Figures (8)  Tables (5)

    • Figure 1. 

      Workflow of contribution-evaluation poisoning attack in federated learning.

    • Figure 2. 

      Workflow of fake-client-based model poisoning attack in federated learning.

    • Figure 3. 

      ProFlip workflow.

    • Figure 4. 

      Overview of 3DFed framework.

    • Figure 5. 

      System model of GCAMA.

    • Figure 6. 

      System overview of FreqFed.

    • Figure 7. 

      Filtering layer of DeepSight.

    • Figure 8. 

      Structure of DeepSight.

    • Symbol Description
      $t$ Communication round in federated learning.
      $i,k$ Client index.
      $K$ Total number of clients.
      $m$ Number of malicious clients or fake clients, depending on the context.
      $w^t$, $W_t$, or $G_t$ Global model at round $t$, with notation depending on the reviewed method.
      $w_i^t$ or $W_i^t$ Local model or local update submitted by client $i$.
      $\Delta_i^t$ or $g_i^t$ Local model update or gradient update of client $i$.
      ${\cal{A}}(\cdot)$ or $\Lambda(\cdot)$ Aggregation rule or aggregation process.
      $s$ Attack direction or estimated benign update direction.
      $S$ Context-dependent symbol; it may denote an output event set in DP definitions or a clipping bound in DP-SGD.
      $\epsilon,\delta$ Differential privacy parameters.
      $\sigma$ Gaussian noise scale or noise multiplier.
      $\lambda,\tau,\beta$ Method-specific control parameters.
      ASR Attack success rate.
      MTA Main task accuracy.

      Table 1. 

      Frequently used notation in this survey.

    • Category Byzantine attacks Backdoor attacks
      Objective Global performance degradation Hidden malicious functionality
      Target Training and aggregation Inference behavior
      Specificity Untargeted Targeted
      Attack means Malicious model updates Poisoned data or updates
      Clean accuracy Severely affected Largely preserved
      Stealthiness Low High
      Activation Always active Trigger-based
      Threat type Availability and robustness Integrity and trustworthiness

      Table 2. 

      Comparison of Byzantine and backdoor attacks in federated learning.

    • AttackMechanismStealthiness
      ACEPredict global update, disguise contributionHigh
      OPTReverse optimization vs aggregation rulesModerate
      MPAFLarge-scale fake clients push base modelModerate
      PFFlip critical bits in deployed modelHigh
      3DFMulti-objective optimization + noise masksVery high
      ACE: contribution evaluation poisoning; OPT: optimization-based poisoning; MPAF: fake-client poisoning; PF: ProFlip bit-flip backdoor; 3DF: adaptive backdoor.

      Table 3. 

      Comparison of poisoning attack methods in FL.

    • Category Defense strategy Attack type Key limitation
      Robust aggregation Median, trimmed mean Byzantine Ineffective against backdoors
      Update filtering Similarity/anomaly detection Byzantine Adaptive attacks
      Backdoor detection Trigger inference Backdoor Trigger dependency
      Backdoor mitigation Fine-tuning, unlearning Backdoor Extra computation
      Hybrid defense Joint filtering and mitigation Both Increased complexity

      Table 4. 

      Comparison of defense mechanisms against poisoning attacks in federated learning.

    • Defense Mechanism Limitation
      RA Robust aggregation (median, trimmed mean) Ineffective against backdoors
      UF Update filtering (similarity/anomaly detection) Vulnerable to adaptive attacks
      BD Backdoor detection (trigger inference) Depends on trigger knowledge
      BM Backdoor mitigation (fine-tuning, unlearning) Extra computation cost
      HD Hybrid defense (joint filtering + mitigation) Increased complexity
      RA: robust aggregation; UF: update filtering; BD: backdoor detection; BM: backdoor mitigation; HD: hybrid defense.

      Table 5. 

      Comparison of defense strategies in FL.