# Reducing Defense Vulnerabilities in Federated Learning:
## 4 Attack Scenarios and Results
### Performance Analysis
#### 4.3.2 Model Poisoning Scenario and Results (IID)  
In this study, sign-flipping and LIE attacks were performed in the model poisoning attack scenario. The sign-flipping attack is as mentioned in Section 4.3[12]. Table 5 shows the results of the sign-flipping attack performed on the CIFAR-10 dataset. This model poisoning attack affects more gradient values than data poisoning attacks. However, the proposed NC-FLD method is also resistant to sign-flipping attacks because it selects neurons that change significantly. Table 6 illustrates the sign-flipping attack results on F-MNIST and MNIST. NC-FLD with OC-SVM classification consistently outperforms baseline methods, preserving over 80% accuracy even under severe attack conditions. As Tables 5 and 6 show, the Krum algorithm is highly vulnerable against sign-flipping attack compared to other methods. **LIE attack**: First of all, the standard deviations and averages of all gradients should be estimated empirically, and then it will not affect these values, only the max. It is model poisoning, which is carried out by affecting the model parameters in such a way that the \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline  & \multicolumn{2}{c}{**F-MNIST**} & \multicolumn{2}{c}{**MNIST**} \\ \hline  & **\%0** & **\%20** & **\%40** & **\%0** & **\%20** & **\%40** \\ \hline Krum [14] & 61.95 & 55.44 & 52.79 & 79.99 & 50.24 & 48.12 \\ Median [16] & 81.65 & 72.56 & 58.36 & 94.52 & 74.41 & 61.26 \\ TMeans [16] & 80.71 & 64.24 & 15.18 & 94.63 & 70.86 & 16.13 \\ Ours OC-SVM & 83.79 & **83.54** & **81.21** & **98.02** & **87.62** & **86.66** \\ Ours Agg-C & **84.01** & 80.46 & 78.35 & 97.88 & 87.48 & 83.51 \\ Ours k-NN & 80.46 & 77.46 & 74.18 & 97.05 & 78.39 & 75.14 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Sign-flipping attack results for F-MNIST and MNIST. \begin{table}
\begin{tabular}{l c c c} \hline \hline  & **\%0** & **\%20** & **\%40** \\ \hline Krum [14] & 62.08 & 48.94 & 41.02 \\ Median [16] & 73.71 & 67.17 & 63.92 \\ TMeans [16] & 69.88 & 68.52 & 43.02 \\ Ours OC-SVM & **74.75** & **72.24** & **67.36** \\ Ours Agg-C & 74.09 & 71.96 & 64.56 \\ Ours k-NN & 73.82 & 71.81 & 63.88 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Sign-flipping attack results for CIFAR-10. corrupted values are transmitted to the server [32]. The aim of this attack is to deviate from the global model with malicious model gradient updates, without distinguishing the standard deviation and mean. The LIE attack results are given in Table 7 for CIFAR-10, and Table 8 for the F-MNIST and MNIST datasets. An LIE attack is one of the hardest attack types to detect and avoid because the gradient change after attack keeps within the standard deviation of benign user updates. Therefore, the performance of our method decreased the most while defending against an LIE attack. Table 8 shows the LIE attack results for the F-MNIST and MNIST datasets. The OC-SVM and Agg-C variants demonstrate resilience against this sophisticated attack type. The superior performance of NC-FLD against LIE attacks, particularly with the OC-SVM classifier, can be attributed to several key factors. Firstly, LIE attacks are designed to maintain statistical similarity to benign updates while maximizing negative impact. This makes them particularly difficult to detect using statistical methods that rely on simple metrics like the Euclidean distance or angular similarity. Our neuron-centric approach counteracts this by focusing on the neurons most affected during training rather than examining the entire parameter space. Since LIE attacks attempt