# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
The algorithm for the federated learning system using RPCA + PCA + K-means as the aggregation model works as follows (Algorithm 6):

```
Input: numberOfAgents, T (number of iterations) Output: globalWeights // Step 1: Initialization and Configuration  Initialize agents with indices [1, 2,..., numberOfAgents]  Initialize globalWeights  Set t = 0 // Step 2: Main Training Loop whilet < T do // Step 2: Calculate probabilities for agent selection  probabilities = CalculateSelectionProbabilities(agents) // Step 2: Start parallel training and wait for completion  selectedAgents = SelectAgents(probabilities)  updates = ParallelTraining(selectedAgents) // Step 2: Data Collection and Preprocessing  updateMatrix = CollectUpdates(updates)
```

**Algorithm 6**Identifying malicious model updates using RPCA + PCA + K-means

## 6 Experimental Setup

In this section, we detail the setup of our experiments, examining the simulation model and the performance metrics. In addition, we examine the datasets used and explain the specific neural network architectures tailored to the requirements of each dataset. ### Simulation Model

The simulation model used in our experiments is based on the repository provided by [17], as previously described in Section 4.2. The experiments for the classification task used the Fashion-MNIST dataset along with the CIFAR-10, UCI Adult Census, and Epileptic Seizure Recognition datasets, which are described in Section 6.3. The impact of the following three dynamic parameters on performance metrics is also analyzed: (i) the percentage of Independent and Identically Distributed (IID) data in clients, (ii) the total number of clients, and (iii) the percentage of malicious clients. The extent of IID in the data is quantified in a manner similar to that described in [PERSON]'s original paper [11]. First, the training data to be distributed among the clients are sorted using class labels. Then, they are divided as evenly as possible into a number of slices that lies between the number of clients and the number of training examples. Then, an equal number of slices are randomly distributed to the clients. If the number of slices is equal to the number of clients, the data are maximally non-IID because each client is likely to receive data from only one or two labels. If the number of slices is equal to the number of training examples, the data are maximally IID, since this is equivalent to randomly distributing the data among the clients. These two extremes are linearly mapped to the values 0 and 1 of the parameter called IID, where 0 is completely non-IID and 1 is IID. Each run consisted of 20 communication rounds, as detailed in the subsequent section, and theperformance metrics were averaged over the 10 experimental runs. This approach aligns with the methodology utilized by [7] for computing performance metrics across different scenarios listed in Table 2.

### Performance Metrics

In the experiments, the performance is measured after each round of communication and consists of the following six metrics: Accuracy, Precision, Recall, F1-Score, Malicious Confidence, and Attack Success Rate. A communication round in federated learning is a cycle where clients train models locally and send their updates to the server, and the server aggregates these updates to refine the global model and sends the updated global model to the clients, completing one iteration of the collaborative learning process. The server retains a portion of the data as a test set to evaluate performance. Then, at the end of the federated learning process, the metrics of the global model are extracted from the test data. As mentioned above, this is computed after 20 rounds of communication. The Malicious Confidence (MC) measures the accuracy of the model specifically in predicting malicious examples. It is calculated by dividing the number of correct malicious predictions by the total number of predictions that the model classified as malicious (see Equation (1)).