Federated Learning: Attacks and Defenses, Rewards, Energy

Efficiency: Past, Present and Future

DIMITRIS KARYDAS, HELEN C. LELIGOU

Department of Industrial Design and Production Engineering,

University of West Attica,

250 Thivon & P. Ralli str 122 41 Egaleo,

GREECE

immutability and at the same time enables dataset monetization through tokenization. Unfortunately,

vulnerabilities of the blockchain-based solutions have been identified while the implementation of blockchain

introduces significant energy consumption issues. There are many solutions that also offer personalized ideas

and uses. In the field of security, solutions such as security against model-poisoning backdoor assaults with

poles and modified algorithms are proposed. Defense systems that identify hostile devices, Against Phishing

and other social engineering attack mechanisms that could threaten current security systems after careful

comparison of mutual systems. In a federated learning system built on blockchain, the design of reward

mechanisms plays a crucial role in incentivizing active participation. We can use tokens for rewards or other

cryptocurrency methods for rewards to a federated learning system. Smart Contracts combined with proof of

stake with performance-based rewards or (and) value of data contribution. Some of them use games or game

problems that classical computers cannot solve, their multidimensional nature, analyze large data sets more

efficiently than classical artificial intelligence counterparts and the later maturity of a technology that is now

expensive will provide solutions in areas such as cryptography, security and why not in energy autonomy. The

human brain and an emerging technology can provide solutions to all of the above solutions due to the brain's

decentralized nature, built-in reward mechanism, negligible energy use, and really high processing power In

this paper we attempt to survey the currently identified threats, attacks and defenses, the rewards and the energy

efficiency issues of BFL in order to guide the researchers and the designers of FL based solution to adopt the

most appropriate of each application approach.

Key-Words: - Blockchain Federated Learning, Energy Efficiency, Security, Privacy, Defenses, Rewards.

importance in the current technology landscape due

to several key factors. Internet of Things (I.o.T.)

applications with the growth of big data can lead to

the true implementation of many intelligent

situations such as smart cities, smart meters, smart

hospitals, etc.. These clever brushes can fuel many

a real opportunity for artificial intelligence and

mechanical learning. For this purpose, we can train

Artificial Intelligence (A.I.) and Machine Learning

(M.L.) algorithms via multiple independent

sessions, each using our own datasets to optimize

these smart IoT applications. Depending on the

type of local workers, FL can be divided into cross

capabilities.

to FL, are confidentiality, availability, and

integrity. Data privacy preservation, data

sovereignty, decentralization, incentive

mechanisms, scalability, cross-organizational

collaboration, and resilience to data poisoning

attacks are significant topics to be taken into

consideration when an FL solution targeting a

specific sector is to be designed. FL allows

laws. FL distributes the training process across a

network of nodes, eliminating the need for

centralized authority, and enhancing the system

resilience. Incentive mechanisms can be

implemented, fostering participation and

cooperation.

transparent and auditable record of model updates,

building trust among stakeholders in sectors where

this is highly required for example like healthcare

secure multiparty computer technology, the model

update provider cannot be traced and thus, any

attack with respect to (inappropriate) model update

can be detected, [4]. Although blockchain

adds/improves the level of security, it is not a

panacea. It is essential for people, businesses, and

governments to make proactive efforts to defend

against FL attacks, especially those who will adopt

this technology, and encourage a culture of total

awareness, [5], [6], [7], [8], [9], [10].

Adopting the same principle of performance-

Another key issue for FL systems is energy.

In this paper, we survey the literature relevant

to a) attack and related defense mechanisms, b)

rewarding mechanisms, and c) energy efficiency as

well as present the recent developments relevant to

quantum technologies and brain-inspired FL

systems. Quantum technologies and brain-inspired

example, the rewarding schemes that incentivize

citizens are different than those that may

incentivize organizations; the security level

(measures to defend against a rich or less rich set of

attacks) depends on the nature of the application

and its specificities. Additionally, we discuss the

interplay, [21], [22] among the three dimensions

mentioned above and shown in the Figure 1. The

importance of this discussion increases if we take

into consideration i) the legislation as the General

at least 55 percent below 1990 levels by 2030. This

is a significant increase compared to the existing

target of above the previous target of at least 40

percent, [25].

The standard project of the “Federated Machine

Learning Application and architecture framework”

was approved by the IEEE Standards Committee in

December 2018. As a result of that, an increasing

number of academics and technical specialists

joined the standards working group and contributed

to the creation of IEEE Standards regarding FL,

[26]. There are numerous inherent hazards to

privacy and security. Malicious local workers may

sabotage the availability, confidentiality, and

name of this method. The resulting model is less

expressive, making backdoor assaults more

difficult to execute. Such a technique also brings

up some advantageous side effects. In fact, the

fewer parameters minimize both the likelihood of

message interception and the cost of

communication, [12]. For the backdoor attack

explicitly scaling maliciously uploaded clients'

local updates, the attack simply swaps the weights

of some inconsequential model parameters. F3BA

is able to escape and achieve a high attack success

rate in the majority of tests. From this, the authors

claim that even while the current stage of backdoor

protection offers some robustness, they still expose

the vulnerability to advanced backdoor attacks. In

[30], FL was analyzed from an adversarial

standpoint and created a straightforward defense

significantly lowers backdoor accuracy while just

slightly degrading overall validation accuracy.

Overall, it outperforms some of the recently

proposed defenses in the literature. As a final

comment, they believe the insights behind their

defense are also related to training in non-. i.d.

setting, even in the presence of no adversaries. The

differences in local distributions can cause updates

coming from different agents to steer the model

toward different directions over the loss surface. In

injecting of several watermarked, incorrectly

labeled training examples into a training set. On

usual data, the watermark has no effect on the

model's test-time performance, but on watermarked

samples, the model consistently makes mistakes

and generates errors, [32]. To solve this problem,

authors suggest Robust Filtering of one-

dimensional Outliers (RFOut-1d), a defense

mechanism based on a robust filtering of one-

dimensional outliers in the federated aggregation

In many cases, a malevolent person tries to

suggested work is a workable and successful

defense against FL model inversion attacks. In

order to obscure the gradients of the sensitive data,

the authors introduce a concealing sample that

mimics the sensitive data. Their suggested method

makes sure that the samples that are used to hide

sensitive information are visually distinct from the

losing FL performance when compared to other

similar defense strategies.

updated models to a centralized server may become

a difficult task due to privacy issues and significant

connection constraints. Thus, a recent paper [36],

suggests an efficient approach for user assignment

and resource allocation across hierarchical FL

solutions designed for IoT heterogeneous systems.

The findings of this study showed that, for the

attack that are often used to steal user data, the

authors of [37] suggest the use of Phishing

Detection with Generative Adversarial Networks

(PDGAN). PDGAN is a revolutionary poisoning

defense strategy in federated learning. The

suggested approach is based on a server-side

generative adversarial network that can reconstitute

participants' training data. The suggested method

verifies the accuracy of each participant's model

defense for federated learning with differential

privacy at the device, class, or user levels as future

work.

are events or observations that deviate significantly

from the majority of the data and do not conform to

a well-defined notion of normal behavior. The

authors of [38] suggested a federated learning-

based anomaly detection system for precisely

identifying and categorizing threats in IoT

In the study [39], authors have proven that by

variables that are unique to DBA to investigate its

properties and limitations. According to the

findings, DBA is a fresh and more potent attack

against FL than the ones currently used as

backdoor attacks. For assessing the adversarial

robustness of FL, the study and findings may offer

fresh perspectives and new threat assessment

propose a defense method that can prevent

backdoor attacks from influencing the model while

maintaining the accuracy of the original

classification task. TAG leverages a small

validation data set to estimate the largest change

that a benign user's local training can make to the

output layer of the shared model, which can be

used as a cutoff for returning user models.

Experimental results on multiple data sets show

that TAG defends against backdoor attacks even

data are called ‘Free-riders’. The free rider problem

is the burden on a shared resource that is created by

its use or overuse by people who aren't paying their

fair share for it or aren't paying anything at all.

Much attention has been paid to the free-rider

challenge of peer-to-peer programs. There are a

number of attacks that can be used by an attacker

and possible defenses against such attacks. This

study shows a new detection method called STD-

DAGMM, a high-dimensional anomaly detection

combined studies, tends to identify riders who do

not participate in the efficacy. The STD-DAGMM

method in other attacks can be found in combined

studies, such as venom attacks that are attractive

for research. The field concluded that much

remains to be learned about “free riders” about the

autonomy and countermeasures, especially because

of the many proposed solutions. It is believed that

preliminary research may inform subsequent

efforts in this area. In this research and in the same

Byzantine invasion. They also offer new attack

mechanisms that could threaten current security

systems after careful comparison and discussion

supported by experimental findings.

attacks, which alter the local models sent from the

compromised worker devices to the master device

aggregated global model deviates most from the

direction along which the global model would

change in the absence of attacks, increasing the

error rates of the learned global models.

Additionally, the search for such carefully

constructed local models might be framed as an

optimization problem. To counteract local model

poisoning attacks, we can expand already-existing

data poisoning attack countermeasures. Such all-

encompassing protections work in certain

techniques to find compromised local models and

new adversarial resistant aggregation rules, is also

important, [48]. As a solution to this, a paper [49]

suggests Local Malicious Factor (LoMar), a two-

phase defense algorithm. In phase I, LoMar scores

model updates from each remote client by

measuring the relative distribution over their

neighbors using a kernel density estimation

method. In phase II, an optimal threshold is

approximated to distinguish malicious and clean

difficult to be mitigated by current defense

strategies. The key challenge is that the server

cannot immediately assess the caliber of the local

data sets of the clients. Researchers then talk about

some potential de-fences. Although distance-based

methods like Multi-Krum and Fast Aggregation

against Byzantine Attacks (FABA) cannot

withstand the weight attack, we still believe they

are a viable option. Multi-Krum and FABA both

In principle, using blockchain technology, FL

Security can be thought of as a distributed

database— a public ledger— that is accessible to

everybody. The database verifies and forgery-

proofs each new entry. It suggests a method for

establishing device trust in which local model

validation is carried out by a blockchain network in

for a specific operation with the goal of creating a

new block stored. The created block also contains

the aggregated local model updates that are

available for download by other network

participants. The global model can then be locally

computed by each client. By approving model

updates, this method makes poisoning attacks more

challenging [50] New literature and research are

added every day, vanguard algorithms try to detect

and block the threats that appear every day. Of

contribute to better quality work.

area, they begin by analyzing the model bias in a

medical FL situation. By doing so, they discover a

slight influence of the distribution of chest X-ray

scans across various institutions on the FL model

bias in some cases. They also show that S.V.

approximations can assess bias in medical FL in

addition to contributions to predictive performance.

participating devices in a federated learning system

is modelled in [54] using a Stackelberg game. (The

Stackelberg leadership model is a strategic game in

economics in which the leader firm moves first and

then the follower firms move sequentially). In

order to maximize each device's specific utility, the

authors search to identify the best training times for

the server, reward, and each device. Both the

server-side deadline and the device-side upload

time are taken into account by their model.

a game in algorithmic game theory. Price of

Anarchy is the difference between the social cost of

the worst Nash equilibrium and the social optimum

(i.e., assigning strategies to players to achieve the

lowest possible social cost). The typical assessment

of the potential efficiency loss owing to individual

selfishness, when players are just thinking about

their own utility and not the overall welfare of

society, is commonly conceived of as this very

effective and important notion. By incorporating

they construct a blockchain-powered testbed. The

presented models and theoretical findings are

validated by experiments carried out on top of it.

The authors of [56] used blockchain technology

with federated learning to address the issues of data

privacy, security, and fair compensation in

distributed machine learning. A thorough

methodology for scalable recording and rewarding

of gradients utilizing a mix of off-chain databases

of records and blockchain was provided. In order to