# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
This metric provides insights into the model's confidence in making malicious classifications. A higher Malicious Confidence indicates a greater tendency for the model to identify malicious instances that manage to go unnoticed by being misclassified as benign. A robust defense algorithm should ideally exhibit a low MC, indicating a reduced likelihood of misclassifying malicious instances as benign. \[\text{MC}=\frac{\text{Number of Correct Malicious Predictions}}{\text{Total Number of Prediction Classified as Malicious}} \tag{1}\]

The Attack Success Rate (ASR) [8] evaluates the effectiveness of malicious attacks on the model. It is calculated by dividing the number of successful malicious attacks by the total number of attempted malicious attacks (see Equation (2)). The ASR provides a measure of the adversary's success in manipulating the model to misclassify examples as malicious. \[\text{ASR}=\frac{\text{Number of Successful Malicious Attacks}}{\text{Total Number of Attempted Malicious Attacks}} \tag{2}\] \begin{table}
\begin{tabular}{c c c} \hline \hline
**Dynamic Parameter** & **Range Values** & **Default Value** \\ \hline \multirow{4}{*}{\begin{tabular}{c} Percentage of Independent \\ and Identically Distributed \\ (IID) Data \\ \end{tabular} } & 0 & \\  & 0.2 & \\  & 0.4 & \\  & 0.6 & \\  & 0.8 & \\  & 1 & \\ \hline \multirow{4}{*}{\
\begin{tabular}{c} Percentage of Malicious \\ Clients \\ \end{tabular} } & 20 & \\  & 40 & \\  & 60 & \\  & 80 & \\  & 100 & \\ \hline \multirow{4}{*}{
\begin{tabular}{c} Percentage of \\ Clients \\ \end{tabular} } & 0\% & \\  & 2\% & \\  & 4\% & \\ \cline{1-1}  & 10\% & \\ \cline{1-1}  & 20\% & \\ \cline{1-1}  & 30\% & \\ \cline{1-1}  & 40\% & \\ \cline{1-1}  & 50\% & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Parameters and variation ranges used in experimental evaluation. In this equation the \"Number of Successful Malicious Attacks\" represents the number of test data instances that were successfully tampered with (mislabeled), and the \"Total Number of Attempted Malicious Attacks\" is the total number of test data instances on which malicious attacks were attempted [8]. The higher the ASR, the worse the algorithm's performance in preventing attacks. Therefore, we aim for a good algorithm to have a low ASR. Before discussing the additional metrics, we must first clarify the meanings of true positive (TP), true negative (TN), false positive (FN), and false negative (FN). TP is the number of instances correctly predicted to be malicious. TN is the number of instances correctly predicted to be benign. FP is the number of instances falsely predicted to be malicious (benign instances misclassified). FN is the number of instances misclassified as benign [21]. Accuracy is a general metric that measures the overall correctness of the model's predictions. It is the ratio of the correct predictions (both benign and malicious) to the total number of predictions (see Equation (3)). High accuracy indicates a well-performing model. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+ \text{FN}} \tag{3}\]

Precision measures the correctness of the model's malicious predictions. It is calculated by dividing the number of true positives (correctly predicted) by the sum of true positives and false positives (see Equation (4)). Precision is critical when minimizing false positives or misclassifying benign examples as malicious. \[\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}} \tag{4}\]

Recall, also known as Sensitivity or True Positive Rate, measures the ability of the model to identify all malicious examples. It is calculated by dividing the number of true positives by the sum of true positives and false negatives (see Equation (5)). A high recall indicates the effective detection of malicious instances. \[\text{Recall}=\frac{\text{TP}}{\text{TP}+\text{FN}} \tag{5}\]

The F1-Score is the harmonic mean of Precision and Recall (see Equation (6)).