# The role of disorder in the motion of chiral swimmers in the presence of
obstacles

Danne M. van Roon  Centro de Física Teórica e Computacional, Faculdade de
Ciências, Universidade de Lisboa, 1749-016 Lisboa, Portugal  Departamento de
Física, Faculdade de Ciências, Universidade de Lisboa, 1749-016 Lisboa,
Portugal  Giorgio Volpe  Department of Chemistry, University College London,
20 Gordon Street, London WC1H 0AJ, UK.  Margarida M. Telo da Gama  Centro de
Física Teórica e Computacional, Faculdade de Ciências, Universidade de Lisboa,
1749-016 Lisboa, Portugal  Departamento de Física, Faculdade de Ciências,
Universidade de Lisboa, 1749-016 Lisboa, Portugal  Nuno A. M. Araújo  Centro
de Física Teórica e Computacional, Faculdade de Ciências, Universidade de
Lisboa, 1749-016 Lisboa, Portugal  Departamento de Física, Faculdade de
Ciências, Universidade de Lisboa, 1749-016 Lisboa, Portugal

###### Abstract

The presence of obstacles is intuitively expected to hinder the diffusive
transport of micro-swimmers. However, for chiral micro-swimmers, a low density
of obstacles near a surface can enhance their diffusive behavior, due to the
rectification of the chiral motion by the obstacles. Here, we study
numerically the role that disorder plays in determining the transport dynamics
of chiral micro-swimmers on surfaces with obstacles. We consider different
densities of regularly spaced obstacles and distinct types of disorder: noise
in the dynamics of the micro-swimmer, quenched noise in the positions of the
obstacles as well as obstacle size polydispersity. We show that, depending on
the type and strength of the disorder, the presence of obstacles can either
enhance or hinder transport, and discuss implications for the control of
active transport in disordered media.

##  I Introduction

Figure 1: (a) Schematic depiction of an ‘ideal chiral swimmer’ and its
trajectory with orbit radius $R_{\textrm{o}}$. (b) Schematic depiction of four
obstacles in a square lattice with lattice periodicity $l_{\textrm{c}}$. (c)
Schematic depiction of the trajectory of a chiral swimmer with low dynamic
noise. (d) Lattice with quenched noise in the form of randomly perturbed
obstacle positions. The arrows denote the change in position of the obstacles
(dark blue circles) due to the positional quenched noise, relative to their
original lattice position marked by the immediately lighter shade of blue. The
lightest shade of blue marks the area from which a new position was chosen
randomly. (e) Lattice with quenched noise in the form of obstacle
polydispersity.

In the last two decades, active matter has become an increasingly important
focus of research. On small length scales, active matter describes micron-
sized entities such as motile cells and artificial micro-swimmers including
Janus particles and active droplets [1]. Typically a micro-swimmer is
represented as an active Brownian particle, or a particle undergoing run-and-
tumble dynamics [2]. Due to hydrodynamic interactions, several flagellated
swimmers, such as E. coli trace circular trajectories when swimming near a
substrate [3, 4, 5]. Significant progress has been made in capturing the
behavior of chiral micro-swimmers in homogeneous environments. Present tools
include agent based models and various stochastic descriptions [6, 7, 8, 9].

Biological and man-made micro-swimmers, however, rarely move in homogeneous
environments, but rather encounter heterogeneity, such as domain walls, pores
and obstacles [1]. To address this, recent research efforts have been directed
at understanding the underlying (bio)physical mechanisms of micro-swimmers in
heterogeneous environments [10]. From a fundamental perspective, this is
interesting to understand and optimise search strategies in realistic
environments [11]. From a practical perspective, such an understanding is
crucial to explain and control biomedically relevant processes, such as bio-
film formation. In addition, there remains signiﬁcant yet unexploited
potential to enable novel nanotechnological applications, including smart
self-propelled cargo carriers with uses in drug-delivery in tissue or
contamination removal in porous soil, among others [12, 13, 14, 15, 16].

A first approach to control the dynamics of micro-swimmers in heterogeneous
environments relies on designing the topography of the environment by
carefully placing obstacles or structures on a substrate. Another approach
would be to design a micro-swimmer that is able to navigate a complex
environment in a controlled manner[17]. This requires control over the
reorientation of the swimmer, which has to date been achieved only in a
limited number of cases [18, 19].

Experimental observations show that the topography of the environment can
strongly influence the dynamics of micro-swimmers, and in non-intuitive ways.
Recent evidence indicates that the presence of porous micro-structures
generally hinders the diffusive transport of micro-swimmers [20, 21].
Interestingly, for chiral micro-swimmers, contrasting phenomenology has also
been observed. For example, a significantly enhanced propagation on surfaces,
due to randomly placed obstacles, has been reported in theoretical studies in
[22, 23] and experimentally for E. coli in [24]. Furthermore, experiments
tracking E. coli navigating a colloidal crystal found that the colloids
rectified the trajectory of bacteria, resulting in enhanced transport [25, 26,
27, 28].

A common feature of natural and man-made heterogeneous environments at the
micro-scale is the presence of disorder or noise in the surface topography.
Disorder can occur in the form of spatial positioning and size of obstacles or
pores. Also the motion of micro-swimmers contains disorder in the
reorientation, typically in the form of flagellar noise or rotational Brownian
diffusion[18, 19, 29, 30].

In this article, we examine numerically the influence of disorder (from here
on referred to as ‘noise’) on the dynamics of chiral micro-swimmers exploring
a periodic arrangement of obstacles, where we introduce noise in a controlled
manner. We first consider a chiral swimmer that does not experience any
rotational Brownian diffusion in a periodic array of obstacles. Distinct types
of noise are then introduced independently: ‘dynamic noise’ determining the
reorientation of the swimmer and two types of ‘quenched noise’, the first
being disorder in the positions of the obstacles, and the second being
polydispersity in the sizes of the obstacles.

To quantify the effect of the different types of noise on the transport
properties of the swimmer, we computed its effective diffusion coefficient
(diffusivity) for a wide range of obstacle area fractions (densities) and
noise strengths. We find that the diffusivity of a chiral swimmer is strongly
non-monotonic for increasing density of obstacles. At lower densities, the
transport of a chiral swimmer is rectified due to the interaction of the
swimmer with the obstacles, affecting the swimming orbits, and allowing the
swimmer to explore space. At higher densities, the swimmer is unable to
perform chiral motion due to constant interactions with the obstacles and the
diffusivity is reduced until the conditions are right for the motion to be
channeled in the lattice. When the strength of dynamic noise is increased, the
diffusivity is enhanced for all but high densities, which we attribute to the
randomization of the chiral orbits. Moreover, the ability of the swimmer to
better explore space becomes less dependent on the obstacles. At high
densities, dynamic noise suppresses guided transport through channels.
Quenched noise introduces disorder in the spatial arrangement of the
obstacles, resulting in erratic motion, preempting fixed swimming orbits, and
perturbing guided motion through channels.

Figure 2: (a) Example trajectories (green) of the swimmer (red) navigating the
square lattice of obstacles (faint blue) for increasing densities. The blue
arrows indicate the direction of propagation of the ‘translating orbits’. (b)
Diffusivity $D$ vs. density of obstacles $\rho$ for the ‘ideal chiral swimmer’
and the ‘ideal straight swimmer’, which has been rescaled such that for
$\rho=0$, $D=40.0$. The inset displays the diffusivity vs. the lattice
periodicity $l_{\textrm{c}}$ normalized by the orbit radius $R_{\textrm{o}}$.
The dashed lines mark the densities for which diffusion occurs for the ‘ideal
chiral swimmer’.

##  II Model

We consider a spherically shaped chiral swimmer of diameter $\sigma$ (for E.
coli typically 1-2 $\mu$m) on a surface containing $N_{\textrm{o}}$ fixed
obstacles also of diameter $\sigma$. The amount of obstacles is expressed as
the percentage of the surface that is covered by the obstacles:
$\rho=\frac{\mathrm{N_{\textrm{o}}}\pi\sigma^{2}}{L^{2}}$ ($\times 100\%$),
with $L$ being the edge size of the square simulation box. Interactions
between the swimmer and the obstacles are defined by the Weeks-Chandler-
Anderson potential obtained by truncating a Lennard-Jones potential at its
minimum:

$V(r_{i})=\begin{cases}4\left[\left(\frac{\sigma}{r_{i}}\right)^{6}-\left(\frac{\sigma}{r_{i}}\right)^{12}\right]+1&\text{for:
$r_{i}<2^{\frac{1}{6}}\sigma$},\\\ 0&\text{for: $r_{i}\geq
2^{\frac{1}{6}}\sigma$},\\\ \end{cases}$ (1)

where $r_{i}$ is the distance between swimmer and obstacle $i$. The initial
position of the swimmer is randomly chosen in the box while guaranteeing that
it does not overlap with any obstacle. The trajectory of the swimmer is then
obtained by integrating the following equations:

$\begin{dcases}&\frac{{dx}}{dt}=v\cos{(\phi)}+F_{x},\\\
&\frac{dy}{dt}=v\sin{(\phi)}+F_{y},\\\
&\frac{d\phi}{dt}=\omega+\sqrt{2D_{\textrm{R}}}\>\xi_{\phi},\end{dcases}$ (2)

where $x,y$ denote the position of the swimmer, $v$ and $\phi$ are its
swimming speed and direction, and $F_{x}$ and $F_{y}$ are the $x$ and $y$
components of the force $\bf F=-\nabla$ $V$. The angular velocity $\omega$
results in periodic orbiting motion of the swimmer that is counterclockwise
for $\omega>0$ and $D_{\textrm{R}}$ defines the rotational diffusion constant.
The stochastic term $\xi_{\phi}$ represents independent white noise with zero
mean and unitary variance. The model reproduced well the experimental data for
E. coli in [24]. The time evolution of the position of the swimmer is obtained
with a second order Runge-Kutta scheme, to guarantee stability at high
obstacle densities. As a reference swimmer, we consider an ‘ideal chiral
swimmer’ with $v=3\sigma$ and $\omega=1$, representing a swimmer that moves in
perfect circles of radius $R_{\textrm{o}}=v/\omega=3\sigma$ when moving in a
homogeneous environment (no obstacles and $D_{\textrm{R}}=0$) as in Fig. 1
(a). As reference surface topography, we consider obstacles placed in a square
lattice arrangement (Fig. 1 b).

Two types of noise are then introduced independently: dynamic noise in the
dynamics of the swimmer ($D_{\textrm{R}}\neq 0$) (Fig. 1 c) and quenched noise
either in the positions of the obstacles (Fig. 1 d) or in the form of obstacle
size polydispersity (Fig. 1 e). For positional quenched noise, the strength is
set by $\xi_{\textrm{q}}$, which defines the radius of a circular disk
centered at the position of the obstacle; the perturbed obstacles are placed
at a new random position chosen uniformly in this disk. For the obstacle size
polydispersity, the size distribution follows a Gaussian with mean $\sigma$,
and dispersion $\sigma_{\textrm{s}}$. For each obstacle, the diameter $d$ is
drawn from the size distribution, if $d\leq 0$ a new diameter is drawn from
the distribution until a diameter $d>0$ is obtained.

In the following we will express distances in terms of the dimensionless
obstacle radius $\sigma/2$ and time in terms of $\sigma/v$. A simulation
typically includes $N_{\textrm{o}}=400$ obstacles. Finally, the step size in
the simulation is $\Delta t=10^{-4}$ and a simulation lasts for $t$ = 4800
$\sigma/v$.

Figure 3: Example trajectories as a function of the different types of noise,
for three increasing values of obstacle density: $(a)$ $\rho=9.5\%$, $(b)$
$\rho=15.0\%$ and $(c)$ $\rho=20.0\%$. The swimmer (red) traces a trajectory
(green) moving among the obstacles (faint blue). In the middle, in the
ellipsoid shape, the trajectory for the ‘ideal chiral swimmer’
($D_{\textrm{R}}=0$) in a square lattice, with no quenched noise, is shown as
reference. The axes indicate the three different noise types: the vertical
axis indicates the dynamic noise ($D_{\textrm{R}}$), the axis to the left the
positional quenched noise ($\xi$) for a swimmer with $D_{\textrm{0}}\equiv
D_{\textrm{R}}/v\sigma^{-1}=0.002$, and the axis to the right quenched noise
in the form of size polydispersity ($\sigma_{\textrm{s}}$).

##  III Results

To characterize the transport properties of the micro-swimmer, we computed the
mean square displacement:

$\text{MSD}(t)=\left\langle[R(t)-R(0)]^{2}\right\rangle,$ (3)

with $R(t)$ denoting the position of the swimmer at time $t$. The brackets
$\langle.\rangle$ indicate an ensemble average over 4000 swimmer trajectories,
each beginning at a position selected uniformly at random. For positional
quenched noise or size polydispersity, the average is performed over 100
obstacle configurations, with 40 swimmer trajectories per configuration. At
long times, the mean squared displacement is expected to scale with the
effective diffusion constant $D$ or diffusivity,

$\text{MSD}(t)\sim 4Dt,\quad t\rightarrow\infty.$ (4)

which we extracted through a linear regression in the interval
$3600\sigma/v<t<4800\sigma/v$. The diffusivity is measured for obstacle
densities ranging from $\rho=0\%$ representing a homogeneous environment (Fig.
2 (a) for $\rho=0\%$) to $\rho=21.0\%$, where the swimmer rapidly gets stuck
in between obstacles (caged) and is unable to explore space (Fig. 2 (a) for
$\rho=21.0\%$).

###  III.1 Ideal chiral swimmer

In the case of an ‘ideal chiral swimmer’ ($D_{\textrm{R}}=0$) in a homogeneous
environment (without obstacles), the swimmer moves in a circular orbit of
radius $R_{\textrm{o}}=3\sigma$. More interesting behaviour emerges for a
heterogeneous environment. A defining feature of the ‘ideal chiral swimmer’ is
that its space exploration is deterministic and a result of being scattered by
the obstacles. The spatial distribution of obstacles alone governs its
dynamics.

When an ‘ideal chiral swimmer’ navigates a square lattice, the swimmer
performs periodic orbits in between or around obstacles at most obstacle
densities and is limited to exploring a small part of the system (or
‘localized’), meaning that it does not perform long time diffusion. Example
trajectories of ‘localized’ swimmers are presented in Fig. 2 (a) for
$\rho=0\%$, $\rho=4.0\%$, $\rho=8.5\%$, $\rho=10.0\%$, $\rho=15.0\%$ and a
caged swimmer for $\rho=21.0\%$. For a small number of intermediate densities
the swimmer explores space, performing long time ‘diffusive’ behaviour.
Examples of diffusive behaviour are shown in Fig. 2 (a) for $\rho\approx
8.0\%$, $\rho\approx 9.5\%$, $\rho\approx 10.2\%$ and $20\%$. In Fig. 2 (b),
the diffusivity $D$ of the ‘ideal chiral swimmer’ vs. $\rho$, is presented.

The sharp peak in the diffusivity at $\rho=9.5\%$ is a consequence of space
exploration in the form of regular periodic motion. For densities around
$\rho=9.5\%$, the distance in between neighbouring obstacles (the lattice
periodicity, Fig. 1 b) $l_{\textrm{c}}$ approximates the radius of the
swimming orbit $R_{\textrm{o}}$ causing the swimmer to collide frequently with
the surrounding obstacles. Around density $\rho=9.5\%$, where
$R_{\textrm{o}}\approx l_{\textrm{c}}$ (Fig. 2 b), the swimmer collides with
an obstacle before it completes an orbit, and it is scattered forward towards
the next row of obstacles. This ‘translating orbit’ (a term we borrow from
Vizarim _et al._ [31], where a similar effect was observed for skyrmions) is
repeated for each row of obstacles, and results in the swimmer efficiently
traversing the system. In Fig. 2 (a), an example trajectory is presented for
$\rho=9.5\%$. The blue arrow indicates the direction of propagation of the
‘translating orbit’. At the two much smaller neighbouring peaks, for densities
$\rho=8.0\%$ (Fig. 2 a) and $\rho=10.2\%$ (Fig. 2 a), the swimmer is scattered
by the obstacles and traces mostly erratic trajectories with occasional laps
of periodic behaviour. For higher densities, at $\rho=20.0\%$, the swimmer is
unable to trace chiral trajectories due to constant interactions with the
closely spaced obstacles. Instead, it is guided through channels in the
lattice, a trajectory traces a ‘translating orbit’ as the ‘ideal chiral
swimmer’ moves through the lattice (Fig. 2 a). Efficient transport in the form
of ‘translating orbits’, resulting from a crowded topography, strongly
contrasts with the behaviour of ‘ideal straight swimmers’ (swimmers with
$D_{\textrm{R}}=0$ and $\omega=0$), for which increasing the obstacle density
monotonically hinders space exploration (Fig. 2 b).

###  III.2 Noise in the dynamics

When a chiral swimmer exhibits noisy dynamics ($D_{\textrm{R}}\neq 0$), the
circular trajectory is perturbed allowing the swimmer to explore space. For a
swimmer experiencing rotational diffusion with strength $D_{\textrm{R}}$,
$\tau_{\textrm{R}}=D_{\textrm{R}}^{-1}$ sets the typical time for the swimmer
to decorrelate from its initial direction of motion in free space.

Let us now consider a chiral swimmer moving through a square lattice of
obstacles. In Fig. 3 (a-c) some example swimmer trajectories are presented for
different densities of obstacles. The noise in the dynamics is represented by
the vertical axis ($D_{\textrm{R}}/v\sigma^{-1}$). In Fig. 4 (a) the
diffusivity is presented for different noise amplitudes $D_{\textrm{R}}$. The
dashed line indicates the diffusivity for the swimmer in a homogeneous
environment (without obstacles); by comparing the diffusivity for a given
noise strength to the homogeneous case $D(D_{\textrm{R}},\rho=0)$, we can
determine the effect of the obstacles on the diffusivity. When a diffusivity
curve dips below the dashed line, the presence of obstacles hinders diffusion.

For the smallest noise strength ($D_{\textrm{0}}\equiv
D_{\textrm{R}}/v\sigma^{-1}=0.002$), the diffusivity profile is clearly non-
monotonic with increasing obstacle density (Fig. 4 a). The noise perturbs the
localized orbits of the ‘ideal chiral swimmer’, resulting in diffusive
behaviour for all densities $\rho<20.5\%$. For higher densities, the swimmer
is caged by the obstacles and the diffusivity vanishes. A fine structure with
four peaks emerges, around densities $\rho=2.0\%$, $\rho=4.5\%$, $\rho=9.5\%$
and $\rho=20.0\%$. Less pronounced minima occur at $\rho=2.5\%$, $\rho=6.0\%$
and $\rho=15.0\%$. For densities $\rho<7.5\%$, the fine structure does not
qualitatively change the behaviour of the swimmer, only resulting in a small
enhancement or suppression of the diffusion. The fine structure is a result of
the chiral swimmer interacting with the periodic lattice, and disappears if
the lattice is sufficiently perturbed, which will be explored in depth in
paragraph III.3.

To understand the main features of the diffusivity (Fig. 4 a), we can look at
the number of orbits $n=\frac{\omega}{2\pi D_{\textrm{R}}}$ a swimmer
typically completes (in a homogeneous environment) before its orientation is
randomized by the dynamic noise, as suggested by [23]. For the small noise
strength ($D_{\textrm{R}}/v\sigma^{-1}=0.002$), we obtain $n=159$, implying
that the swimmer still largely traces a circular trajectory if it does not
interact with the obstacles. In this case, the increased diffusion can be
attributed to efficient scattering by obstacles, rectifying the swimming
orbits, and enhancing the swimmer’s diffusion. This mechanism dominates for
intermediate densities, especially around $\rho=9.5\%$ where the radius of the
swimming orbit $R_{\textrm{o}}$ approximates the spacing between obstacles
$l_{\textrm{c}}$, such that $l_{\textrm{c}}/R_{\textrm{o}}\approx 1$ (Fig. 4 a
inset). Some example trajectories are presented along the vertical axis
($D_{\textrm{R}}/v\sigma^{-1}$) in Fig. 3 (a.1-3). The suppression of the
diffusion for densities around $\rho=15.0\%$ results from the swimmer becoming
intermediately trapped in trajectories that orbit around a few obstacles. Due
to the interactions with the obstacles, the swimmer keeps moving in a fixed
orbit until, driven by dynamic noise, it hops (diffuses) to the next row of
obstacles. Similar orbits were also observed for the ‘ideal chiral swimmer’
for densities around $\rho=15.0\%$, but since the ‘ideal chiral swimmer’ does
not experience dynamic noise, it remains trapped indefinitely (Fig. 2 for
$\rho=15\%$). In Fig 3 (b.3), an example trajectory is presented of a swimmer
that hopped to a new orbit once. At higher densities the channels narrow
further; now a small deviation in the trajectory more readily results in the
swimmer hopping across rows, enhancing diffusion. Around density $\rho=20.0\%$
(the highest densities before caging occurs), the frequent interactions with
the closely spaced obstacles prevent the swimmer from moving in circular
orbits. Instead, the swimmer is guided through channels in the lattice, in an
erratic way, efficiently exploring space. In Fig. 3 (c.1-3) some example
trajectories of a swimmer with dynamic noise navigating a dense system with
$\rho=20.0\%$ are presented. For higher densities $\rho\geq 20.5\%$, the
swimmer is fully caged in the lattice.

Now that the general behaviour of a noisy chiral swimmer is outlined, we can
examine the effect of increasing the noise strength $D_{\textrm{R}}$ (Fig. 4
a). As a reference, we take the previous case of a swimmer with
$D_{\textrm{R}}=D_{\textrm{0}}$. For a small increase in the noise strength to
$D_{\textrm{R}}/v\sigma^{-1}=0.004$, and $n=80$, the behaviour is similar to
the reference case. When the noise is increased to
$D_{\textrm{R}}/v\sigma^{-1}=0.016$, we obtain $n=20$; now the presence of
obstacles enhances the diffusivity for all densities in a more uniform manner,
but still peaks around $\rho=9.5\%$, before flattening out. Limited
enhancement is observed for densities $\rho>15\%$ until it vanishes for
$\rho\geq 20.5\%$. In this case, the noise is too strong for the swimmer to
remain trapped in fixed periodic orbits for an extended period of time.
Instead, the swimmer moves across the lattice in an erratic way, along with
intermittent periods of orbiting around (multiple) obstacles (Fig. 3 (a-c.2)).
The diffusion of such erratic motion is not very sensitive to the density; the
diffusivity varies little for $\rho>15.0\%$, until it vanishes at
$\rho=20.5\%$ as the swimmer becomes caged by the obstacles.

For still larger noise strengths ($D_{\textrm{R}}/v\sigma^{-1}=0.040$ and
$D_{\textrm{R}}/v\sigma^{-1}=0.080$), the noise increasingly perturbs the
orbiting motion, the swimmer is markedly less chiral, typically only able to
perform $n=8$ orbits ($D_{\textrm{R}}/v\sigma^{-1}=0.040$) and $n=4$ orbits
($D_{\textrm{R}}/v\sigma^{-1}=0.080$) before its orientation is fully
decorrelated. In this case, the swimmer traces strongly erratic trajectories
for all densities, which are not very sensitive to the density. Some example
trajectories are presented in Fig. 3 (a-c.1) for
$D_{\textrm{R}}/v\sigma^{-1}=0.040$. Scattering by obstacles enhances
diffusion only marginally for low densities $\rho<9.5\%$
($D_{\textrm{R}}/v\sigma^{-1}=0.040$) and $\rho<3.0\%$
($D_{\textrm{R}}/v\sigma^{-1}=0.080$). Moreover, the diffusivity varies little
with the density for $\rho<9.5\%$ ($D_{\textrm{R}}/v\sigma^{-1}=0.040$) and
$\rho<3.0\%$ ($D_{\textrm{R}}/v\sigma^{-1}=0.080$). For higher densities,
similarly to the ‘straight swimmer’ (black curve in Fig. 4 a), a monotonic
decrease in diffusivity for increasing density is retrieved, vanishing for
$\rho\geq 20.5\%$ where the swimmer is caged in the lattice.

###  III.3 Randomness in the positions of the obstacles

When a chiral swimmer with $D_{\textrm{0}}$ explores a lattice with noise in
the positions of the obstacles, the diffusivity is markedly affected for large
strengths of noise. In Fig. 4 (b), the diffusivity is presented for different
amplitudes of the noise $\xi_{\textrm{q}}$, alongside the diffusivity of a
configuration with randomly placed non-overlapping obstacles. The largest
noise strength ($\xi_{\textrm{q}}/\sigma=1.00$) corresponds to configurations
where the contact between obstacles at density $\rho=20.0\%$ is still low,
with typically less than $10.0\%$ of the obstacles touching. In Fig. 3, noise
in the positions is represented by the left axis
($\xi/\sigma+D_{\textrm{0}}$).

For the smallest noise strength ($\xi_{\textrm{q}}/\sigma=0.05$), at low
densities ($\rho<7.0\%$), the fine structure is little affected. The
diffusivity profile is affected for high densities ($\rho>17.0\%$), with the
peak around $\rho=20.0\%$ being significantly suppressed and shifted towards
lower density values with respect to the ordered lattice
($\xi_{\textrm{q}}/\sigma=0)$. The shift in the position of the peak around
$\rho=20.0\%$ is a result of the obstacles guiding the swimmer through
(disordered) channels, leading to a small local maximum in the diffusivity for
densities around $\rho=19.5\%$. For higher densities, the randomness combined
with the densely spaced obstacles perturbs the channels, and introduces
significant backtracking of the trajectories, reducing the diffusivity when
compared to the ordered lattice (Fig. 3 (c.4)). At the highest densities
$\rho>19.5\%$, the obstacles are closely spaced; even a small perturbation of
the channels introduces bottlenecks a swimmer can not pass through, limiting
diffusion.

When the noise is increased to $\xi_{\textrm{q}}/\sigma=0.25$, the peak is
shifted towards lower densities, channels are randomized further and
bottlenecks occur at lower densities. Now, the disordered obstacles preempt
the swimmer from getting trapped for long in intermittently stable orbits
around a number of obstacles, as observed in the ordered lattice for densities
around $\rho=15.0\%$ (Fig. 3 (b.4) and for the ‘ideal chiral swimmer’ 2 a).
The swimmer is scattered randomly and diffuses more efficiently (Fig. 3
(b.5)), reducing the depth of the local minimum in the diffusivity. As the
lattice perturbation is increased, bottlenecks occur at lower densities
($\rho>18.0\%$). An example trajectory is presented in Fig. 3 (c.5).

For large amplitudes of positional noise ($\xi_{\textrm{q}}/\sigma=0.50$ and
$\xi_{\textrm{q}}/\sigma=1.00$), with the average random displacement
comparable to the obstacle size, the lattice is strongly perturbed. This
results in a smoothing out of the fine structure of the diffusivity profile
for all densities. In the limit of large positional quenched noise, a random
topography is retrieved, and the diffusivity exhibits a single flattened peak,
centered around $\rho=10.0\%$ (black curve in Fig. 4 b). Due to the positional
disorder, the distance between obstacles becomes irregular. This leads to
suppression of the diffusion for densities around $\rho=9.5\%$, as the
disordered arrangement preempts regular motion where the swimmer moves from
one row of obstacles to another, instead it is scattered randomly. As the
lattice is further perturbed, this effect becomes increasingly pronounced
(Fig. 3 (a.4-6)). Even for a fully random arrangement, the diffusion is
enhanced for densities $\rho<17.0\%$, indicating that for all but high
densities of randomly placed obstacles, the rectification of swimming orbits
by obstacles leads to enhanced diffusion. For large amplitudes of positional
noise (and the random configuration), and increasing densities $\rho>17.0\%$,
the strongly disordered and densely packed arrangements increasingly contain
pockets of obstacles that trap the swimmer, limiting diffusion. A trajectory
of a swimmer in a strongly disordered lattice that ultimately becomes trapped
in a fixed orbit is displayed in Fig. 3 (c.6).

###  III.4 Non-uniform size distribution

For a non-uniform obstacle size distribution, $\sigma_{\textrm{s}}$ sets the
strength of the obstacle size polydispersity. In Fig. 4 (c), the diffusivity
is presented for different $\sigma_{\textrm{s}}$. Here the limit of large
polydispersity ($\sigma_{\textrm{s}}/\sigma=0.50$) corresponds to
configurations with about $20.0\%$ of obstacles, typically the largest,
touching at density $\rho=20.0\%$. The right axis in Fig. 3 represents the
size polydispersity ($\sigma_{\textrm{s}}/\sigma+D_{\textrm{0}}$).

When navigating a surface with polydisperse obstacles, the diffusivity profile
for a swimmer with $D_{\textrm{0}}$ is affected similarly to the system with
positional quenched noise. For the smallest polydispersity
($\sigma_{\textrm{s}}/\sigma=0.05$), at densities $\rho<17.0\%$, the fine
structure is little affected, as the swimmer traverses the system in an
erratic way (Fig. 3(a.7) provides an example for $\rho=9.5\%$). For higher
densities $\rho>17.0\%$, similar to the positional noise, the shift in the
position of the peak around $\rho=20.0\%$ is a result of the obstacles guiding
the swimmer through channels of irregularly sized obstacles (similar to Fig. 3
(c.7)). This leads to a local maximum in the diffusivity for densities around
$\rho=19.0\%$. For still higher densities bottlenecks and pockets form that
trap the swimmer. When the polydispersity is increased slightly to
$\sigma_{\textrm{s}}/\sigma=0.10$, the effect of intermittent trapping in
orbits for densities around $\rho=15.0\%$ is reduced (Fig. 3 (b.8)) and the
peak is smeared out and shifted to lower densities.

For polydispersity $\sigma_{\textrm{s}}/\sigma=0.25$, the fine structure is
smoothed out for $\rho>12.0\%$ as the swimmer explores the system efficiently
tracing erratic trajectories, until it increasingly becomes trapped for
$\rho>18.0\%$ and the diffusivity vanishes (Fig. 3 (c.8)). When the
polydispersity is increased to $\sigma_{\textrm{s}}/\sigma=0.50$, the fine
structure is smoothed out for all densities, the peak around $\rho=9.5\%$ is
shifted to slightly lower densities and is reduced as the trajectories are
randomized and periods of intermittent trapping in orbits occur (Fig. 3(a.9)).
The shifting of the peak can be explained by the larger total surface covered
by the obstacles due to the size polydispersity (what is gained by the
obstacles that increase in size is not offset by what is lost by the obstacles
that become smaller). For $\sigma_{\textrm{s}}/\sigma=0.50$ the diffusivity is
suppressed relatively to $\sigma_{\textrm{s}}/\sigma=0.25$, for almost all
densities. This is a result of some of the obstacles becoming increasingly
larger; for $\rho>8.0\%$ the large obstacles form clusters that trap the
swimmer, as well as walls that subdivide the system and prevent the swimmer
from accessing parts of it. For $\rho>15.0\%$, the diffusivity vanishes
rapidly as the swimmer becomes caged in pockets of obstacles. In Fig.
3(a-c.9), some example trajectories are displayed for noise amplitudes
$\sigma_{\textrm{s}}/\sigma=0.50$. When the polydispersity is further
increased ($\sigma_{\textrm{s}}/\sigma>0.50$), some obstacles become much
larger than the swimmer; in this limit swimmer-obstacle interactions become
more important, and our simplified model is no longer expected to accurately
capture the dynamics [32, 33].

Figure 4: Diffusivity $D$ vs. density of obstacles: (a) for different dynamic
noise amplitudes $D_{\textrm{R}}$, (b) with
$D_{\textrm{R}}/v\sigma^{-1}=D_{\textrm{0}}=0.002$ for different lattice
perturbation amplitudes $\xi_{\textrm{q}}$, (c) with
$D_{\textrm{R}}/v\sigma^{-1}=D_{\textrm{0}}=0.002$ for different amplitudes of
size polydispersity $\sigma_{\textrm{s}}$. The inset displays the diffusivity
vs. the lattice periodicity $l_{\textrm{c}}$ for the obstacles, for a non
perturbed lattice, normalized by the orbit radius $R_{\textrm{o}}$. The dashed
lines indicate the diffusivity for a system without obstacles, and serve as a
guide for the eye. The straight swimmer in (a) represents a swimmer with with
velocity $v=3\sigma/s$, $\omega=0$ and $D_{\textrm{0}}$, and has been rescaled
such that, for $\rho=0$, it matches the curve with
$D_{\textrm{R}}/v\sigma^{-1}=0.080$. The random system in (b) represents a
regular chiral swimmer with $D_{\textrm{0}}$, in a system with randomly placed
non overlapping obstacles.

##  IV Conclusions

We have investigated the dynamics of a chiral micro-swimmer on a surface with
obstacles. Different densities of obstacles as a fraction of the surface area
were considered. We introduced distinct types of disorder: noise in the
dynamics of the swimmer and noise in the positions of the obstacles, as well
as obstacle size polydispersity.

A noiseless chiral swimmer in an environment without obstacles gets trapped in
circular orbits and does not explore space. When navigating an array of
regularly spaced obstacles, for most densities, space exploration of a chiral
swimmer is limited to fixed swimming orbits. Efficient long time transport, in
the form of a ‘translating orbit’, occurs when the distance between the
obstacles approximates the orbit radius of the swimmer, or the spacing between
the obstacles approximates the size of the swimmer. Less efficient long time
transport occurs for a few densities, with the swimmer tracing an erratic
trajectory.

A chiral swimmer that experiences dynamic noise performs long time transport
for all densities, except for very high densities when it becomes trapped by
the obstacles. The presence of low to intermediate densities of obstacles
enhances the transport of a chiral swimmer, by rectifying swimming orbits.
Especially when the distance between the obstacles approximates the radius of
the swimmer orbit, this effect is pronounced. For higher densities, obstacles
can enhance transport by guiding the swimmer through open channels in the
lattice.

When the strength of the dynamic noise is increased, the chiral trajectories
are more strongly perturbed. This reduces the tendency of the swimmer to swim
in circles, enhancing transport for all densities, and reducing the effect of
scattering by obstacles on the transport. For large noise amplitudes, the
swimmer is effectively no longer chiral. In this case, the presence of
obstacles hinders transport, which is in agreement with previously published
results for non-chiral swimmers [20, 21].

Positional noise and obstacle size polydispersity result in a disordered
environment, which enhances transport by preempting fixed swimming orbits in
between or around obstacles. Additionally, scattering of the swimmer by the
disordered obstacles results in erratic motion. For densities where the inter-
obstacle distance approximates the radius of the swimmer orbit, such motion
perturbs the otherwise efficient rectification of swimming orbits, and
suppresses transport.

For high densities, quenched noise perturbs channels, limiting, and
suppressing transport. For high densities and large quenched positional
disorder or size polydispersity, pockets of obstacles form that trap the
swimmer, strongly hindering transport. In the limit of large positional noise,
the presence of a low or intermediate density of obstacles enhances transport.
When the obstacle size polydispersity is increased, the dynamics is
increasingly hindered by a few very large obstacles that form pockets that
trap the swimmer, inhibiting long term transport. Moreover, when the obstacles
are much larger than the swimmers, often the swimmers tend to move along the
boundary of the obstacles, and in this limit our model might no longer be
accurate [32, 33]. To describe the dynamics of such systems, a model that
explicitly incorporates a boundary following interaction, where a swimmer is
guided along the boundary of an obstacle upon contact, such as in [22, 23],
should be more realistic.

An interesting extension of this work would be to investigate the effect of
spatial arrangement and disorder on the dynamics of interacting chiral micro-
swimmers. Previous work encountered motility induced phase separation,
commensuration effects and frustrated states for a simple model of interacting
non-chiral swimmers in a similar square lattice of obstacles [34]. Another
possibility would be to consider dynamic obstacles. The bronchus in the lungs
are lined with respiratory cilia: microscopic, periodically beating hairs that
clear inhaled debris and microbes from the conducting airways [35]. By
introducing a periodic motion in the obstacles, the dynamics governing the
transport of (chiral) microbes in the cilia could be explored. Although this
work is limited to surface topography, extending it to three dimensions would
also be interesting. Recently a geometric criterion for the optimal transport
of run and tumble polymers in a porous medium was uncovered, which emerges
when their run lengths are comparable to the longest straight path available
in the porous medium [28]. From a very different perspective, simulation
studies of circular ac driven skyrmions on a square lattice of obstacles
encountered behaviours similar to our findings for the ‘ideal circle
swimmer’[31]. It could be interesting to see how such systems respond to
noise. In addition to a fundamental understanding of bacterial dynamics near
surfaces and interfaces as well as of search strategies and optimal navigation
in complex environments, this work can be employed to guide the design
microstructured surfaces that can control and prevent bacterial adhesion.

## Acknowledgements

We acknowledge financial support by the European Commissions Horizon 2020
research and innovation program under the Marie Sklodowska-Curie Grant
Agreement No. 812780 and from the Portuguese Foundation for Science and
Technology (FCT) under Contracts no. PTDC/FIS-MAC/28146/2017 (LISBOA-
01-0145-FEDER-028146), UIDB/00618/2020, and UIDP/00618/2020.

## References

  * Bechinger _et al._ [2016] C. Bechinger, R. Di Leonardo, H. Löwen, C. Reichhardt, G. Volpe and G. Volpe, _Reviews of Modern Physics_ , 2016, 88, 045006.
  * Ramaswamy [2010] S. Ramaswamy, _Annual Review of Condensed Matter Physics_ , 2010, 1, 323–345.
  * Lauga _et al._ [2006] E. Lauga, W. R. DiLuzio, G. M. Whitesides and H. A. Stone, _Biophysical Journal_ , 2006, 90, 400–412.
  * Bukatin _et al._ [2015] A. Bukatin, I. Kukhtevich, N. Stoop, J. Dunkel and V. Kantsler, _Proceedings of the National Academy of Sciences_ , 2015, 112, 15904–15909.
  * Utada _et al._ [2014] A. S. Utada, R. R. Bennett, J. C. N. Fong, M. L. Gibiansky, F. H. Yildiz, R. Golestanian and G. Wong, _Nature Communications_ , 2014, 5, 4913\.
  * Caprini and Marini Bettolo Marconi [2019] L. Caprini and U. Marini Bettolo Marconi, _Soft Matter_ , 2019, 15, 2627–2637.
  * van Teeffelen _et al._ [2009] S. van Teeffelen, U. Zimmermann and H. Löwen, _Soft Matter_ , 2009, 5, 4510–4519.
  * Sevilla [2016] F. J. Sevilla, _Physical Review Letters E_ , 2016, 94, 062120\.
  * van Teeffelen and Löwen [2008] S. van Teeffelen and H. Löwen, _Physical Review Letters E_ , 2008, 78, 020101.
  * Araújo _et al._ [2022] N. A. M. Araújo, L. M. C. Janssen, T. Barois, G. Boffetta, I. Cohen, A. Corbetta, O. Dauchot, M. Dijkstra, W. M. Durham, A. Dussutour, S. Garnier, H. Gelderblom, R. Golestanian, L. Isa, G. H. Koenderink, H. Löwen, R. Metzler, M. Polin, C. P. Royall, A. Šarić, A. Sengupta, C. Sykes, V. Trianni, I. Tuval, N. Vogel, J. M. Yeomans, I. Zuriguel, A. Marin and G. Volpe, _Steering self-organisation through confinement_ , 2022, https://arxiv.org/abs/2204.10059.
  * Volpe and Volpe [2017] G. Volpe and G. Volpe, _Proceedings of the National Academy of Sciences_ , 2017, 114, 11350–11355.
  * Li _et al._ [2017] J. Li, B. E. de Avila, W. Gao, L. Zhang and J. Wang, _Science Robotics_ , 2017, 2, eaam6431.
  * Gao and Wang [2014] W. Gao and J. Wang, _ACS nano_ , 2014, 8, 3170–3180.
  * Zhang _et al._ [2021] J. Zhang, Z. Chen, R. K. Kankala, S.-B. Wang and A.-Z. Chen, _International Journal of Pharmaceutics_ , 2021, 596, 120275\.
  * Erkoc _et al._ [2018] P. Erkoc, I. C. Yasa, H. Ceylan, O. Yasa, Y. Alapan and M. Sitti, _Advanced Therapeutics_ , 2018, 2, 1800064.
  * Adadevoh _et al._ [2016] J. S. Adadevoh, S. C. Triolo, C. A. Ramsburg and R. M. Ford, _Environmental science & technology_, 2016, 50 1, 181–7.
  * Volpe _et al._ [2011] G. Volpe, I. Buttinoni, D. Vogt, H.-J. Kümmerer and C. Bechinger, _Soft Matter_ , 2011, 7, 8810–8815.
  * Mano _et al._ [2017] T. Mano, J.-B. Delfau, J. Iwasawa and M. Sano, _Proceedings of the National Academy of Sciences_ , 2017, 114, E2580–E2589.
  * Fernandez-Rodriguez _et al._ [2020] M. A. Fernandez-Rodriguez, F. Grillo, L. Alvarez, M. Rathlef, I. Buttinoni, G. Volpe and L. Isa, _Nature Communications_ , 2020, 11, 4223\.
  * Dehkharghani _et al._ [2022] A. Dehkharghani, N. Waisbord and J. S. Guasto, _Self-transport of swimming bacteria is impaired by porous microstructure_ , 2022.
  * Zeitz _et al._ [2017] M. Zeitz, K. Wolff and H. Stark, _The European Physical Journal E_ , 2017, 40, 1–10.
  * Chepizhko and Franosch [2019] O. Chepizhko and T. Franosch, _Soft Matter_ , 2019, 15, 452–461.
  * Chepizhko and Franosch [2020] O. Chepizhko and T. Franosch, _New Journal of Physics_ , 2020, 22, 073022\.
  * Makarchuk _et al._ [2019] S. Makarchuk, V. Braz, N. Araujo, L. Ciric and G. Volpe, _Nature Communications_ , 2019, 10, 4110.
  * Brown _et al._ [2016] A. T. Brown, I. D. Vladescu, A. Dawson, T. Vissers, J. Schwarz-Linek, J. S. Lintuvuori and W. C. K. Poon, _Soft Matter_ , 2016, 12, 131–140.
  * Weber _et al._ [2019] A. Weber, M. Bahrs, Z. Alirezaeizanjani, X. Zhang, C. Beta and V. Zaburdaev, _Frontiers in Physics_ , 2019, 7, 148.
  * Brun-Cosme-Bruny _et al._ [2019] M. Brun-Cosme-Bruny, E. Bertin, B. Coasne, P. Peyla and S. Rafaï, _The Journal of Chemical Physics_ , 2019, 150, 104901.
  * Kurzthaler _et al._ [2021] C. Kurzthaler, S. Mandal, T. Bhattacharjee, H. Löwen, S. Dattaf and H. Stone, _Nature Communications_ , 2021, 12, 7088.
  * Clausznitzer and Endres [2011] D. Clausznitzer and R. Endres, _BMC systems biology_ , 2011, 5, 151\.
  * Polin _et al._ [2009] M. Polin, I. Tuval, K. Drescher, J. P. Gollub and R. E. Goldstein, _Science_ , 2009, 325, 487–490.
  * Vizarim _et al._ [2020] N. P. Vizarim, C. J. O. Reichhardt, P. A. Venegas and C. Reichhardt, _Journal of Physics Communications_ , 2020, 4, 085001.
  * Takagi _et al._ [2014] D. Takagi, J. Palacci, A. Braunschweig, M. Shelley and J. Zhang, _Soft Matter_ , 2014, 10, 1784–1789.
  * Spagnolie _et al._ [2015] S. E. Spagnolie, G. R. Moreno-Flores, D. Bartolo and E. Lauga, _Soft Matter_ , 2015, 11, 3396–3411.
  * Reichhardt and Reichhardt [2021] C. Reichhardt and C. J. O. Reichhardt, _Physical Review Letters E_ , 2021, 103, 022602.
  * Crystal _et al._ [2008] R. G. Crystal, S. H. Randell, J. F. Engelhardt, J. Voynow and M. E. Sunday, _Proceedings of the American Thoracic Society_ , 2008, 5, 772—777.


# Poisoning Attacks and Defenses in Federated Learning: A Survey

Subhash Sagar, Chang-Tsun Li, Seng W. Loke, and Jinho Choi All the authors are
with the School of Information Technology, Deakin University, Geelong,
Australia
E-mail<EMAIL_ADDRESS>
###### Abstract

Federated learning (FL) enables the training of models among distributed
clients without compromising the privacy of training datasets, while the
invisibility of clients’ datasets and the training process poses a variety of
security threats. This survey provides the taxonomy of poisoning attacks and
experimental evaluation to discuss the need for robust FL.

###### Index Terms:

Federated Learning, poisoning attacks, distributed machine learning

##  1 Introduction

Recent advances in distributed machine learning, in particular, federated
learning (FL) [1] have paved the way for the next generation of data-driven
intelligent applications. FL has emerged as a promising solution to a number
of applications to solve data silos while protecting the privacy of data.
Since its emergence, FL has been employed in a variety of applications
including but not limited to healthcare, crowdsourcing systems, natural
language processing (NLP), and the Internet of Things (IoT). The primary
notion of FL is to generate a collaborative global training model without
sharing the actual data distributed over several participating clients. In FL,
the participating clients first train local models as well as the shared
global model with local data and then send the local updates to the central
server in order to update the global model. In this way, the privacy of the
client’s data is protected from unauthorized access.

Similar to machine learning, FL is susceptible to several adversarial attacks
since both the data and the local training process are controlled by clients.
A few common attacks are inference attacks (targeting the privacy of clients)
and poisoning attacks (targeting the training data or model) [2]. In poisoning
attacks, attackers aim to poison the local training data by injecting the
poisoned instances in the training data (i.e., _data poisoning attacks
(DPA)_), or directly manipulating the weights of the model updates (i.e.,
_model poisoning attacks (MPA)_). In essence, the main objective of poisoning
attacks is to instigate the global model to predict the attacker-specific
outputs on the poisoned inputs, and it is presumed that the main factor of
poisoning attacks is the count of malicious clients and the poisoned data.
Furthermore, Steinhardt et al. [3] suggested that a $3\%$ ratio of malicious
clients can reduce the accuracy of the main task by $11\%$. Therefore, it is
imperative to study the current state-of-the-art poisoning attacks and defense
strategies to mitigate these attacks.

As of late, a plethora of research has been published in order to
comprehensively discuss and understand the notion of FL and its use cases in
the real world. Most recently, researchers have been exploring the security
and privacy threats that limit the exploitation of FL [2] [4]. A comprehensive
discussion of FL threats is presented in [4] in terms of a taxonomy of attacks
and defense methods. The authors also conducted an experimental evaluation in
order to draw a conclusion on how to select the suitable method in each
category of adversarial attacks. Furthermore, a brief overview of threats to
FL is discussed in [2] and focuses on poisoning and inference attacks in order
to comprehend the model behavior in presence of these attacks.

The generalization of state-of-the-art into various categories is the core of
the surveys on security and privacy in FL that have emerged in recent years
[2] [4]. The discussed studies’ pros and cons with regard to evaluation
criteria, including but not limited to the adaptability of attacks these
studies can handle, their effectiveness in the presence of backdoor attacks,
their use in real-world applications, and their impact on benign clients, are
not taken into account by the current literature. In order to get over the
aforementioned limitations, this survey presents the most recent state-of-the-
art attacks and defense strategies suggested for FL. Additionally, this study
lists the advantages and disadvantages of the attacks and defense strategies
in relation to a variety of assessment criteria as well as via experimental
evaluation. Finally, we have concluded the study by highlighting potential
future research directions.

##  2 Preliminaries

###  2.1 Federated Learning

The notion of FL was first introduced by Google and is characterized as a
distributed machine learning (ML) paradigm to collaboratively train a global
ML model on datasets that are distributed across a number of clients (e.g.,
mobile devices) while protecting the privacy of clients [1]. In essence, there
are two different types of parties in FL, i.e., a number of clients and a
central server/cloud, wherein each client maintains a local model trained on
the local dataset. In contrast, the central server maintains a global model,
which is the aggregation of locally trained models.

In general, FL employs the stochastic gradient descent (SGD) to minimize a
loss function and the models are updated iteratively (due to the use of SGD).
In each iteration, there are three stages as follows: (1) selection of
clients; (2) local model updates; and (3) aggregation by the central server.
In particular, firstly, the central server selects a number of clients and
shares the current global model. Secondly, each client retrains the current
global model on the local dataset and sends the latest local model back to the
central server. Finally, the central server aggregates all the local models in
order to obtain the latest global model and such aggregation schemes include
mean aggregation, byzantine-robust aggregation, etc [4].

###  2.2 Poisoning Attacks

The term ‘poisoning attack’ in FL refers to an attack that involves attackers
intentionally tampering with the training data or model parameters to
manipulate the model aggregation in order to disrupt the integrity and
availability of the global learning model. In FL, because the participants’
data and the training processes are invisible to the central server, poisoning
attacks might be easy to carry out by some clients.

Poisoning attacks can be divided into two types, i.e., DPA and MPA, or can be
divided into targeted and untargeted attacks [4]. We have considered the
division in terms of data and poisoning attacks and a taxonomy of these
attacks is illustrated in Figure 1(a). The location of poisoning attacks may
vary and it can be on the client’s side, communication channel, or sometimes
on the central server. Nevertheless, the common poisoning attacks usually take
place on the client side (i.e., modifying the data, models, or both) as
illustrated in Figure 1(b).

####  2.2.1 Data Poisoning Attacks

In DPA, it is presumed that the attackers have access to the training data of
at least one client and are able to alter it. DPA can be further classified in
terms of the characteristic of the poisoning, and we have categorized them
into the following types of attacks.

_Label-Flipping Attacks:_ In this type of attack, adversaries with access to
the training data alter the labels of a portion of the data (e.g., flipping
label $4$ to $1$, or vice versa) while preserving the remaining content in
order to manipulate the FL models. Label flipping can be either targeted
(i.e., flipping the targeted label) or untargeted (i.e., random flipping) [5].

_Poisoning Sample Attacks:_ In this type of DPA, the attackers modify a
portion of training data, i.e., by inserting modified patterns in data samples
or adding unification noise. Recent studies suggest the use of generative
adversarial nets to generate positioned patterns in order to maximize targeted
attacks and evade defense approaches [5].

_Backdoor Attacks:_ The idea of backdoor attacks is to degrade the performance
of a subtask while preserving the performance of the main task. These attacks
inject triggers into the training data of one or more clients’ to poison the
global model. Since these attacks do not affect the overall performance, it is
difficult to mitigate. In essence, backdoor attacks do not pose threats to the
FL’s main task. However, the integrity and the infrastructure of FL are
vulnerable and can be considered a security threat as the prediction of test
samples can be controlled by attackers [6][7].

_Untargeted Attacks:_ The untargeted attacks aim at disrupting the performance
of the FL model. One of the well-known scenarios is the _byzantine attack_ ,
wherein an adversary shares a randomly generated model trained over modified
training data. The untargeted attacks can be further divided into the
following two types, namely _disruption untargeted_ and _exploitation
untargeted_ [4]. With disruption untargeted attacks, the attackers corrupt the
FL model in order to disrupt the convergence of the training process. With
exploitation untargeted attacks, the attackers utilize the poisoning attacks
in order to exploit the FL framework for malicious purposes by mimicking as a
benign client .

(a) Taxonomy of Poisoning Attacks in Federated Learning

(b) Illustration of Poisoning Attacks in Federated Learning

Figure 1: Taxonomy and illustration of poisoning attacks

####  2.2.2 Model Poisoning Attacks

MPA aims to manipulate the training processes of the local FL models by
directly poisoning the model updates sent by the clients to the central
server. Furthermore, DPA can be considered to be a subset of MPA as they
eventually lead to MPA, and in general, MPA attempts to directly modify local
model weights. A number of variants fall under the category of model poisoning
and are discussed as follows.

_Gradient Manipulation:_ These types of attacks [8] are based on generating
random weights having a similar dimension as that of the original model
weights. These random weights are then employed to manipulate the local model
gradient and compromise the global model.

_Optimization Methods:_ Optimization methods [9] are utilized to maximize the
performance of poisoning attacks, specifically, backdoor attacks, wherein the
optimization helps in minimizing the difference between the original and the
poisoned model from the last round in order to make it difficult for the
attacks to be mitigated. Hence, the attackers force the main model to output
the attacker-specified labels.

_Untargeted Attacks:_ The untargeted attacks are to lower the main task
accuracy of the global model [10]. Moreover, the attackers in these types of
attacks quantify the original local model updates, and then alter their
genuine local model updates so that the tainted global model updates
significantly diverge from the original ones. In essence, these attacks aim at
limiting the availability of the global model.

##  3 Poisoning Attacks and Defense Strategies

This section discusses existing state-of-the-art for poisoning attacks and
defense strategies in FL.

###  3.1 Attacks Strategies

In FL, poisoning attacks work by corrupting the data of one or more clients or
the locally trained models in an effort to interfere with the global model.
For DPA, it is assumed that the attacker has the access to the data of at
least one client and the capacity to alter it, wherein the poisoned data is an
amalgam of cleaned (original labels) and modified data. Furthermore, the MPA
directly poison the local model updates sent by the participating clients to
the global server by modifying the weights of the local models.

With the assumption that the FL participants may change the raw data on their
devices, the authors of [5] proposed a DPA model in terms of label flipping
attacks. Under this assumption, a complex neural network model is employed to
investigate the FL application in the presence of label-flipping attacks.
Furthermore, the efficacy of the attacks is shown with respect to varying
percentages of malevolent participants using two well-known image datasets,
_CIFAR-10_ and _Fashion-MNIST_. It can be observed that the attack is
effective even with a small ratio of malicious participants and can also be
targeted, i.e., having more impact on a subset of targeted data labels.

Xie et al. suggested a distributed backdoor attack, called DBA [6], which
employed a composite global trigger to perform the attacks as opposed to the
straightforward label-flipping attack [5] carried out by several attackers.
The local models are trained on a poisoned dataset after each adversary picks
a unique local trigger to poison the training dataset. The server then
receives the updates from the attackers for model aggregation. The attackers
employ the local triggers to create a global trigger at the inference step
rather than using them directly. It is demonstrated that the global trigger
has the highest attack success rate of any local trigger, even if it never
appears in the training phase.

Furthermore, [7] theoretically demonstrated that backdoor attacks are
inevitable in the presence of adversarial samples in FL and intuitively
proposed a new family of backdoor attacks, known as edge-case backdoor to
manipulate the model on the input resides on the tail of the distribution.
Therefore, this makes it difficult for the defense strategies to detect such
attacks as the attacker’s access is restricted to developing an untrained
feature map instead of a fully trained model.

In [8], the vulnerability of FL towards a MPA is discussed. The MPA can be
performed by using model replacement, wherein one or more malicious clients
attempt to replace a benign model with a malicious one, leading the model to
misclassify future inputs. Moreover, the study discusses the countermeasures
and concludes that the attackers can easily bypass such measures. The main
idea of FL is to take advantage of the diversity of the clients in terms of
non-iid training data, including uncommon or low-quality data. However, using
secure aggregation by the central server to filter out anomalous contributions
runs counter to this idea.

In contrast to [8], Bhagoji et al. proposed [11] to carry out the attack even
when the global model is not yet converged. They specifically nurture the
malicious updates for $lambda$ times to counteract the benefits of benign
clients. Two stealth metrics that the server might examine were suggested. The
first is that the server may determine whether the attacker’s update aids in
model training, i.e., enhances the performance of the overall model. The
server may also examine if the submitted update differs from earlier updates,
which is the second possibility. They then improved the loss function based on
those two covert metrics to prevent anomaly identification in order to
increase the attack’s robustness. Finally, the effectiveness of the model is
evaluated with a number of assumptions (single-shot, repeated, and pixel-
pattern attack). It was observed that the model can achieve $100\%$ accuracy
on an attacker’s task in just a single training round.

TABLE I: Comparison of Attacks Strategies Literature |  Attacks Type |  Training Set Type |  Adaptive Attacks |  Backdoor Attacks |  Application
---|---|---|---|---|---
[5] |  Data Poisoning |  iid |  No |  No |  Image Classification
[6] |  Data Poisoning |  Non-iid |  No |  Yes |  Image Classification
[7] |  Data Poisoning |  iid |  Yes |  Yes |  Image Classification, Text Prediction and Sentiment Analysis
[8] |  Model Poisoning |  Non-iid |  Yes |  Yes |  Image Classification and Word Prediction
[11] |  Model Poisoning |  iid |  Yes |  Yes |  Image Classification and Census Income Prediction
[9] |  Model Poisoning |  Non-iid |  Yes |  Yes |  Image Classification and Breast Cancer Detection
Attack Types | Training Set Types | Adaptive Attacks
Data Poisoning | iid | Yes
Model Poisoning | Non-iid | No
Backdoor Attacks | Target Application
Yes | Yes
No | No Specific Application

###  3.2 Defense Approaches

A number of defense strategies are present in the literature, this study
divides the state-of-the-art into three defense types, namely _anomaly
detection_ , _robust aggregation_ , and _perturbation mechanism_.

Anomaly Detection: In general, anomaly detection is understood as the
identification of rare events or observations significantly different from the
notion of well-defined data or activities. A defense algorithm to mitigate the
label-flipping attacks is proposed in [5], wherein the aggregator employs an
array to store the subset of parameters from the final layers of the deep
neural network (DNN) architecture in each round. The list of stored parameters
is then fed into principle component analysis to cluster into honest and
malicious participants and accordingly limit the participation of malicious
clients in model training. Similarly, A two-phase defense mechanism, known as
LoMar is proposed in [12], wherein the kernel density approximation is
employed in order to score the local model update over the neighbouring
update. The measured score is utilized to cluster participants with similar
characteristics and then employ an outlier detection technique to mitigate the
poisoning attack.

Robust Aggregation: Aggregation mechanisms are utilized to mitigate poisoning
attacks during the training phase in contrast to anomaly detection, and a few
robust aggregation mechanisms are Krum, mean, trimmed mean, etc. Furthermore,
most of these methodologies assume the iid data, therefore, fail to mitigate
against current poisoning attacks for non-iid scenarios.

A feedback-based defense strategy, known as _BaFFle_ , is put forward in [13]
to eliminate the backdoored model updates. _BaFFle_ employs each participant
to validate the global model for each round of FL by quantifying the
validation function with their own private data to report whether the model is
backdoored or not to the central server. The validation function compares the
misclassification rate of a distinct class with the previous global model.
Then, the central server utilizes the feedback via the validation function to
decide whether to accept or reject the global model update based on the
misclassification rate.

The discussed defense strategies work fine in the presence of a small number
of malicious participants. The performance of these strategies degrades with
an increase in malicious participants. Zhang et al. [10] proposed the
malicious client detection algorithm, named _FLDetector_ , wherein the idea is
to detect the malicious participants and eliminate them from the global model
updates. In _FLDetector_ , the central server predicts the participants’ model
updates in each iteration based on historical updates and flags the
participant as malicious if there is an inconsistency between the current
update and the predicted one in multiple iterations. The performance
evaluation illustrates promising results when compared with the current state-
of-the-art. Nevertheless, the impact of eliminating the malicious participants
on the main task accuracy is not discussed.

Perturbation Mechanism: The perturbation mechanism in mathematics represents a
method of solving a problem by comparing it with the known solution. One of
the well-known perturbation mechanisms is differential privacy, which has been
extensively employed in FL to improve the performance of outlier detection. A
low-complexity defense approach is proposed in [14] in order to mitigate the
backdoored model updates via weight clipping and noise injection. However,
this approach fails to mitigate the untargeted backdoored attacks that do not
rely on model weight modification. In essence, the weight clipping method may
negatively influence the change in the weights of benign participants’ model
updates. Most recently, to overcome the limitation of current differential
privacy-based strategies that deteriorate the performance of benign
participants, a novel technique, called (_FLAME_) [15], is proposed. _FLAME_
estimates the amount of noise to be injected to mitigate the targeted
poisoning attacks with minimal impact on benign participants. This technique
employs the clustering and weight-clipping methods to eliminate outliers in
the participants’ updates and then the estimated noise is added to obtained
parameters to mitigate possible attacks. The experimental evaluation
demonstrates that _FLAME_ is effective in defending against poisoning attacks
when compared with the state-of-the-art. However, it requires extensive
modification in the current FL framework.

(a) Model Accuracy - DPA

(b) Attack Success Rate - DPA

(c) Model Accuracy - MPA

(d) Attack Success Rate - MPA

Figure 2: Poisoning Attacks - Model Accuracy and Attack Success Rate on
CIFAR-10 w.r.t. varying malicious clients for DPA and varying iterations for
MPA

##  4 Analysis and Evaluation

This section presents the analysis and performance evaluation of poisoning
attacks and the defense strategies.

###  4.1 Comparison and Evaluation of Attack Strategies

Firstly, we compare attack strategies with the following fours characteristics
(Table I)

_Training Set Types:_ FL is devised to employ clients’ data while protecting
the privacy, and there are two types of data in general, i.e., independent and
identically distributed (iid) and non-independent and identically distributed
(non-iid). Here, iid data samples are statistically identical and drawn from
the same probability distribution, wherein each data sample is seen as an
independent event, while non-iid data samples are not statistically identical
and include complexities beyond iid, including but not limited to
relationships, heterogeneity, dynamic data over time, sampling, etc. In
general, most of the real-life datasets are non-iid. However, the current
notion of analytics and machine learning methods often are based on the
assumption that datasets are iid. Therefore, it is imperative to assess the
proposed solutions on training set type in terms of their suitability for
real-world applications.

As can be seen in Table I, the majority of the attack strategies utilize iid
datasets for DPA (except [6]) in order to distinguish between the benign and
malicious updates [5] [7]. In contrast, the majority of MPA use datasets that
are non-iid, making them beneficial in real-life FL environments.

_Adaptive Attacks:_ An adaptive attack represents the variation in the attack
scenario of the attacker, e.g., each round, an attacker modifies its
strategies to attack the data or model by learning the defense strategies of
the FL system. A number of state-of-the-art attack approaches consider
adaptive attacks [7][8][9] to disrupt the functionality of federated learning
systems via poisoning attacks (i.e., data and model) from the intelligent
malicious clients.

_Backdoor Attacks:_ A backdoor attack aims to mislead the model to perform
abnormally on data samples stamped with a backdoor trigger to misclassify
specific target labels in terms of targeted backdoor but behave normally on
all other samples. Moreover, the untargeted backdoor attacks aim to degrade
the overall accuracy of the global model [4]. The majority of the studies
discussed in this research consider the backdoor attacks to mislead the
backdoor model by injecting local triggers to poison the model (except [5])

_Application:_ It is also imperative to identify the practicality of the
proposed attacks model in terms of a specific application in order to devise
the conclusion on the suitability of the current state-of-the-art. As can be
seen from the table that most of the proposed attack strategies focus on
poisoning attacks on image classification.

The experimental evaluation in terms of overall model accuracy (MA) and attack
success rate (ASR) is carried out for a few selected attacks models
[5][6][8][11] as depicted in Figure 2 for both DPA and MPA. MA measures the
model accuracy on benign samples, whereas, ASR represents the probability
(success rate) of attacks in misclassifying the target labels.

We have trained the global model on CIFAR-10 for attack scenarios and MNIST
for defense strategies with a total of 100 participants and considered the
common simulation scenarios among all the compared models. For DPA, we train
the global model with a varying number of malicious participants. For the MPA,
the global model is trained with a varying number of iterations with a
poisoning rate of $10\%$.

The results for DPA are shown in Figure 2a and 2b. It can be seen that [6] can
achieve higher ASR (Figure 2(a)) than [5] and also maintains high MA (Figure
2(b)). The reason for lower ASR and lower MA for [5] is the use of complex
CIFAR-10 datasets and the increase in the malicious ratio. Moreover, the
results for MPA are depicted in Figure 2c and 2d. It can be seen that the ASR
for [8] decreases with an increase in the iterations as the benign
participants dilute the impact of backdoor. However, the ASR and MA of [11]
remains stable with the iterations.

In general, the current studies are well-suited to poisoning attack scenarios
with the fixed assumption. Nevertheless, the predefined conditions in the
state-of-the-art attack strategies may not be suitable for real-world
applications with dynamic characteristics.

TABLE II: Comparison of Defense Strategies Literature |  Defense Type |  Attack Type |  Defense Target |  Training Time Defenses |  Secure Aggregation |  Effect on Benign Clients
---|---|---|---|---|---|---
[5] |  Anomaly Detection |  Data Poisoning |  Label Flipping |  Yes |  No |  No
[12] |  Anomaly Detection |  Data Poisoning |  Label Flipping |  Yes |  No |  No
[13] |  Robust Aggregation |  Model Poisoning |  Backdoor Attacks |  No |  Yes |  No
[10] |  Robust Aggregation |  Model Poisoning |  Untargeted Attacks |  Yes |  Yes |  Yes
[14] |  Perturbation Mechanism |  Model Poisoning |  Backdoor Attacks |  Yes |  Yes |  Yes
[15] |  Perturbation Mechanism |  Model Poisoning |  Backdoor Attacks |  Yes |  No |  No
Defense Types | Attack Type | Defense Target
Anomaly Detection | Data Poisoning | Label Flipping
Perturbation Mechanism | Model Poisoning | Backdoor Attacks
Robust Aggregation | - | Untargeted Attacks
Training Type Defenses | Secure Aggregation | Influence on Benign Clients
Yes | Yes | Yes
Yes | Np | No

###  4.2 Comparison and Evaluation of Defense Strategies

Table II illustrates the comparison of defense strategies by employing a
number of aspects discussed below.

_Defense Types:_ A variety of defense strategies are suggested to lessen the
effects of poisoning attacks and it is imperative to compare the effectiveness
of each of these strategies since they each have merits and drawbacks. The
defense strategies described in the literature have generally been grouped
into three categories: _anomaly detection_ , _perturbation mechanism_ , and
_robust aggregation_. In essence, the literature uses either the robust
aggregation or perturbation method for the MPA [10][15][13], but the defensive
strategies for DPA include anomaly detection as the defense type to mitigate
these attacks [5] [12].

_Defense Target:_ This parameter compares the existing literature in terms of
types of targeted attacks mitigated by the current state-of-the-art (e.g.,
label-flipping attacks, backdoor attacks, untargeted attacks, etc). The label-
flipping attack is the common DPA mitigated by the present state-of-the-art
[5][12], and in contrast, backdoor attacks and untargeted attacks are the
defense target for the MPA [10][15][13].

_Training Time Defense:_ Most of the proposed solutions are effective in
mitigating poisoning attacks during the training time period as the global
model does not have access to client’s data, therefore, the submitted local
model is evaluated in terms of its reliability. However, a few studies
consider applying the defense strategies on the model submitted by the clients
after training [13]. In these studies, the defender prunes the dormant neurons
after the training step via the submitted pruning sequence from the client.

_Secure Aggregation:_ In order to prevent the inspection of confidential model
updates, a number of FL works suggest utilizing secure multi-party computation
(MPC). MPC is a subbranch of cryptography, wherein the goal is to create a
method for multiple parties to jointly compute a function over their inputs
while preserving privacy. Thus, the comparison of current studies in terms of
compatibility with secure aggregation is essential. Most of the FL systems
employ MPC to secure submitted confidential models from the clients. However,
a few defense strategies [5][15] rely on detecting the local model updates and
are not compatible with secure aggregation.

_Effect on Benign Clients:_ It is essential for the defense strategies to not
only detect malicious clients but also have minimal effect on benign clients.
A number of studies have a negative effect on benign clients. For example, the
authors in [10] utilize the suspicious score by comparing the predicted and
updated model to detect malicious clients. This score can cause ill-effect on
benign clients if the score is closer to the boundary of the suspicious score.
The performance of the benign clients is impacted by the differential privacy
mechanism in [14] because the clipping factor will alter the benign updates.

In Figure 3, we have compared the four defense strategies studied in
[5][12][13][10] in terms of MA with respect to varying percentages of
malicious participants the number of iterations for DPA and MPA, respectively.
As depicted in Figure 3(a), the MA for [5] decreases as the number of
malicious participants increases, and maintains the accuracy of around $80\%$.
Nevertheless, the accuracy of [12] remains stable with an average MA of
$85\%$. Furthermore, the MA for defense strategies for MPA increases as the
number of iterations increases for both [10] and [13]. Nonetheless, the
convergence time in terms of defense mechanism for [10] is better than [13].

As a whole, the current research on defense strategies for poisoning attacks
is well-defined for the specific scenarios. However, intelligent malicious
clients can still learn the behaviour of these defense strategies and poison
the FL systems.

(a) Defense Against DPA

(b) Defense Against MPA

Figure 3: Model Accuracy w.r.t. varying percentage of Malicious Clients and
Number of Iterations

##  5 Future Research Directions

As the notion of the FL paradigm has been widely explored in recent years,
adversarial attacks and defenses for FL are also investigated. Nevertheless,
there are still numerous research challenges that need the attention of
researchers. We have identified a number of such research challenges in this
section.

Firstly, the mathematical formulation for different types of poisoning attacks
is not lacking. For example, in data poisoning, the label-flipping attack
depends on the number of malicious clients in the data and it is not
deterministic (i.e., no mathematical exposition of this phenomenon).
Furthermore, most of the attack strategies are inclined towards data with
similar feature space, and different samples. However, the behaviour of these
attacks will vary with data having different feature space (i.e., vertical FL)
as the label information is usually hidden in this type of FL. In general,
proposing the mathematical exposition of attacks and designing attack
strategies suitable for vertical FL are potential research directions.

Secondly, defense strategies proposed in the literature somehow have
vulnerabilities that can be transformed into another adversarial attack,
hence, the study of these vulnerabilities and the solutions to mitigate such
attacks is imperative and challenging. Furthermore, most defense strategies
have trade-offs between attack prevention and the overall performance of the
original task. For example, a solution based on differential privacy tends to
add noise in order to preserve privacy, which however impairs the performance
of the global model. In addition, the client filtering-based defense solutions
sometimes lead to filtering out more clients and thus, losing a large portion
of data for the aggregation process. In general, it is imperative to consider
an optimal defense strategy that can filter out all the attacks while
maintaining the original task’s performance. The solution must not compromise
the privacy of the clients while preventing adversarial attacks.

Thirdly, the importance of the types of training set cannot be understated
since it is difficult to distinguish between malicious and benign clients with
various data samples that are important for the learning process in the case
of non-iid distribution of data. Employing an anomaly detection algorithm
suitable for non-iid distribution or those that do not rely on data
distribution is the typical solution to these situations. Nevertheless, it is
a problem that requires attention because the methods mentioned above still
struggle to identify malicious clients in situations with highly skewed data
distribution.

Finally, keeping track of adversaries is one of the key challenges since
clients in the FL system are free to leave and rejoin the FL system at any
moment during the training process. As a result, it is critical for the FL
system to keep track of malicious clients that leave and then rejoin the
system. However, existing research works do not offer any suggestions for a
fix. One of the potential solutions to this issue is to employ either smart
contracts or credibility evaluation mechanisms in multiple rounds to identify
the reputation of clients in order to keep the adversaries traceable.

##  6 Conclusion

The emergence of FL is one of the challenging and interesting research
directions in the field of machine learning because of in light of rigorous
laws for protecting the privacy of participating clients. Nevertheless, the
novel concept of FL leads to new challenges due to the invisibility of client-
side training data in terms of adversarial attacks, and the poisoning attack
is one of such attacks. Recent years have seen an increase in the literature
on poisoning attacks and defense strategies to mitigate these attacks. This
paper presents a comprehensive summary of current poisoning attacks and
defense strategies for FL. Furthermore, we perform a comparative analysis of
the state-of-the-art for both poisoning attack and defense in various aspects.
Additionally, the results of experimental evaluations are presented for
quantitative comparisons. Finally, we conclude that the study of FL threats is
ongoing by pointing out the challenges and future research direction.

## References

  * [1] Jakub Konečný and Brendan McMahan and Daniel Ramage, “Federated Optimization: Distributed Optimization Beyond the Datacenter,” _CoRR_ , vol. abs/1511.03575, 2015. [Online]. Available: http://arxiv.org/abs/1511.03575
  * [2] Jere, Malhar S. and Farnan, Tyler and Koushanfar, Farinaz, “A Taxonomy of Attacks on Federated Learning,” _IEEE Security & Privacy_, vol. 19, no. 2, pp. 20–28, 2021.
  * [3] J. Steinhardt, P. W. Koh, and P. Liang, “Certified Defenses for Data Poisoning Attacks,” in _Proceedings of the 31st International Conference on Neural Information Processing Systems_ , 2017, p. 3520–3532.
  * [4] N. Rodríguez-Barroso, D. Jiménez-López, M. V. Luzón, F. Herrera, and E. Martínez-Cámara, “Survey on federated Learning Threats: Concepts, Taxonomy on Attacks and Defences, Experimental Study and Challenges,” _Information Fusion_ , vol. 90, pp. 148–173, 2023.
  * [5] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data Poisoning Attacks Against Federated Learning Systems,” in _Computer Security – ESORICS 2020_. Cham: Springer International Publishing, 2020, pp. 480–501.
  * [6] C. Xie, K. Huang, P.-Y. Chen, and B. Li, “DBA: Distributed Backdoor Attacks against Federated Learning,” in _International Conference on Learning Representations_ , 2020.
  * [7] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the Tails: Yes, You Really Can Backdoor Federated Learning,” in _Advances in Neural Information Processing Systems_ , vol. 33. Curran Associates, Inc., 2020, pp. 16 070–16 084.
  * [8] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How To Backdoor Federated Learning,” in _Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics_ , ser. Proceedings of Machine Learning Research, vol. 108. PMLR, 26–28 Aug 2020, pp. 2938–2948.
  * [9] M. Fang, X. Cao, J. Jia, and N. Z. Gong, “Local Model Poisoning Attacks to Byzantine-Robust Federated Learning,” in _29th USENIX Security Symposium (USENIX Security 2020)_. USA: USENIX Association, 2020.
  * [10] Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients,” in _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_ , New York, NY, USA, 2022, p. 2545–2555.
  * [11] A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 634–643.
  * [12] X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, and Y. Liu, “LoMar: A Local Defense Against Poisoning Attack on Federated Learning,” _IEEE Transactions on Dependable and Secure Computing_ , no. 01, pp. 1–1, dec 2022.
  * [13] S. Andreina, G. A. Marson, H. Möllering, and G. Karame, “BaFFLe: Backdoor Detection via Feedback-based Federated Learning,” in _2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS)_ , 2021, pp. 852–863.
  * [14] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can You Really Backdoor Federated Learning?” _arXiv preprint arXiv:1911.07963_ , 2019.
  * [15] T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. Möllering, H. Fereidooni, S. Marchal, M. Miettinen, A. Mirhoseini, S. Zeitouni, F. Koushanfar, A.-R. Sadeghi, and T. Schneider, “FLAME: Taming Backdoors in Federated Learning,” in _31st USENIX Security Symposium (USENIX Security 22)_ , Boston, MA, Aug. 2022, pp. 1415–1432.