# Reducing Defense Vulnerabilities in Federated Learning:
## 2 Related Work
### Defenses Against Model Poisoning Attacks  
In the model poisoning attack scenario, which is the second type of poisoning attack performed according to the method, end users perform the training with true data. However, later, attackers turn the model updates of benign users into poisonous model updates by applying attack types such as changing the sign, adding noise or a standard deviation amount, and diverting the direction of the gradient.  
One of the important defense algorithms implemented in the literature is [PERSON] et al.'s [12]. They proposed a method to detect malicious users against model poisoning attacks by performing dimensionality reduction to an F space. The aim here is to maximize the distance of gradient projections between malicious users and benign users. To protect the privacy of users, in addition to the defense system, the functional encryption method constitutes the second step of the defense algorithm. Among the model poisoning attacks, Gaussian, sign-flipping, and ALIE attacks were performed. Another exemplary study in the literature is the study by [PERSON] et al. [13]. MKrum [14], Buylan [15], Trimmed [16], and Median [16] algorithms have been proposed in FL, which are resistant to model poisoning. Another defense method, TRIM [17], selects the training data in a way that minimizes the loss function. Data other than the selected training data are considered harmful training data and are eliminated from the system. [PERSON] et al. [18] proposed an algorithm called DeMAC, which is based on the idea that malicious users' model updates reduce learning loss. Since there will be significant increases in the gradient norm of malicious model updates, the GradScore metric has been defined to measure this norm. They stated that the GradScore of bad and benign users differs from each other at all training stages. In the system they designed dynamically, they created a defense against model poisoning by taking advantage of historical records of global model updates. [PERSON] et al. [19] proposed a defense system based on the aim of detecting the difference between model gradients, similar to the work in [18]. They test their proposed method under several model poisoning attacks such as LIE and min-max. Considering the studies in the literature, gradient selection that carries valuable information and feature vectors created from selected gradients play an important role in detecting malicious users. Finally, [PERSON] et al. [20] brought a different perspective to the literature. In their proposed defense algorithm, include malicious users in FL collection rounds instead of directly kicking them off the network. However, they assign different weights at the time of FL aggregation to model gradients that they mark as malicious among local updates considered as a whole. In this way, the impact of malicious users on the federated learning network is reduced. It has been stated that the defense part of the proposed study is effective in various datasets and different distributions. For this reason, it is predicted that it can adapt to different data types and features.