# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
\begin{table}
\begin{tabular}{c c} \hline \hline
**Layer Type** & **Size** \\ \hline Two Densely Connected Layers + ReLU & 128 neurons in each layer \\ activation & Dropout: 0.5 (randomly deactivates 50\% of \\ neurons during training for regularization \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The DNN architecture used in the Epileptic Seizure Recognition dataset. \begin{table}
\begin{tabular}{c c} \hline \hline
**Layer Type** & **Size** \\ \hline Two Densely Connected Layers + ReLU & 256 neurons in each layer \\ activation & Dropout: 0.5 (randomly deactivates 50\% of \\ neurons during training for regularization \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The DNN architecture used in UCI Adult Census dataset. space, where nonlinear patterns can be more easily separated. Subsequently, the K-means algorithm groups the projected data into clusters, helping identify distinct patterns and make more precise decisions. This results in a more robust and effective model for data classification. On the other hand, KRUM showed the lowest global model performance, considering the metrics Accuracy, Precision, Recall, and F1-Score. This is due to its sensitivity to the presence of outliers and its inability to effectively handle nonlinear or highly complex data, which are common in real-world datasets. The global model performances of the algorithms vary according to their ability to handle the complexity of the data and extract relevant patterns for the classification task. KPCA + K-means stood out in this specific case due to its ability to handle nonlinear data and find more complex patterns in the Fashion-MNIST dataset. Based solely on the metrics of Precision, Recall, and F1-Score, the best algorithm is COOMED, followed by CONTRA, RPCA + PCA + K-means, PCA + K-means, KPCA + K-means, and KRUM. Considering just the metric accuracy, the best algorithm is KPCA + K-means, followed by RPCA + PCA + K-means, CONTRA, PCA + K-means, KRUM, and COOMED. Considering the Attack Success Rate (ASR) and the Malicious Confidence (MC), where lower values indicate better performance, the experiments show that the best algorithms are PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means, which have an ASR and MC of 0%, and COOMED is the worst algorithm with the highest ASR and MC. In terms of the execution time, the fastest algorithm is CONTRA, and RPCA + PCA + K-means is the slowest algorithm. CONTRA is 1.06, 1.07, 1.11, 1.13, and 1.14 times faster than KRUM, PCA + K-means, KPCA + K-means, COMMED, and RPCA + PCA + K-means, respectively. ### Impacts of the Percentage of Independent and Identically Distributed Data

To study the impacts of the percentage of IID data on the performances of the defense algorithms, we vary the percentage of the IID parameter between 0% and 100%, as shown in Table 1. This provides insights into the robustness of the algorithms under different data distribution scenarios. By examining the results across all datasets, as shown in Figures 3-5, a trend emerges that shows an improvement in the model's performance and a significant reduction in the Attack Success Rate and Malicious Confidence as the percentage of IID parameter increases.