{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T06:27:49Z","timestamp":1787898469582,"version":"build-2784847793"},"reference-count":134,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2021.3075203","type":"journal-article","created":{"date-parts":[[2021,4,23]],"date-time":"2021-04-23T16:08:23Z","timestamp":1619194103000},"page":"63229-63249","source":"Crossref","is-referenced-by-count":243,"title":["Vulnerabilities in Federated Learning"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4571-8484","authenticated-orcid":false,"given":"Nader","family":"Bouacida","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2768-5308","authenticated-orcid":false,"given":"Prasant","family":"Mohapatra","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","first-page":"5132","article-title":"SCAFFOLD: Stochastic controlled averaging for federated learning","volume":"119","author":"karimireddy","year":"2020","journal-title":"Proc 37th Int Conf Mach Learn"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ISCO.2016.7727096"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787987"},{"key":"ref32","article-title":"Protection against reconstruction and its applications in private federated learning","author":"bhowmick","year":"2018","journal-title":"arXiv 1812 00984"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref30","first-page":"1","article-title":"Federated learning: Strategies for improving communication efficiency","author":"kone?n\u00fd","year":"2016","journal-title":"Proc NIPS Workshop Private Multi-Party Mach Learn"},{"key":"ref37","first-page":"117","article-title":"Analysis of cloud computing attacks and countermeasures","author":"jabir","year":"2016","journal-title":"Proc 18th Int Conf Adv Commun Technol (ICACT)"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2014.02.005"},{"key":"ref35","first-page":"5650","article-title":"Byzantine-Robust distributed learning: Towards optimal statistical rates","volume":"80","author":"yin","year":"2018","journal-title":"Proc 35th Int Conf Mach Learn (ICML)"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3170521.3170525"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31912-9_28"},{"key":"ref27","first-page":"493","article-title":"BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning","author":"zhang","year":"2020","journal-title":"Proc Annu Tech Conf"},{"key":"ref29","first-page":"115","article-title":"Homomorphic encryption and some black box attacks","author":"borovik","year":"2020","journal-title":"Proc Conf Math Softw"},{"key":"ref20","article-title":"A framework for evaluating gradient leakage attacks in federated learning","author":"wei","year":"2020","journal-title":"arXiv 2004 10397"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357370"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2976612"},{"key":"ref26","first-page":"1","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"papernot","year":"2017","journal-title":"Int Conf on Learning Representations"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.02.037"},{"key":"ref25","year":"2018"},{"key":"ref100","article-title":"Efficient and private federated learning using TEE","author":"mo","year":"2019","journal-title":"Proc EuroSys Conf"},{"key":"ref50","article-title":"Testing robustness against unforeseen adversaries","author":"kang","year":"2019","journal-title":"arXiv 1908 08016"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2020.3039941"},{"key":"ref59","first-page":"1","article-title":"Model poisoning attacks in federated learning","author":"bhagoji","year":"2018","journal-title":"Proc Workshop Secur Mach Learn (SecML)"},{"key":"ref58","article-title":"Threats to federated learning: A survey","author":"lyu","year":"2020","journal-title":"arXiv 2003 02133"},{"key":"ref57","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"gu","year":"2017","journal-title":"arXiv 1708 06733"},{"key":"ref56","author":"lecun","year":"2010","journal-title":"MNIST Handwritten Digit Database"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2986024"},{"key":"ref54","first-page":"6106","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","author":"shafahi","year":"2018","journal-title":"Proc 32nd Int Conf Neural Inf Process Syst"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.10.007"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref40","article-title":"Federated optimization in heterogeneous networks","author":"li","year":"2018","journal-title":"arXiv 1812 06127"},{"key":"ref4","article-title":"Federated optimization: Distributed machine learning for on-device intelligence","author":"kone\u00e4n\u00fd","year":"2016","journal-title":"arXiv 1610 02527"},{"key":"ref3","author":"phelan","year":"2019","journal-title":"Amazon Admits Listening to Alexa Conversations Why it Matters"},{"key":"ref6","article-title":"Towards federated learning at scale: System design","author":"bonawitz","year":"2019","journal-title":"arXiv 1902 01046"},{"key":"ref5","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume":"54","author":"mcmahan","year":"2017","journal-title":"Proc Conf Artif Intell Statist"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3030072"},{"key":"ref49","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref9","year":"2013","journal-title":"Consumer Data Privacy in A Networked World A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.3389\/fphar.2019.01303"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-020-00323-1"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref47","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"chen","year":"2017","journal-title":"arXiv 1712 05526"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5793"},{"key":"ref41","article-title":"Federated learning with matched averaging","author":"wang","year":"2020","journal-title":"arXiv 2002 06440"},{"key":"ref44","first-page":"1","article-title":"DBA: Distributed backdoor attacks against federated learning","author":"xie","year":"2020","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref43","author":"xu","year":"2020","journal-title":"Compressed communication for distributed deep learning Survey and quantitative evaluation"},{"key":"ref127","article-title":"Peer-to-peer federated learning on graphs","author":"lalitha","year":"2019","journal-title":"arXiv 1901 11173"},{"key":"ref126","article-title":"BrainTorrent: A Peer-to-Peer environment for decentralized federated learning","author":"guha roy","year":"2019","journal-title":"arXiv 1905 06731"},{"key":"ref125","article-title":"FedMD: Heterogenous federated learning via model distillation","author":"li","year":"2019","journal-title":"arXiv 1910 03581"},{"key":"ref124","article-title":"Federated knowledge distillation","author":"seo","year":"2020","journal-title":"arXiv 2011 02367"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000379"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_6"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1007\/s12083-019-00869-2"},{"key":"ref71","article-title":"Attack-resistant federated learning with residual-based reweighting","author":"fu","year":"2019","journal-title":"arXiv 1912 11464"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_9"},{"key":"ref70","first-page":"285","article-title":"Evasion attacks against banking fraud detection systems","author":"carminati","year":"2020","journal-title":"Proc 23rd Int Symp Res Attacks Intrusions Defenses"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1007\/s41666-020-00082-4"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref74","article-title":"IDLG: Improved deep leakage from gradients","author":"zhao","year":"2020","journal-title":"arXiv 2001 02610"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref133","article-title":"Layer rotation: A surprisingly powerful indicator of generalization in deep networks?","author":"carbonnelle","year":"2018","journal-title":"arXiv 1806 01603"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS51746.2020.00017"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2942190"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2019.00057"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2020.3044223"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2020.3000372"},{"key":"ref60","first-page":"1605","article-title":"Local model poisoning attacks to Byzantine-robust federated learning","author":"fang","year":"2020","journal-title":"Proc 29th Secur Symp"},{"key":"ref62","first-page":"296","article-title":"Federated learning with Gaussian differential privacy","author":"chuanxin","year":"2020","journal-title":"Proc 2nd Int Conf Robot Intell Control Artif Intell"},{"key":"ref61","first-page":"8635","article-title":"A little is enough: Circumventing defenses for distributed learning","volume":"32","author":"baruch","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref63","article-title":"Can you really backdoor federated learning?","author":"sun","year":"2019","journal-title":"arXiv 1911 07963"},{"key":"ref64","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","author":"wang","year":"2020","journal-title":"arXiv 2007 05084"},{"key":"ref65","article-title":"Dynamic backdoor attacks against federated learning","author":"huang","year":"2020","journal-title":"arXiv 2011 07429"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref67","article-title":"Model pruning enables efficient federated learning on edge devices","author":"jiang","year":"2019","journal-title":"arXiv 1909 12326"},{"key":"ref68","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"arXiv 1312 6199"},{"key":"ref2","author":"frier","year":"2019","journal-title":"Facebook Paid Contractors to Transcribe Users’ Audio Chats"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CISS48834.2020.1570617116"},{"key":"ref1","author":"poushter","year":"2016","journal-title":"Smartphone Ownership and Internet Usage Continues to Climb in Emerging Economies Pew Research Center’s Global Attitudes Project"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1145\/22145.22178"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.3390\/app8122663"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.47"},{"key":"ref94","article-title":"Learning to detect malicious clients for robust federated learning","author":"li","year":"2020","journal-title":"arXiv 2002 00211"},{"key":"ref107","article-title":"Expanding the reach of federated learning by reducing client resource requirements","author":"caldas","year":"2018","journal-title":"arXiv 1812 07210"},{"key":"ref93","first-page":"1","article-title":"Exploiting machine learning to subvert your spam filter","author":"nelson","year":"2008","journal-title":"Proc 1st Usenix Workshop Large-Scale Exploits Emergent Threats"},{"key":"ref106","first-page":"1","article-title":"An efficient and robust aggregation algorithm for learning federated CNN","author":"lu","year":"2020","journal-title":"Proc 3rd Int Conf Signal Process Mach Learn"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2020.2979149"},{"key":"ref91","article-title":"Abnormal client behavior detection in federated learning","author":"li","year":"2019","journal-title":"arXiv 1910 09933"},{"key":"ref104","article-title":"Robust aggregation for adaptive privacy preserving federated learning in healthcare","author":"grama","year":"2020","journal-title":"arXiv 2009 08294"},{"key":"ref90","first-page":"119","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","volume":"30","author":"blanchard","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref103","article-title":"Robust aggregation for federated learning","author":"pillutla","year":"2019","journal-title":"arXiv 1912 13445"},{"key":"ref102","first-page":"619","article-title":"Oblivious multi-party machine learning on trusted processors","author":"ohrimenko","year":"2016","journal-title":"Proc 25th Secur Symp"},{"key":"ref111","first-page":"1","article-title":"Adversarial training for free!","volume":"32","author":"shafahi","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref110","first-page":"6586","article-title":"On the convergence and robustness of adversarial training","volume":"97","author":"wang","year":"2019","journal-title":"Proc 36th Int Conf Mach Learn"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134098"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref97","article-title":"Differentially private federated learning: A client level perspective","author":"geyer","year":"2017","journal-title":"arXiv 1712 07557"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57959-7"},{"key":"ref11","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","volume":"97","author":"bhagoji","year":"2019","journal-title":"Proc 36th Int Conf Mach Learn"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/657"},{"key":"ref13","first-page":"2938","article-title":"How to backdoor federated learning","volume":"108","author":"bagdasaryan","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref14","first-page":"14774","volume":"32","author":"zhu","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3411501.3419428"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006060"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.001.1900506"},{"key":"ref82","article-title":"Free-riders in federated learning: Attacks and defenses","author":"lin","year":"2019","journal-title":"arXiv 1911 12560"},{"key":"ref117","article-title":"Federated kernelized multi-task learning","author":"caldas","year":"2018","journal-title":"Proc SysML Conf"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref81","article-title":"Local SGD converges fast and communicates little","author":"stich","year":"2018","journal-title":"arXiv 1805 09767"},{"key":"ref18","article-title":"Advances and open problems in federated learning","author":"kairouz","year":"2019","journal-title":"arXiv 1912 04977"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCAF.2017.8344724"},{"key":"ref119","article-title":"Ditto: Fair and robust federated learning through personalization","author":"li","year":"2020","journal-title":"arXiv 2012 04221"},{"key":"ref19","article-title":"Privacy leakage of real-world vertical federated learning","author":"weng","year":"2020","journal-title":"arXiv 2011 09290"},{"key":"ref83","article-title":"Free-rider attacks on model aggregation in federated learning","author":"fraboni","year":"2020","journal-title":"arXiv 2006 11901"},{"key":"ref114","first-page":"1802","article-title":"Exploring the landscape of spatial robustness","author":"engstrom","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref113","article-title":"Exploiting excessive invariance caused by norm-bounded adversarial robustness","author":"jacobsen","year":"2019","journal-title":"arXiv 1903 10484"},{"key":"ref116","first-page":"4427","article-title":"Federated multi-task learning","author":"smith","year":"2017","journal-title":"Proc 31st Int Conf Neural Inf Process Syst"},{"key":"ref80","article-title":"Don’t decay the learning rate, increase the batch size","author":"smith","year":"2017","journal-title":"arXiv 1711 00489"},{"key":"ref115","first-page":"1","article-title":"Adversarial training and robustness for multiple perturbations","volume":"32","author":"tramer","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2013.6578785"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991125"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/2663474.2663486"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/3759626"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2982955"},{"key":"ref85","article-title":"Man-in-the-middle attacks against machine learning classifiers via malicious generative models","author":"wang","year":"2018","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2019.8761315"},{"key":"ref87","article-title":"Fairness and accuracy in federated learning","author":"huang","year":"2020","journal-title":"arXiv 2012 10069"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09411833.pdf?arnumber=9411833","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T14:55:46Z","timestamp":1639752946000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9411833\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":134,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3075203","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}