# Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detection

arXiv: https://arxiv.org/abs/1910.13111 · HTML: https://mlsanity.com/paper/1910.13111/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Oct 2019.

## Built on by (most cited first, 26 of 26)

- [CrowdGuard: Federated Backdoor Detection in Federated Learning](https://mlsanity.com/paper/2210.07714/) (2022)
- [Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning](https://mlsanity.com/paper/2304.12961/) (2023)
- [Poisoning Attacks and Defenses on Artificial Intelligence: A Survey](https://mlsanity.com/paper/2202.10276/) (2022)
- [FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attacks](https://mlsanity.com/paper/2308.05832/) (2023)
- [Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges](https://mlsanity.com/paper/2407.06754/) (2024)
- [Combined Federated and Split Learning in Edge Computing for Ubiquitous Intelligence in Internet of Things: State of the Art and Future Directions](https://mlsanity.com/paper/2207.09611/) (2022)
- [Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance](https://mlsanity.com/paper/2402.01096/) (2024)
- [Trustworthy Federated Learning: Privacy, Security, and Beyond](https://mlsanity.com/paper/2411.01583/) (2024)
- [Federated Learning with Unreliable Clients: Performance Analysis and Mechanism Design](https://mlsanity.com/paper/2105.06256/) (2021)
- [FLTracer: Accurate Poisoning Attack Provenance in Federated Learning](https://mlsanity.com/paper/2310.13424/) (2023)
- [Covert Model Poisoning Against Federated Learning: Algorithm Design and Optimization](https://mlsanity.com/paper/2101.11799/) (2021)
- [Performance Weighting for Robust Federated Learning Against Corrupted Sources](https://mlsanity.com/paper/2205.01184/) (2022)
- [Bristle: Decentralized Federated Learning in Byzantine, Non-i.i.d. Environments](https://mlsanity.com/paper/2110.11006/) (2021)
- [FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks](https://mlsanity.com/paper/2310.02113/) (2023)
- [BoBa: Boosting Backdoor Detection through Data Distribution Inference in Federated Learning](https://mlsanity.com/paper/2407.09658/) (2024)
- [Practical Framework for Privacy-Preserving and Byzantine-robust Federated Learning](https://mlsanity.com/paper/2512.17254/) (2025)
- [New data poison attacks on machine learning classifiers for mobile exfiltration](https://mlsanity.com/paper/2210.11592/) (2022)
- [BadReward: Clean-Label Poisoning of Reward Models in Text-to-Image RLHF](https://mlsanity.com/paper/2506.03234/) (2025)
- [Fabricated Flips: Poisoning Federated Learning without Data](https://mlsanity.com/paper/2202.05877/) (2022)
- [Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations](https://mlsanity.com/paper/2306.03600/) (2023)
- [Data Poisoning and Leakage Analysis in Federated Learning](https://mlsanity.com/paper/2409.13004/) (2024)
- [SoK: Towards Security and Safety of Edge AI](https://mlsanity.com/paper/2410.05349/) (2024)
- [CrowdTransfer: Enabling Crowd Knowledge Transfer in AIoT Community](https://mlsanity.com/paper/2407.06485/) (2024)
- [Data Distribution Shifts in (Industrial) Federated Learning as a Privacy Issue](https://mlsanity.com/paper/2409.13875/) (2024)
- [TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data](https://mlsanity.com/paper/2504.15674/) (2025)
- [Generative Adversarial Networks Applied for Privacy Preservation in Biometric-Based Authentication and Identification](https://mlsanity.com/paper/2509.20024/) (2025)

## Abstract (arXiv)

Collaborative learning allows multiple clients to train a joint model without sharing their data with each other. Each client performs training locally and then submits the model updates to a central server for aggregation. Since the server has no visibility into the process of generating the updates, collaborative learning is vulnerable to poisoning attacks where a malicious client can generate a poisoned update to introduce backdoor functionality to the joint model. The existing solutions for detecting poisoned updates, however, fail to defend against the recently proposed attacks, especially in the non-IID setting. In this paper, we present a novel defense scheme to detect anomalous updates in both IID and non-IID settings. Our key idea is to realize client-side cross-validation, where each update is evaluated over other clients' local data. The server will adjust the weights of the updates based on the evaluation results when performing aggregation. To adapt to the unbalanced distribution of data in the non-IID setting, a dynamic client allocation mechanism is designed to assign detection tasks to the most suitable clients. During the detection process, we also protect the client-level privacy to prevent malicious clients from stealing the training data of other clients, by integrating differential privacy with our design without degrading the detection performance. Our experimental evaluations on two real-world datasets show that our scheme is significantly robust to two representative poisoning attacks.