# Deformation of a magnetic liquid drop and unsteady flow inside and outside
it in a non-stationary magnetic field

Alexander N. Tyatyushkin  Institute of Mechanics, Moscow State University,
Michurinskiy Ave., 1, Moscow 119192, Russia

###### Abstract

Small steady-state deformational oscillations of a drop of a viscous magnetic
liquid in a non-stationary uniform magnetic field are theoretically
investigated for low Reynolds numbers. The drop is suspended in another
viscous magnetic liquid immiscible with the former. The non-stationary
magnetic field causes flow inside and outside the drop. The inertia is taken
into account by regarding the flow as essentially unsteady. The variation of
the magnetic field is so slow that the approximation of quasi-stationary
magnetic field may be used.

## Introduction.

A non-stationary magnetic field applied to a drop of a magnetic liquid
suspended in an ordinary liquid or to a drop of an ordinary liquid suspended
in a magnetic liquid causes a motion of the liquids inside and outside the
drop. Investigation of this phenomenon is interesting from the point of view
of application to the actuation of motion of liquids in various devices
including microfluidic ones. Besides, the study of this phenomenon is
interesting from the point of view of basic science.

Results of experimental and theoretical investigation of the behavior of
magnetic liquid drops in non-stationary magnetic fields are presented in works
[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]. The behavior of an ordinary liquid drop
suspended in a magnetic liquid was also studied [11].

In works [2, 3, 4], [6], and [8] for the theoretical description of the
behavior of a magnetic liquid drop, models based on rather strong assumptions
about the shape of the drop and about the flow inside and outside it were
used. In works [9] and [10] the tree-dimensional boundary element method
algorithm was used for the numerical calculations. In works [1], [5], [7], and
[9] asymptotic methods were used. In the present work the problem about the
shape of the drop and flow inside and outside it is also solved with
asymptotic methods without the use of any assumptions about them. Within this
approach, the shape of the drop is determined by equations obtained with the
help of asymptotic methods from the system of equations and boundary
conditions that determine the magnetic field and the flow. In order to provide
the applicability of the asymptotic methods, the scope of the present
theoretical investigation is restricted by the case of weakly deformed drops.
The unsteady flow inside and outside a drop of a viscous magnetic liquid
suspended in another viscous magnetic liquid in non-stationary magnetic field
is investigated with taking into account the influence of form of the drop on
the field and flow. This approach was used also in works [12, 13, 14], in
which the behavior of a magnetic liquid drop in non-stationary fields for low
Reynolds numbers was investigated within the quasi-steady flow approximation,
and in [15], in which the Reynolds numbers were regarded as high and the
viscosity was neglected. Thus, the inertia was completely neglected in [12,
13, 14]. In the present work, the inertia is taken into account simultaneously
with the viscosity by refusing the quasi-steady flow approximation.

The Reynolds number in the problem about deformational oscillations of a drop
under action of non-stationary fields tends to zero as the amplitude of the
oscillation tends to zero. Indeed, the velocity in that case has the order of
magnitude $\omega\Delta{a}$, where $\omega$ is the angular frequency of the
oscillations of the applied field, $\Delta{a}$ is the amplitude of the
deformational oscillations of the drop (maximal variation of the distance from
the center of the drop to its surface). Then the Reynolds number tends to zero
as the amplitude of the oscillations tends to zero. Thus, in the case of small
oscillations of the drop, the influence of the convection term in the momentum
equation can be neglected, and the influence of the inertia can be described
by the unsteady therm. This is directly confirmed by the fact that, in the
problem about deformational oscillations of a drop in the case of when the
influence of the viscosity is completely neglected (see [15]), the influence
of the convection term in the correction of the first order over the parameter
the smallness of which provides the smallness of the deformations is absent,
although it is taken into account in the input system of equations. It is also
followed from this fact that the solution of the problem about small
oscillations of the drop with taking into account both the viscosity and
inertia should tend to the solution in [15] as the maximal viscosity of the
liquids tends to zero with exception of the case when the frequency of the
applied field is close to the resonance frequency.

In order to use the asymptotic methods for the investigation of small
oscillations of drops under action of non-stationary fields developed in the
works [12, 13, 14, 15] with the use of unsteady term in the momentum equation,
it is necessary to obtain the general solution to the system of hydrodynamic
equations that contains this term. This solution was obtained and is written
down below. The problem stated above presents a good opportunity to use this
general solution since the problems solved in the works [12, 13, 14, 15] allow
checking the results for the limit cases when the influence of either the
inertia or the viscosity is neglected.

##  I Setting of the problem.

###  I.1 Object of investigation.

Consider a drop of incompressible magnetic liquid in an applied non-stationary
uniform magnetic field with intensity
$\vec{H}_{\mathrm{a}}=\vec{H}_{\mathrm{a}}(t)$, where $t$ is the time. The
density, viscosity, and magnetic permeability of the liquid inside the drop
are $\rho_{\mathrm{i}}$, $\eta_{\mathrm{i}}$, and $\mu_{\mathrm{i}}$. The
radius of the drop in the undeformed state is $a$. The drop is suspended in an
incompressible magnetic liquid with the density $\rho_{\mathrm{e}}$, viscosity
$\eta_{\mathrm{e}}$, and magnetic permeability $\mu_{\mathrm{e}}$. The surface
tension of the interface between the liquids is $\sigma_{\mathrm{s}}$. The
liquids are regarded as sufficiently viscous so that the low Reynolds number
approximation is valid. The influence of the inertia of the liquids is taken
into account by means of regarding the flow as essentially unsteady. The
variation of the magnetic field is so slow and the conductivities of the
liquids are so small that the ferrohydrodynamics approximation is valid (see
[16]).

###  I.2 System of equations.

In order to find the magnetic field intensity, $\vec{H}$, velocity, $\vec{v}$,
and pressure, $p$, as functions of the radius-vector, $\vec{r}$, and time,
$t$, as well as the shape of the drop under the above made assumptions, the
system of equations of ferrohydrodynamics written down in the quasi-stationary
magnetic field and low Reynolds number approximations is used. This system
consists of the continuity equation for an incompressible liquid

$\nabla\cdot\vec{v}=0,$ (1)

the motion equation in the low Reynolds number approximation for arbitrary
Strouhal numbers

$\rho\dfrac{\partial\vec{v}}{\partial{t}}=\nabla\cdot\left(-p\hat{I}+\hat{\sigma}_{\mathrm{m}}+\hat{\sigma}_{\mathrm{v}}\right),$
(2)

the Maxwell’s equations in the ferrohydrodynamics and quasi-stationary field
approximations

$\nabla\cdot\vec{B}=0,\qquad\nabla\times\vec{H}=0,$ (3)

and the constitutive relation

$\vec{B}=\mu\vec{H}.$ (4)

Here, the formulas are written down for Gaussian system of units, $\cdot$ and
$\times$ denote the scalar and vector products, $\vec{B}$ is the magnetic
induction, $\rho=\rho_{\mathrm{i}}$, $\eta=\eta_{\mathrm{i}}$, and
$\mu=\mu_{\mathrm{i}}$ inside the drop, $\rho=\rho_{\mathrm{e}}$,
$\eta=\eta_{\mathrm{e}}$, and $\mu=\mu_{\mathrm{e}}$ outside it, $\nabla$ is
the nabla operator, $\hat{I}$ is the identity tensor, $\hat{\sigma}_{\rm m}$
and $\hat{\sigma}_{\rm v}$ are the tensors of magnetic and viscous stresses
expressed as follows

$\displaystyle\hat{\sigma}_{\rm m}$ $\displaystyle=$
$\displaystyle\frac{1}{4\pi}\vec{B}\vec{H}-\frac{1}{8\pi}\vec{B}\cdot\vec{H}\hat{I},$
(5) $\displaystyle\hat{\sigma}_{\rm v}$ $\displaystyle=$ $\displaystyle
2\eta\left(\nabla\vec{v}\right)^{\mathrm{S}},$ (6)

where $\vec{A}\vec{B}$ denotes the dyadic product of the vectors $\vec{A}$ and
$\vec{B}$, $\nabla\vec{f}$ denotes the dyadic product of the nabla operator
and the vector field $\vec{f}=\vec{f}(\vec{r})$, $\hat{T}^{\mathrm{S}}$
denotes the symmetric part of the tensor $\hat{T}$.

Using the continuity equation Eq. (1) and Maxwell’s equations Eq. (3) and
taking into account that the magnetic permeability is uniform, the motion
equation Eq. (2) can be rewritten in the form of the Navier–Stokes equation in
the low Reynolds number approximation for arbitrary Strouhal numbers

$\rho\dfrac{\partial\vec{v}}{\partial{t}}=-\nabla{p}+\eta\Delta\vec{v},$ (7)

where $\Delta$ is the Laplacian.

###  I.3 Boundary conditions.

The boundary conditions on the interface between the liquids include the
impenetrability condition

$\left.\vec{v}\right|_{\rm e}\cdot\vec{n}=\left.\vec{v}\right|_{\rm
i}\cdot\vec{n}={v}_{\mathrm{s}n},$ (8)

the no-slip condition

$\left[\vec{v}\right]_{\rm s}\times\vec{n}=0,$ (9)

the conditions for the jumps of the normal and tangential components of the
stress vector $\vec{\sigma}_{n}=\vec{n}\cdot\left(-p\hat{I}+\hat{\sigma}_{\rm
m}+\hat{\sigma}_{\rm v}\right)$

$\displaystyle\vec{n}\cdot\left[-p\hat{I}+\hat{\sigma}_{\rm
m}+\hat{\sigma}_{\rm v}\right]_{\rm s}\cdot\vec{n}$ $\displaystyle=$
$\displaystyle-\sigma_{\rm s}\mathcal{H},$ (10)
$\displaystyle\vec{n}\cdot\left[\hat{\sigma}_{\rm m}+\hat{\sigma}_{\rm
v}\right]_{\rm s}\times\vec{n}$ $\displaystyle=$ $\displaystyle 0,$ (11)

the continuity conditions for the tangential component of the magnetic field
intensity

$\left[\vec{H}\right]_{\rm s}\times\vec{n}=0$ (12)

and for the normal component of the magnetic field induction

$\left[\vec{B}\right]_{\rm s}\cdot\vec{n}=0.$ (13)

Here, $\left.A\right|_{\textrm{i}}$ and $\left.A\right|_{\textrm{e}}$ denote
the values of the quantity $A$ on the interface between the liquids approached
from inside and outside the drop, respectively, $[A]_{\rm
s}=\left.A\right|_{\rm e}-\left.A\right|_{\rm i}$ denotes the jump of the
quantity $A$ at the interface when moving from the inside to the outside,
$\nabla_{\mathrm{s}}$ denotes the surface nabla operator, $\vec{n}$ is the
external normal unit vector at a given point of the interface,
${v}_{\mathrm{s}n}$ is the normal component of the velocity of the surface of
the drop at a given point, $\mathcal{H}$ is the mean curvature at a given
point of the surface of the drop. Note that definition of the mean curvature
used in the present work is such that it takes negative values on the surface
of a convex domain.

The continuity conditions for the tangential components of the velocity and
electric field intensity allow determining the following vector fields defined
on the surface of the drop

$\vec{v}_{\mathrm{s}\tau}=\vec{n}\times\left(\left.\vec{v}\right|_{\mathrm{i}}\times\vec{n}\right)=\vec{n}\times\left(\left.\vec{v}\right|_{\mathrm{e}}\times\vec{n}\right),$
(14)
$\vec{H}_{\mathrm{s}}=\vec{n}\times\left(\left.\vec{H}\right|_{\mathrm{i}}\times\vec{n}\right)=\vec{n}\times\left(\left.\vec{H}\right|_{\mathrm{e}}\times\vec{n}\right).$
(15)

The boundary conditions at infinity have the form

$\displaystyle\vec{v}$ $\displaystyle\to 0$ $\displaystyle\quad\text{as}\quad
r$ $\displaystyle\to\infty,$ (16) $\displaystyle p$ $\displaystyle\to
p_{\infty}$ $\displaystyle\quad\text{as}\quad r$ $\displaystyle\to\infty,$
(17) $\displaystyle\vec{H}$ $\displaystyle\to\vec{H}_{\mathrm{a}}$
$\displaystyle\quad\text{as}\quad r$ $\displaystyle\to\infty,$ (18)

where $p_{\infty}$ is the pressure at infinity.

Besides, $\vec{v}(\vec{r},t)$, $p(\vec{r},t)$, and $\vec{H}(\vec{r},t)$ should
be bounded for all the bounded values of $\vec{r}$.

##  II Solution.

###  II.1 Deformation of the drop.

Let the surface of the drop be given by the following equation

$r=\left|\vec{r}\right|=a+h\left(\dfrac{\vec{r}}{{r}},t\right).$ (19)

In order the deformations of the drop to be small, the following condition
should be fulfilled

$h=h\left(\dfrac{\vec{r}}{{r}},t\right)\ll a.$ (20)

The function $h\left(\vec{r}/{r},t\right)$ can be represented in the form

$h=h\left(\dfrac{\vec{r}}{{r}},t\right)=\sum\limits_{n=2}^{\infty}\hat{h}_{n}\stackrel{{\scriptstyle
n}}{{\cdot}}\dfrac{\vec{r}\,^{n}}{{r}^{n}}.$ (21)

Here, $\hat{h}_{n}=\hat{h}_{n}(t)$ ($n>1$) are some tensors each of which is
an arbitrary irreducible tensor of $n$th order, i.e., a tensor of $n$th order
symmetric with respect to any pair of indices and such that its contraction
with the identity tensor over any pair of indices is equal to zero (see [17]).
Here and in what follows, $\vec{b}\,^{n}$ denotes $n$th dyadic degree of the
vector $\vec{b}$ (i.e., the $(n-1)$-multiple dyadic product of the vector
$\vec{b}$ by itself), $\stackrel{{\scriptstyle n}}{{\cdot}}$ denotes
$n$-multiple contraction of tensors over the adjacent indices.

The impenetrability condition (8) yields the following equation for the
function $h\left(\vec{r}/{r},t\right)$

$\vec{n}\cdot\dfrac{\vec{r}}{{r}}\dfrac{\partial{h}}{\partial{t}}={v}_{\mathrm{s}n}.$
(22)

###  II.2 Magnetic field.

The intensity of the magnetic field is sought for in the form

$\vec{H}=\nabla\psi,$ (23)

where

$\psi=\begin{cases}\vec{H}_{\mathrm{a}}\cdot\vec{r}-\displaystyle\sum\limits_{n=1}^{\infty}\hat{M}_{\mathrm{e}n}\stackrel{{\scriptstyle
n}}{{\cdot}}\dfrac{\vec{r}\,^{n}}{r^{2n+1}},\ r>a+h,\\\
\vec{H}_{\mathrm{a}}\cdot\vec{r}-\displaystyle\sum\limits_{n=1}^{\infty}\hat{M}_{\mathrm{i}n}\stackrel{{\scriptstyle
n}}{{\cdot}}\dfrac{\vec{r}\,^{n}}{a^{2n+1}},\ r\leqslant a+h.\end{cases}$ (24)

Here, $\hat{M}_{\mathrm{e}n}=\hat{M}_{\mathrm{e}n}(t)$ and
$\hat{M}_{\mathrm{i}n}=\hat{M}_{\mathrm{i}n}(t)$ are tensors which are either
some vectors for $n=1$ or, for $n>1$, some irreducible tensors of $n$th order.
For a field given in this form, Maxwell’s equations Eq. (3), the constitutive
relation Eq. (4), the condition at infinity Eq. (18), and the condition of
boundedness of $\vec{H}$ are automatically satisfied.

###  II.3 Flow.

The velocity and pressure in the flow are sought for in the form

$\vec{v}=\vec{v}(\vec{r},t)=\dfrac{1}{2\pi}\int\limits_{-\infty}^{\infty}\mathrm{e}^{-\mathrm{i}\omega{t}}\vec{v}_{1\omega}\mathrm{d}\omega\\\
+\dfrac{1}{2\pi}\int\limits_{-\infty}^{\infty}\mathrm{e}^{-\mathrm{i}\omega{t}}\vec{v}_{2\omega}\mathrm{d}\omega,$
(25)
${p}={p}(\vec{r},t)=\dfrac{1}{2\pi}\int\limits_{-\infty}^{\infty}\mathrm{e}^{-\mathrm{i}\omega{t}}{p}_{\omega}\mathrm{d}\omega\\\
+\begin{cases}{p}_{\infty},\quad r>a+h,\\\ {p}_{0},\quad r<a+h,\end{cases}$
(26) $\vec{v}_{1\omega}=\begin{cases}\vec{v}_{1\mathrm{e}\omega},\quad
r>a+h,\\\ \vec{v}_{1\mathrm{i}\omega},\quad r\leqslant a+h,\end{cases}$ (27)
$\vec{v}_{1\mathrm{e}\omega}=\nabla\times\left(\left\\{\sum_{n=1}^{\infty}\left[\dfrac{{Q}_{-n-1}\left(\varkappa_{\mathrm{e}}\dfrac{r}{a}\right)}{\varkappa_{\mathrm{e}}^{2}}\hat{B}_{\mathrm{e}n}+\hat{C}_{\mathrm{e}n}\right]\rule{0.0pt}{21.52771pt}\right.\right.\\\
\left.\left.\rule{0.0pt}{21.52771pt}\stackrel{{\scriptstyle
n-1}}{{\cdot}}\dfrac{\vec{r}\,^{n-1}{a}^{n+2}}{{r}^{2n+1}}\right\\}\times\vec{r}\right),$
(28)
$\vec{v}_{1\mathrm{i}\omega}=\nabla\times\left(\left\\{\sum_{n=1}^{\infty}\left[\dfrac{{Q}_{n}\left(\varkappa_{\mathrm{i}}\dfrac{r}{a}\right)}{\varkappa_{\mathrm{i}}^{2}}\hat{B}_{\mathrm{i}n}+\hat{C}_{\mathrm{i}n}\right]\rule{0.0pt}{21.52771pt}\right.\right.\\\
\left.\left.\rule{0.0pt}{21.52771pt}\stackrel{{\scriptstyle
n-1}}{{\cdot}}\dfrac{\vec{r}\,^{n-1}}{{a}^{n-1}}\right\\}\times\vec{r}\right),$
(29) $\vec{v}_{2\omega}=\begin{cases}\vec{v}_{2\mathrm{e}\omega},\quad
r>a+h,\\\ \vec{v}_{2\mathrm{i}\omega},\quad r\leqslant a+h,\end{cases}$ (30)
$\vec{v}_{2\mathrm{e}\omega}=\sum_{n=1}^{\infty}n\left[\varkappa_{\mathrm{e}}^{2n+1}{G}_{-n-1}\left(\varkappa_{\mathrm{e}}\dfrac{r}{a}\right)\hat{\Omega}_{\mathrm{e}n}\rule{0.0pt}{12.91663pt}\right.\\\
\left.\rule{0.0pt}{12.91663pt}\stackrel{{\scriptstyle
n-1}}{{\cdot}}\dfrac{\vec{r}\,^{n-1}}{{a}^{n-1}}\right]\times\vec{r},$ (31)
$\vec{v}_{2\mathrm{i}\omega}=\sum_{n=1}^{\infty}n\left[{G}_{n}\left(\varkappa_{\mathrm{i}}\dfrac{r}{a}\right)\hat{\Omega}_{\mathrm{i}n}\stackrel{{\scriptstyle
n-1}}{{\cdot}}\dfrac{\vec{r}\,^{n-1}}{{a}^{n-1}}\right]\times\vec{r},$ (32)
${p}_{\omega}=\begin{cases}{p}_{\mathrm{e}\omega},\quad r>a+h,\\\
{p}_{\mathrm{i}\omega},\quad r<a+h,\end{cases}$ (33)
${p}_{\mathrm{e}\omega}=\dfrac{\eta_{\mathrm{e}}}{a}\left[2(2n-1)\hat{B}_{\mathrm{e}n}+\varkappa_{\mathrm{e}}^{2}\hat{C}_{\mathrm{e}n}\right]\stackrel{{\scriptstyle
n}}{{\cdot}}\dfrac{\vec{r}\,^{n}{a}^{n+1}}{{r}^{2n+1}},$ (34)
${p}_{\mathrm{i}\omega}=\dfrac{\eta_{\mathrm{i}}}{a}\left[\dfrac{2(n+1)(2n+3)}{n}\hat{B}_{\mathrm{i}n}-\varkappa_{\mathrm{i}}^{2}\dfrac{(n+1)}{n}\hat{C}_{\mathrm{i}n}\right]\stackrel{{\scriptstyle
n}}{{\cdot}}\dfrac{\vec{r}\,^{n}}{{a}^{n}},$ (35)
$\varkappa_{\mathrm{e}}=(1-\mathrm{i})\sqrt{\dfrac{\rho_{\mathrm{e}}\omega
a^{2}}{2\eta_{\mathrm{e}}}},\quad\varkappa_{\mathrm{i}}=(1-\mathrm{i})\sqrt{\dfrac{\rho_{\mathrm{i}}\omega
a^{2}}{2\eta_{\mathrm{i}}}},$ (36)
${G}_{n+1}(z)=\dfrac{2n+3}{z}{G}^{\prime}_{n}(z),\quad{G}_{0}(z)=\dfrac{\sinh{z}}{z},$
(37)
${G}_{-n-2}(z)=-\dfrac{1}{(2n+1)z}{G}^{\prime}_{-n-1}(z),\quad{G}_{-1}(z)=\dfrac{\mathrm{e}^{-{z}}}{z},$
(38) ${Q}_{n}\left(z\right)=2(2n+3)\left[{G}_{n}\left(z\right)-1\right],\quad
n\geqslant 0,$ (39)
${Q}_{-n-1}\left(z\right)=-2(2n-1)\left[z^{2n+1}{G}_{-n-1}\left(z\right)-1\right],\quad
n\geqslant 0.$ (40)

Here, $\hat{\Omega}_{\mathrm{e}n}=\hat{\Omega}_{\mathrm{e}n,\omega}$,
$\hat{B}_{\mathrm{e}n}=\hat{B}_{\mathrm{e}n,\omega}$,
$\hat{C}_{\mathrm{e}n}=\hat{C}_{\mathrm{e}n,\omega}$,
$\hat{\Omega}_{\mathrm{i}n}=\hat{\Omega}_{\mathrm{i}n,\omega}$,
$\hat{B}_{\mathrm{i}n}=\hat{B}_{\mathrm{i}n,\omega}$,
$\hat{C}_{\mathrm{i}n}=\hat{C}_{\mathrm{i}n,\omega}$ are some tensors
depending on $\omega$ each of which is either an arbitrary vector for $n=1$ or
an arbitrary irreducible tensor for $n>1$, $p_{0}=p_{0}(t)$ is the pressure at
the center of the drop, which is to be found. For a flow given in this form,
the continuity equation Eq. (1), the motion equation Eq. (7), the conditions
at infinity Eqs. (16)–(17), and the condition of boundedness of $\vec{v}$ and
${p}$ are automatically satisfied.

The general solution Eqs. (25)–(40) of the equations Eq. (1)–(7) was obtained
as the generalization of the general Lamb’s solution for the case of unsteady
flows with arbitrary Strouhal numbers. It turns into the general Lamb’s
solution (cf. [18], art. 336 and [12]) for the quasi-steady flow
approximation.

###  II.4 Asymptotic expansion.

Thus, in order to solve the problem set above, it is necessary to find the
unknown vector and tensor functions
$\hat{M}_{\mathrm{e}n}=\hat{M}_{\mathrm{e}n}(t)$,
$\hat{\Omega}_{\mathrm{e}n}=\hat{\Omega}_{\mathrm{e}n,\omega}$,
$\hat{B}_{\mathrm{e}n}=\hat{B}_{\mathrm{e}n,\omega}$,
$\hat{C}_{\mathrm{e}n}=\hat{C}_{\mathrm{e}n,\omega}$,
$\hat{M}_{\mathrm{i}n}=\hat{M}_{\mathrm{i}n}(t)$,
$\hat{\Omega}_{\mathrm{i}n}=\hat{\Omega}_{\mathrm{i}n,\omega}$,
$\hat{B}_{\mathrm{i}n}=\hat{B}_{\mathrm{i}n,\omega}$, and
$\hat{C}_{\mathrm{i}n}=\hat{C}_{\mathrm{i}n,\omega}$ ($n=1,2,\dots$) as well
as the tensor functions $\hat{h}_{n}=\hat{h}_{n}(t)$ ($n=2,\dots$) and the
scalar function $p_{0}=p_{0}(t)$ using the remaining boundary conditions Eqs.
(8)–(13), and the equation Eq. (22). The functions are sought for in the form
of the following asymptotic expansions over the parameter

$\alpha=\dfrac{9a\mu_{\mathrm{e}}{H}_{\mathrm{am}}^{2}}{32\pi\sigma_{\mathrm{s}}},$
(41)
$\hat{M}_{\mathrm{e}n}\sim\sum_{j=0}^{\infty}\alpha^{j}\hat{M}_{\mathrm{e}n,j},\
\hat{\Omega}_{\mathrm{e}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{\Omega}_{\mathrm{e}n,j},\
\\\
\hat{B}_{\mathrm{e}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{B}_{\mathrm{e}n,j},\
\hat{C}_{\mathrm{e}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{C}_{\mathrm{e}n,j},\
\\\
\hat{M}_{\mathrm{i}n}\sim\sum_{j=0}^{\infty}\alpha^{j}\hat{M}_{\mathrm{i}n,j},\
\hat{\Omega}_{\mathrm{i}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{\Omega}_{\mathrm{i}n,j},\
\\\
\hat{B}_{\mathrm{i}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{B}_{\mathrm{i}n,j},\
\hat{C}_{\mathrm{i}n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{C}_{\mathrm{i}n,j},\
\\\ {p}_{0}\sim\sum_{j=0}^{\infty}\alpha^{j}{p}_{0j},\
\hat{h}_{n}\sim\sum_{j=1}^{\infty}\alpha^{j}\hat{h}_{n,j}\text{ as }\alpha\to
0.$ (42)

Here, ${H}_{\mathrm{am}}$ is the maximal absolute value of the intensity
vector of the applied magnetic field. The parameter $\alpha$ is the magnetic
Bond number for the present problem.

###  II.5 Steady-state oscillations.

For the forced steady-state oscillations, the found nonzero terms of the
asymptotic expansions are as follows

$\hat{M}_{\mathrm{e}1,0}=\vec{M}_{\mathrm{e}1,0}=\hat{M}_{\mathrm{i}1,0}=\vec{M}_{\mathrm{i}1,0}=\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}a^{3}\vec{H}_{\mathrm{a}},$
(43)
$p_{0,0}=p_{\infty}+\dfrac{2\sigma_{\mathrm{s}}}{a}+\dfrac{3\mu_{\mathrm{e}}}{8\pi}\dfrac{\mu_{\mathrm{e}}-\mu_{\mathrm{i}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}H_{\mathrm{a}}^{2},$
(44)
$\hat{B}_{\mathrm{e}2,1}=-\dfrac{\mathrm{i}\omega\tau}{2}\hat{h}_{2,1,\omega}\left[14\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+5\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right.\\\
\left.+16\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\right]\\\
\left(3\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[4\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right]\right.\right.\\\
\left.\left.+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[6\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}-{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\right\\}\right)^{-1},$
(45)
$\hat{C}_{\mathrm{e}2,1}=\dfrac{\mathrm{i}\omega\tau}{2}\hat{h}_{2,1,\omega}\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[14\dfrac{{Q}_{-3}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}^{2}}\right.\right.\\\
\left.\left.-4\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\right]\right.\\\
\left.+\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\left[5\dfrac{{Q}_{-3}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}^{2}}-\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\right]\right.\\\
\hskip
30.00005pt\left.+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[16\dfrac{{Q}_{-3}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}^{2}}\right.\right.\\\
\left.\left.-6\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}+{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\right\\}\\\
\left(3\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[4\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right]\right.\right.\\\
\left.\left.+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[6\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}-{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\right\\}\right)^{-1},$
(46)
$\hat{B}_{\mathrm{i}2,1}=\dfrac{\mathrm{i}\omega\tau}{2}\hat{h}_{2,1,\omega}\left[6\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\right.\\\
\left.+14\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}-5{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\\\
\left(3\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[4\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right]\right.\right.\\\
\left.\left.+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[6\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}-{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\right\\}\right)^{-1},$
(47)
$\hat{C}_{\mathrm{i}2,1}=-\dfrac{\mathrm{i}\omega\tau}{2}\hat{h}_{2,1,\omega}\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[6\dfrac{{Q}_{2}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}^{2}}\right.\right.\\\
\left.\left.+4\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right]\right.\\\
\left.+\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[14\dfrac{{Q}_{2}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}^{2}}+6\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\right]\right.\\\
\left.-{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\left[5\dfrac{{Q}_{2}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}^{2}}+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\right]\right\\}\\\
\left(3\left\\{\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}\left[4\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}+{Q}_{2}^{\prime\prime}\left(\varkappa_{\mathrm{i}}\right)\right]\right.\right.\\\
\left.\left.+\dfrac{{Q}_{2}^{\prime}\left(\varkappa_{\mathrm{i}}\right)}{\varkappa_{\mathrm{i}}}\left[6\dfrac{{Q}_{-3}^{\prime}\left(\varkappa_{\mathrm{e}}\right)}{\varkappa_{\mathrm{e}}}-{Q}_{-3}^{\prime\prime}\left(\varkappa_{\mathrm{e}}\right)\right]\right\\}\right)^{-1},$
(48)
$\vec{M}_{\mathrm{e}1,1}=\dfrac{2}{5}\left(\mu_{\mathrm{e}}-\mu_{\mathrm{i}}\right)\dfrac{13\mu_{\mathrm{e}}+11\mu_{\mathrm{i}}}{\left(\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}\right)^{2}}a^{2}\vec{H}_{\mathrm{a}}\cdot\hat{h}_{2,1},$
(49)
$\vec{M}_{\mathrm{i}1,1}=\dfrac{4}{5}\left(\mu_{\mathrm{e}}-\mu_{\mathrm{i}}\right)\dfrac{7\mu_{\mathrm{i}}+5\mu_{\mathrm{e}}}{\left(\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}\right)^{2}}a^{2}\vec{H}_{\mathrm{a}}\cdot\hat{h}_{2,1},$
(50)
$\hat{M}_{\mathrm{e}3,1}=\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\dfrac{5\mu_{\mathrm{i}}-8\mu_{\mathrm{e}}}{3\mu_{\mathrm{i}}+4\mu_{\mathrm{e}}}a^{4}\left[\left(\vec{H}_{\mathrm{a}}\hat{h}_{2,1}\right)^{\mathrm{S}}\right]^{\mathrm{D}},$
(51)
$\hat{M}_{\mathrm{i}3,1}=-4\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{3\mu_{\mathrm{i}}+4\mu_{\mathrm{e}}}a^{4}\left[\left(\vec{H}_{\mathrm{a}}\hat{h}_{2,1}\right)^{\mathrm{S}}\right]^{\mathrm{D}},$
(52)

where

$\tau=\dfrac{4\eta_{\mathrm{e}}a}{\sigma_{\mathrm{s}}},$ (53)
$\hat{h}_{2,1}=\hat{h}_{2,1}(t)=\dfrac{1}{2\pi}\int\limits_{-\infty}^{\infty}\mathrm{e}^{-\mathrm{i}\omega{t}}\hat{h}_{2,1,\omega}\mathrm{d}\omega,$
(54)
$\left[\left(\vec{H}_{\mathrm{a}}\hat{h}_{2,1}\right)^{\mathrm{S}}\right]^{\mathrm{D}}=\left(\vec{H}_{\mathrm{a}}\hat{h}_{2,1}\right)^{\mathrm{S}}-\dfrac{3}{5}\left(\vec{H}_{\mathrm{a}}\cdot\hat{h}_{2,1}\hat{I}\right)^{\mathrm{S}},$
(55)

and $\hat{h}_{2,1,\omega}$ is the solution of the following equation

$\dfrac{1}{2\pi}\int\limits_{-\infty}^{\infty}\mathrm{e}^{-\mathrm{i}\omega{t}}\left[1-\dfrac{\mathrm{i}\omega\tau}{48}{F}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}})\right]\hat{h}_{2,1,\omega}\mathrm{d}\omega\\\
=\dfrac{\left(\mu_{\mathrm{i}}-\mu_{\mathrm{e}}\right)^{2}a}{\left(2\mu_{\mathrm{e}}+\mu_{\mathrm{i}}\right)^{2}{H}_{\mathrm{am}}^{2}}\left(\vec{H}_{\mathrm{a}}^{2}-\dfrac{1}{3}\hat{I}H_{\mathrm{a}}^{2}\right),$
(56) ${F}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}})\\\
=\dfrac{P_{\mathrm{Ns}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})\sinh\varkappa_{\mathrm{i}}+P_{\mathrm{Nc}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})\varkappa_{\mathrm{i}}\cosh\varkappa_{\mathrm{i}}}{P_{\mathrm{Ds}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})\sinh\varkappa_{\mathrm{i}}+P_{\mathrm{Dc}}n(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})\varkappa_{\mathrm{i}}\cosh\varkappa_{\mathrm{i}}},$
(57)
$P_{\mathrm{Ds}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})=(\varkappa_{\mathrm{i}}^{4}+15\varkappa_{\mathrm{i}}^{2}+30)(\varkappa_{\mathrm{e}}+1)\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\\\
-3(2\varkappa_{\mathrm{i}}^{2}+5)(\varkappa_{\mathrm{e}}^{2}+5\varkappa_{\mathrm{e}}+5),$
(58)
$P_{\mathrm{Dc}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})=-5(\varkappa_{\mathrm{i}}^{2}+6)(\varkappa_{\mathrm{e}}+1)\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\\\
+(\varkappa_{\mathrm{i}}^{2}+15)(\varkappa_{\mathrm{e}}^{2}+5\varkappa_{\mathrm{e}}+5),$
(59)
$P_{\mathrm{Ns}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})=3(\varkappa_{\mathrm{i}}^{6}+25\varkappa_{\mathrm{i}}^{4}+252\varkappa_{\mathrm{i}}^{2}+480)(\varkappa_{\mathrm{e}}+1)\dfrac{\eta_{\mathrm{i}}^{2}}{\eta_{\mathrm{e}}^{2}}\\\
+(2\varkappa_{\mathrm{e}}^{3}\varkappa_{\mathrm{i}}^{4}+9\varkappa_{\mathrm{e}}^{2}\varkappa_{\mathrm{i}}^{4}+30\varkappa_{\mathrm{e}}^{3}\varkappa_{\mathrm{i}}^{2}-45\varkappa_{\mathrm{e}}\varkappa_{\mathrm{i}}^{4}\\\
+540\varkappa_{\mathrm{e}}^{2}\varkappa_{\mathrm{i}}^{2}-45\varkappa_{\mathrm{i}}^{4}+60\varkappa_{\mathrm{e}}^{3}+198\varkappa_{\mathrm{e}}\varkappa_{\mathrm{i}}^{2}\\\
+1260\varkappa_{\mathrm{e}}^{2}+198\varkappa_{\mathrm{i}}^{2}+720\varkappa_{\mathrm{e}}+720)\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\\\
-6(2\varkappa_{\mathrm{i}}^{2}+5)(\varkappa_{\mathrm{e}}^{4}+5\varkappa_{\mathrm{e}}^{3}+45\varkappa_{\mathrm{e}}^{2}+72\varkappa_{\mathrm{e}}+72),$
(60)
$P_{\mathrm{Nc}}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}}^{2})=-3(5\varkappa_{\mathrm{i}}^{4}+92\varkappa_{\mathrm{i}}^{2}+480)(\varkappa_{\mathrm{e}}+1)\dfrac{\eta_{\mathrm{i}}^{2}}{\eta_{\mathrm{e}}^{2}}\\\
-(-3\varkappa_{\mathrm{e}}^{2}\varkappa_{\mathrm{i}}^{4}+10\varkappa_{\mathrm{e}}^{3}\varkappa_{\mathrm{i}}^{2}-15\varkappa_{\mathrm{e}}\varkappa_{\mathrm{i}}^{4}+120\varkappa_{\mathrm{e}}^{2}\varkappa_{\mathrm{i}}^{2}\\\
-15\varkappa_{\mathrm{i}}^{4}+60\varkappa_{\mathrm{e}}^{3}-42\varkappa_{\mathrm{e}}\varkappa_{\mathrm{i}}^{2}+1260\varkappa_{\mathrm{e}}^{2}\\\
-42\varkappa_{\mathrm{i}}^{2}+720\varkappa_{\mathrm{e}}+720)\dfrac{\eta_{\mathrm{i}}}{\eta_{\mathrm{e}}}\\\
+2(\varkappa_{\mathrm{i}}^{2}+15)(\varkappa_{\mathrm{e}}^{4}+5\varkappa_{\mathrm{e}}^{3}+45\varkappa_{\mathrm{e}}^{2}+72\varkappa_{\mathrm{e}}+72).$
(61)

Here, $\mathrm{i}$ is the imaginary unit, $\sinh$ and $\cosh$ are the
hyperbolic sine and cosine.

The obtained relations for the terms of the asymptotic expansions allow one
also to find the expressions for the corresponding unknown scalar, vector, and
tensor functions for the free proper oscillations of the drop. They have, in
general, infinite number of modes determined by the initial disturbances of
the spherical shape and decay due to the viscosity. These expressions are too
cumbersome and are not written down here.

Figure 1: Drop in an applied uniform harmonically oscillating magnetic field.

With accuracy up to the terms of the first order, in an oscillating applied
magnetic field with the intensity

$\vec{H}_{\mathrm{a}}=H_{\mathrm{am}}\cos\left(\omega{t}\right)\vec{k},$ (62)

the drop is a prolate spheroid with the axis directed along $\vec{k}$ (see
Fig. 1) and with the semiaxes

$a_{1}=a_{2}\\\
=a\left\\{1-\dfrac{\alpha}{6}\left(\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\right)^{2}\left[1+\left|\zeta\right|\cos\left(2\omega{t}-2\phi\right)\right]\right\\},$
(63)
$a_{3}=a\left\\{1+\dfrac{\alpha}{3}\left(\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\right)^{2}\left[1+\left|\zeta\right|\cos\left(2\omega{t}-2\phi\right)\right]\right\\},$
(64)

where

$\zeta=\left[1-\dfrac{i\omega\tau}{96}{F}(\varkappa_{\mathrm{e}},\varkappa_{\mathrm{i}})\right]^{-1},$
(65)
$\phi=\dfrac{1}{2}\arctan\left(-\dfrac{\mathop{\mathrm{missing}}{Im}\zeta}{\mathop{\mathrm{missing}}{Re}\zeta}\right).$
(66)

Here, $\mathrm{Re}$ and $\mathrm{Im}$ denote the real and imaginary parts of a
complex quantity, $\arctan$ is the arc tangent. Thus, the drop performs
deformational oscillations with the angular frequency $2\omega$ and the phase
lag $2\phi$.

Figure 2: Drop in an applied uniform rotating magnetic field. Figure 3: The
dependencies of $\left|\zeta\right|$ and $\phi$ upon the angular frequency
$\omega$ for $\eta_{\mathrm{i}}=20~{}\mathrm{mPa}~{}\mathrm{s}$,
$\rho_{\mathrm{i}}=1.4~{}\mathrm{kg}/\mathrm{m}$,
$\eta_{\mathrm{e}}=0.89~{}\mathrm{mPa}~{}\mathrm{s}$,
$\rho_{\mathrm{e}}=1~{}\mathrm{kg}/\mathrm{m}$,
$\sigma_{\mathrm{s}}=20~{}\mathrm{mN}/\mathrm{m}$ (1: $a=1~{}\mathrm{mm}$, 2:
$a=100$ µ$\mathrm{m}$, 3: $a=10$ µ$\mathrm{m}$, 4: $a=1$ µ$\mathrm{m}$).

With accuracy up to the terms of the first order, in a rotating applied
magnetic field with the intensity

$\vec{H}_{\mathrm{a}}=H_{\mathrm{am}}\left[\cos\left(\omega{t}\right)\vec{i}+\sin\left(\omega{t}\right)\vec{j}\right],$
(67)

the drop takes the shape of a tri-axial ellipsoid (see Fig. 2) with the
semiaxes

$\displaystyle a_{1}$
$\displaystyle=a\left[1-\dfrac{\alpha}{3}\left(\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\right)^{2}\right],$
(68) $\displaystyle a_{2}$
$\displaystyle=a\left[1+\dfrac{\alpha}{6}\left(\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\right)^{2}\left(1-3\left|\zeta\right|\right)\right],$
(69) $\displaystyle a_{3}$
$\displaystyle=a\left[1+\dfrac{\alpha}{6}\left(\dfrac{\mu_{\mathrm{i}}-\mu_{\mathrm{e}}}{\mu_{\mathrm{i}}+2\mu_{\mathrm{e}}}\right)^{2}\left(1+3\left|\zeta\right|\right)\right].$
(70)

The ellipsoid rotates around its minor axis, directed along
$\vec{k}=\vec{i}\times\vec{j}$, with the angular speed $\omega$ so that its
major axis lags from $\vec{H}_{\mathrm{a}}$ by the angle $\phi$. Here,
$\vec{i}$, $\vec{j}$, and $\vec{k}$ form a right triple of orthonormal
vectors.

The dependencies of $\left|\zeta\right|$ and $\phi$ upon $\omega$ for a drop
of magnetic liquid on the basis of magnetite in kerosene suspended in water at
various values of the radius of the drop, $a$, are presented in Fig. 3.

###  II.6 Limit cases.

Figure 4: The dependencies of $\left|\zeta\right|$ upon the angular frequency
$\omega$ for $\eta_{\mathrm{i}}=20~{}\mathrm{mPa}~{}\mathrm{s}$,
$\rho_{\mathrm{i}}=1.4~{}\mathrm{kg}/\mathrm{m}$,
$\eta_{\mathrm{e}}=0.89~{}\mathrm{mPa}~{}\mathrm{s}$,
$\rho_{\mathrm{e}}=1~{}\mathrm{kg}/\mathrm{m}$,
$\sigma_{\mathrm{s}}=20~{}\mathrm{mN}/\mathrm{m}$ (1: $a=1~{}\mathrm{mm}$, 2:
$a=100$ µ$\mathrm{m}$, 3: $a=10$ µ$\mathrm{m}$, 4: $a=1$ µ$\mathrm{m}$) as
compared with those for the limit cases: the dotted line when the inertia is
neglected and the dashed lines when the viscosity is neglected.

For the limit case
$\rho_{\mathrm{e}}\sigma_{\mathrm{s}}a/(2\eta_{\mathrm{e}}^{2})\to 0$,

$\left|\zeta\right|\to\dfrac{1}{\sqrt{1+4\tau_{2,1}^{2}\omega^{2}}},\quad\phi\to\dfrac{1}{2}\arctan\left(2\tau_{2,1}\omega\right)\\\
\text{ as
}\dfrac{\rho_{\mathrm{e}}\sigma_{\mathrm{s}}{a}}{2\eta_{\mathrm{e}}^{2}}\to
0,$ (71)
$\tau_{2,1}=\dfrac{\left(16\eta_{\mathrm{e}}+19\eta_{\mathrm{i}}\right)\left(3\eta_{\mathrm{e}}+2\eta_{\mathrm{i}}\right)a}{40\left(\eta_{\mathrm{e}}+\eta_{\mathrm{i}}\right)\sigma_{\mathrm{s}}}.$
(72)

This case corresponds to the case when the inertia of the liquids can be
neglected, considered in [12, 13, 14].

For the limit case
$\rho_{\mathrm{e}}\sigma_{\mathrm{s}}a/(2\eta_{\mathrm{e}}^{2})\to\infty$,

$\left|\zeta\right|\to\dfrac{\omega^{2}_{2,1}}{\left|\omega^{2}_{2,1}-4\omega^{2}\right|},\quad\phi\to\begin{cases}0,\quad
2\omega<\omega_{2,1}\\\ \pi,\quad 2\omega>\omega_{2,1}\end{cases}\\\ \text{ as
}\dfrac{\rho_{\mathrm{e}}\sigma_{\mathrm{s}}{a}}{2\eta_{\mathrm{e}}^{2}}\to\infty,$
(73)
$\omega_{2,1}=\sqrt{\dfrac{24\rho_{\mathrm{e}}}{2\rho_{\mathrm{e}}+3\rho_{\mathrm{i}}}\dfrac{\sigma_{\mathrm{s}}}{\rho_{\mathrm{e}}a^{3}}}.$
(74)

This case corresponds to the case when the viscosity of the liquids can be
neglected, considered in [15]. The limit resonance circular frequency
$\omega_{2,1}$ coincides with the frequency of the proper free deformational
oscillations (for the mode with $n=2$) found by Rayleigh (see [18] art. 275).

In Fig. 4, the dependencies of $\left|\zeta\right|$ upon the angular frequency
$\omega$ are presented together with those for the limit cases. As can be seen
from the figure, the inertia may be neglected for small oscillations of a drop
of a typical magnetic liquid suspended in water if the radius of the drop does
not exceed 10 microns. And, for sufficiently large-scale drops, the formulas
in which the influence of the viscosity is neglected may be used only if the
frequency of the oscillations of the applied field is sufficiently far from
the resonance frequency.

##  III Conclusion

The behavior of a drop of a viscous magnetic liquid suspended in another
viscous magnetic liquid immiscible with the former in an applied non-
stationary uniform magnetic field is theoretically investigated within the
approximation of low Reynolds numbers with taking into account that the flow
of the liquids is unsteady. The general solution of the Navier–Stokes equation
in the low Reynolds number approximation is found for unsteady flows of an
incompressible liquid. With the use of this general solution in the first
order approximation over the small parameter smallness of which provides the
smallness of the deformation of the drop, the equations are obtained that
describe the variation of the form of the drop in an arbitrarily varying
uniform magnetic field. The solutions of these equations are found for forced
steady-state oscillations of the drop in harmonically oscillating and rotating
applied magnetic fields.

As the solution of the given problem shows, rather cumbersome expressions even
for the corrections of the first order appear in taking into account the
unsteady term. So more careful study of the general solution with the goal to
find more simple asymptotic expressions for the case when the viscosity tends
to zero acquires actuality. Those asymptotic expressions should allow
describing the process of the oscillation decay and finiteness of the
oscillation amplitude for the resonance.

###### Acknowledgements.

The partial support by RFBR grant 19-01-00056 is acknowledged.

## References

  * [1] G. I. Subkhankulov. Dynamics of small deformable drops of magnetic liquid. Magnetohydrodynamics, vol. 20 (1984), no. 4, pp. 370–375.
  * [2] J.-C. Bacri, A. Cebers, and R. Perzynski. Behavor of Magnetic Fluid Microdrop in a Rotating Magnetic Field. Phys. Rev. Lett., vol. 72 (1994), pp. 2705–2708.
  * [3] A. V. Lebedev and K. I. Morozov. Dynamics of a drop of magnetic liquid in a rotating magnetic field. Journal of Experimental and Theoretical Physics Letters, vol. 65 (1997), pp. 160–165.
  * [4] K. I. Morozov. Rotation of a droplet in a viscous fluid. Journal of Experimental and Theoretical Physics, vol. 85 (1997), pp. 728–733.
  * [5] Y. K. Bratukhin, A.V. Lebedev, and A. F. Pshenichnikov. Motion of a deformable droplet of magnetic fluid in a rotating magnetic field. Fluid Dynamics, vol. 35 (2000), no. 1, pp. 17–23.
  * [6] K. I. Morozov and A. V. Lebedev. Bifurcations of the shape of a magnetic fluid droplet in a rotating magnetic field. Journal of Experimental and Theoretical Physics, vol. 91 (2000), pp. 1029–1032.
  * [7] Yu. K. Bratukhin and A. V. Lebedev. Forced oscillations of a magnetic liquid drop. Journal of Experimental and Theoretical Physics, vol. 94 (2002), pp. 1114–1120.
  * [8] A. V. Lebedev, A. Engel, K. I. Morozov, and H. Bauke. Ferrofluid drops in rotating magnetic fields. New J. Phys., vol. 5 (2003), pp. 57.1–57.20.
  * [9] A. P. Stikuts, R. Perzynski and A. Cebers. Small deformation theory for a magnetic droplet in a rotating field. Phys. Fluids, vol. 34 (2022), pp. 052010.1–052010.14.
  * [10] A. Langins, A. P. Stikuts and A. Cebers. A three-dimensional boundary element method algorithm for simulations of magnetic fluid droplet dynamics. Phys. Fluids, vol. 34 (2022), pp. 062105.1–062105.18.
  * [11] Yu. I. Dikansky and A. R. Zakinyan. Dynamics of a nonmagnetic drop suspended in a magnetic fluid in a rotating magnetic field. Technical Physics, vol. 55 (2010), pp. 1082–1086.
  * [12] A. N. Tyatyushkin. Deformation of a magnetic liquid drop in an applied non-stationary uniform magnetic field. EPJ Web of Conferences, vol. 185 (2018), pp. 09006-1–09006-4.
  * [13] A. N. Tyatyushkin. Drop of viscous magnetic liquid in a non-stationary magnetic field. Magnetohydrodynamics, vol. 54 (2018), nos. 1–2, pp. 151–154.
  * [14] A. N. Tyatyushkin. Magnetization and Deformation of a Drop of a Magnetic Fluid in an Alternating Magnetic Field. Bulletin of the Russian Academy of Sciences: Physics, vol. 83 (2019), pp. 804–805.
  * [15] A. N. Tyatyushkin. Deformation of an Inviscid Magnetizable Liquid Drop in a Non-Stationary Magnetic Field. Fluid Dynamics, vol. 56 (2021), no. 5, pp. 732–744.
  * [16] R. E. Rosensweig. Ferrohydrodynamics (Cambridge University Press, New York, 1985).
  * [17] L. D. Landau and E. M. Lifshits. The classical theory of fields (Pergamon Press, 1975).
  * [18] H. Lamb. Hydrodynamics (Cambridge University Press, 1932).


require extensive fine-tuning in order to provide a nice trade-off between
privacy and performance. Most of the defences require access to big
computational resources or they will be too slow to apply. Therefore, such
defences might not be suitable for FL settings with low power devices.
Additionally, to our knowledge, there is not a consensus about how to measure
the trade-off between privacy and performance.

To finish, as a fundamental lesson learned is that the field of adversarial
attacks and defences in FL is a research area in steady development, which is
not expected to change in the forthcoming years. There are still many
vulnerabilities which need to be faced in order to ensure a truly secure and
privacy-preserving learning environment.

##  8 Challenges of addressing federated learning threats

Regarding the previous lessons learnt, we identified the following challenges
that the field will have to face up in the next years.

##### Defences vs. attacks

An identified trend is that for each defence proposed, it is possible to
identify a vulnerability that can be turned into an adversarial attack, and
vice versa. Therefore, one of the biggest challenges is to find both: (1) all
vulnerabilities present in a FL scenario that an attacker could exploit, and
(2) a defence effective enough to defend against any attack. For the time
being, this seems a long way off, as the different perspectives from which
both problems have been approached are ad hoc to the type of attack to be
identified or defended. From our point of view, the study of defences is
crucial, since the final goal is to achieve a secure, robust and private
learning environment. Along this vein, the optimal defence will be the one
that combines the best proposals in each of the categories, in such a way that
it manages to defend against all types of attacks while maintaining
performance in the original task. There are existing approaches that combine
client’s filtering with noise addition [15], although there is still a long
way to go.

##### Trade-off in defences

In most defences, we find that it is difficult to strike a trade-off between
preventing the model from attacking and not impairing performance in the
original task. For example, in those based on DP, we find that in order to
ensure data privacy, a large amount of noise has to be added, which
significantly impairs the performance of the model [105]. Therefore one of the
main challenges would be the development of more efficient DP methods, and the
extension of DP to defences against all adversarial attacks. This situation
also occurs in defences based on client filtering when more clients than
necessary are filtered out, thus losing information in the aggregation
process. In short, it is difficult to strike a trade-off between preventing an
attack and not losing or poisoning the information received by clients.

##### Non-IID assumptions

The non-IID nature of the training data distributed among clients often makes
it difficult to differentiate between adversarial clients and those who have
had a very different from the rest, but still valuable, learning process. One
common approach is to use anomaly detection algorithms suitable for non-IID
distributions [174] or approaches which not rely on data distribution [109],
however, there are still problems in differentiating between clients with a
highly skewed distribution and adversarial clients in most cases.

##### Generalised FL

The vast majority of adversarial attacks have been identified for HFL. In
particular, the adversarial attacks to the federated model. Although there is
already existing work on privacy attacks in VFL [77], there is still a long
way to go in identifying and analysing the vulnerabilities in terms of leakage
of information of attacker possibilities in other categories of FL wich are
becoming widely used such as VFL or FTL [175]. Therefore, we believe that in
the coming years, work on identifying attacks for VFL and FTL and the research
in defences against them will take centre stage.

##### Combination with other trends

While ensuring data privacy is one of the main goals of FL, there are other
desirable features. For example, some of the most popular trends are
Personalised FL [176] or fairness in FL [177]. We believe that, at the end of
the day, data security and privacy must be a requirement in all other
approaches. Therefore, several future works will address this issue as a
cross-cutting objective while developing proposals for more concrete desirable
features. For example, a method of personalised FL that is secure against
adversarial attacks.

##  9 Conclusions

FL emerges as a solution to the computational costs and privacy-preserving
demands of the most groundbreaking ML. However, this new learning paradigm
brings new challenges, particularly in terms of adversarial attacks and
defending against them. Hence, several proposals of new adversarial attacks or
adaptations of centralised ones as well as defences ad hoc to these attacks
have been proposed in the recent years.

We proposed several taxonomies according to different criteria that eases the
knowledge of the wide field of FL threats. In addition, we conducted an
extensive experimental study which leads us to propose a guidelines for the
application of defences against adversarial attacks, and to highlight a set of
lessons learned and challenges related to FL threats.

We conclude that the study of FL threats is an ongoing field of research, due
to its importance in ensuring FL as a robust machine learning paradigm that
safeguards data privacy. There are still several challenges to be faced and
directions to be studied in order to identify additional threats (or
vulnerabilities) of FL, as well as the appropriate mechanisms to make it a
resilient and robust learning paradigm against those threats.

## Acknowledgments

This research work is partially supported by the Trust-ReDaS
(PID2020-119478GB-I00), the FedDAP (PID2020-116118GA-I00) and the
EQC2018-005084-P projects from the Spanish Government, and a grant from the
European Regional Development Fund (ERDF). Nuria Rodríguez Barroso and Eugenio
Martínez Cámara were supported by the Spanish Government fellowship programmes
Formación de Profesorado Universitario (FPU18/04475) and Juan de la Cierva
Incorporación (IJC2018-036092-I) respectively.

## References

  * Al-Kuwari [2021] S. Al-Kuwari, Multiple Perspectives on Artificial Intelligence in Healthcare: Opportunities and Challenges, Springer International Publishing, 2021, pp. 65–77.
  * Boissay et al. [2021] F. Boissay, T. Ehlers, L. Gambacorta, H. S. Shin, The Palgrave Handbook of Technological Finance, Springer International Publishing, 2021, pp. 855–875.
  * Goddard [2017] M. Goddard,  The EU General Data Protection Regulation (GDPR): European regulation that has a global impact,  International Journal of Market Research 59 (2017) 703–705.
  * Gómez-Carmona et al. [2020] O. Gómez-Carmona, D. Casado-Mansilla, F. A. Kraemer, D. L. de Ipiña, J. García-Zubia,  Exploring the computational cost of machine learning at the edge for human-centric internet of things,  Future Generation Computer Systems 112 (2020) 670–683.
  * Zhang and Tao [2021] J. Zhang, D. Tao,  Empowering things with intelligence: A survey of the progress, challenges, and opportunities in artificial intelligence of things,  IEEE Internet of Things Journal 8 (2021) 7789–7817.
  * Ma et al. [2017] C. Ma, J. Konečný, M. Jaggi, V. Smith, M. Jordan, P. Richtárik, M. Takáč,  Distributed optimization with arbitrary local solvers,  Optimization Methods and Software 32 (2017) 813–848.
  * Yang et al. [2019] Q. Yang, Y. Liu, Y. Cheng, Y. Kang, T. Chen, H. Yu, Federated Learning, Synthesis Lectures on Artificial Intelligence and Machine Learning, 2019.
  * Huang et al. [2011] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, J. D. Tygar,  Adversarial machine learning,  Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence (2011) 43–58.
  * Dalvi et al. [2004] N. Dalvi, P. Domingos, Mausam, S. Sanghai, D. Verma,  Adversarial classification,  in: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2004, p. 99–108.
  * Bagdasaryan et al. [2020] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, V. Shmatikov,  How to backdoor federated learning,  in: International Conference on Artificial Intelligence and Statistics, 2020, pp. 2938–2948.
  * Fang et al. [2020] M. Fang, X. Cao, J. Jia, N. Z. Gong,  Local model poisoning attacks to byzantine-robust federated learning,  in: USENIX Security Symposium, 2020, pp. 1605–1622.
  * Zhu and Han [2020] L. Zhu, S. Han,  Deep leakage from gradients,  in: Federated learning, Springer, 2020, pp. 17–31.
  * Zhang et al. [2021] W. Zhang, S. Tople, O. Ohrimenko,  Leakage of dataset properties in Multi-Party machine learning,  in: 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2687–2704.
  * Park et al. [2021] J. Park, D.-J. Han, M. Choi, J. Moon,  Sageflow: Robust federated learning against both stragglers and adversaries,  in: Thirty-fifth Conference on Neural Information Processing Systems (NeurIPS), 2021.
  * Ozdayi et al. [2021] M. S. Ozdayi, M. Kantarcioglu, Y. R. Gel,  Defending against backdoors in federated learning with robust learning rate,  in: Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, 2021, pp. 9268–9276.
  * Sun et al. [2021a] J. Sun, A. Li, B. Wang, H. Yang, H. Li, Y. Chen,  Soteria: Provable Defense Against Privacy Leakage in Federated Learning From Representation Perspective,  in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021a, pp. 9311–9319.
  * Sun et al. [2021b] J. Sun, A. Li, L. DiValentin, A. Hassanzadeh, Y. Chen, H. Li,  FL-WBC: enhancing robustness against model poisoning attacks in federated learning from a client perspective,  in: Thirty-fifth Conference on Neural Information Processing Systems (NeurIPS), 2021b.
  * Bhagoji et al. [2019] A. Bhagoji, S. Chakraborty, P. Mittal, S. Calo,  Analyzing federated learning through an adversarial lens,  in: Proceedings of the 36th International Conference on Machine Learning (ICML), volume 97, 2019, pp. 634–643.
  * Fraboni et al. [2021] Y. Fraboni, R. Vidal, M. Lorenzi,  Free-rider attacks on model aggregation in federated learning,  in: Proceedings of The 24th International Conference on Artificial Intelligence and Statistics, volume 130, 2021, pp. 1846–1854.
  * Shejwalkar et al. [2022] V. Shejwalkar, A. Houmansadr, P. Kairouz, D. Ramage,  Back to the drawing board: A critical evaluation of poisoning attacks on federated learning,  in: 43rd IEEE Symposium on Security and Privacy, 2022\.
  * Enthoven and Al-Ars [2021] D. Enthoven, Z. Al-Ars,  An Overview of Federated Deep Learning Privacy Attacks and Defensive Strategies,  Studies in Computational Intelligence 965 (2021) 173–196.
  * Asad et al. [2020] M. Asad, A. Moustafa, C. Yu,  A critical evaluation of privacy and security threats in federated learning,  Sensors (Switzerland) 20 (2020) 1–15.
  * Mothukuri et al. [2021] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, G. Srivastava,  A survey on security and privacy of federated learning,  Future Generation Computer Systems 115 (2021) 619–640.
  * Lyu et al. [2020] L. Lyu, H. Yu, X. Ma, L. Sun, J. Zhao, Q. Yang, P. S. Yu,  Privacy and Robustness in Federated Learning: Attacks and Defenses,  CoRR abs/2012.06337 (2020).
  * Biggio et al. [2013] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, F. Roli,  Evasion attacks against machine learning at test time,  in: Machine Learning and Knowledge Discovery in Databases, 2013, pp. 387–402.
  * Lyu et al. [2020] L. Lyu, H. Yu, J. Zhao, Q. Yang,  Threats to Federated Learning,  Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12500 LNCS (2020) 3–16.
  * Jere et al. [2021] M. S. Jere, T. Farnan, F. Koushanfar,  A Taxonomy of Attacks on Federated Learning,  IEEE Security and Privacy 19 (2021) 20–28.
  * Bouacida and Mohapatra [2021] N. Bouacida, P. Mohapatra,  Vulnerabilities in Federated Learning,  IEEE Access 9 (2021) 63229–63249.
  * Yang et al. [2019] Q. Yang, Y. Liu, T. Chen, Y. Tong,  Federated machine learning: Concept and applications,  ACM Transactions on Intelligent Systems and Technology 10 (2019) 12:1–12:19.
  * Rodríguez-Barroso et al. [2020] N. Rodríguez-Barroso, G. Stipcich, D. Jiménez-López, J. A. Ruiz-Millán, E. Martínez-Cámara, G. González-Seco, M. V. Luzón, M. Ángel Veganzones, F. Herrera,  Federated learning and differential privacy: Software tools analysis, the Sherpa.ai FL framework and methodological guidelines for preserving data privacy,  Information Fusion 64 (2020) 270 – 292.
  * Dwork and Roth [2014] C. Dwork, A. Roth,  The algorithmic foundations of differential privacy,  Foundations and Trends® in Theoretical Computer Science 9 (2014) 211–407.
  * Dwork et al. [2006] C. Dwork, F. McSherry, K. Nissim, A. Smith,  Calibrating noise to sensitivity in private data analysis,  in: Theory of Cryptography, 2006, pp. 265–284.
  * Truex et al. [2019] S. Truex, L. Liu, M. E. Gursoy, L. Yu, W. Wei,  Demystifying membership inference attacks in machine learning as a service,  IEEE Transactions on Services Computing (2019).
  * Fung et al. [2018] C. Fung, C. J. M. Yoon, I. Beschastnikh,  Mitigating sybils in federated learning poisoning,  CoRR abs/1808.04866 (2018).
  * Bhagoji et al. [2018] A. N. Bhagoji, S. Chakraborty, P. Mittal, S. Calo,  Model poisoning attacks in federated learning,  in: In Workshop on Security in Machine Learning (SecML), collocated with the 32nd Conference on Neural Information Processing Systems (NeurIPS’18), 2018.
  * Nasr et al. [2019] M. Nasr, R. Shokri, A. Houmansadr,  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,  IEEE Symposium on Security and Privacy (SP) (2019) 739–753.
  * Chen et al. [2017] X. Chen, C. Liu, B. Li, K. Lu, D. Song,  Targeted backdoor attacks on deep learning systems using data poisoning,  CoRR abs/1712.05526 (2017).
  * Sun et al. [2019] Z. Sun, P. Kairouz, A. T. Suresh, H. B. McMahan,  Can you really backdoor federated learning?,  CoRR abs/1911.07963 (2019).
  * Bhagoji et al. [2019] A. N. Bhagoji, S. Chakraborty, P. Mittal, S. Calo,  Analyzing federated learning through an adversarial lens,  in: Proceedings of the 36th International Conference on Machine Learning (ICML), volume 97, 2019, pp. 634–643.
  * Wang et al. [2020] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, D. Papailiopoulos,  Attack of the tails: Yes, you really can backdoor federated learning,  Advances in Neural Information Processing Systems 33 (2020).
  * Sun et al. [2021] G. Sun, Y. Cong, J. Dong, Q. Wang, L. Lyu, J. Liu,  Data poisoning attacks on federated machine learning,  IEEE Internet of Things Journal PP (2021) 1–1.
  * Xie et al. [2020] C. Xie, K. Huang, P.-Y. Chen, B. Li,  Dba: Distributed backdoor attacks against federated learning,  in: International Conference on Learning Representations, 2020.
  * Salem et al. [2021] A. Salem, R. Wen, M. Backes, S. Ma, Y. Zhang, Dynamic backdoor attacks against deep neural networks, 2021.
  * Liu et al. [2020] Y. Liu, Z. Yi, T. Chen,  Backdoor attacks and defenses in feature-partitioned collaborative learning,  CoRR abs/2007.03608 (2020).
  * Fang et al. [2020] M. Fang, X. Cao, J. Jia, N. Z. Gong,  Local model poisoning attacks to byzantine-robust federated learning,  29th USENIX Security Symposium (2020).
  * Blanchard et al. [2017] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, J. Stainer,  Machine learning with adversaries: Byzantine tolerant gradient descent,  in: I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing Systems 30, Curran Associates, Inc., 2017, pp. 119–129.
  * Lamport et al. [1982] L. Lamport, R. Shostak, M. Pease,  The byzantine generals problem,  ACM Trans. Program. Lang. Syst. 4 (1982) 382–401.
  * Hu et al. [2021] S. Hu, J. Lu, W. Wan, L. Y. Zhang,  Challenges and approaches for mitigating byzantine attacks in federated learning,  CoRR abs/2112.14468 (2021).
  * Fraboni et al. [2021] Y. Fraboni, R. Vidal, M. Lorenzi,  Free-rider attacks on model aggregation in federated learning,  in: Proceedings of the 24th International Conference on Artificial Intelligence and Statistics (AISTATS), 2021, pp. 1846–1854.
  * Tolpegin et al. [2020] V. Tolpegin, S. Truex, M. Gursoy, L. Liu, Data Poisoning Attacks Against Federated Learning Systems, 2020, pp. 480–501.
  * Cao et al. [2019] D. Cao, S. Chang, Z. Lin, G. Liu, D. Sun,  Understanding distributed poisoning attack in federated learning,  in: 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS), 2019, pp. 233–239.
  * Li et al. [2021] X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, Y. Liu,  Lomar: A local defense against poisoning attack on federated learning,  IEEE Transactions on Dependable and Secure Computing (2021) 1–1.
  * Goodfellow et al. [2014] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio,  Generative adversarial nets,  in: Advances in Neural Information Processing Systems, volume 27, 2014, pp. 2672–2680.
  * Zhang et al. [2021] J. Zhang, B. Chen, X. Cheng, H. T. T. Binh, S. Yu,  Poisongan: Generative poisoning attacks against federated learning in edge computing systems,  IEEE Internet of Things Journal 8 (2021) 3310–3322.
  * Zhang et al. [2019] J. Zhang, J. Chen, D. Wu, B. Chen, S. Yu,  Poisoning attack in federated learning using generative adversarial nets,  in: 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), 2019, pp. 374–380.
  * Fort et al. [2021] S. Fort, J. Ren, B. Lakshminarayanan,  Exploring the limits of out-of-distribution detection,  CoRR abs/2106.03004 (2021).
  * Koh et al. [2018] P. W. Koh, J. Steinhardt, P. Liang,  Stronger data poisoning attacks break data sanitization defenses,  CoRR abs/1811.00741 (2018).
  * Xu et al. [2020] X. Xu, J. Wu, M. Yang, T. Luo, X. Duan, W. Li, Y. Wu, B. Wu,  Information leakage by model weights on federated learning,  in: Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, Association for Computing Machinery, 2020, p. 31–36.
  * Costa et al. [2021] G. Costa, F. Pinelli, S. Soderi, G. Tolomei,  Covert channel attack to federated learning systems,  CoRR abs/2104.10561 (2021).
  * Konec̆ný et al. [2016] J. Konec̆ný, H. McMahan, F. Yu, P. Richtarik, A. Suresh, D. Bacon,  Federated learning: Strategies for improving communication efficiency,  in: NIPS Workshop on Private Multi-Party Machine Learning, 2016.
  * Andreina et al. [2021] S. Andreina, G. A. Marson, H. Möllering, G. O. Karame,  Baffle: Backdoor detection via feedback-based federated learning,  in: 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), 2021, pp. 852–863.
  * Zhao et al. [2020] B. Zhao, K. R. Mopuri, H. Bilen,  idlg: Improved deep leakage from gradients,  CoRR abs/2001.02610 (2020).
  * Li et al. [2019] Z. Li, Z. Huang, C. Chen, C. Hong,  Quantification of the leakage in federated learning,  CoRR abs/1910.05467 (2019).
  * Geiping et al. [2020] J. Geiping, H. Bauermeister, H. Dröge, M. Moeller,  Inverting Gradients - How easy is it to break privacy in federated learning?,  in: Advances in Neural Information Processing Systems, volume 33, 2020, pp. 16937–16947.
  * Ren et al. [2021] H. Ren, J. Deng, X. Xie,  GRNN: Generative Regression Neural Network – A Data Leakage Attack for Federated Learning,  CoRR abs/2105.00529 (2021).
  * Wei et al. [2020] W. Wei, L. Liu, M. Loper, K.-H. Chow, M. E. Gursoy, S. Truex, Y. Wu,  A framework for evaluating client privacy leakages in federated learning,  in: European Symposium on Research in Computer Security, 2020, pp. 545–566.
  * Jin et al. [2021] X. Jin, R. Du, P.-Y. Chen, T. Chen,  CAFE: Catastrophic Data Leakage in Vertical Federated Learning,  CoRR 1412.6830 (2021).
  * Hitaj et al. [2017] B. Hitaj, G. Ateniese, F. Perez-Cruz,  Deep models under the GAN: information leakage from collaborative deep learning,  in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 603–618.
  * Wang et al. [2019] Z. Wang, M. Song, Z. Zhang, Y. Song, Q. Wang, H. Qi,  Beyond inferring class representatives: User-level privacy leakage from federated learning,  in: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, 2019, pp. 2512–2520.
  * Yuan et al. [2021] X. Yuan, X. Ma, L. Zhang, Y. Fang, D. Wu,  Beyond Class-Level Privacy Leakage: Breaking Record-Level Privacy in Federated Learning,  IEEE Internet Things J. 4662 (2021) 1–11.
  * Luo et al. [2021] X. Luo, Y. Wu, X. Xiao, B. C. Ooi,  Feature inference attack on model predictions in vertical federated learning,  in: Proc. - Int. Conf. Data Eng., volume 2021-April, 2021, pp. 181–192.
  * Weng et al. [2020] H. Weng, J. Zhang, F. Xue, T. Wei, S. Ji, Z. Zong,  Privacy leakage of real-world vertical federated learning,  CoRR abs/2011.09290 (2020).
  * Shokri et al. [2017] R. Shokri, M. Stronati, C. Song, V. Shmatikov,  Membership inference attacks against machine learning models,  in: 2017 IEEE Symposium on Security and Privacy (SP), 2017, pp. 3–18.
  * Mao et al. [2019] Y. Mao, X. Zhu, W. Zheng, D. Yuan, J. Ma,  A Novel User Membership Leakage Attack in Collaborative Deep Learning,  in: 2019 11th Int. Conf. Wirel. Commun. Signal Process. WCSP, 2019, pp. 1–6.
  * Zhang et al. [2020] J. J. Zhang, J. J. Zhang, J. Chen, S. Yu,  GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning,  in: IEEE Int. Conf. Commun., volume 2020-June, 2020, pp. 5–10.
  * Chen et al. [2020] J. Chen, J. Zhang, Y. Zhao, H. Han, K. Zhu, B. Chen,  Beyond model-level membership privacy leakage: an adversarial approach in federated learning,  in: 2020 29th International Conference on Computer Communications and Networks (ICCCN), 2020, pp. 1–9.
  * Li et al. [2021] O. Li, J. Sun, X. Yang, W. Gao, H. Zhang, J. Xie, V. Smith, C. Wang,  Label Leakage and Protection in Two-party Split Learning,  CoRR abs/2102.08504 (2021).
  * Wang et al. [2019] L. Wang, S. Xu, X. Wang, Q. Zhu,  Eavesdrop the Composition Proportion of Training Labels in Federated Learning,  CoRR abs/1910.06044 (2019).
  * Mo et al. [2020] F. Mo, A. Borovykh, M. Malekzadeh, H. Haddadi, S. Demetriou,  Layer-wise Characterization of Latent Information Leakage in Federated Learning,  CoRR abs/2010.08762 (2020).
  * Melis et al. [2019] L. Melis, C. Song, E. De Cristofaro, V. Shmatikov,  Exploiting unintended feature leakage in collaborative learning,  IEEE Symposium on Security and Privacy (2019) 691–706.
  * Zhang and Yang [2021] Y. Zhang, Q. Yang,  A survey on multi-task learning,  IEEE Transactions on Knowledge and Data Engineering (2021) 1–1.
  * Xu and Li [2020] M. Xu, X. Li,  Subject Property Inference Attack in Collaborative Learning,  in: Proc. - 2020 12th Int. Conf. Intell. Human-Machine Syst. Cybern. IHMSC 2020, volume 1, 2020, pp. 227–231.
  * Zhu et al. [2017] J.-Y. Zhu, T. Park, P. Isola, A. A. Efros,  Unpaired image-to-image translation using cycle-consistent adversarial networks,  in: Proceedings of the IEEE international conference on computer vision, 2017, pp. 2223–2232.
  * Chase et al. [2021] M. Chase, E. Ghosh, S. Mahloujifar,  Property Inference From Poisoning,  CoRR abs/2101.11073 (2021).
  * Shen et al. [2021] M. Shen, H. Wang, B. Zhang, L. Zhu, K. Xu, Q. Li, X. Du,  Exploiting Unintended Property Leakage in Blockchain-Assisted Federated Learning for Intelligent Edge Computing,  IEEE Internet Things J. 8 (2021) 2265–2275.
  * McMahan et al. [2017] B. McMahan, E. Moore, D. Ramage, S. Hampson, B. A. y Arcas,  Communication-Efficient Learning of Deep Networks from Decentralized Data,  in: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54, 2017, pp. 1273–1282.
  * Yin et al. [2018] D. Yin, Y. Chen, R. Kannan, P. Bartlett,  Byzantine-robust distributed learning: Towards optimal statistical rates,  in: Proceedings of the 35th International Conference on Machine Learning (ICML), volume 80, 2018, pp. 5650–5659.
  * Wu et al. [2020] Z. Wu, Q. Ling, T. Chen, G. B. Giannakis,  Federated variance-reduced stochastic gradient descent with robustness to byzantine attacks,  IEEE Transactions on Signal Processing 68 (2020) 4583–4596.
  * Pillutla et al. [2019] K. Pillutla, S. M. Kakade, Z. Harchaoui,  Robust aggregation for federated learning,  CoRR abs/1912.13445 (2019).
  * Blanchard et al. [2017] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, J. Stainer,  Machine learning with adversaries: Byzantine tolerant gradient descent,  Advances in Neural Information Processing Systems 30 (2017) 119–129.
  * El Mhamdi et al. [2018] E. M. El Mhamdi, R. Guerraoui, S. Rouault,  The hidden vulnerability of distributed learning in Byzantium,  in: Proceedings of the 35th International Conference on Machine Learning, volume 80, 2018, pp. 3521–3530.
  * Muñoz-González et al. [2019] L. Muñoz-González, K. T. Co, E. C. Lupu,  Byzantine-robust federated machine learning through adaptive model averaging,  CoRR abs/1909.05125 (2019).
  * Fu et al. [2021] S. Fu, C. Xie, B. Li, Q. Chen,  Attack-resistant federated learning with residual-based reweighting,  CoRR abs/1912.11464 (2021).
  * Tahanian et al. [2021] E. Tahanian, M. Amouei, H. Fateh, M. Rezvani,  A game-theoretic approach for robust federated learning,  International Journal of Engineering 34 (2021) 832–842.
  * Nash [1950] J. F. Nash,  Equilibrium points in n-person games,  Proceedings of the National Academy of Sciences 36 (1950) 48–49.
  * Shen et al. [2016] S. Shen, S. Tople, P. Saxena,  Auror: defending against poisoning attacks in collaborative deep learning systems,  in: Proceedings of the 32nd Annual Conference on Computer Security Applications, 2016, pp. 508–519.
  * Sattler et al. [2020] F. Sattler, K.-R. Müller, T. Wiegand, W. Samek,  On the byzantine robustness of clustered federated learning,  in: ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 8861–8865.
  * Preuveneers et al. [2018] D. Preuveneers, V. Rimmer, I. Tsingenopoulos, J. Spooren, W. Joosen, E. Ilie-Zudor,  Chained anomaly detection models for federated learning: An intrusion detection case study,  Applied Sciences 8 (2018).
  * Hei et al. [2020] X. Hei, X. Yin, Y. Wang, J. Ren, L. Zhu,  A trusted feature aggregator federated learning for distributed malicious attack detection,  Computers & Security 99 (2020) 102033.
  * Azulay et al. [2020] S. Azulay, L. Raz, A. Globerson, T. Koren, Y. Afek,  Holdout sgd: Byzantine tolerant federated learning,  CoRR abs/2008.04612 (2020).
  * Nguyen et al. [2019] T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, A.-R. Sadeghi,  Dïot: A federated self-learning anomaly detection system for iot,  in: 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), 2019, pp. 756–767.
  * Zhao et al. [2019] Y. Zhao, J. Chen, J. Zhang, D. Wu, J. Teng, S. Yu,  Pdgan: A novel poisoning defense method in federated learning using generative adversarial network,  in: ICA3PP, 2019.
  * Li et al. [2020] S. Li, Y. Cheng, W. Wang, Y. Liu, T. Chen,  Learning to detect malicious clients for robust federated learning,  CoRR abs/2002.00211 (2020).
  * Naseri et al. [2020] M. Naseri, J. Hayes, E. De Cristofaro,  Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy,  CoRR abs/2009.03561 (2020).
  * Bagdasaryan et al. [2019] E. Bagdasaryan, O. Poursaeed, V. Shmatikov,  Differential privacy has disparate impact on model accuracy,  Advances in Neural Information Processing Systems 32 (2019) 15479–15488.
  * Kairouz et al. [2021] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. B. Charles, G. Cormode, R. Cummings, R. G. L. D’Oliveira, S. Y. E. Rouayheb, D. Evans, J. Gardner, Z. Garrett, A. Gascón, B. Ghazi, P. B. Gibbons, M. Gruteser, Z. Harchaoui, C. He, L. He, Z. Huo, B. Hutchinson, J. Hsu, M. Jaggi, T. Javidi, G. Joshi, M. Khodak, J. Konecný, A. Korolova, F. Koushanfar, O. Koyejo, T. Lepoint, Y. Liu, P. Mittal, M. Mohri, R. Nock, A. Özgür, R. Pagh, M. Raykova, H. Qi, D. Ramage, R. Raskar, D. X. Song, W. Song, S. U. Stich, Z. Sun, A. T. Suresh, F. Tramèr, P. Vepakomma, J. Wang, L. Xiong, Z. Xu, Q. Yang, F. X. Yu, H. Yu, S. Zhao,  Advances and open problems in federated learning,  Found. Trends Mach. Learn. 14 (2021) 1–210.
  * McMahan et al. [2018] B. McMahan, D. Ramage, K. Talwar, L. Zhang,  Learning differentially private recurrent language models,  in: International Conference on Learning Representations (ICLR), 2018.
  * Bernstein et al. [2018] J. Bernstein, Y.-X. Wang, K. Azizzadenesheli, A. Anandkumar,  signSGD: Compressed optimisation for non-convex problems,  in: Proceedings of the 35th International Conference on Machine Learning (ICML), volume 80, 2018, pp. 560–569.
  * Wu et al. [2020] C. Wu, X. Yang, S. Zhu, P. Mitra,  Mitigating backdoor attacks in federated learning,  CoRR abs/2011.01767 (2020).
  * Portnoy et al. [2021] A. Portnoy, Y. Tirosh, D. Hendler,  Towards federated learning with byzantine-robust client weighting,  CoRR abs/2004.04986 (2021).
  * Abadi et al. [2016] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, L. Zhang,  Deep learning with differential privacy,  in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 308–318.
  * Zheng et al. [2021] Q. Zheng, S. Chen, Q. Long, W. Su,  Federated f-differential privacy,  in: International Conference on Artificial Intelligence and Statistics, 2021, pp. 2251–2259.
  * Bu et al. [2020] Z. Bu, J. Dong, Q. Long, W. J. Su,  Deep learning with gaussian differential privacy,  Harvard data science review 2020 (2020).
  * Cao et al. [2021] X. Cao, J. Jia, N. Z. Gong,  Data poisoning attacks to local differential privacy protocols,  in: 30th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 21), 2021, pp. 947–964.
  * Yadav et al. [2020] K. Yadav, B. B. Gupta, K. T. Chui, K. Psannis,  Differential privacy approach to solve gradient leakage attack in a federated machine learning environment,  in: International Conference on Computational Data and Social Networks, 2020, pp. 378–385.
  * Hao et al. [2019] M. Hao, H. Li, G. Xu, S. Liu, H. Yang,  Towards efficient and privacy-preserving federated deep learning,  in: ICC 2019-2019 IEEE International Conference on Communications (ICC), 2019, pp. 1–6.
  * Wei et al. [2021] W. Wei, L. Liu, Y. Wut, G. Su, A. Iyengar,  Gradient-leakage resilient federated learning,  in: 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), 2021, pp. 797–807.
  * Papernot et al. [2016] N. Papernot, M. Abadi, U. Erlingsson, I. Goodfellow, K. Talwar,  Semi-supervised knowledge transfer for deep learning from private training data,  CoRR abs/1610.05755 (2016).
  * Papernot et al. [2018] N. Papernot, S. Song, I. Mironov, A. Raghunathan, K. Talwar, Ú. Erlingsson,  Scalable private learning with PATE,  CoRR abs/1802.08908 (2018).
  * Zhu et al. [2020a] Y. Zhu, X. Yu, M. Chandraker, Y.-X. Wang,  Private-knn: Practical differential privacy for computer vision,  in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020a, pp. 11854–11862.
  * Zhu et al. [2020b] Y. Zhu, X. Yu, Y.-H. Tsai, F. Pittaluga, M. Faraki, Y.-X. Wang, et al.,  Voting-based Approaches For Differentially Private Federated Learning,  CoRR abs/2010.04851 (2020b).
  * Wang et al. [2020] C. Wang, J. Liang, M. Huang, B. Bai, K. Bai, H. Li,  Hybrid differentially private federated learning on vertically partitioned data,  CoRR abs/2009.02763 (2020).
  * Bhowmick et al. [2018] A. Bhowmick, J. Duchi, J. Freudiger, G. Kapoor, R. Rogers,  Protection against reconstruction and its applications in private federated learning,  CoRR abs/1812.00984 (2018).
  * Lee et al. [2021] H. Lee, J. Kim, S. Ahn, R. Hussain, S. Cho, J. Son,  Digestive Neural Networks: A Novel Defense Strategy Against Inference Attacks in Federated Learning,  Computers & Security (2021).
  * Fan et al. [2020] L. Fan, K. W. Ng, C. Ju, T. Zhang, C. Liu, C. S. Chan, Q. Yang,  Rethinking privacy preserving deep learning: How to evaluate and thwart privacy attacks,  in: Federated Learning, Springer, 2020, pp. 32–50.
  * Zhang and Wang [2021] M. Zhang, S. Wang,  Matrix Sketching for Secure Collaborative Machine Learning,  in: International Conference on Machine Learning (ICML), 2021, pp. 12589–12599.
  * Woodruff [2014] D. P. Woodruff, Sketching as a Tool for Numerical Linear Algebra, 2014.
  * Yang et al. [2021] X. Yang, Y. Feng, W. Fang, J. Shao, X. Tang, S.-T. Xia, R. Lu,  An Accuracy-Lossless Perturbation Method for Defending Privacy Attacks in Federated Learning,  CoRR abs/2002.09843 (2021).
  * Chen et al. [2020] C.-L. Chen, L. Golubchik, M. Paolieri,  Backdoor attacks on federated meta-learning,  CoRR abs/2006.07026 (2020).
  * Zhang et al. [2020] J. Zhang, D. Wu, C. Liu, B. Chen,  Defending poisoning attacks in federated learning via adversarial training method,  in: Frontiers in Cyber Security, Springer Singapore, 2020, pp. 83–94.
  * Zhu [2020] H. Zhu,  On the relationship between (secure) multi-party computation and (secure) federated learning,  CoRR abs/2008.02609 (2020).
  * Lindell [2017] Y. Lindell,  How to simulate it–a tutorial on the simulation proof technique,  Tutorials on the Foundations of Cryptography (2017) 277–346.
  * Goldreich [2001] O. Goldreich, The Foundations of Cryptography \- Volume 1, Basic Techniques., 2001.
  * Goldreich [2004] O. Goldreich, The Foundations of Cryptography \- Volume 2, Basic Applications., 2004.
  * Beimel [2011] A. Beimel,  Secret-sharing schemes: A survey,  in: International conference on coding and cryptology, 2011, pp. 11–46.
  * Goldreich and Oren [1994] O. Goldreich, Y. Oren,  Definitions and properties of zero-knowledge proof systems,  Journal of Cryptology 7 (1994) 1–32.
  * Bellare et al. [2012] M. Bellare, V. T. Hoang, P. Rogaway,  Foundations of garbled circuits,  in: Proceedings of the 2012 ACM conference on Computer and communications security, 2012, pp. 784–796.
  * Ma et al. [2021] J. Ma, S.-A. Naas, S. Sigg, X. Lyu,  Privacy-preserving Federated Learning based on Multi-key Homomorphic Encryption,  CoRR abs/2104.06824 (2021).
  * Jiang et al. [2021] Z. L. Jiang, H. Guo, Y. Pan, Y. Liu, X. Wang, J. Zhang,  Secure Neural Network in Federated Learning with Model Aggregation under Multiple Keys,  in: 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2021 7th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom), 2021, pp. 47–52.
  * Bonawitz et al. [2017] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, K. Seth,  Practical secure aggregation for privacy-preserving machine learning,  in: proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191.
  * Bonawitz et al. [2019] K. Bonawitz, F. Salehi, J. Konečnỳ, B. McMahan, M. Gruteser,  Federated learning with autotuned communication-efficient secure aggregation,  in: 2019 53rd Asilomar Conference on Signals, Systems, and Computers, 2019, pp. 1222–1226.
  * Meng et al. [2020] D. Meng, H. Li, F. Zhu, X. Li,  FedMONN: Meta Operation Neural Network for Secure Federated Aggregation,  in: 2020 IEEE 22nd International Conference on High Performance Computing and Communications; IEEE 18th International Conference on Smart City; IEEE 6th International Conference on Data Science and Systems (HPCC/SmartCity/DSS), 2020, pp. 579–584.
  * Kadhe et al. [2020] S. Kadhe, N. Rajaraman, O. O. Koyluoglu, K. Ramchandran,  Fastsecagg: Scalable secure aggregation for privacy-preserving federated learning,  CoRR abs/2009.11248 (2020).
  * Sandholm et al. [2021] T. Sandholm, S. Mukherjee, B. A. Huberman,  SAFE: Secure Aggregation with Failover and Encryption,  CoRR abs/2108.05475 (2021).
  * Truex et al. [2019] S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, Y. Zhou,  A hybrid approach to privacy-preserving federated learning,  in: Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, 2019, pp. 1–11.
  * Asad et al. [2020] M. Asad, A. Moustafa, T. Ito,  Fedopt: towards communication efficiency and privacy preservation in federated learning,  Applied Sciences 10 (2020) 2864.
  * Li et al. [2021] Y. Li, Y. Zhou, A. Jolfaei, D. Yu, G. Xu, X. Zheng,  Privacy-preserving federated learning framework based on chained secure multiparty computing,  IEEE Internet of Things Journal 8 (2021) 6178–6186.
  * Le et al. [2021] N. K. Le, Y. Liu, Q. M. Nguyen, Q. Liu, F. Liu, Q. Cai, S. Hirche,  Fedxgboost: Privacy-preserving xgboost for federated learning,  CoRR abs/2106.10662 (2021).
  * Li et al. [2020] Y. Li, T.-H. Chang, C.-Y. Chi,  Secure federated averaging algorithm with differential privacy,  in: 2020 IEEE 30th International Workshop on Machine Learning for Signal Processing (MLSP), 2020, pp. 1–6.
  * Sabater et al. [2020] C. Sabater, A. Bellet, J. Ramon,  Distributed differentially private averaging with improved utility and robustness to malicious parties,  CoRR abs/2006.07218 (2020).
  * Ghazi et al. [2019] B. Ghazi, R. Pagh, A. Velingker,  Scalable and differentially private distributed aggregation in the shuffled model,  CoRR abs/1906.08320 (2019).
  * Kairouz et al. [2021] P. Kairouz, Z. Liu, T. Steinke,  The distributed discrete gaussian mechanism for federated learning with secure aggregation,  CoRR abs/2102.06387 (2021).
  * Weng et al. [2019] J. Weng, J. Weng, J. Zhang, M. Li, Y. Zhang, W. Luo,  Deepchain: Auditable and privacy-preserving deep learning with blockchain-based incentive,  IEEE Transactions on Dependable and Secure Computing (2019).
  * Nguyen et al. [2021] D. C. Nguyen, M. Ding, Q.-V. Pham, P. N. Pathirana, L. B. Le, A. Seneviratne, J. Li, D. Niyato, H. V. Poor,  Federated learning meets blockchain in edge computing: Opportunities and challenges,  IEEE Internet of Things Journal (2021).
  * Li et al. [2020] X. Li, P. Jiang, T. Chen, X. Luo, Q. Wen,  A survey on the security of blockchain systems,  Future Generation Computer Systems 107 (2020) 841–853.
  * Wang et al. [2019] S. Wang, C. Wang, Q. Hu,  Corking by forking: Vulnerability analysis of blockchain,  in: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, 2019, pp. 829–837.
  * Zhang and Lee [2020] S. Zhang, J.-H. Lee,  Mitigations on sybil-based double-spend attacks in bitcoin,  IEEE Consumer Electronics Magazine (2020).
  * Qin et al. [2018] R. Qin, Y. Yuan, S. Wang, F.-Y. Wang,  Economic issues in bitcoin mining and blockchain research,  in: 2018 IEEE Intelligent Vehicles Symposium (IV), 2018, pp. 268–273.
  * LeCun et al. [1998] Y. LeCun, L. Bottou, Y. Bengio, P. Haffner,  Gradient-based learning applied to document recognition,  in: Proceedings of the IEEE, volume 86, 1998, pp. 2278–2324.
  * Cohen et al. [2017] G. Cohen, S. Afshar, J. Tapson, A. van Schaik,  Emnist: Extending mnist to handwritten letters,  in: International Joint Conference on Neural Networks (IJCNN), 2017, pp. 2921–2926.
  * Xiao et al. [2017] H. Xiao, K. Rasul, R. Vollgraf,  Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,  CoRR abs/1708.07747 (2017).
  * Torralba et al. [2008] A. Torralba, R. Fergus, W. T. Freeman,  80 million tiny images: A large data set for nonparametric object and scene recognition,  IEEE Transactions on Pattern Analysis and Machine Intelligence 30 (2008) 1958–1970.
  * Tan and Le [2019] M. Tan, Q. Le,  Efficientnet: Rethinking model scaling for convolutional neural networks,  in: International Conference on Machine Learning (ICML), 2019, pp. 6105–6114.
  * Yeom et al. [2018] S. Yeom, I. Giacomelli, M. Fredrikson, S. Jha,  Privacy risk in machine learning: Analyzing the connection to overfitting,  in: 2018 IEEE 31st Computer Security Foundations Symposium (CSF), 2018, pp. 268–282.
  * Wang et al. [2019] Y.-X. Wang, B. Balle, S. P. Kasiviswanathan,  Subsampled rényi differential privacy and analytical moments accountant,  in: The 22nd International Conference on Artificial Intelligence and Statistics, 2019, pp. 1226–1235.
  * Zhu and Jin [2020] H. Zhu, Y. Jin,  Multi-objective evolutionary federated learning,  IEEE Transactions on Neural Networks and Learning Systems 31 (2020) 1310–1322.
  * LeCun et al. [1989] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, L. D. Jackel,  Backpropagation applied to handwritten zip code recognition,  Neural computation 1 (1989) 541–551.
  * Wang et al. [2003] Z. Wang, E. P. Simoncelli, A. C. Bovik,  Multiscale structural similarity for image quality assessment,  in: The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003, volume 2, 2003, pp. 1398–1402.
  * Wan et al. [2013] L. Wan, M. Zeiler, S. Zhang, Y. L. Cun, R. Fergus,  Regularization of neural networks using dropconnect,  in: Proceedings of the 30th International Conference on Machine Learning(ICML - 13), 2013, pp. 1058–1066.
  * Novikov et al. [2015] A. Novikov, D. Podoprikhin, A. Osokin, D. P. Vetrov,  Tensorizing neural networks,  in: Advances in Neural Information Processing Systems, volume 28, 2015, pp. 442–450.
  * Tan and Le [2021] M. Tan, Q. Le,  Efficientnetv2: Smaller models and faster training,  in: Proceedings of the 38th International Conference on Machine Learning (ICML), volume 139, 2021, pp. 10096–10106.
  * Graham et al. [2021] B. Graham, A. El-Nouby, H. Touvron, P. Stock, A. Joulin, H. J’egou, M. Douze,  Levit: a vision transformer in convnet’s clothing for faster inference,  CoRR abs/2104.01136 (2021).
  * Lin et al. [2017] Y. Lin, S. Han, H. Mao, Y. Wang, W. J. Dally,  Deep gradient compression: Reducing the communication bandwidth for distributed training,  CoRR abs/1712.01887 (2017).
  * Pang et al. [2021] G. Pang, L. Cao, L. Chen,  Homophily outlier detection in non-iid categorical data,  Data Mining and Knowledge Discovery (2021) 1–62.
  * Yang et al. [2019] Q. Yang, Y. Liu, T. Chen, Y. Tong,  Federated machine learning: Concept and applications,  ACM Trans. Intell. Syst. Technol. 10 (2019).
  * Tan et al. [2021] A. Z. Tan, H. Yu, L. Cui, Q. Yang,  Towards personalized federated learning,  CoRR abs/2103.00710 (2021).
  * Ezzeldin et al. [2021] Y. H. Ezzeldin, S. Yan, C. He, E. Ferrara, S. Avestimehr,  Fairfed: Enabling group fairness in federated learning,  in: Workshop on New Frontiers in Federated Learning: Privacy, Fairness, Robustness, Personalization and Data Ownership (NeurIPS 2021), 2021.