# CS-FL: Cross-Zone Secure Federated Learning with Blockchain and a Credibility Mechanism
## 5 Experiments and Analysis  
### Simulation Setup  
**Datasets and Models. ** The proposed CS-FL method was evaluated on two classic federated learning datasets: MNIST and CIFAR-10. For MNIST, a simple convolutional neural network (CNN) with two convolutional layers, two pooling layers, and two fully connected layers was used. This architecture was chosen for its efficiency in handling small, grayscale images [34]. The CNN model uses 32 filters in the first convolutional layer and 64 filters in the second, both with a kernel size of 3 \(\times\) 3 and ReLU activation. Max-pooling with a pool size of 2 \(\times\) 2 follows each convolutional block. The model ends with two fully connected layers: 64 units with ReLU activation and 10 output units with softmax. An Adam optimizer and sparse categorical cross-entropy loss were used for training. For CIFAR-10, the deeper VGG16 model was chosen due to its superior ability to handle the complexity and diversity of the dataset [35]. VGG16, with its 13 convolutional layers and increasing filter sizes (64, 128, and 256), is well-suited for the more complex CIFAR-10 dataset, which contains color images across 10 classes. The model includes max-pooling layers after each pair of convolutional layers, followed by flattening, a dropout layer, and a dense output layer with 10 units and softmax activation. An Adadelta optimizer and sparse categorical cross-entropy loss were applied. This work adopts the data distribution method in [36] to simulate Non-IID datasets across ENs. The training set sizes of MNIST and CIFAR-10 were randomly selected to be between 100 and 500 and between 1000 and 2000, respectively. **Evaluated Threat Models. ** To simulate various threats from the edge side in EC, threat models are classified into three categories: local poisoning models, communication delay models, and malicious behaviors models. For local poisoning models, two types of attacks are set up, respectively, aimed at tampering with datasets and modifying local models:  
* Data poisoning attack (DPA): Label flipping (LF) model [37] is a type of DPA where attackers manipulate data of a specific label to be wrongly classified as another target label. It is assumed that malicious ENs flip each label \(l\) to \(L-l-1\) in \(L\)-classified datasets. * Model poisoning attack (MPA): This study proposes a noise-based model poisoning approach aimed at disrupting the convergence of the global model in FL. By introducing certain noise perturbations into the local model updates of malicious ENs, the attack ensures that the malicious updates deviate from the distribution of normal node updates. Specifically, the attacker perturbs the benign model updates by injecting Gaussian noise or fixed values. The malicious update for each dimension \(j\in[d]\) is defined as follows: \[w_{malicious,j}=w_{n,i,j}+\varsigma\cdot\sigma_{j}\cdot\text{sign}(r_{j})\] (17) where \(w_{n,i,j}\) represents the benign update based on local dataset of ENs, \(\sigma_{j}\) is the standard deviation of the benign updates, and \(\text{sign}(r_{j})\) is the sign of a random value drawn from a standard normal distribution \(r_{j}\sim N(0,1)\). The noise amplification factor \(\varsigma\) is randomly selected within the range \([3,5]\). For communication delay models, this study employs a 5G NR-based channel model, where the Signal-to-Interference-plus-Noise Ratio (SINR) is the primary metric to measure the transmission performance of ENs. The CQI value is used to quantify the channel condition. The channel characteristics are impacted by path loss, multipath fading, shadowing, interference, and noise. The SINR is defined as follows:  
\[\text{SINR}_{n}=\frac{P_{signal,n}}{P_{interface,n}+P_{noise,n}} \tag{18}\]where \(P_{signal,n}\) is the effective received power for EN \(n\), \(P_{interference,n}\) is the interference power from neighboring nodes or base stations, and \(P_{noise,n}\) is the thermal and environmental noise power.