# Federated Learning: A Comparative Study of Defenses Against Poisoning Attacks
## 5 Defense Methods
### Krlu
For all the algorithms, regardless of the dataset used, when reaching 50% malicious clients, these malicious clients were able to achieve 100% successful attacks, as can be observed in Figure 10. All algorithms, when reaching 20% malicious clients, already exhibit some failure in mitigating attacks, and as the percentage of malicious clients grows, the number of successful attacks increases. Only PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means show successful attacks in all four datasets starting from 20% malicious clients, while below 20%, they do not exhibit successful attacks. In the case of CONTRA, for the FMNIST and CIFAR-10 datasets, successful attacks occur even with only 2% malicious clients. Considering all four datasets, CONTRA, KRUM, and COOMED start showing successful attacks with 4% to 10% malicious clients. Taking these into account, we can say that no algorithm is 100% effective in mitigating attacks. Still, PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means demonstrate greater resilience, unlike CONTRA, KRUM, and COOMED, and this observation holds across all datasets. As observed in Figures 10 and 11, the defense algorithms PCA + K-means, KPCA + K-means, and RPCA + PCA + K-means consistently achieve a very similar Attack Success Rate. The primary distinction among them lies in the Malicious Confidence metric, where RPCA + PCA + K-means predominantly exhibits lower Malicious Confidence compared to the other algorithms, which indicates a lower probability of misclassification of malicious instances as benign. In summary, COOMED often shows the largest decreases in the model performance (Accuracy, Precision, Recall, and F1-Score) while KPCA + K-means and RPCA + PCA + K-means tend to show more resilient performance across different datasets, as we can observe in the Attack Success Rate and Malicious Confidence metrics. When increasing the percentage of malicious clients from 0% to 50% of the clients, as shown in Figures 10 and 11, the following results are obtained: for the Fashion-MNIST dataset, our proposed algorithm RPCA + PCA + K-means is the most effective algorithm in defending the federated learning system, followed by KPCA + K-means, PCA + K-means, KRUM, COOMED, and CONTRA; for the CIFAR-10 dataset, RPCA + PCA + K-means remains the most effective algorithm, followed by KPCA + K-means, PCA + K-means, COOMED, KRUM, and CONTRA; for the UCI Adult Census dataset, RPCA + PCA + K-means is still the most effective algorithm, followed by KPCA + K-means, PCA + K-means, KRUM, CONTRA, and COOMED; and for the Epileptic Seizure Recognition dataset RPCA + PCA + K-means remains the most effective, followed by KPCA + K-means, PCA + K-means, CONTRA, KRUM, and COOMED. Comparing the execution times of the algorithms presented in Table 10, when the number of malicious clients increases from 0% to 50%, the experiments show the following results: for the Fashion-MNIST dataset, the fastest algorithm is COOMED, followed by KRUM, PCA + K-means, CONTRA, KPCA + K-means, and finally RPCA + PCA + K-means; for the CIFAR-10 dataset, KRUM is the fastest algorithm, followed by CONTRA, PCA + K-means, COOMED, KPCA + K-means, and finally RPCA + PCA + K-means; for the UCI Adult Census dataset, the execution time in the tests was so fast that the only conclusion we can draw is that PCA + K-means, CONTRA, KRUM, and COOMED seems to be faster than KPCA + K-means and RPCA + PCA + K-means; and lastly, for the Epileptic Seizure Recognition dataset, the fastest algorithm is COOMED, followed by KRUM, then PCA + K-means, and CONTRA, KPCA + PCA + K-Means, and finally RPCA + PCA + K-Means. ## 8 Conclusions and Future Work

This paper presents experimental studies comparing the following six state-of-the-art algorithms designed to defend against model update attacks in a federated learning setting: PCA + K-means, KPCA + K-means, CONTRA, KRUM, COOMED, and RPCA + PCA + K-means. Each algorithm aims to detect updates originating from malicious clients and mitigate their impact on the classification performance of the global model.