## 6 Defenses against Model and Data Attacks
### Detect and Remove  
This method is typically implemented on the server side and focuses on detecting and removing malicious updates to the model. It involves continuously monitoring incoming updates from clients and analyzing them for any signs of abnormality or inconsistency. Suspicious updates that do not conform to the expected pattern of legitimate updates are flagged. These deviations might be detected through statistical analysis, machine-learning-based anomaly detection, or by comparing the updates against a baseline of known good updates. Once identified, these flagged updates are removed from the aggregation process to prevent them from negatively impacting the model's performance, thereby ensuring the integrity and reliability of the FL system. The block diagram of the detect and remove method is presented in Figure 6.  
The defense framework presented in [82], called Local Malicious Factor (LoMar), is a two-phase algorithm designed to defend against poisoning attacks in FL. In Phase I, the Malicious Client Factor phase, each remote client update's maliciousness is scored. This involves finding the k-nearest neighbors of each update to form a reference set and using kernel density estimation (KDE) to calculate a \"maliciousness factor\" F(i) for each update. In Phase II, the Decision Threshold phase, a threshold is determined to classify the F(i) scores as clean or malicious. The threshold is derived by combining the theoretical lower bound for malicious updates and the expected boundary value for clean updates in a trusted system. By applying this threshold, LoMar effectively identifies and defends against poisoning attacks in FL. Similarly, the authors in [83] introduced a defense strategy called FederatedReverse, which involves reverse engineering, trigger generation, outlier detection, and model repair. Each participant generates local reverse triggers for each label by finding minimal perturbations that identify samples as specific labels, revealing backdoor triggers. These local triggers are sent to the central server, which aggregates them into robust global reverse triggers. The server then detects outliers among these triggers using an absolute median method, flagging abnormal scores that indicate attacks. If an attack is detected, the global reverse trigger for the infected label is added to each participant's training data to \"unlearn\" the backdoor influence while preserving the main task accuracy. This approach enhances the security and reliability of FL systems. The authors in [84] introduced a defense strategy termed Dynamic Defense Against Byzantine Attacks (DDaBA). The framework operates by dynamically deciding which client updates to aggregate and which to discard, specifically targeting potentially adversarial clients attempting to poison the model. Central to DDaBA is the use of an Induced Ordered Weighted Averaging (IOWA) operator for aggregation. This operator assigns weights to client contributions based on their performance on a validation dataset, ordering the clients from best to worst. A linguistic quantifier adjusts these weights dynamically, leveraging statistical outlier detection to identify and exclude potential adversarial clients. By adapting weights based on performance discrepancies modeled as an exponential  
Figure 6: Visual representation of detect and remove defense strategy. distribution, DDaBA effectively filters out adversarial influences while improving the overall performance of the FL model. The SecFedNIDS framework [85] defends FL-based network intrusion detection systems against poisoning attacks with two main mechanisms. At the model level, it centrally detects and rejects poisoned local intrusion detection models by selecting critical parameters using gradient information and employing the Stochastic Outlier Selection (SOS) algorithm for real-time anomaly detection among local models. This prevents poisoned models from influencing the global model.