# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
First, we notice that as the number of clients increases, the overall accuracy gradually decreases along with precision and recall, except for with the UCI Adult Census dataset, where the recall metric increases when the number of clients also increases. Another factor observed across all datasets is that recall is higher than precision and accuracy. This makes sense because each client gets a smaller portion of the data when there are more clients, making the local models more specialized. This makes it harder to combine these specialized models together into one strong global model that can work well with different datasets. For instance, for the Fashion-MNIST dataset, the algorithm with the highest average precision was COOMED with 86.92%, followed by CONTRA with 84.14%, RPCA + PCA + K-means with 83.87%, PCA + K-means with 83.36%, KPCA + K-means with 83.29%, and lastly KRUM with 80.06%. Figure 6: The impact of the number of clients on the prediction accuracy of the global model on: (a) Fashion-MNIST dataset; (b) CIFAR-10 dataset; (c) UCI Adult Census dataset; (d) Epileptic Seizure Recognition dataset. As for average recall, considering only the Fashion-MNIST dataset, the algorithm with the highest recall is COOMED with 97.74%, followed by PCA + K-means with 97.67%, RPCA + PCA + K-means with 97.66%, CONTRA with 97.63%, KPCA + K-means with 97.61%, and lastly KRUM with 96.67%. In terms of average accuracy, and considering only the Fashion-MNIST dataset, the algorithm with the highest accuracy was KPCA + K-means with 88.59%, followed by CONTRA with 84.78%, RPCA + PCA + K-means with 84.12%, PCA + K-means with 83.56%, KRUM with 82.13%, and lastly COOMED with 81.11%. The results obtained from Precision, Recall, and F1-Score as the number of clients varies can be found in Appendix A--Figures A4-A6, respectively. Figure 7: The impact of the number of clients on attack success rate on: (**a**) Fashion-MNIST dataset; (**b**) CIFAR-10 dataset; (**c**) UCI Adult Census dataset; (**d**) Epileptic Seizure Recognition dataset. In terms of MC and ASR, we see a consistent decrease in all algorithms as the number of clients increases. This is because the local models become more specialized with fewer data per client, making it easier for these algorithms to see the \"suspicious similarity\" between malicious updates and benign updates. In general, CONTRA, KRUM, and COOMED typically have an Attack Success Rate above 90% with 20 clients, but with 100 clients, they consistently maintain an Attack Success Rate below 30%. On the other hand, PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means perform more consistently and better than the other algorithms; their MC and ASR levels may increase slightly for a few clients, but they typically remain below 15%. This suggests that the total number of clients does not have a big impact on how distinct clusters are formed between malicious and benign updates. In addition, as shown in Figures 7 and 8, ASR and MC are higher in some datasets, which may be related to the nature of the dataset itself. However, they all follow the same

Figure 8: The impact of the number of clients on malicious confidence on: (a) Fashion-MNIST dataset; (b) CIFAR-10 dataset; (c) UCI Adult Census dataset; (d) Epileptic Seizure Recognition dataset. trend of decreasing ASR and MC as the number of clients increases. This suggests that, despite variations in datasets, the positive influence of increasing clients on reducing ASR and MC is a consistent trend across different scenarios. Moreover, all algorithms perform well as the number of clients increases, indicating that they are well suited to handling a large number of clients.