# LoMar: A Local Defense Against Poisoning Attack on Federated Learning

arXiv: https://arxiv.org/abs/2201.02873 · HTML: https://mlsanity.com/paper/2201.02873/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 63 references that are in the map.
- First posted on arXiv 8 Jan 2022.

## Builds on (most cited first, 23 of 23)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Spectral Signatures in Backdoor Attacks](https://mlsanity.com/paper/1811.00636/) (2018)
- [Analyzing Federated Learning through an Adversarial Lens](https://mlsanity.com/paper/1811.12470/) (2018)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [Data Poisoning Attacks Against Federated Learning Systems](https://mlsanity.com/paper/2007.08432/) (2020)
- [Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning](https://mlsanity.com/paper/1804.00308/) (2018)
- [Mitigating Sybils in Federated Learning Poisoning](https://mlsanity.com/paper/1808.04866/) (2018)
- [Technical Report on the CleverHans v2.1.0 Adversarial Examples Library](https://mlsanity.com/paper/1610.00768/) (2016)
- [MetaPoison: Practical General-purpose Clean-label Data Poisoning](https://mlsanity.com/paper/2004.00225/) (2020)
- [Generalized Byzantine-tolerant SGD](https://mlsanity.com/paper/1802.10116/) (2018)
- [Learning to Detect Malicious Clients for Robust Federated Learning](https://mlsanity.com/paper/2002.00211/) (2020)
- [Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks](https://mlsanity.com/paper/1803.06975/) (2018)
- [Free-rider Attacks on Model Aggregation in Federated Learning](https://mlsanity.com/paper/2006.11901/) (2020)

## Built on by (most cited first, 30 of 31)

- [Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges](https://mlsanity.com/paper/2201.08135/) (2022)
- [FedSecurity: Benchmarking Attacks and Defenses in Federated Learning and Federated LLMs](https://mlsanity.com/paper/2306.04959/) (2023)
- [Text-driven Prompt Generation for Vision-Language Models in Federated Learning](https://mlsanity.com/paper/2310.06123/) (2023)
- [FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attacks](https://mlsanity.com/paper/2308.05832/) (2023)
- [Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance](https://mlsanity.com/paper/2402.01096/) (2024)
- [Preference Poisoning Attacks on Reward Model Learning](https://mlsanity.com/paper/2402.01920/) (2024)
- [Open Challenges and Opportunities in Federated Foundation Models Towards Biomedical Healthcare](https://mlsanity.com/paper/2405.06784/) (2024)
- [AdaER: An Adaptive Experience Replay Approach for Continual Lifelong Learning](https://mlsanity.com/paper/2308.03810/) (2023)
- [Data-Agnostic Model Poisoning against Federated Learning: A Graph Autoencoder Approach](https://mlsanity.com/paper/2311.18498/) (2023)
- [SARMAE: Masked Autoencoder for SAR Representation Learning](https://mlsanity.com/paper/2512.16635/) (2025)
- [A Survey on Trustworthy Edge Intelligence: From Security and Reliability To Transparency and Sustainability](https://mlsanity.com/paper/2310.17944/) (2023)
- [AGRAMPLIFIER: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification](https://mlsanity.com/paper/2311.06996/) (2023)
- [A Model Consistency-Based Countermeasure to GAN-Based Data Poisoning Attack in Federated Learning](https://mlsanity.com/paper/2405.11440/) (2024)
- [EAB-FL: Exacerbating Algorithmic Bias through Model Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2410.02042/) (2024)
- [Poisoning Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2301.05795/) (2023)
- [FedRDF: A Robust and Dynamic Aggregation Function against Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2402.10082/) (2024)
- [Leverage Variational Graph Representation For Model Poisoning on Federated Learning](https://mlsanity.com/paper/2404.15042/) (2024)
- [GloPath: An Entity-Centric Foundation Model for Glomerular Lesion Assessment and Clinicopathological Insights](https://mlsanity.com/paper/2603.02926/) (2026)
- [Communication-Efficient Diffusion Strategy for Performance Improvement of Federated Learning with Non-IID Data](https://mlsanity.com/paper/2207.07493/) (2022)
- [Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2404.04139/) (2024)
- [Data Poisoning and Leakage Analysis in Federated Learning](https://mlsanity.com/paper/2409.13004/) (2024)
- [Defending Against Diverse Attacks in Federated Learning Through Consensus-Based Bi-Level Optimization](https://mlsanity.com/paper/2412.02535/) (2024)
- [DaringFed: A Dynamic Bayesian Persuasion Pricing for Online Federated Learning under Two-sided Incomplete Information](https://mlsanity.com/paper/2505.05842/) (2025)
- [ASMR: Angular Support for Malfunctioning Client Resilience in Federated Learning](https://mlsanity.com/paper/2508.02414/) (2025)
- [FLAegis: A Two-Layer Defense Framework for Federated Learning Against Poisoning Attacks](https://mlsanity.com/paper/2508.18737/) (2025)
- [MGSER-SAM: Memory-Guided Soft Experience Replay with Sharpness-Aware Optimization for Enhanced Continual Learning](https://mlsanity.com/paper/2405.09492/) (2024)
- [SHFL: Secure Hierarchical Federated Learning Framework for Edge Networks](https://mlsanity.com/paper/2409.15067/) (2024)
- [Client-Side Patching against Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2412.10605/) (2024)
- [PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT](https://mlsanity.com/paper/2602.17973/) (2026)
- [PCDM: A Diffusion-Based Data Poisoning Attack Against Federated Learning Systems](https://mlsanity.com/paper/2605.16098/) (2026)

## Abstract (arXiv)

Federated learning (FL) provides a high efficient decentralized machine learning framework, where the training data remains distributed at remote clients in a network. Though FL enables a privacy-preserving mobile edge computing framework using IoT devices, recent studies have shown that this approach is susceptible to poisoning attacks from the side of remote clients. To address the poisoning attacks on FL, we provide a textittwo-phase defense algorithm called Local Malicious Factor (LoMar). In phase I, LoMar scores model updates from each remote client by measuring the relative distribution over their neighbors using a kernel density estimation method. In phase II, an optimal threshold is approximated to distinguish malicious and clean updates from a statistical perspective. Comprehensive experiments on four real-world datasets have been conducted, and the experimental results show that our defense strategy can effectively protect the FL system. Specifically, the defense performance on Amazon dataset under a label-flipping attack indicates that, compared with FG+Krum, LoMar increases the target label testing accuracy from 96.0% to 98.8%, and the overall averaged testing accuracy from 90.1% to 97.0%.