# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Fashion-MNIST Dataset** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & \begin{tabular}{c} **Attack** \\ **Success Rate** \\ \end{tabular} & \
\begin{tabular}{c} **Malicious** \\ **Confidence** \\ \end{tabular} &
\begin{tabular}{c} **Execution** \\ **Time (min)** \\ \end{tabular} \\ \hline PCA + K-means & 79.66 & 79.48 & 97.28 & 87.51 & **0** & **0** & 90 \\ \hline KPCA + K-means & **87.44** & 79.43 & 97.36 & 87.44 & **0** & **0** & 93 \\ \hline CONTRA & 80.31 & 80.64 & 97.46 & 88.49 & 20 & 11.12 & **84** \\ \hline KRUM & 78.61 & 71.45 & 95.47 & 81.53 & 15 & 8.29 & 89 \\ \hline COOMED & 77.50 & **85.54** & **97.51** & **90.69** & 20 & 17.44 & 95 \\ \hline RPCA + PCA + K-Means & 80.52 & 80.54 & 97.45 & 88.43 & **0** & **0** & 96 \\ \hline \hline \end{tabular}

* The bold is used to highlight the best results achieved for each of the metrics used.

\end{table} 
Table 7: The average test results with the default dynamic parameter values for the Fashion-MNIST dataset. Regardless of the defense algorithm employed, the overall accuracy remains consistently stable across all datasets, as depicted in Figure 3. This indicates that the choice of defense algorithm has minimal impact on the system's overall accuracy across varying datasets. For instance, for the Fashion-MNIST dataset, the algorithm with the highest average precision is COOMED with 73.00%, followed by KPCA + K-means with 72.40%, RPCA + PCA + K-means with 71.81%, PCA + K-means with 71.73%, CONTRA with 70.22%, and lastly KRUM with 66.33%. As for average recall, considering only the Fashion-MNIST dataset, the algorithm with the highest recall was KPCA + K-means with 93.51%, followed by PCA + K-means with 93.41%, RPCA + PCA + K-means with 92.81%, CONTRA with 91.32%, COOMED with 89.52%, and lastly KRUM with 89.11%. Figure 3: The impact of the percentage of IID data on the prediction accuracy of the global model on: (**a**) Fashion-MNIST dataset; (**b**) CIFAR-10 dataset; (**c**) UCI Adult Census dataset; (**d**) Epileptic Seizure Recognition dataset. In terms of average accuracy, and considering only the Fashion-MNIST dataset, the algorithm with the highest accuracy was KPCA + K-means with 77.34%, followed by PCA + K-means with 71.45%, RPCA + PCA + K-means with 71.37%, CONTRA with 70.17%, COOMED with 66.68%, and lastly KRUM with 67.88%. The results obtained from Precision, Recall, and F1-Score as the number of clients varies can be found in Appendix A--Figures A1-A3, respectively. Of particular note is the low performance seen when the data are completely non-IID (percentage of IID data = 0%). However, as the percentage of IID data increases, the overall accuracy improves rapidly, stabilizing in the percentage of IID data range of 20% to 100%. This behavior is intuitively expected as a higher percentage of IID data indicates that each client has data points drawn from the same underlying distribution, independently of each

Figure 4: The impact of the percentage of Independent and Identically Distributes data on the attack success rate on: (**a**) Fashion-MNIST dataset; (**b**) CIFAR-10 dataset; (**c**) UCI Adult Census dataset; (**d**) Epileptic Seizure Recognition dataset. other. Thus, the local models are trained on datasets that are more representative of the global dataset, facilitating easier convergence. Figures 4 and 5 show that CONTRA, KRUM, and COOMED have relatively worse performances in minimizing Malicious Confidence (MC) and Attack Success Rate (ASR) compared to other algorithms. PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means perform quite similarly in attempting to minimize malicious confidence. In certain cases, non-IID data can result in malicious updates that are difficult to distinguish from benign updates. This consistency is observed across different datasets. The reductions in MC and ASR as the percentage of IID data increases is intuitive, as non-IID data can make a malicious update more detectable among more similar benign updates.