# Untargeted Poisoning Attack Detection in Federated Learning via Behavior Attestation

arXiv: https://arxiv.org/abs/2101.10904 · HTML: https://mlsanity.com/paper/2101.10904/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 32 references that are in the map.
- First posted on arXiv 24 Jan 2021.

## Builds on (most cited first, 13 of 13)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Analyzing Federated Learning through an Adversarial Lens](https://mlsanity.com/paper/1811.12470/) (2018)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [Data Poisoning Attacks Against Federated Learning Systems](https://mlsanity.com/paper/2007.08432/) (2020)
- [Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning](https://mlsanity.com/paper/1804.00308/) (2018)
- [Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization](https://mlsanity.com/paper/1708.08689/) (2017)
- [Threats to Federated Learning: A Survey](https://mlsanity.com/paper/2003.02133/) (2020)
- [Mitigating Sybils in Federated Learning Poisoning](https://mlsanity.com/paper/1808.04866/) (2018)
- [Ensemble Convolutional Neural Networks for Mode Inference in Smartphone Travel Survey](https://mlsanity.com/paper/1904.08933/) (2019)

## Built on by (most cited first, 13 of 13)

- [FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation](https://mlsanity.com/paper/2305.05506/) (2023)
- [Long-Short History of Gradients is All You Need: Detecting Malicious and Unreliable Clients in Federated Learning](https://mlsanity.com/paper/2208.10273/) (2022)
- [Can We Trust the Similarity Measurement in Federated Learning?](https://mlsanity.com/paper/2311.03369/) (2023)
- [Towards Reliable Participation in UAV-Enabled Federated Edge Learning on Non-IID Data](https://mlsanity.com/paper/2312.10411/) (2023)
- [Fragile Giants: Understanding the Susceptibility of Models to Subpopulation Attacks](https://mlsanity.com/paper/2410.08872/) (2024)
- [FedSAUC: A Similarity-Aware Update Control for Communication-Efficient Federated Learning in Edge Computing](https://mlsanity.com/paper/2504.04867/) (2025)
- [On the Initial Behavior Monitoring Issues in Federated Learning](https://mlsanity.com/paper/2109.05385/) (2021)
- [Federated Learning based on Defending Against Data Poisoning Attacks in IoT](https://mlsanity.com/paper/2209.06397/) (2022)
- [Covert Communication Based on the Poisoning Attack in Federated Learning](https://mlsanity.com/paper/2306.01342/) (2023)
- [Multi-Model based Federated Learning Against Model Poisoning Attack: A Deep Learning Based Model Selection for MEC Systems](https://mlsanity.com/paper/2409.08237/) (2024)
- [Decoding FL Defenses: Systemization, Pitfalls, and Remedies](https://mlsanity.com/paper/2502.05211/) (2025)
- [FIDELIS: Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2508.10042/) (2025)
- [PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning](https://mlsanity.com/paper/2603.23574/) (2026)

## Abstract (arXiv)

Federated Learning (FL) is a paradigm in Machine Learning (ML) that addresses data privacy, security, access rights and access to heterogeneous information issues by training a global model using distributed nodes. Despite its advantages, there is an increased potential for cyberattacks on FL-based ML techniques that can undermine the benefits. Model-poisoning attacks on FL target the availability of the model. The adversarial objective is to disrupt the training. We propose attestedFL, a defense mechanism that monitors the training of individual nodes through state persistence in order to detect a malicious worker. A fine-grained assessment of the history of the worker permits the evaluation of its behavior in time and results in innovative detection strategies. We present three lines of defense that aim at assessing if the worker is reliable by observing if the node is really training, advancing towards a goal. Our defense exposes an attacker's malicious behavior and removes unreliable nodes from the aggregation process so that the FL process converge faster. Through extensive evaluations and against various adversarial settings, attestedFL increased the accuracy of the model between 12% to 58% under different scenarios such as attacks performed at different stages of convergence, attackers colluding and continuous attacks.