates: DROPlet, which is DROP without distillation, leaves ASR at 99.9% for CIFAR-10 with 2.5% DPR and Chameleon (Table IV). The ensemble logits z̄_t therefore plausibly contain poisoned contributions, and the only reason the clone would not inherit them is if the GAN-generated synthetic data never contains the trigger pattern. The paper provides no analysis or experiment on the trigger content of D_synthetic, and MAZE-style generators are optimized to maximize teacher–student disagreement, which could favor trigger-like inputs when the teacher is poisoned. Please add a direct test (e.g., ASR of the clone on trigger inputs, a comparison of DROP against a certified-clean teacher, and a quantitative measure of trigger presence in generated samples). The non-IID results in Table VII, where CIFAR-10 ASR rises to 88.7–93.0%, may already be an instance of this failure mode and should be discussed in that light.
  2. [§V-A, Table V] The claim that DROP is agnostic to learning configurations is overstated because most of the configurations in the headline average are not usable under the paper's own utility criterion. Table II defines danger-zone configurations by MTA ≥ 80% and ASR ≥ 85%, but in Table V DROP's MTA is below 80% in seven of the ten configurations (e.g., C1 69.47%, C4 76.05%, C6 62.61%). Only C3, C9, and C10 meet the 80% threshold. The average ASR of 1.93% therefore includes configurations where the main-task accuracy is poor, and reporting ASR alone for those cases is misleading. The paper should report the MTA/ASR trade-off explicitly and either restrict the configuration-agnostic claim to configurations where MTA remains acceptable or provide a justification for why sub-80% MTA is acceptable in those settings.
  3. [§V, Tables III–VII] All experimental tables report single point estimates with no error bars, number of seeds, or variance information. This is a particular problem for the core near-zero-ASR result, where the difference between a genuinely robust defense and a favorable run is small; it also affects the comparison with baselines whose ASR fluctuates across rounds (e.g., FLIP and FLAME in Fig. 5). Please report the number of independent runs, the mean and standard deviation (or min/max) for MTA and ASR, and the random-seed policy. Without this, the quantitative claims in the abstract and Section V-A cannot be properly evaluated.
  4. [§IV-C, Algorithm 1 Step 4] The knowledge-distillation layer assumes the server holds a clean seed set D_clean drawn from the same distribution as client data, and that the GAN can synthesize from that distribution. In privacy-preserving FL, the server is usually not assumed to possess client-distribution-matched data, and this assumption is load-bearing because D_clean initializes the generator. The paper never states the size n of D_clean per dataset, nor does it vary n, the distillation frequency K, or the query budget in a sensitivity analysis. The same applies to the activity-monitoring hyperparameters p, r, and τ_b. Please specify n for every experiment and add an ablation showing how DROP's ASR and MTA depend on D_clean (size and distribution shift) and on K, budget, p, r, and τ_b, since the paper's 'agnostic' claim is only as strong as its least-tuned parameter.
minor comments (4)
  1. [§II-B, Eq. (4)] The notation M is used both for the total number of malicious clients in the federation and for the random variable counting malicious clients in a sampled round; please disambiguate these uses.
  2. [§II-B, Eqs. (2)–(3)] The thresholds λ and τ in the consistency definition are never assigned values in the experiments; please state the values used, if any, or clarify that the definition is qualitative.
  3. [§V-D, Table VII] The caption of Table VII says 'across rounds' but the table shows a single aggregated value per condition; please correct the caption to avoid confusion.
  4. [§V-A, Fig. 5] The round-by-round comparison is only shown for configuration C4; given the paper's emphasis on configuration diversity, it would be helpful to state whether the consistency pattern in Fig. 5 also holds for other configurations.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DROP's claimed robustness is an empirical result against external baselines, with no fitted parameter or self-citation chain forcing the reported ASR.

full rationale

I walked the paper's derivation chain from the threat model through the proposed defense to the experimental claims. The central claim is that DROP achieves near-zero ASR across a range of FL configurations. The 10 'danger zone' configurations in Table II are selected from an undefended attack grid (Figure 2, based on MTA >= 80% and ASR >= 85% without any defense), not from DROP's outputs, so the evaluation is not circular in its benchmark construction. The knowledge distillation step (Algorithm 1 Step 4, Section IV-C) trains a clone network to match ensemble logits of clients surviving clustering via Eq. 10; this is a defense mechanism that fits logits, not the ASR metric that is later reported. No fitted parameter is renamed as a prediction, and the paper does not define DROP's success in terms of its own inputs. The clean seed set Dclean is an availability assumption, and the non-IID limitation (Table VII, CIFAR-10 ASR 88.7-93.0%) plus DROPlet's failure on stealthy attacks (Table IV) are honestly disclosed; these are limitations or assumptions, not circular reasoning. The only self-citation I found is reference [29] (Jagielski et al., which includes authors Oprea and Nita-Rotaru), cited for background on untargeted poisoning attacks; it is not load-bearing for DROP's design or evaluation. Therefore, the derivation is self-contained as an empirical system defense evaluation, and no circular step is present.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central result rests on the availability of clean, distribution-matched seed data for distillation, on the clusterability of benign updates, and on the correctness of the binomial bound used to motivate activity monitoring. The distillation frequency and query budgets are tuned per dataset; the reputation hyperparameters p, r, and tau_b are not reported. No new physical or conceptual entities are introduced.

free parameters (6)
  • penalty increment p
    Used in Eq (7) to increase a client's penalty when flagged suspicious; described as a server-determined hyperparameter, but no value is reported.
  • reward decrement r
    Used in Eq (7) to decrease a client's penalty when flagged benign; described as a server-determined hyperparameter, but no value is reported.
  • ban threshold tau_b
    Used in Algorithm 1 to exclude clients whose penalty exceeds the threshold; no value is reported.
  • distillation frequency K = K=5 for CIFAR-10, K=40 for EMNIST
    Chosen per dataset to balance MTA recovery and computational overhead; reported in Appendix C2 but not derived from a principled criterion.
  • query budget for GAN distillation = 5M queries for CIFAR-10, 4M for EMNIST
    Model-stealing budget that determines synthetic sample quality; values are tuned per dataset.
  • clean seed set size n
    Dclean is stated to be no larger than a single client's dataset, but the exact n and its sampling procedure are not reported.
assumptions (4)
  • domain assumption The server holds a clean seed set Dclean drawn from the same distribution as the federation clients' data.
    Invoked in Algorithm 1 Step 4 and Section IV-C to initialize the GAN; if the seed set is unavailable or misaligned, synthetic queries drift and the clone model cannot neutralize the backdoor.
  • domain assumption Benign client updates cluster together and are separable from malicious updates by Ward agglomerative clustering into exactly two clusters.
    Section IV-A assumes benign updates share a training objective and therefore form a large cluster; Table VII non-IID results show this can fail, especially on CIFAR-10.
  • domain assumption The averaged logits of clients passing the filter are free of backdoor influence.
    Eqs (8)-(9) take the mean of benign-client logits as the distillation target; if an attacker evades clustering, the backdoor signal enters the target and is distilled into the clone.
  • ad hoc to paper The Chernoff-based inequality in Eq (6) is a valid lower bound on the probability that malicious clients are the majority in a round.
    Appendix A applies a Chernoff bound designed for upper tails as a lower bound; the numerical example (C=20, rho=0.4) gives ~0.34 while the exact binomial probability is ~0.13, so the premise as stated is false.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DROP: Poison Dilution via Knowledge Distillation for Federated Learning." pith.science (2026). https://pith.science/paper/YUA4I7IP

@misc{pith2026250207011,
  author       = {Pith},
  title        = {Pith review of: DROP: Poison Dilution via Knowledge Distillation for Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YUA4I7IP}},
  note         = {Machine review of arXiv:2502.07011}
}
read the original abstract

Federated Learning is vulnerable to adversarial manipulation, where malicious clients can inject poisoned updates to influence the global model's behavior. While existing defense mechanisms have made notable progress, they fail to protect against adversaries that aim to induce targeted backdoors under different learning and attack configurations. To address this limitation, we introduce DROP (Distillation-based Reduction Of Poisoning), a novel defense mechanism that combines clustering and activity-tracking techniques with extraction of benign behavior from clients via knowledge distillation to tackle stealthy adversaries that manipulate low data poisoning rates and diverse malicious client ratios within the federation. Through extensive experimentation, our approach demonstrates superior robustness compared to existing defenses across a wide range of learning configurations. Finally, we evaluate existing defenses and our method under the challenging setting of non-IID client data distribution and highlight the challenges of designing a resilient FL defense in this setting.

Figures

Figures reproduced from arXiv: 2502.07011 by the authors.

Figure 1
Figure 1. Examples of CIFAR-10 images from the plane class with an added backdoor trigger (top-left corner). The presence of the trigger causes the model to misclassify these inputs as the horse class, illustrating the effect of a targeted backdoor attack. In this work, we focus on targeted backdoor attacks [38], where adversaries poison a specific subpopulation (victim class) with a hidden trigger. The backdoor activates onl… view at source ↗
Figure 2
Figure 2. Visualizing the impact of the learning configuration [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. ASR (%) for our defense (DROP) and various existing [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Overview of the proposed DROP defense. Each round [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: MTA (a) and ASR (b) across rounds for various defenses, for CIFAR-10 with 1.25% DPR and 20% MCR for [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Visualizing the impact of the FL setup (particularly [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 47 canonical work pages

  1. [1]

    Scaling laws for the value of individual data points in machine learning,

    I. Covert, W. Ji, T. Hashimoto, and J. Zou, “Scaling laws for the value of individual data points in machine learning,” ArXiv, vol. abs/2405.20456,

    arXiv

  2. [2]

    Realizing petabyte scale acoustic modeling,

    S. H. K. Parthasarathi, N. Sivakrishnan, P. Ladkat, and N. Strom, “Realizing petabyte scale acoustic modeling,” IEEE Journal on Emerging and Selected Topics in Circuits and Systems , vol. 9, pp. 422–432,

    work page

  3. [3]

    A survey on federated learning systems: Vision, hype and reality for data privacy and protection,

    Q. Li, Z. Wen, Z. Wu, S. Hu, N. Wang, Y . Li, X. Liu, and B. He, “A survey on federated learning systems: Vision, hype and reality for data privacy and protection,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 4, p. 3347–3366, Apr. 2023. [Online]. Available: http://dx.doi.org/10.1109/ TKDE.2021.3124599

    work page arXiv 2023

  4. [4]

    Sustainable ai: Environmental implications, challenges and opportunities,

    C.-J. Wu, R. Raghavendra, U. Gupta, B. Acun, N. Ardalani, K. Maeng, G. Chang, F. A. Behram, J. Huang, C. Bai, M. K. Gschwind, A. Gupta, M. Ott, A. Melnikov, S. Candido, D. Brooks, G. Chauhan, B. Lee, H.-H. S. Lee, B. Akyildiz, M. Balandat, J. Spisak, R. K. Jain, M. G. Rabbat, and K. M. Hazelwood, “Sustainable ai: Environmental implications, challenges and...

    arXiv 2021

  5. [5]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Ben- nis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , “Advances and open problems in federated learning,” Foundations and trends® in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  6. [6]

    Bad- nets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Bad- nets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    work page 2019

  7. [7]

    Linkage on security, privacy and fairness in federated learning: New balances and new perspectives,

    L. Wang, T. Zhu, W. Zhou, and P. S. Yu, “Linkage on security, privacy and fairness in federated learning: New balances and new perspectives,” ArXiv, vol. abs/2406.10884, 2024. [Online]. Available: https://api. semanticscholar.org/CorpusID:270560767

    arXiv 2024

  8. [8]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” CoRR, vol. abs/1807.00459, 2018

    arXiv 2018

Show all 67 references
  1. [9]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,

    M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. X. Song, A. Madry, B. Li, and T. Goldstein, “Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,” IEEE Transactions on Pattern Analysis and Machine Intelli- gence, vol. 45, pp. 15...

    2020

  2. [10]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Soc, 2018

    2018

  3. [11]

    Get rid of your trail: Remotely erasing backdoors in federated learning,

    M. Alam, H. Lamri, and M. Maniatakos, “Get rid of your trail: Remotely erasing backdoors in federated learning,” IEEE Transactions on Artificial Intelligence , vol. 5, pp. 6683–6698, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:258291574

    2023

  4. [12]

    Concealing backdoor model updates in federated learning by trigger- optimized data poisoning,

    Y . Zhang, N. Z. Gong, and M. K. Reiter, “Concealing backdoor model updates in federated learning by trigger- optimized data poisoning,” ArXiv, vol. abs/2405.06206,

    arXiv

  5. [13]

    A survey for federated learning evaluations: Goals and measures,

    D. Chai, L. Wang, L. Yang, J. Zhang, K. Chen, and Q. Yang, “A survey for federated learning evaluations: Goals and measures,” IEEE Transactions on Knowledge and Data Engineering , vol. 36, pp. 5007–5024,

  6. [14]

    Certified robustness to label-flipping attacks via ran- domized smoothing,

    E. Rosenfeld, E. Winston, P. Ravikumar, and Z. Kolter, “Certified robustness to label-flipping attacks via ran- domized smoothing,” in International Conference on Machine Learning. PMLR, 2020, pp. 8230–8241

    2020

  7. [15]

    Available: https://api.semanticscholar

    [Online]. Available: https://api.semanticscholar. org/CorpusID:269740838

  8. [16]

    Local model poisoning attacks to Byzantine-Robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-Robust federated learning,” in 29th USENIX Security Symposium (USENIX Security 20) . USENIX Association, Aug. 2020, pp. 1605–1622. [Online]. Available: https://www.usenix.org/ conference/usenixse...

    2020

  9. [17]

    Data poisoning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in European Symposium on Research in Computer Security , 2020. [Online]. Available: https: //api.semanticscholar.org/CorpusID:220546077

    2020

  10. [18]

    Byzantine- robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine- robust distributed learning: Towards optimal statistical rates,” in International Conference on Machine Learning, 2018

    2018

  11. [19]

    Poisoning attacks against support vector machines,

    B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” 2013. [Online]. Available: https://arxiv.org/abs/1206.6389

    2013 arXiv

  12. [20]

    FLTrust: Byzantine-robust federated learning via trust bootstrap- ping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrap- ping,” in Network and Distributed System Security (NDSS) Symposium, 2021

    2021

  13. [21]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866, 2018

    2018 arXiv

  14. [22]

    Auror: defending against poisoning attacks in collaborative deep learning systems,

    S. Shen, S. Tople, and P. Saxena, “Auror: defending against poisoning attacks in collaborative deep learning systems,” in Proceedings of the 32nd Annual Conference on Computer Security Applications , ser. ACSAC ’16. New York, NY , USA: Association for Computing Machinery, 2016...

    2016

  15. [23]

    Machine learning with adversaries: Byzan- tine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzan- tine tolerant gradient descent,” in Advances in Neural Information Processing Systems , 2017

    2017

  16. [24]

    {FLAME}: Taming backdoors in federated learning,

    T. D. Nguyen, P. Rieger, R. De Viti, H. Chen, B. B. Brandenburg, H. Yalame, H. M ¨ollering, H. Fereidooni, S. Marchal, M. Miettinen et al. , “ {FLAME}: Taming backdoors in federated learning,” in USENIX Security Symposium, 2022

    2022

  17. [25]

    Flip: A provable defense framework for backdoor mitigation in federated learning,

    K. Zhang, G. Tao, Q. Xu, S. Cheng, S. An, Y . Liu, S. Feng, G. Shen, P.-Y . Chen, S. Ma et al. , “Flip: A provable defense framework for backdoor mitigation in federated learning,” in International Conference on Learning Representations, 2023

    2023

  18. [26]

    Mesas: Poisoning defense for federated learning resilient against adaptive attackers,

    T. Krauß and A. Dmitrienko, “Mesas: Poisoning defense for federated learning resilient against adaptive attackers,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’23. New York, NY , USA: Association for Computing Machinery,...

    2023

  19. [27]

    Flare: defending federated learning against model poisoning attacks via latent space representations,

    N. Wang, Y . Xiao, Y . Chen, Y . Hu, W. Lou, and Y . T. Hou, “Flare: defending federated learning against model poisoning attacks via latent space representations,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, 2022, pp. 946– 958

    2022

  20. [28]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017

    2017

  21. [29]

    Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,

    M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” in 2018 IEEE Symposium on Security and Privacy (SP) , 2018, pp. 19–35

    2018

  22. [30]

    Using machine teaching to identify optimal training-set attacks on machine learners,

    S. Mei and X. Zhu, “Using machine teaching to identify optimal training-set attacks on machine learners,” Proceedings of the AAAI Conference on Artificial Intel- ligence, vol. 29, no. 1, Feb. 2015. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/9569

    2015

  23. [31]

    On the pitfalls of security evaluation of robust federated learning,

    M. A. Khan, V . Shejwalkar, A. Houmansadr, and F. M. Anwar, “On the pitfalls of security evaluation of robust federated learning,” in 2023 IEEE Security and Privacy Workshops (SPW). IEEE, 2023, pp. 57–68

    2023

  24. [32]

    Manipulating the byzantine: Optimizing model poisoning attacks and de- fenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and de- fenses for federated learning,” in Network and Dis- tributed System Security (NDSS) Symposium , 2021

    2021

  25. [33]

    Understanding black-box predictions via influence functions,

    P. W. Koh and P. Liang, “Understanding black-box predictions via influence functions,” inProceedings of the 34th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, D. Precup and Y . W. Teh, Eds., vol. 70. PMLR, 06–11 Aug 2017, pp. 1885...

    2017

  26. [34]

    Poison frogs! targeted clean-label poisoning attacks on neural networks,

    A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” in Advances in Neural Information Processing Systems , S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-B...

    2018

  27. [35]

    Is feature selection secure against training data poisoning?

    H. Xiao, B. Biggio, G. Brown, G. Fumera, C. Eckert, and F. Roli, “Is feature selection secure against training data poisoning?” in Proceedings of the 32nd International Conference on Machine Learning , ser. Proceedings of Machine Learning Research, F. Bach and D. Blei, Eds., v...

    2015

  28. [36]

    Attack of the tails: Yes, you really can backdoor federated learning,

    H. Wang, K. Sreenivasan, S. Rajput, H. Vish- wakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the tails: Yes, you really can backdoor federated learning,” in Advances in Neural Information Processing Systems , H. Larochelle, M. Ranzato, R. Hadsell, M....

    2020

  29. [37]

    Can you really backdoor federated learning?

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” 2019. [Online]. Available: https://arxiv.org/abs/1911.07963

    2019 arXiv

  30. [38]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” CoRR, vol. abs/1712.05526, 2017. [Online]. Available: http://arxiv.org/abs/1712.05526

    2017 arXiv

  31. [39]

    When does machine learning FAIL? generalized transferability for evasion and poisoning attacks,

    O. Suciu, R. Marginean, Y . Kaya, H. D. III, and T. Dumitras, “When does machine learning FAIL? generalized transferability for evasion and poisoning attacks,” in 27th USENIX Security Symposium (USENIX Security 18) . Baltimore, MD: USENIX Association, Aug. 2018, pp. 1299–1316....

    2018

  32. [40]

    Modern hierarchical, agglomerative clustering algorithms,

    D. M ¨ullner, “Modern hierarchical, agglomerative clustering algorithms,” 2011. [Online]. Available: https://arxiv.org/abs/1109.2378

    2011 arXiv

  33. [41]

    Baybfed: Bayesian backdoor defense for federated learning,

    K. Kumari, P. Rieger, H. Fereidooni, M. Jadliwala, and A.-R. Sadeghi, “Baybfed: Bayesian backdoor defense for federated learning,” in 2023 IEEE Symposium on Security and Privacy (SP) , 2023, pp. 737–754

    2023

  34. [42]

    Density- based clustering based on hierarchical density estimates,

    R. J. Campello, D. Moulavi, and J. Sander, “Density- based clustering based on hierarchical density estimates,” in Pacific-Asia conference on knowledge discovery and data mining. Springer, 2013, pp. 160–172

    2013

  35. [43]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing , vol. 70, pp. 1142–1154, 2022

    2022

  36. [44]

    Maze: Data-free model stealing attack using zeroth-order gradi- ent estimation,

    S. Kariyappa, A. Prakash, and M. K. Qureshi, “Maze: Data-free model stealing attack using zeroth-order gradi- ent estimation,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021

    2021

  37. [45]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” 2015

    2015

  38. [46]

    Unsupervised rep- resentation learning with deep convolutional generative adversarial networks,

    A. Radford, L. Metz, and S. Chintala, “Unsupervised rep- resentation learning with deep convolutional generative adversarial networks,” 2016

    2016

  39. [47]

    Hierarchical grouping to optimize an objective function,

    J. H. W. Jr., “Hierarchical grouping to optimize an objective function,” Journal of the American Statistical Association, vol. 58, no. 301, pp. 236–244, 1963. [Online]. Available: https://www.tandfonline.com/doi/ abs/10.1080/01621459.1963.10500845

    1963

  40. [48]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  41. [49]

    Cinic-10 is not imagenet or cifar-10,

    L. N. Darlow, E. J. Crowley, A. Antoniou, and A. J. Storkey, “Cinic-10 is not imagenet or cifar-10,” arXiv preprint arXiv:1810.03505, 2018

    2018 arXiv

  42. [50]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition, 2009, pp. 248–255

    2009

  43. [51]

    Data-free model extraction,

    J.-B. Truong, P. Maini, R. J. Walls, and N. Papernot, “Data-free model extraction,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 4771–4780

    2021

  44. [52]

    The mnist database of handwritten digit im- ages for machine learning research [best of the web],

    L. Deng, “The mnist database of handwritten digit im- ages for machine learning research [best of the web],” IEEE Signal Processing Magazine , vol. 29, no. 6, pp. 141–142, 2012

    2012

  45. [53]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” 2015

    2015

  46. [54]

    Federated learning on non-iid data silos: An experimental study,

    Q. Li, Y . Diao, Q. Chen, and B. He, “Federated learning on non-iid data silos: An experimental study,” 2021. [Online]. Available: https://arxiv.org/abs/2102.02079

    2021 arXiv

  47. [55]

    Emnist: an extension of mnist to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. van Schaik, “Emnist: an extension of mnist to handwritten letters,” 2017

    2017

  48. [56]

    Chameleon: Adapting to peer images for planting durable backdoors in federated learning,

    Y . Dai and S. Li, “Chameleon: Adapting to peer images for planting durable backdoors in federated learning,” 2023. [Online]. Available: https://arxiv.org/ abs/2304.12961

    2023 arXiv

  49. [57]

    Robustness may be at odds with accuracy,

    D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robustness may be at odds with accuracy,” 2019. [Online]. Available: https://arxiv.org/ abs/1805.12152

    2019 arXiv

  50. [58]

    Tutorial on large deviations for the binomial distribution,

    R. Arratia and L. Gordon, “Tutorial on large deviations for the binomial distribution,” Bulletin of mathematical biology, vol. 51, no. 1, pp. 125–131, 1989. APPENDIX A. Bound Analysis on Number of Malicious Clients per Round Let N denote the total number of clients and M the n...

    1989

  51. [59]

    Neurotoxin: Durable backdoors in federated learning,

    Z. Zhang, A. Panda, L. Song, Y . Yang, M. W. Mahoney, J. E. Gonzalez, K. Ramchandran, and P. Mittal, “Neurotoxin: Durable backdoors in federated learning,” 2022. [Online]. Available: https://arxiv.org/ abs/2206.10341

    2022 arXiv

  52. [63]

    leverages discrepancies in penultimate layer representa- tions (PLR) of model updates to assign trust scores and filter out potentially malicious updates. This approach works well for overt poisoning attempts but, as we demonstrate, struggles to mitigate stealthy attacks with ...

  53. [64]

    Baselines: Each of the defense methods which were presented aims to limit the influence of malicious updates during aggregation. However, most works provide limited or inconsistent details about their evaluation setups, particularly concerning client learning configurations su...

  54. [65]

    While it does evaluate the method across different batch sizes, it lacks a detailed discussion of the broader local training setup

    reduces the impact of outliers using robust statistics but primarily focuses on how the data is partitioned among clients. While it does evaluate the method across different batch sizes, it lacks a detailed discussion of the broader local training setup. FLTrust [20] adopts a ...

  55. [66]

    DROP Parameters: Knowledge distillation, particularly in the context of model stealing attacks, is inherently imperfect and cannot replicate the target model exactly, resulting in a minor decrease in MTA. To address this and ensure conver- gence in the FL setting, the knowledg...

  56. [67]

    EMNIST Grid-Search: In the same fashion as Sec- tion III-A for CIFAR-10, we conduct a grid-search analysis over key hyperparameters, varying the client’s learning rate, batch size, and number of epochs on the EMNIST [51] dataset. Our findings in Figure 6 indicate that targeted...

  57. [2019]

    Available: https://api.semanticscholar

    [Online]. Available: https://api.semanticscholar. org/CorpusID:129945028

  58. [2023]

    Available: https://api.semanticscholar

    [Online]. Available: https://api.semanticscholar. org/CorpusID:261076520

  59. [2024]

    Available: https://api.semanticscholar

    [Online]. Available: https://api.semanticscholar. org/CorpusID:270199496

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.