mlsanityData to 14 Oct 2026

Federated Learning Attacks and Defenses: A Survey

arXiv 2211.14952 ↗First posted 27 Nov 2022cs.CR cs.AIcited by 12

Not on the map. Why?

Abstract (arXiv)

In terms of artificial intelligence, there are several security and privacy deficiencies in the traditional centralized training methods of machine learning models by a server. To address this limitation, federated learning (FL) has been proposed and is known for breaking down ``data silos" and protecting the privacy of users. However, FL has not yet gained popularity in the industry, mainly due to its security, privacy, and high cost of communication. For the purpose of advancing the research in this field, building a robust FL system, and realizing the wide application of FL, this paper sorts out the possible attacks and corresponding defenses of the current FL system systematically. Firstly, this paper briefly introduces the basic workflow of FL and related knowledge of attacks and defenses. It reviews a great deal of research about privacy theft and malicious attacks that have been studied in recent years. Most importantly, in view of the current three classification criteria, namely the three stages of machine learning, the three different roles in federated learning, and the CIA (Confidentiality, Integrity, and Availability) guidelines on privacy protection, we divide attack approaches into two categories according to the training stage and the prediction stage in machine learning. Furthermore, we also identify the CIA property violated for each attack method and potential attack role. Various defense mechanisms are then analyzed separately from the level of privacy and security. Finally, we summarize the possible challenges in the application of FL from the aspect of attacks and defenses and discuss the future development direction of FL systems. In this way, the designed FL system has the ability to resist different attacks and is more secure and stable.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 44 of its 100 references that are in the map. First posted on arXiv 27 Nov 2022.

Builds on

44 of 100 references.

References · 44

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2019Advances and Open Problems in Federated Learningcited by 3,046
  4. 2016Deep Learning with Differential Privacycited by 2,728
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,538
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2019Deep Leakage from Gradientscited by 1,021
  9. 2018How To Backdoor Federated Learningcited by 765
  10. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  11. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  12. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
32 more
  1. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  2. 2020Backdoor Learning: A Surveycited by 426
  3. 2019Federated Machine Learning: Concept and Applicationscited by 412
  4. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  5. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  6. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  7. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  8. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  9. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  10. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 275
  11. 2020Threats to Federated Learning: A Surveycited by 178
  12. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  13. 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 166
  14. 2018Mitigating Sybils in Federated Learning Poisoningcited by 161
  15. 2019Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulationcited by 141
  16. 2021Federated Learning for Open Bankingcited by 141
  17. 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 130
  18. 2018Stealing Hyperparameters in Machine Learningcited by 118
  19. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  20. 2021Rethinking Architecture Design for Tackling Data Heterogeneity in Federated Learningcited by 111
  21. 2020Feature Inference Attack on Model Predictions in Vertical Federated Learningcited by 106
  22. 2019Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attackscited by 79
  23. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 69
  24. 2021Blockchain Assisted Decentralized Federated Learning (BLADE-FL): Performance Analysis and Resource Allocationcited by 56
  25. 2019Free-riders in Federated Learning: Attacks and Defensescited by 49
  26. 2017Adversarial Examples that Fool Detectorscited by 40
  27. 2021GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learningcited by 36
  28. 2021CaPC Learning: Confidential and Private Collaborative Learningcited by 33
  29. 2018A Survey of Utility-Oriented Pattern Miningcited by 27
  30. 2022Federated Learning with Heterogeneous Architectures using Graph HyperNetworkscited by 19
  31. 2020GFL: A Decentralized Federated Learning Framework Based On Blockchaincited by 12
  32. 2019Quantifying the Performance of Federated Transfer Learningcited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 4; 2025: 3; 2026: 1.

12 papers.

  1. 2023Model-as-a-Service (MaaS): A Surveycited by 25
  2. 2025Mixture of Experts (MoE): A Big Data Perspectivecited by 18
  3. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  4. 2023FedDefender: Client-Side Attack-Tolerant Federated Learningcited by 12
  5. 2024A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspectivecited by 7
  6. 2023Federated Learning for Metaverse: A Surveycited by 3
  7. 2024Defending against Data Poisoning Attacks in Federated Learning via User Eliminationcited by 1
  8. 2023DISBELIEVE: Distance Between Client Models is Very Essential for Effective Local Model Poisoning Attackscited by 0
  9. 2024An Empirical Analysis of Federated Learning Models Subject to Label-Flipping Adversarial Attackcited by 0
  10. 2025Defending Against Gradient Inversion Attacks for Biomedical Images via Learnable Data Perturbationcited by 0
  11. 2025Poison to Detect: Detection of Targeted Overfitting in Federated Learningcited by 0
  12. 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunitiescited by 0