Research map / Federated learning and privacy / Privacy attacks and secure learning
Defending federated learning against poisoning
Detect and mitigate malicious clients and backdoors in federated learning with provable defenses.
76 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2021–2026) · an approach in Privacy attacks and secure learning, keyword cluster “attack · defense · backdoor”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
29 papers in 2023–24 and 40 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 22.1% to 28.2%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2021 · Provably Secure Federated Learning against Malicious Clients (AAAI 2021 · 135 citations)
- 2022 · FedInv: Byzantine-Robust Federated Learning by Inversing Local Model Updates (AAAI 2022 · 76 citations)
- 2023 · On the Vulnerability of Backdoor Defenses for Federated Learning (AAAI 2023 · 55 citations)
- 2024 · Revamping Federated Learning Security from a Defender's Perspective: A Unified Defense with Homomorphic Encrypted Data Space (CVPR 2024 · 43 citations)
- 2025 · Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · 28 citations)
- 2026 · LSHFed: Robust and Communication-Efficient Federated Learning with Locally-Sensitive Hashing Gradient Mapping (AAAI 2026 · 2 citations)
Earliest papers here
- Provably Secure Federated Learning against Malicious Clients (AAAI 2021 · 135 citations)
- CRFL: Certifiably Robust Federated Learning against Backdoor Attacks (ICML 2021 · 47 citations)
- FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective (NeurIPS 2021 · 15 citations)
What has been tried
48 papers here report 473 measured changes (a component added, removed or swapped, compared with a baseline): helped 64%, no clear effect 11%, hurt 20%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add model-domain Euclidean distance to first-stage clustering | Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 · accuracy (%) | 96.82 vs 96.21; 85.16 vs 84.83; 36.85 vs 49.01 (Scaling) | Mixed | Byzantine-robust Decentralized Federated Learning via Dual-domain Clustering and Trust Bootstrapping (CVPR 2024 · 28 citations) |
| use MPSA(30%) without TDA or post-filtering clipping | CIFAR-10 IID and non-IID, Badnet · RA | 88.55; 5.79 | Mixed | Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · 20 citations) |
| add top-down election to bottom-up election | CIFAR-10 CBA · BA (%) | 6.86 -> 3.03 | Helped | Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · 19 citations) |
| use full layers instead of the last layer for similarity computation | CIFAR10 under IPM, ALIE, and SCALINE attacks · accuracy | 70.3 -> 69.84; 64.62 -> 69.73; 69.61 -> 68.89 | Mixed | Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · 15 citations) |
| Switch poison samples rather than only adding triggers | UCI-HAR, K=2 · A | 77.28 -> 98.72 | Helped | Label-Free Backdoor Attacks in Vertical Federated Learning (AAAI 2025 · 12 citations) |
| add FAVD data valuation before training | Covid-chestxray, uniform and non-IID, no threat · test accuracy (%) | 91.37±1.54 -> 93.75±1.20; 88.62±1.27 -> 91.36±1.31 | Helped | Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution (CVPR 2025 · 7 citations) |
| Add current-history similarity S_cl | MNIST-0.5, LMP attack · testing accuracy convergence speed and oscillation amplitude | Helped | Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · 5 citations) | |
| add Early Learner to Train-ME | CIFAR-10, 50 training samples · surrogate model accuracy | 71.71% -> 76.45% | Helped | EMGAN: Early-Mix-GAN on Extracting Server-Side Model in Split Federated Learning (AAAI 2024 · 3 citations) |
| Add both FCDC and FPRA | Cifar-10, β = 0.5, Υ = 30% · V | 52.65 -> 78.06 | Helped | Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · 3 citations) |
| Add a non-target input to the target-input influence scores | CIFAR-10, Scaling attack · DACC | 0.900 -> 1.000 | Helped | Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning (NeurIPS 2025 · 2 citations) |
| Use CF generator embedding size 64 rather than 128 | small-MNIST · accuracy | 86.0±0.3\% -> 85.6±0.4\% | Hurt | Federated Behavioural Planes: Explaining the Evolution of Client Behaviour in Federated Learning (NeurIPS 2024 · 2 citations) |
| replace Wasserstein distance with Euclidean distance for clustering | CIFAR-10, CerP · CAD | close to 94% -> around 44% | Hurt | MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 23 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 12 of 23 papers
- MNIST · 7 of 23 papers
- CIFAR-100 · 7 of 23 papers
- Fashion-MNIST · 4 of 23 papers
- F-MNIST · 2 of 23 papers
- IMDB · 2 of 23 papers
- Sentiment140 · 2 of 23 papers
- Tiny-ImageNet · 2 of 23 papers
Baselines
- Median · 4 of 23 papers
- Krum · 3 of 23 papers
- FLTrust · 3 of 23 papers
- FedAvg · 3 of 23 papers
- Trimmed-mean · 3 of 23 papers
- FoolsGold · 3 of 23 papers
- FedVal · 2 of 23 papers
- LIE · 2 of 23 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 69 papers; from OpenAlex and the papers' affiliations).
- Wuhan University · 4 papers
- Hong Kong University of Science and Technology · 4 papers
- Duke University · 4 papers
- Pennsylvania State University · 3 papers
- Sony · 3 papers
- Meta · 3 papers
- Beihang University · 3 papers
- University of Louisville · 3 papers
- Deakin University · 3 papers
- Zhejiang University · 2 papers
Use it
Download BibTeX of 30 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Gradient inversion attacks (47 papers)
- Membership inference and auditing (47 papers)
Elsewhere in the topic
- Encryption-based private learning (105 papers)
- Private federated aggregation (50 papers)
- Visual privacy and face de-identification (39 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).