# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
When increasing the number of clients from 20 to 100 clients, the experiments show the following results: for the Fashion-MNIST and CIFAR-10 datasets, RPCA + PCA + K-means is the best algorithm, followed by KPCA + K-means, PCA + K-means, COMED, KRUM, and CONTRA; for the UCI Adult Census dataset, RPCA + PCA + K-means is the best algorithm, followed by KPCA + K-means, PCA + K-means, KRUM, CONTRA, and COOMED. ; and for the Epileptic Seizure Recognition dataset, RPCA + PCA + K-means is the best algorithm, followed by KPCA + K-means, PCA + K-means, CONTRA, KRUM, and COOMED. Comparing the execution times of the algorithms on the Fashion-MNIST dataset (presented in Table 9), we can determine that the fastest algorithm is the COOMED, followed by CONTRA, KRUM, PCA + K-means, KPCA + PCA + K-means, and finally RPCA + PCA + K-means. For the CIFAR-10 dataset, COOMED is the fastest, followed by KRUM, CONTRA, PCA + K-means, and finally RPCA + PCA + K-means. For the UCI Adult Census dataset, the execution time in the tests was so fast that it was not possible to identify the fastest and slowest algorithms. Lastly, for the Epileptic Seizure Recognition dataset, the fastest algorithm is COOMED, followed by CONTRA, then KRUM and RPCA + K-means with the same execution time, followed by PCA + K-means, and finally KPCA + PCA + K-means. ### Impact of the Percentage of Malicious Clients

To study the impact of the percentage of clients who are malicious, we vary the percentage of malicious clients parameter. In our experiments, the variation of this parameter, ranging from 0% to 50%, provides valuable insights into the robustness of the algorithms in scenarios with the presence of malicious clients. These insights influence the performance and security of federated learning systems. Upon examining the results across all datasets, as presented in Figures 9-11, a trend emerges that shows a decrease in the prediction accuracy of the global model as the number of malicious clients increases. Additionally, there is a very pronounced increase in ASR and MC, especially when 20% or more of the clients are malicious clients. This observation highlights the sensitivity of federated learning systems to the presence of malicious clients. The negative impact on the global model becomes more prominent beyond the threshold of 20% malicious clients. At this point, ASR and MC experience a sharp increase, indicating a significant compromise in the integrity and security of the federated learning process. When the percentage of malicious clients reaches 40%, none of the algorithms can provide effective defense as they all consistently produce an ASR and MC close to 100%. \begin{table}
\begin{tabular}{c c c c c c c} \hline
**Execution Time** & **PCA +** & **KPCA +** & **CONTRA** & **KRUM** & **COOMED** & **RPCA + PCA + K-Means** \\
**(in min)** & **K-Means** & **K-Means** & **CONTRA** & **KRUM** & **COOMED** & **RPCA + PCA + K-Means** \\ \hline Fashion-MNIST Dataset & 61 & 62 & 58 & 61 & 55 & 62 \\ \hline CIFAR-10 Dataset & 62 & 73 & 60 & 57 & **54** & 78 \\ \hline UCI Adult Census Dataset & 2 & 2 & 2 & 2 & 2 & 2 \\ \hline Epileptic Seizure Recognition Dataset & 77 & 79 & 73 & 74 & **69** & 74 \\ \hline \end{tabular}
\end{table} 
Table 9: Execution time with variation in the number of clients (in minutes). All algorithms perform well in terms of ASR and MC when the percentage of malicious clients is low (from 0% to 4%). However, the performance of the PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means algorithms is excellent at 10% and 20% malicious clients, but deteriorates rapidly, reaching a plateau at 100% ASR and MC. This observation suggests that the clusters of malicious and benign updates remain fairly distinct as long as the proportion of malicious clients is small. As the percentage of malicious clients increases, the likelihood of a malicious client being included in the larger \"benign\" cluster increases, giving it full access to the global model.