# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
This observation is particularly pronounced in the presence of the alternating minimization stealth strategy. When the data are IID, and the attacker optimizes for the stealth objective, a malicious update can apparently share a very similar direction with a

Figure 5: The impact of the percentage of Independent and Identically Distributes data on malicious confidence on: (**a**) Fashion-MNIST dataset; (**b**) CIFAR-10 dataset; (**c**) UCI Adult Census dataset; (**d**) Epileptic Seizure Recognition dataset. benign update, making it less detectable. This suggests that malicious updates, even when optimized for stealth, can form distinctive clusters, regardless of whether the data are IID or not. However, this phenomenon is not entirely reliable and depends on the nature of the classification task. These results underscore the critical importance of considering the percentage of the IID data parameter when selecting and evaluating defense algorithms in federated learning systems. They highlight the need for a tailored approach for different data configurations and potential threats. In addition, the detailed analysis of the ASR and MC metrics provides valuable insights into the algorithms' ability to withstand adversarial attacks in federated environments, contributing to the development of more robust and effective strategies. As we can observe in Figures 4 and 5, both ASR and MC tend to decrease as the data become more independent and identically distributed (increasing the percentage of IID data), and the performance of the model tends to increase. When the percentage of IID data varies from 0% to 100%, RPCA + PCA + K-means becomes the most effective algorithm in defending the federated learning system, followed by KPCA + K-means, PCA + K-means, CONTRA, KRUM, and finally COOMED. Comparing the execution times of the algorithms on the Fashion-MNIST dataset, the results presented in Table 8 show that the fastest algorithm is CONTRA, followed by KRUM, PCA + K-means, KPCA + K-means, COOMED, and finally RPCA + PCA + K-means. RPCA + PCA + K-means is the slowest because it involves more complex computations and additional processing steps compared to the other algorithms. In the CIFAR-10 dataset, the algorithms have almost the same order in terms of execution time as in the Fashion-MNIST dataset, with CONTRA being the fastest, followed by KRUM, COOMED, PCA + K-means, KPCA + K-means, and finally RPCA + PCA + K-means. For the UCI Adult Census dataset, the execution time in our tests was so fast that it was not possible to identify the fastest and slowest algorithms. Lastly, for the Epileptic Seizure Recognition dataset, the fastest algorithm is COOMED, followed by KRUM, then PCA + K-means and CONTRA with the same execution time, followed by KPCA + K-means, and finally RPCA + PCA + K-means. ### Impact of Number of Clients

We investigate the impacts of number of clients on the performance of the defense algorithms by varying the number of clients between 20 and 100. This provides insights into how the algorithms perform in scenarios with many clients. Looking at the results in Figures 6-8, we can see a clear pattern that shows the relationship between the number of clients and how well the defense algorithms work. \begin{table}
\begin{tabular}{c c c c c c c} \hline
**Execution Time** & **PCA +** & **KPCA +** & **CONTRA** & **KRUM** & **COOMED** & **RPCA + PCA + K-Means** \\
**(in min)** & **K-Means** & **K-Means** & **K-Means** & **K-Means** & **K-Means** & **K-Means** & **K-Means** \\ \hline Fashion-MNIST Dataset & 90 & 93 & **84** & 89 & 95 & 96 \\ \hline CIFAR-10 Dataset & 96 & 102 & **87** & 89 & 93 & 105 \\ \hline UCI Adult Census Dataset & 4 & 4 & 4 & 4 & 4 & 4 \\ \hline Epileptic Seizure Recognition Dataset & 106 & 108 & 106 & 102 & **99** & 113 \\ \hline \end{tabular}

* The bold is used to highlight the best execution time in each dataset.

\end{table} 
Table 8: The execution time (in minutes) when varying the percentage of IID data.