## 6 Defenses against Model and Data Attacks
### Regularization  
Regularization serves as a defensive strategy in FL, safeguarding both the server and client sides against data and model poisoning attacks. On the server side, regularization is applied during the aggregation of model updates to prevent overfitting and improve model generalization. Techniques such as L1 and L2 regularization introduce penalty terms in the loss function during training, which helps to control the complexity of the shared model and ensures robust pattern learning from local data [133; 134]. On the client side, participants implement regularization methods like dropout, batch normalization, or weight decay during their training processes [135; 136]. These techniques help to prevent overfitting on local data, enhancing the overall robustness and resilience of the FL system. A diagrammatic overview of the process is provided in Figure 14.  
The work by [PERSON] et al. [137] introduced a defense framework named Local Self-Regularization (LSR) to address the challenge of training on noisy labeled data in FL while maintaining data privacy. LSR focuses on regularizing the local training process on  
Figure 14: Visual representation of regularization.  
Figure 13: Visual representation of Incentivized Federated Learning.  
each client through two main components. First, implicit regularization employs MixUp prediction to boost the model's discrimination confidence and prevent it from memorizing noisy labels. Second, explicit regularization uses self-knowledge distillation to minimize the discrepancy between the model outputs of original and augmented instances of the same sample. This method leverages data augmentation to gain additional supervision without needing an auxiliary clean dataset or compromising FL's privacy principles. By applying these regularization techniques locally, LSR aims to mitigate the performance degradation caused by noisy labels in FL environments. The authors validate the effectiveness of their approach with experiments on benchmark datasets and illustrate its potential to integrate with existing state-of-the-art methods for further performance enhancements.  
Similarly, [PERSON] et al. [138] introduced Contractible Regularization (ConTre), a defense framework for FL designed to address the challenges of non-IID data, especially in image classification tasks. ConTre works by regularizing the latent space of local models to prevent them from prematurely converging to suboptimal local optima. It achieves this by projecting input images into a latent space and using a contrastive-learning-based regularizer to differentiate between images of the same class while clustering images from different classes. ConTre can be easily integrated into existing FL frameworks without additional parameters and gradually reduces its influence during training to avoid potential side effects as the process converges. The authors demonstrate that ConTre significantly enhances the performance of various FL methods on both natural and medical image datasets under non-IID conditions. It also accelerates convergence, allowing models to reach the target accuracy in fewer communication rounds compared to methods without ConTre.  
All the above-described defense frameworks are summarized in Table 2.