{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T16:15:34Z","timestamp":1781021734817,"version":"3.54.1"},"reference-count":46,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Knowledge-Based Systems"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.knosys.2026.115727","type":"journal-article","created":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T01:32:17Z","timestamp":1772847137000},"page":"115727","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"special_numbering":"C","title":["DABD: Direction alignment\u2013based backdoor defense with sign consensus in federated learning"],"prefix":"10.1016","volume":"341","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-2681-7068","authenticated-orcid":false,"given":"Jie","family":"Kang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3952-2370","authenticated-orcid":false,"given":"Ruizhong","family":"Du","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyu","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.knosys.2026.115727_bib0001","series-title":"Proc. 20th Int. Conf. Artif. Intell. Statist. (AISTATS)","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","author":"McMahan","year":"2017"},{"issue":"3","key":"10.1016\/j.knosys.2026.115727_bib0003","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/MSP.2020.2975749","article-title":"Federated learning: challenges, methods, and future directions","volume":"37","author":"Li","year":"2020","journal-title":"IEEE Signal Process. Mag."},{"issue":"1","key":"10.1016\/j.knosys.2026.115727_bib0037","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1561\/2200000083","article-title":"Advances and open problems in federated learning","volume":"14","author":"Kairouz","year":"2021","journal-title":"Found. Trends Mach. Learn."},{"issue":"2","key":"10.1016\/j.knosys.2026.115727_bib0041","doi-asserted-by":"crossref","DOI":"10.1007\/s40747-024-01664-0","article-title":"A survey of security threats in federated learning","volume":"11","author":"Feng","year":"2025","journal-title":"Complex Intell. Syst."},{"key":"10.1016\/j.knosys.2026.115727_bib0042","series-title":"Proc. ACM SIGSAC Conf. Comput. Commun. Security (CCS)","article-title":"Unraveling the connections between privacy and certified robustness in federated learning against poisoning attacks","author":"Xie","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0010","series-title":"Proc. Int. Conf. Artif. Intell. Statist. (AISTATS)","first-page":"2938","article-title":"How to backdoor federated learning","author":"Bagdasaryan","year":"2020"},{"key":"10.1016\/j.knosys.2026.115727_bib0008","series-title":"Proc. Int. Conf. Mach. Learn. (ICML)","first-page":"26429","article-title":"Neurotoxin: durable backdoors in federated learning","author":"Zhang","year":"2022"},{"key":"10.1016\/j.knosys.2026.115727_bib0004","unstructured":"P. Blanchard, E.M. El Mhamdi, R. Guerraoui, and J. Stainer. Byzantine-tolerant machine learning. arXiv preprint, 2017."},{"key":"10.1016\/j.knosys.2026.115727_bib0002","series-title":"Proc. Advances in Neural Information Processing Systems (NeurIPS)","first-page":"118","article-title":"Machine learning with adversaries: byzantine tolerant gradient descent","author":"Blanchard","year":"2017"},{"key":"10.1016\/j.knosys.2026.115727_bib0012","series-title":"Proc. Network Distrib. Syst. Security (NDSS) Symp","article-title":"FLTrust: byzantine-robust federated learning via trust bootstrapping","author":"Cao","year":"2021"},{"key":"10.1016\/j.knosys.2026.115727_bib0014","series-title":"Proc. IEEE Symp. Security Privacy (S&P)","first-page":"1366","article-title":"FedRecover: recovering from poisoning attacks in federated learning using historical informa- tion","author":"Cao","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0015","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR)","first-page":"20654","article-title":"Detecting backdoor attacks in federated learning via direction alignment inspection","author":"Xu","year":"2025"},{"key":"10.1016\/j.knosys.2026.115727_bib0046","unstructured":"W. Wan, Y. Ning, Z. Huang, C. Hong, S. Hu, Z. Zhou, Y. Zhang, T. Zhu, W. Zhou, and L.Y. Zhang. MARS: a malignity-aware backdoor defense in federated learning. arXiv, 2025."},{"key":"10.1016\/j.knosys.2026.115727_bib0021","unstructured":"Y. Hsu, T. Qi, and M. Brown. Measuring the effects of non-identical data distribution for federated visual classification. arXiv preprint, 2019."},{"key":"10.1016\/j.knosys.2026.115727_bib0022","series-title":"Proc. IEEE Int. Conf. Data Eng. (ICDE)","first-page":"965","article-title":"Federated learning on non-IID data silos: an experimental study","author":"Li","year":"2022"},{"key":"10.1016\/j.knosys.2026.115727_bib0023","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.111660","article-title":"RoPE: defending against backdoor attacks in federated learning systems","volume":"293","author":"Wang","year":"2024","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115727_bib0024","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.111511","article-title":"FLMAAcBD: defending against backdoors in federated learning via model anomalous activation be- havior detection","volume":"289","author":"Cai","year":"2024","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115727_bib0032","series-title":"Proc. Advances in Neural Information Processing Systems (NeurIPS)","first-page":"53090","article-title":"FedGame: a game-theoretic defense against backdoor attacks in federated learning","author":"Jia","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0026","series-title":"Proc. IEEE\/CVF Winter Conf. Appl. Comput. Vis. (WACV)","first-page":"7949","article-title":"Identify backdoored model in federated learning via individual unlearning","author":"Xu","year":"2025"},{"key":"10.1016\/j.knosys.2026.115727_bib0029","series-title":"Proc. Int. Conf. Learn. Represen- Tations (ICLR)","article-title":"FLIP: a provable defense framework for backdoor mitigation in federated learning","author":"Zhang","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0036","series-title":"Proc. Network Distrib. Syst. Security (NDSS) Symp","article-title":"DeepSight: mitigating backdoor attacks in federated learning through deep model inspection","author":"Rieger","year":"2022"},{"key":"10.1016\/j.knosys.2026.115727_bib0013","series-title":"Proc. 31st USENIX Security Symp","first-page":"1415","article-title":"FLAME: taming backdoors in federated learning","author":"Nguyen","year":"2022"},{"issue":"2","key":"10.1016\/j.knosys.2026.115727_bib0030","first-page":"1461","article-title":"Federated learning with sparsified model perturbation: improving accuracy under client-level diferential pri- vacy","volume":"23","author":"Hu","year":"2024","journal-title":"IEEE Trans. Mobile Comput."},{"key":"10.1016\/j.knosys.2026.115727_bib0016","series-title":"Proc. 33rd USENIX Security Symp","first-page":"2847","article-title":"BackdoorIndicator: leveraging OOD data for proactive backdoor detection in federated learning","author":"Xiang","year":"2024"},{"key":"10.1016\/j.knosys.2026.115727_bib0019","series-title":"Proc. IEEE\/CVF Int. Conf. Comput. Vis. (ICCV)","first-page":"4652","article-title":"Multi-metrics adaptively identifies backdoors in federated learning","author":"Huang","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0048","series-title":"International Conference on Learning Representations (ICLR)","article-title":"Energy- based backdoor defense against federated graph learning","author":"Wan","year":"2025"},{"key":"10.1016\/j.knosys.2026.115727_bib0049","first-page":"1063","article-title":"QUEEN: query unlearning against model extraction","volume":"20","author":"Chen","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Security"},{"key":"10.1016\/j.knosys.2026.115727_bib0050","doi-asserted-by":"crossref","DOI":"10.1016\/j.csi.2023.103830","article-title":"When deep learning meets watermarking: a survey of application, attacks and defenses","volume":"89","author":"Chen","year":"2024","journal-title":"Comput. Standards Interfaces"},{"key":"10.1016\/j.knosys.2026.115727_bib0018","series-title":"Proc. Mach. Learn. Syst. (MLSys)","first-page":"429","article-title":"Federated optimization in heterogeneous networks","author":"Li","year":"2020"},{"issue":"1","key":"10.1016\/j.knosys.2026.115727_bib0039","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/TNNLS.2022.3182979","article-title":"Backdoor learning: a survey","volume":"35","author":"Li","year":"2024","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"10.1016\/j.knosys.2026.115727_bib0006","series-title":"Proc. Int. Conf. Mach. Learn. (ICML)","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","author":"Bhagoji","year":"2019"},{"key":"10.1016\/j.knosys.2026.115727_bib0005","doi-asserted-by":"crossref","first-page":"47230","DOI":"10.1109\/ACCESS.2019.2909068","article-title":"BadNets: evaluating backdooring attacks on deep neural networks","volume":"7","author":"Gu","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.knosys.2026.115727_bib0038","series-title":"Proc. Advances in Neural Information Processing Systems (NeurIPS)","first-page":"16070","article-title":"Attack of the tails: yes, you really can backdoor fed- erated learning","author":"Wang","year":"2020"},{"key":"10.1016\/j.knosys.2026.115727_bib0035","series-title":"Proc. ACM SIGSAC Conf. Comput. Commun. Security (CCS)","article-title":"Distributed backdoor attacks on federated graph learning and certified defenses","author":"Yang","year":"2024"},{"key":"10.1016\/j.knosys.2026.115727_bib0034","series-title":"Proc. Network Distrib. Syst. Security (NDSS) Symp","article-title":"Manipulating the Byzantine: op- timizing model poisoning attacks and defenses for federated learning","author":"Shejwalkar","year":"2021"},{"key":"10.1016\/j.knosys.2026.115727_bib0009","series-title":"Proc. Int. Conf. Learn. Representations (ICLR)","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2018"},{"key":"10.1016\/j.knosys.2026.115727_bib0011","series-title":"Proc. Int. Conf. Learn. Repre- Sentations (ICLR)","article-title":"DBA: distributed backdoor attacks against federated learning","author":"Xie","year":"2020"},{"issue":"6","key":"10.1016\/j.knosys.2026.115727_bib0044","doi-asserted-by":"crossref","first-page":"817","DOI":"10.1109\/TBDATA.2023.3237397","article-title":"An experimental study of Byzantine-robust aggregation schemes in federated learning","volume":"10","author":"Li","year":"2024","journal-title":"IEEE Trans. Big Data"},{"key":"10.1016\/j.knosys.2026.115727_bib0045","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114004","article-title":"Improving (\u03b1, f)-Byzantine resilience in federated learning via layerwise aggregation and cosine distance","volume":"326","author":"Garc\u00eda-M\u00e1rquez","year":"2025","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115727_bib0007","series-title":"Proc. IEEE Symp. Security Privacy (S&P)","first-page":"707","article-title":"Neural cleanse: identifying and mitigating backdoor attacks in neural networks","author":"Wang","year":"2019"},{"key":"10.1016\/j.knosys.2026.115727_bib0033","series-title":"Proc. Int. Conf. Mach. Learn. (ICML)","first-page":"11372","article-title":"CRFL: certifiably robust federated learning against backdoor attacks","author":"Xie","year":"2021"},{"key":"10.1016\/j.knosys.2026.115727_bib0028","series-title":"Proc. 29th USENIX Security Symp","first-page":"1605","article-title":"Local model poisoning attacks to Byzantine-robust federated learning","author":"Fang","year":"2020"},{"key":"10.1016\/j.knosys.2026.115727_bib0040","series-title":"Proc. IEEE Symp. Security Privacy (S&P)","article-title":"BayBFed: Bayesian backdoor defense for federated learning","author":"Kumari","year":"2023"},{"key":"10.1016\/j.knosys.2026.115727_bib0025","series-title":"Proc. IEEE\/CVF Winter Conf. Appl. Comput. Vis. (WACV)","first-page":"1508","article-title":"Achieving byzantine-resilient federated learning via layer-adaptive sparsified model aggregation","author":"Xu","year":"2025"},{"key":"10.1016\/j.knosys.2026.115727_bib0027","series-title":"Proc. Advances in Neural Information Processing Systems (NeurIPS)","article-title":"A3FL: adversarially adaptive backdoor attacks to federated learning","author":"Zhang","year":"2024"},{"key":"10.1016\/j.knosys.2026.115727_bib0047","series-title":"Proc. Network Distrib. Syst. Security (NDSS) Symp","article-title":"Automatic adver- sarial adaption for stealthy poisoning attacks in federated learning","author":"Krau\u00df","year":"2024"}],"container-title":["Knowledge-Based Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126004673?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126004673?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T11:39:01Z","timestamp":1779449941000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950705126004673"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":46,"alternative-id":["S0950705126004673"],"URL":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115727","relation":{},"ISSN":["0950-7051"],"issn-type":[{"value":"0950-7051","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"DABD: Direction alignment\u2013based backdoor defense with sign consensus in federated learning","name":"articletitle","label":"Article Title"},{"value":"Knowledge-Based Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115727","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"115727"}}