SoK: Benchmarking Poisoning Attacks and Defenses in Federated Learning
On the map: LLM safety and security → Federated unlearning and poisoning
Abstract (arXiv)
Federated learning (FL) enables collaborative model training while preserving data privacy, but its decentralized nature exposes it to client-side data poisoning attacks (DPAs) and model poisoning attacks (MPAs) that degrade global model performance. While numerous proposed defenses claim substantial effectiveness, their evaluation is typically done in isolation with limited attack strategies, raising concerns about their validity. Additionally, existing studies overlook the mutual effectiveness of defenses against both DPAs and MPAs, causing fragmentation in this field. This paper aims to provide a unified benchmark and analysis of defenses against DPAs and MPAs, clarifying the distinction between these two similar but slightly distinct domains. We present a systematic taxonomy of poisoning attacks and defense strategies, outlining their design, strengths, and limitations. Then, a unified comparative evaluation across FL algorithms and data heterogeneity is conducted to validate their individual and mutual effectiveness and derive key insights for design principles and future research. Along with the analysis, we frame our work to a unified benchmark, FLPoison, with high modularity and scalability to evaluate 15 representative poisoning attacks and 17 defense strategies, facilitating future research in this domain. Code is available at https://github.com/vio1etus/FLPoison.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. First posted on arXiv 6 Feb 2025.
Builds on
0 of 0 references.
No references here yet.
Built on by
Citing papers per year: 2025: 2; 2026: 1.
3 papers.
- 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
- 2025FLARE: Adaptive Multi-Dimensional Reputation for Robust Client Reliability in Federated Learningcited by 1
- 2026Graph Representation Learning Augmented Model Manipulation on Federated Fine-Tuning of LLMscited by 1
- 2026Graph Representation Learning Augmented Model Manipulation on Federated Fine-Tuning of LLMs8 May 2026
- 2025FLARE: Adaptive Multi-Dimensional Reputation for Robust Client Reliability in Federated Learning18 Nov 2025
- 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning7 Jul 2025
Similar, not cited
Close in wording, no citation either way
- 2024Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learning
- 2024Defending against Data Poisoning Attacks in Federated Learning via User Elimination
- 2024Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense
- 2024Data Poisoning and Leakage Analysis in Federated Learning
- 2023A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspective
- 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning
- 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
- 2024Fake or Compromised? Making Sense of Malicious Clients in Federated Learning