# FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective

arXiv: https://arxiv.org/abs/2110.13864 · HTML: https://mlsanity.com/paper/2110.13864/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 28 references that are in the map.
- First posted on arXiv 26 Oct 2021.

## Builds on (most cited first, 20 of 20)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [On the Convergence of FedAvg on Non-IID Data](https://mlsanity.com/paper/1907.02189/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [On Adaptive Attacks to Adversarial Example Defenses](https://mlsanity.com/paper/2002.08347/) (2020)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Analyzing Federated Learning through an Adversarial Lens](https://mlsanity.com/paper/1811.12470/) (2018)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [Robust Aggregation for Federated Learning](https://mlsanity.com/paper/1912.13445/) (2019)
- [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning](https://mlsanity.com/paper/2007.05084/) (2020)
- [FedML: A Research Library and Benchmark for Federated Machine Learning](https://mlsanity.com/paper/2007.13518/) (2020)
- [A Little Is Enough: Circumventing Defenses For Distributed Learning](https://mlsanity.com/paper/1902.06156/) (2019)
- [Can You Really Backdoor Federated Learning?](https://mlsanity.com/paper/1911.07963/) (2019)
- [Mitigating Sybils in Federated Learning Poisoning](https://mlsanity.com/paper/1808.04866/) (2018)
- [Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging](https://mlsanity.com/paper/1909.05125/) (2019)
- [LotteryFL: Personalized and Communication-Efficient Federated Learning with Lottery Ticket Hypothesis on Non-IID Datasets](https://mlsanity.com/paper/2008.03371/) (2020)
- [Attack-Resistant Federated Learning with Residual-based Reweighting](https://mlsanity.com/paper/1912.11464/) (2019)
- [Universal Multi-Party Poisoning Attacks](https://mlsanity.com/paper/1809.03474/) (2018)

## Built on by (most cited first, 30 of 36)

- [Heterogeneous Federated Learning: State-of-the-art and Research Challenges](https://mlsanity.com/paper/2307.10616/) (2023)
- [Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges](https://mlsanity.com/paper/2201.08135/) (2022)
- [Client Selection in Federated Learning: Principles, Challenges, and Opportunities](https://mlsanity.com/paper/2211.01549/) (2022)
- [Recent Advances on Federated Learning: A Systematic Survey](https://mlsanity.com/paper/2301.01299/) (2023)
- [Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directions](https://mlsanity.com/paper/2303.02213/) (2023)
- [FedSecurity: Benchmarking Attacks and Defenses in Federated Learning and Federated LLMs](https://mlsanity.com/paper/2306.04959/) (2023)
- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges](https://mlsanity.com/paper/2407.06754/) (2024)
- [FedDefender: Client-Side Attack-Tolerant Federated Learning](https://mlsanity.com/paper/2307.09048/) (2023)
- [FRAG: Toward Federated Vector Database Management for Collaborative and Secure Retrieval-Augmented Generation](https://mlsanity.com/paper/2410.13272/) (2024)
- [G2uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering](https://mlsanity.com/paper/2306.04984/) (2023)
- [Secure Federated Learning against Model Poisoning Attacks via Client Filtering](https://mlsanity.com/paper/2304.00160/) (2023)
- [Vertical Federated Unlearning via Backdoor Certification](https://mlsanity.com/paper/2412.11476/) (2024)
- [MixTailor: Mixed Gradient Aggregation for Robust Learning Against Tailored Attacks](https://mlsanity.com/paper/2207.07941/) (2022)
- [Network-Level Adversaries in Federated Learning](https://mlsanity.com/paper/2208.12911/) (2022)
- [Trustworthy Federated Learning: A Survey](https://mlsanity.com/paper/2305.11537/) (2023)
- [Linkage on Security, Privacy and Fairness in Federated Learning: New Balances and New Perspectives](https://mlsanity.com/paper/2406.10884/) (2024)
- [Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2502.05547/) (2025)
- [Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification](https://mlsanity.com/paper/2310.04055/) (2023)
- [Poisoning with A Pill: Circumventing Detection in Federated Learning](https://mlsanity.com/paper/2407.15389/) (2024)
- [On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directions](https://mlsanity.com/paper/2508.13730/) (2025)
- [Fabricated Flips: Poisoning Federated Learning without Data](https://mlsanity.com/paper/2202.05877/) (2022)
- [Secure Cluster-Based Hierarchical Federated Learning in Vehicular Networks](https://mlsanity.com/paper/2505.01186/) (2025)
- [BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2507.04903/) (2025)
- [Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning](https://mlsanity.com/paper/2605.19969/) (2026)
- [FADE: Enabling Federated Adversarial Training on Heterogeneous Resource-Constrained Edge Devices](https://mlsanity.com/paper/2209.03839/) (2022)
- [Secure Hierarchical Federated Learning in Vehicular Networks Using Dynamic Client Selection and Anomaly Detection](https://mlsanity.com/paper/2405.17497/) (2024)
- [SHFL: Secure Hierarchical Federated Learning Framework for Edge Networks](https://mlsanity.com/paper/2409.15067/) (2024)
- [Privacy Attack in Federated Learning is Not Easy: An Experimental Study](https://mlsanity.com/paper/2409.19301/) (2024)
- [Lossless Privacy-Preserving Aggregation for Decentralized Federated Learning](https://mlsanity.com/paper/2501.04409/) (2025)

## Abstract (arXiv)

Federated learning (FL) is a popular distributed learning framework that trains a global model through iterative communications between a central server and edge devices. Recent works have demonstrated that FL is vulnerable to model poisoning attacks. Several server-based defense approaches (e.g. robust aggregation), have been proposed to mitigate such attacks. However, we empirically show that under extremely strong attacks, these defensive methods fail to guarantee the robustness of FL. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks. In this work, we propose a client-based defense, named White Blood Cell for Federated Learning (FL-WBC), which can mitigate model poisoning attacks that have already polluted the global model. The key idea of FL-WBC is to identify the parameter space where long-lasting attack effect on parameters resides and perturb that space during local training. Furthermore, we derive a certified robustness guarantee against model poisoning attacks and a convergence guarantee to FedAvg after applying our FL-WBC. We conduct experiments on FasionMNIST and CIFAR10 to evaluate the defense against state-of-the-art model poisoning attacks. The results demonstrate that our method can effectively mitigate model poisoning attack impact on the global model within 5 communication rounds with nearly no accuracy drop under both IID and Non-IID settings. Our defense is also complementary to existing server-based robust aggregation approaches and can further improve the robustness of FL under extremely strong attacks.