{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T03:39:46Z","timestamp":1777174786615,"version":"3.51.4"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T00:00:00Z","timestamp":1777161600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T00:00:00Z","timestamp":1777161600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"JSPS KAKENHI","award":["25K15290"],"award-info":[{"award-number":["25K15290"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Supercomput"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Federated Learning (FL) enables multiple clients to collaboratively train a shared model without exposing local data, making it a fundamental paradigm for large-scale distributed intelligence. However, in practical edge-cloud deployments, the server must inspect a large volume of high-dimensional client updates within tight communication windows, which makes secure aggregation a problem closely tied to parallel processing, real-time response, and high-performance computing (HPC) resources. Among the major threats to FL, backdoor attacks are particularly insidious because they implant malicious behaviors into the global model while preserving benign-task performance. Although pre-aggregation defenses based on gradient analysis are promising, the current state-of-the-art methods such as Scope suffer from two key limitations: fixed parameters are ineffective against adaptive attackers, and single-point clustering is vulnerable to failure under heterogeneous (non-IID) data distributions. To address these limitations, we propose FAROS, a robust and HPC-friendly defense framework that generalizes the transform-and-cluster paradigm. FAROS incorporates two key components: Adaptive Differential Scaling (ADS), which dynamically adjusts defense sensitivity according to the dispersion of client gradients, and Robust Core-set Computing (RCC), which replaces single-point clustering with a consensus-based centroid derived from a stable core-set. This design improves robustness while preserving server-side efficiency through vectorizable similarity computation and parallelizable filtering. Extensive experiments on multiple datasets, models, and attack settings show that FAROS consistently outperforms existing defenses in both attack suppression and benign-task accuracy, while remaining compatible with scalable distributed FL infrastructures.<\/jats:p>","DOI":"10.1007\/s11227-026-08527-0","type":"journal-article","created":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T03:31:24Z","timestamp":1777174284000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Faros: robust federated learning with adaptive scaling against backdoor attacks"],"prefix":"10.1007","volume":"82","author":[{"given":"Chenyu","family":"Hu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiming","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sinan","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nianyu","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mingyue","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jialong","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,26]]},"reference":[{"key":"8527_CR1","unstructured":"McMahan B, Moore E, Ramage D, Hampson S, Blaise Ag\u00fcera Y, Arcas. (2017) Communication-efficient learning of deep networks from decentralized data. In: International Conference on Artificial Intelligence and Statistics 54:1273\u20131282"},{"key":"8527_CR2","unstructured":"Kone\u010dn\u00fd J, McMahan HB, Yu FX, Richt\u00e1rik P, Suresh AT, Bacon D (2016) Federated learning: strategies for improving communication efficiency. CoRR, abs\/1610.05492,"},{"key":"8527_CR3","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110909","volume":"256","author":"H-R Zhang","year":"2025","unstructured":"Zhang H-R, Wang K-X, Liang X-Y, Yi-Fan Yu (2025) DUPS: data poisoning attacks with uncertain sample selection for federated learning. Comput Networks 256:110909","journal-title":"Comput Networks"},{"key":"8527_CR4","doi-asserted-by":"publisher","first-page":"6529","DOI":"10.1109\/TIFS.2025.3581743","volume":"20","author":"L Bai","year":"2025","unstructured":"Bai L, Zhang X, Zhang S, Ye Q, Haibo H (2025) Provfl: property inference attacks against vertical federated learning. IEEE Trans Inf Forensics Secur 20:6529\u20136543","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"8527_CR5","doi-asserted-by":"crossref","unstructured":"Sanon SP, Reddy R, Lipps C, Schotten HD (2024) Ddos attacks in communication: Analysis and mitigation of unreliable clients in federated learning. In: IEEE Consumer Communications and Networking Conference, pages 986\u2013989,","DOI":"10.1109\/CCNC51664.2024.10454783"},{"key":"8527_CR6","unstructured":"Fraboni Y, Vidal R, Lorenzi M (2021) Free-rider attacks on model aggregation in federated learning. In: International Conference on Artificial Intelligence and Statistics 130:1846\u20131854"},{"key":"8527_CR7","doi-asserted-by":"publisher","first-page":"2096","DOI":"10.1109\/TIFS.2025.3539087","volume":"20","author":"Z Ma","year":"2025","unstructured":"Ma Z, Huang X, Wang Z, Qin Z, Wang X, Ma J (2025) Fedghost: data-free model poisoning enhancement in federated learning. IEEE Trans Inf Forensics Secur 20:2096\u20132108","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"6","key":"8527_CR8","doi-asserted-by":"publisher","first-page":"827","DOI":"10.1109\/TBDATA.2022.3224392","volume":"10","author":"X Xiao","year":"2024","unstructured":"Xiao X, Tang Z, Li C, Jiang B, Li K (2024) SBPA: sybil-based backdoor poisoning attacks for distributed big data in aiot-based federated learning system. IEEE Transactions on Big Data 10(6):827\u2013838","journal-title":"IEEE Transactions on Big Data"},{"key":"8527_CR9","doi-asserted-by":"publisher","first-page":"3877","DOI":"10.1109\/TIFS.2025.3555193","volume":"20","author":"L Yang","year":"2025","unstructured":"Yang L, Miao Y, Liu Z, Liu Z, Li X, Kuang D, Li H, Deng RH (2025) Enhanced model poisoning attack and multi-strategy defense in federated learning. IEEE Trans Inf Forensics Secur 20:3877\u20133892","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"8527_CR10","doi-asserted-by":"crossref","unstructured":"Yueqi Xie, Minghong Fang, and Neil\u00a0Zhenqiang Gong. Model poisoning attacks to federated learning via multi-round consistency. In: IEEE Conference on Computer Vision and Pattern Recognition, pages 15454\u201315463, 2025","DOI":"10.1109\/CVPR52734.2025.01440"},{"key":"8527_CR11","unstructured":"Arjun\u00a0Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin\u00a0B. Calo. Analyzing federated learning through an adversarial lens. In: International Conference on Machine Learning, volume\u00a097, pages 634\u2013643, 2019"},{"key":"8527_CR12","unstructured":"Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil\u00a0Zhenqiang Gong. Local model poisoning attacks to byzantine-robust federated learning. In: USENIX Security Symposium, pages 1605\u20131622, 2020"},{"key":"8527_CR13","unstructured":"Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu\u00a0Lin, and Dinghao Wu. A3FL: adversarially adaptive backdoor attacks to federated learning. In: Neural Information Processing Systems, 2023"},{"key":"8527_CR14","unstructured":"Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo\u00a0Li. DBA: distributed backdoor attacks against federated learning. In: International Conference on Learning Representations, 2020"},{"key":"8527_CR15","unstructured":"Bagdasaryan E, Veit A, Hua Y, Estrin D, Shmatikov V (2020) How to backdoor federated learning. In: International Conference on Artificial Intelligence and Statistics 108:2938\u20132948"},{"key":"8527_CR16","unstructured":"Zhang Z, Panda A, Song L, Yang Y, Mahoney MW, Mittal P, Ramchandran K, Gonzalez J (2022) Neurotoxin: durable backdoors in federated learning. In: International Conference on Machine Learning 162:26429\u201326446"},{"key":"8527_CR17","doi-asserted-by":"crossref","unstructured":"Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In: IEEE Security and Privacy, pages 1893\u20131907, 2023","DOI":"10.1109\/SP46215.2023.10179401"},{"key":"8527_CR18","doi-asserted-by":"publisher","first-page":"50017","DOI":"10.1109\/ACCESS.2025.3552168","volume":"13","author":"X Chen","year":"2025","unstructured":"Chen X, Feng C, Wang S (2025) AIDFL: an information-driven anomaly detector for data poisoning in decentralized federated learning. IEEE Access 13:50017\u201350031","journal-title":"IEEE Access"},{"key":"8527_CR19","volume":"90","author":"H Chenyu","year":"2025","unstructured":"Chenyu H, Qiming H, Zhang M, Yang Z (2025) Fdba: feature-guided defense against byzantine and adaptive attacks in federated learning. J Inform Secur Appl 90:104035","journal-title":"J Inform Secur Appl"},{"key":"8527_CR20","doi-asserted-by":"publisher","first-page":"51754","DOI":"10.1109\/ACCESS.2023.3277858","volume":"11","author":"H Masuda","year":"2023","unstructured":"Masuda H, Kita K, Koizumi Y, Takemasa J, Hasegawa T (2023) Byzantine-resilient secure federated learning on low-bandwidth networks. IEEE Access 11:51754\u201351766","journal-title":"IEEE Access"},{"key":"8527_CR21","doi-asserted-by":"publisher","first-page":"118515","DOI":"10.1109\/ACCESS.2025.3586943","volume":"13","author":"S Ghazi","year":"2025","unstructured":"Ghazi S, Farzi S, Nikoofard A (2025) Federated learning for all: a reinforcement learning-based approach for ensuring fairness in client selection. IEEE Access 13:118515\u2013118535","journal-title":"IEEE Access"},{"key":"8527_CR22","doi-asserted-by":"publisher","first-page":"104926","DOI":"10.1109\/ACCESS.2025.3580198","volume":"13","author":"H Yeo","year":"2025","unstructured":"Yeo H, Lee J-W (2025) Norm-based outlier filtering and consensus aggregation for robust federated learning. IEEE Access 13:104926\u2013104936","journal-title":"IEEE Access"},{"key":"8527_CR23","doi-asserted-by":"publisher","first-page":"117808","DOI":"10.1109\/ACCESS.2025.3586730","volume":"13","author":"W Almuseelem","year":"2025","unstructured":"Almuseelem W (2025) Secure latency-aware task offloading using federated learning and zero trust in edge computing for iomt. IEEE Access 13:117808\u2013117830","journal-title":"IEEE Access"},{"key":"8527_CR24","doi-asserted-by":"crossref","unstructured":"Siquan Huang, Yijiang Li, Chong Chen, Leyu Shi, and Ying Gao. Multi-metrics adaptively identifies backdoors in federated learning. In: International Conference on Computer Vision, pages 4629\u20134639, 2023","DOI":"10.1109\/ICCV51070.2023.00429"},{"key":"8527_CR25","doi-asserted-by":"crossref","unstructured":"On detecting constrained backdoor attacks in federated learning (2025) Siquan Huang, Yijiang Li, Xingfu Yan, Ying Gao, Chong Chen, Leyu Shi, Biao Chen, and Wing W. Y. Ng. Scope. IEEE Trans Inf Forensics Secur 20:3302\u20133315","DOI":"10.1109\/TIFS.2025.3533899"},{"key":"8527_CR26","unstructured":"Thien\u00a0Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen M\u00f6llering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, and Thomas Schneider. FLAME: taming backdoors in federated learning. In USENIX Security Symposium, pages 1415\u20131432, 2022"},{"key":"8527_CR27","doi-asserted-by":"publisher","first-page":"1142","DOI":"10.1109\/TSP.2022.3153135","volume":"70","author":"K Pillutla","year":"2022","unstructured":"Pillutla K, Kakade SM, Harchaoui Z (2022) Robust aggregation for federated learning. IEEE Trans Signal Process 70:1142\u20131154","journal-title":"IEEE Trans Signal Process"},{"key":"8527_CR28","unstructured":"Yin D, Chen Y, Ramchandran K, Bartlett PL (2018) Byzantine-robust distributed learning: towards optimal statistical rates. In: International Conference on Machine Learning 80:5636\u20135645"},{"key":"8527_CR29","doi-asserted-by":"crossref","unstructured":"Mustafa\u00a0Safa \u00d6zdayi, Murat Kantarcioglu, and Yulia\u00a0R. Gel. Defending against backdoors in federated learning with robust learning rate. In: The Association for the Advancement of Artificial Intelligence, pages 9268\u20139276, 2021","DOI":"10.1609\/aaai.v35i10.17118"},{"key":"8527_CR30","unstructured":"Ziteng Sun, Peter Kairouz, Ananda\u00a0Theertha Suresh, and H.\u00a0Brendan McMahan. Can you really backdoor federated learning? CoRR, abs\/1911.07963, 2019"},{"key":"8527_CR31","unstructured":"Chen Wu, Xian Yang, Sencun Zhu, and Prasenjit Mitra. Mitigating backdoor attacks in federated learning. CoRR, abs\/2011.01767, 2020"},{"key":"8527_CR32","unstructured":"Peva Blanchard, El\u00a0Mahdi\u00a0El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: byzantine tolerant gradient descent. In: Neural Information Processing Systems, pages 119\u2013129, 2017"},{"key":"8527_CR33","unstructured":"Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil\u00a0Zhenqiang Gong. Fltrust: byzantine-robust federated learning via trust bootstrapping. In: Network and Distributed System Security Symposium, 2021"},{"issue":"11","key":"8527_CR34","doi-asserted-by":"publisher","first-page":"16171","DOI":"10.1109\/JIOT.2025.3531852","volume":"12","author":"X Wang","year":"2025","unstructured":"Wang X, Chen J, Zhang Z, He K, Zongru W, Ruiying D, Li Q, Liu G (2025) Transferable and robust dynamic adversarial attack against object detection models. IEEE Internet Things J 12(11):16171\u201316180","journal-title":"IEEE Internet Things J"},{"key":"8527_CR35","unstructured":"Xudong Pan, Mi\u00a0Zhang, Duocai Wu, Qifan Xiao, Shouling Ji, and Min Yang. Justinian\u2019s gaavernor: robust distributed learning with gradient aggregation agent. In: USENIX Security Symposium, pages 1641\u20131658, 2020"},{"key":"8527_CR36","doi-asserted-by":"publisher","first-page":"80637","DOI":"10.1109\/ACCESS.2025.3562128","volume":"13","author":"A Ali","year":"2025","unstructured":"Ali A, Huang J, Jabbar A (2025) Recent advances in federated learning for connected autonomous vehicles: addressing privacy, performance, and scalability challenges. IEEE Access 13:80637\u201380665","journal-title":"IEEE Access"},{"key":"8527_CR37","doi-asserted-by":"crossref","unstructured":"Divya\u00a0G. Nair, C.\u00a0V.\u00a0Aswartha Narayana, K.\u00a0Jaideep Reddy, and Jyothisha\u00a0J. Nair. Fedhsp: a robust federated learning framework coherently addressing heterogeneity, security, and performance challenges. IEEE Access, 13:77049\u201377063, 2025","DOI":"10.1109\/ACCESS.2025.3563544"},{"key":"8527_CR38","doi-asserted-by":"publisher","first-page":"136361","DOI":"10.1109\/ACCESS.2023.3337638","volume":"11","author":"C Cui","year":"2023","unstructured":"Cui C, Haiping D, Jia Z, Zhang X, He Y, Yang Y (2023) Data poisoning attacks with hybrid particle swarm optimization algorithms against federated learning in connected and autonomous vehicles. IEEE Access 11:136361\u2013136369","journal-title":"IEEE Access"},{"key":"8527_CR39","doi-asserted-by":"publisher","first-page":"118264","DOI":"10.1109\/ACCESS.2025.3584948","volume":"13","author":"S Almutairi","year":"2025","unstructured":"Almutairi S, Barnawi A (2025) Exploring the limitations of federated learning: a novel wasserstein metric-based poisoning attack on traffic sign classification. IEEE Access 13:118264\u2013118280","journal-title":"IEEE Access"},{"key":"8527_CR40","unstructured":"Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris\u00a0S. Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In: Neural Information Processing Systems, 2020"},{"key":"8527_CR41","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations, 2018"},{"issue":"3\u20134","key":"8527_CR42","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1561\/0400000042","volume":"9","author":"C Dwork","year":"2014","unstructured":"Dwork C, Roth A (2014) The algorithmic foundations of differential privacy. Found Trends Theor Comput Sci 9(3\u20134):211\u2013407","journal-title":"Found Trends Theor Comput Sci"},{"key":"8527_CR43","doi-asserted-by":"publisher","first-page":"4752","DOI":"10.1109\/TIFS.2024.3384846","volume":"19","author":"J Zhang","year":"2024","unstructured":"Zhang J, Zhu C, Sun X, Ge C, Chen B, Susilo W, Shui Yu (2024) Flpurifier: backdoor defense in federated learning via decoupled contrastive training. IEEE Trans Inf Forensics Secur 19:4752\u20134766","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"8527_CR44","unstructured":"Clement Fung, Chris J.\u00a0M. Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In: International Symposium on Research in Attacks, Intrusions and Defenses, pages 301\u2013316, 2020"},{"key":"8527_CR45","doi-asserted-by":"publisher","first-page":"1639","DOI":"10.1109\/TIFS.2022.3169918","volume":"17","author":"Z Ma","year":"2022","unstructured":"Ma Z, Ma J, Miao Y, Li Y, Deng RH (2022) Shieldfl: mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Trans Inf Forensics Secur 17:1639\u20131654","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"6","key":"8527_CR46","doi-asserted-by":"publisher","first-page":"5259","DOI":"10.1109\/TDSC.2024.3372634","volume":"21","author":"M Xutong","year":"2024","unstructured":"Xutong M, Cheng K, Shen Y, Li X, Chang Z, Zhang T, Ma X (2024) Feddmc: efficient and robust federated learning via detecting malicious clients. IEEE Trans Dependable Secure Comput 21(6):5259\u20135274","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"8527_CR47","unstructured":"Alex Krizhevsky, Geoffrey Hinton, et\u00a0al. Learning multiple layers of features from tiny images. 2009"},{"key":"8527_CR48","doi-asserted-by":"crossref","unstructured":"Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andr\u00e9 van Schaik. EMNIST: extending MNIST to handwritten letters. In: International Joint Conference on Neural Networks, pages 2921\u20132926, 2017","DOI":"10.1109\/IJCNN.2017.7966217"},{"key":"8527_CR49","unstructured":"Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In: International Conference on Learning Representations, 2015"},{"issue":"11","key":"8527_CR50","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y, Haffner P (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324","journal-title":"Proc IEEE"}],"container-title":["The Journal of Supercomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-026-08527-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11227-026-08527-0","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-026-08527-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T03:31:30Z","timestamp":1777174290000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11227-026-08527-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,26]]},"references-count":50,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,4]]}},"alternative-id":["8527"],"URL":"https:\/\/doi.org\/10.1007\/s11227-026-08527-0","relation":{},"ISSN":["1573-0484"],"issn-type":[{"value":"1573-0484","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,26]]},"assertion":[{"value":"7 October 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 April 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 April 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"379"}}