# Reducing Defense Vulnerabilities in Federated Learning:
## 2 Related Work
### Neuron-Level Defenses in Distributed Learning  
[PERSON] et al. [21] introduce FL-Defender, a novel method to combat targeted poisoning attacks in FL. The authors analyze the behavior of label-flipping and backdoor attacks, finding that attack-related neurons in the last layer of deep learning models exhibit different behavior from unrelated neurons. Based on this insight, they engineer robust discriminative features by calculating worker-wise angle similarity for last-layer gradients and compressing the resulting similarity vectors using PCA. FL-Defender then re-weights workers' updates based on their deviation from the centroid of these compressed similarity vectors. The method is designed to be effective regardless of data distribution or model size, addressing the limitations of existing defenses. Experiments on three datasets with different deep learning models and data distributions demonstrate FL-Defender's effectiveness in defending against label-flipping and backdoor attacks, achieving the lowest attack success rates while maintaining global model performance on the main task and causing minimal computational overhead on the server compared to several state-of-the-art defenses.  
Recent research has increasingly focused on examining neural network behavior at the neuron level to detect poisoning attacks. [PERSON] et al. [21] introduced FL-Defender, which analyzes the behavior of neurons in the last layer of deep learning models during poisoning attacks. They discovered that attack-related neurons exhibit distinctly different behavior patterns compared to unrelated neurons, allowing for more effective detection of malicious updates. Their approach focuses specifically on the last layer, calculating worker-wise angle similarity for these gradients and then applying dimensionality reduction.  
Similarly, [PERSON] et al. [22] developed LFGuard, which evaluates received models on an auxiliary dataset and extracts activations from the last layer to identify malicious participants. Their approach uses a Multi-Class Support Vector Machine (MCSVM) to classify updates as malicious or legitimate, showing particular effectiveness in vehicular network settings. LFGuard evaluates each received model on an auxiliary dataset, extracts the activations of the last layer, and feeds them into the MCSVM to classify the model as malicious or legitimate. The method's effectiveness was evaluated against targeted label-flipping attacks with various numbers of malicious participants, considering both single-label and multi-label-flipping scenarios under different poisoning intensities. The authors assessed LFGuard's efficacy against different state-of-the-art techniques using three benchmark datasets (Fashion-MNIST, EMNIST, and GTSR) to showcase its performance in mitigating poisoning attacks in both IID and non-IID environments. The findings indicate that LFGuard outperforms prior studies in thwarting targeted label-flipping attacks,demonstrating more than 5% improvement in global model accuracy, 12% in source class recall, and a 6% reduction in attack success rate while maintaining high model utility.  
While these approaches demonstrate the value of neuron-level analysis, they typically focus on specific layers (particularly output layers) rather than examining neurons across the entire network architecture. [PERSON] et al. [23] explored model pruning in federated learning contexts, demonstrating that selecting the most impactful neurons can maintain model performance while reducing computational requirements. Though their work focused on efficiency rather than security, it provides important insights into the relationship between neuron importance and model functionality.  
In light of these findings, we propose a novel mechanism for the strategic selection of key neurons to be utilized in decision-making processes for defensive measures in FL environments.