Decoding FL Defenses: Systemization, Pitfalls, and Remedies
Not on the map. Why?
Abstract (arXiv)
While the community has designed various defenses to counter the threat of poisoning attacks in Federated Learning (FL), there are no guidelines for evaluating these defenses. These defenses are prone to subtle pitfalls in their experimental setups that lead to a false sense of security, rendering them unsuitable for practical deployment. In this paper, we systematically understand, identify, and provide a better approach to address these challenges. First, we design a comprehensive systemization of FL defenses along three dimensions: i) how client updates are processed, ii) what the server knows, and iii) at what stage the defense is applied. Next, we thoroughly survey 50 top-tier defense papers and identify the commonly used components in their evaluation setups. Based on this survey, we uncover six distinct pitfalls and study their prevalence. For example, we discover that around 30% of these works solely use the intrinsically robust MNIST dataset, and 40% employ simplistic attacks, which may inadvertently portray their defense as robust. Using three representative defenses as case studies, we perform a critical reevaluation to study the impact of the identified pitfalls and show how they lead to incorrect conclusions about robustness. We provide actionable recommendations to help researchers overcome each pitfall.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 63 of its 100 references that are in the map. First posted on arXiv 3 Feb 2025.
Builds on
63 of 100 references.
References · 63
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
- 2019Advances and Open Problems in Federated Learningcited by 3,021
- 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
- 2020Adaptive Federated Optimizationcited by 1,036
- 2018LEAF: A Benchmark for Federated Settingscited by 780
- 2021Model-Contrastive Federated Learningcited by 762
- 2018How To Backdoor Federated Learningcited by 745
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
38 more
- 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
- 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
- 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
- 2019Robust Aggregation for Federated Learningcited by 314
- 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
- 2019Can You Really Backdoor Federated Learning?cited by 250
- 2020Federated Learning of a Mixture of Global and Local Modelscited by 208
- 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
- 2021Federated Learning for Smart Healthcare: A Surveycited by 182
- 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
- 2018RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasetscited by 148
- 2020Learning from History for Byzantine Robust Optimizationcited by 137
- 2020Byzantine-Robust Learning on Heterogeneous Datasets via Bucketingcited by 125
- 2020Lower Bounds and Optimal Algorithms for Personalized Federated Learningcited by 122
- 2022FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settingscited by 121
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
- 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
- 2018Generalized Byzantine-tolerant SGDcited by 94
- 2019Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfercited by 91
- 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
- 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 86
- 2021Federated Evaluation and Tuning for On-Device Personalization: System Design & Applicationscited by 84
- 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
- 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
- 2019Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attackscited by 79
- 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 72
- 2021Provably Secure Federated Learning against Malicious Clientscited by 60
- 2020Byzantine-Resilient Non-Convex Stochastic Gradient Descentcited by 56
- 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
- 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 52
- 2019Abnormal Client Behavior Detection in Federated Learningcited by 39
- 2020Mitigating Backdoor Attacks in Federated Learningcited by 39
- 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
- 2021Game of Gradients: Mitigating Irrelevant Clients in Federated Learningcited by 35
50 most cited of 63 All 63 (JSON)
Built on by
Not cited yet.