## 6 Defenses against Model and Data Attacks
### Data and Update Analysis  
This defense strategy can be implemented on both the server and client sides in FL. On the server side, it focuses on examining aggregated client updates to detect suspicious patterns or inconsistencies. Techniques such as statistical analysis, outlier detection, and machine-learning-based anomaly detection are used to identify potential malicious activity or data manipulation. On the client side, the approach involves preprocessing data, conducting data quality checks, validating, and cleaning the data to ensure their integrity before training. This dual-layered approach helps to maintain the security and reliability of the FL system by addressing potential threats at multiple points in the data lifecycle. Clients also verify their local updates before sending them to the server. This framework is graphically presented in Figure 11.  
The defense strategy outlined in [113] introduces a proactive security measure named Siren, aimed at strengthening the resilience of FL systems against byzantine attacks. Siren is implemented on both the client and server sides. On the client side, each client engages in a dual process involving training and alarming. Clients reserve a portion of their local dataset as a test set to assess the performance of the global model. During each communication round, clients receive the global model weights from the server and compare them against the performance of their local model on the test dataset. If the global model's accuracy exceeds a predefined threshold compared to the local model, the client proceeds with training using the global model and informs the server that the model is reliable. However, if the global model's performance falls below the local model, the client continues using its local model and alerts the server about a potential issue with the global model. On the server side, the server gathers these alerts and leverages them to identify suspicious updates. By consolidating this feedback, the server can recognize patterns and determine if the global model has been compromised. This enables the server to exclude dubious updates and uphold the integrity of the FL process. The defense strategy described in [114], called DeepSight, involves a multi-layered approach to protect against dynamic backdoor attacks in FL. The first layer is a classification-based filtering that assesses the homogeneity of a model's training data using a metric called \"Threshold Exceedings\". This enables deep analysis of individual models to classify them as benign or suspicious. The second layer employs clustering to group model updates based on similar training data, separating malicious from benign updates. Techniques like Division Differences and Normalized Energy Updates characterize the training data. The third layer combines the classification and clustering results to identify clusters containing poisoned models, deciding whether to exclude or accept each model update. The fourth layer enforces constraints on model updates through weight clipping, mitigating attacks by making any backdoor behavior negligible during aggregation. Finally, the aggregation  
Figure 11: Visual representation of data and update analysis. layer minimizes the effect of any remaining weakly trained poisoned models, ensuring their minimal impact on the overall model aggregation. This multi-layered approach provides robustness such that, even if one component fails to detect poisoned models, others can compensate to maintain integrity. By combining these techniques, DeepSight ensures the integrity and performance of the aggregated model. The Biscotti framework [115] uses a decentralized peer-to-peer approach with blockchain technology to enhance the security and privacy of FL. It addresses key vulnerabilities in FL, such as poisoning and information leakage attacks. Biscotti employs a Proof-of-Federation consensus protocol where a peer's contribution determines their role. Consistent hashing and verifiable random functions prevent Sybil attacks and randomly select peers for protocol stages.