## 6 Defenses against Model and Data Attacks
### Detect and Remove
On the client side, SecFedNIDS employs a data-level defense by identifying and filtering out poisoned traffic data using class path similarity analysis via Layer-wise Relevance Propagation. Further, ref. [86] introduced two targeted defense strategies for FL environments. The first, Defense Against Convergence-Round Attack with Similarity Measurement (PA-SM), employs a pre-aggregation step to compute an interim model (wrP) before the final aggregation. By assessing the cosine similarity between wrP and each local model update (wri), updates with high similarity above a set threshold (e.g., 0.95-0.99) are identified as potentially malicious and excluded from the aggregation. This prevents backdoor attacks aiming to manipulate the model convergence. The second strategy, Defense Against Early-Round Attack with Backdoor Neuron Activation (ACCDR), uses the Data-Free TrojanNet Detector (DF-TND) to detect backdoor activations. It assesses models based on abnormal scores derived from comparisons between neuron representations of recovered patterns and original inputs. Models exceeding a threshold for abnormality are flagged as compromised and excluded from the aggregation, ensuring that the final model remains robust against early-round backdoor intrusions. Another defense framework, called density-based anomaly detection [87], introduces a density-based algorithm to assess the anomaly scores for each client's uploaded local model, marking a model as anomalous if it stands out as denser than its closest neighbors. An anomaly score is computed based on how isolated a model is compared to its neighbors. Additionally, the framework proposes dynamically adjusting the weight of each local model during aggregation based on these anomaly scores. BAFFLE is a defense framework designed to enhance the security of FL against backdoor attacks [61]. It operates through a feedback loop mechanism where, during each training round, a subset of clients independently validate the global model from the previous round using their private datasets. These clients assess the model for suspicious behavior by comparing its error rates across different classes with those of previously accepted \"trusted\" models. Significant discrepancies in error rates above a set threshold indicate potential backdoor presence, prompting the clients to vote on the model's integrity. The server then aggregates these votes and accepts the model only if the number of suspicious votes falls below a predefined quorum threshold. Further, ref. [88] proposed a defense framework for FL against data poisoning attacks. It utilizes Kernel Principal Component Analysis (KPCA) for the dimensionality reduction of participant updates to capture data patterns and reduce noise. An algorithm (Algorithm 2) based on KPCA identifies malicious updates by measuring the deviation from the global model update. Optionally, K-means clustering may be applied after KPCA, although KPCA alone proves more effective due to its simplicity. The identified malicious participants are blacklisted or ignored in future FL rounds to prevent model poisoning. The framework includes real-time online detection to continuously monitor updates and take immediate mitigation actions like blacklisting, ensuring ongoing protection during FL training. The authors in [89] proposed a defense for detecting abnormal samples, including out-of-distribution and adversarial ones. It derives a generative classifier from a pre-trained softmax neural model using Gaussian discriminant analysis (GDA), assuming that the class features follow Gaussian distributions. A confidence score based on Mahalanobis distance assesses the proximity of test samples to these distributions, gauging their probability density. Calibration techniques involve adding controlled noise to test samples and combining confidence scores from multiple layers to improve detection. The framework demonstratesrobustness under conditions like noisy labels, small training datasets, and minimal hyperparameter tuning without out-of-distribution data.