Data to 7 Oct 2026

A Little Is Enough: Circumventing Defenses For Distributed Learning

arXiv 1902.06156 ↗First posted 16 Feb 2019cs.LG cs.CR cs.DCcited by 285

Not on the map. Why?

Abstract (arXiv)

Distributed learning is central for large-scale training of deep-learning models. However, they are exposed to a security threat in which Byzantine participants can interrupt or control the learning process. Previous attack models and their corresponding defenses assume that the rogue participants are (a) omniscient (know the data of all other participants), and (b) introduce large change to the parameters. We show that small but well-crafted changes are sufficient, leading to a novel non-omniscient attack on distributed learning that go undetected by all existing defenses. We demonstrate our attack method works not only for preventing convergence but also for repurposing of the model behavior (backdooring). We show that 20% of corrupt workers are sufficient to degrade a CIFAR10 model accuracy by 50%, as well as to introduce backdoors into MNIST and CIFAR10 models without hurting their accuracy

Key facts. Cited by 285 papers in the map (data through 7 Oct 2026). First posted on arXiv 16 Feb 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 32; 2022: 30; 2023: 52; 2024: 61; 2025: 70; 2026: 40.

285 papers.

Sort:

By area:

2021A Field Guide to Federated Optimizationcited by 312
2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 97
2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
2023Fixing by Mixing: A Recipe for Optimal Byzantine ML under Heterogeneitycited by 64
2022Byzantine Machine Learning Made Easy by Resilient Averaging of Momentumscited by 63
2021Provably Secure Federated Learning against Malicious Clientscited by 60
2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
2021Fault-Tolerant Federated Reinforcement Learning with Theoretical Guaranteecited by 52
2021FedGEMS: Federated Learning of Larger Server Models via Selective Knowledge Fusioncited by 49

38 more

2024Byzantine-Robust Decentralized Federated Learningcited by 47
2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
2023Recent Advances on Federated Learning: A Systematic Surveycited by 40
2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotioncited by 37
2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 35
2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directionscited by 33
2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
2022Byzantine-Robust Decentralized Learning via ClippedGossipcited by 29
2021Byzantine-robust Federated Learning through Collaborative Malicious Gradient Filteringcited by 28
2023A Survey on Decentralized Federated Learningcited by 27
2023Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneitycited by 25
2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 25
2023On the Privacy-Robustness-Utility Trilemma in Distributed Learningcited by 24
2023Sensitivity-Aware Amortized Bayesian Inferencecited by 20
2022FedRecAttack: Model Poisoning Attack to Federated Recommendationcited by 18
2023Practical Differentially Private and Byzantine-resilient Federated Learningcited by 18
2024Emerging Safety Attack and Defense in Federated Instruction Tuning of Large Language Modelscited by 18
2021Robust Federated Learning with Attack-Adaptive Aggregationcited by 17
2021Differential Privacy and Byzantine Resilience in SGD: Do They Add Up?cited by 17
2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
2022An Equivalence Between Data Poisoning and Byzantine Gradient Attackscited by 16
2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
2023FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregationcited by 16
2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
2024Poisoning Federated Recommender Systems with Fake Userscited by 15
2024Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challengescited by 14
2021Stragglers Are Not Disaster: A Hybrid Federated Learning Algorithm with Delayed Gradientscited by 13
2023Byzantine-Robust Learning on Heterogeneous Data via Gradient Splittingcited by 13
2024Byzantine-Robust Federated Learning: Impact of Client Subsampling and Local Updatescited by 13
2024Achieving Byzantine-Resilient Federated Learning via Layer-Adaptive Sparsified Model Aggregationcited by 13
2025Do We Really Need to Design New Byzantine-robust Aggregation Rules?cited by 13
2025Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspectioncited by 13
2021Data Poisoning Attacks and Defenses to Crowdsourcing Systemscited by 12
2022Robust Collaborative Learning with Linear Gradient Overheadcited by 12
2023FedDefender: Client-Side Attack-Tolerant Federated Learningcited by 12
2023Communication Compression for Byzantine Robust Learning: New Efficient Algorithms and Improved Ratescited by 12
2024Advances in Robust Federated Learning: A Survey with Heterogeneity Considerationscited by 12
2021Secure Distributed Training at Scalecited by 11

50 most cited of 285 All 285 (JSON)