the security of IoT devices and networks. Mothukuri et al. [94] proposed a
decentralized, federated learning approach to enable anomaly detection on
Internet of Things (IoT) networks. This approach enables on-device training,
eliminating the need to transfer network data to a centralized server and
ensuring optimal results in predicting intrusion in IoT networks. The proposed
approach utilizes long short-term memory (LSTM) and gated recurrent units
(GRUs) neural network models to train the machine learning model on the Modbus
network data set. The article also provides an overview of LSTM and GRU
networks, architecture, and real-time implementations. The proposed approach
is beneficial in securing data privacy at end devices, achieving optimal
results, and being computationally inexpensive.

###  V-C GAN-based solution

Generative Adversarial Networks (GANs) [160] have been applied successfully in
various fields, including computer vision and natural language processing. In
recent years, researchers have started exploring their use in IoT security.
One potential application of GAN-based solutions is to generate realistic
attack scenarios and create diverse datasets for training security models.
GANs can also generate synthetic data that mimics real-world sensor data. This
can be used to detect anomalies and prevent security breaches. Furthermore,
GANs can generate adversarial examples to test the robustness of IoT security
systems. Cui et al. [95] presented an approach for decentralized and
asynchronous Federated Learning (FL) for Internet of Things (IoT) anomaly
detection. The proposed approach uses a modified Generative Adversarial
Network (GAN) model called DP-GAN, which has an additional perceptron, the DP
identifier (DPI), to generate differential noise, while approximating the raw
data to a better degree. The proposed method also integrates blockchain to
achieve global aggregation and improve system reliability. The paper
demonstrates the effectiveness of the proposed approach in terms of accuracy,
privacy protection, and efficient convergence, as shown by the experiments on
benchmark datasets.

###  V-D Fixed-point quantization method-based solution

Fixed-point quantization is a method used in digital signal processing to
reduce numerical data’s storage requirements and computational complexity. In
IoT security, this technique can reduce the amount of data transmitted over
the network, minimizing the risk of data leakage and unauthorized access. Xu
et al. [96] proposes Federated Learning with Minimum Square Quantization Error
(FedMSQE), an approach to address the challenges of deploying popular neural
network models on Internet of Medical Things (IoMT) devices. The paper focuses
on the security of neural network model transmission and reducing the network
scale. The proposed method uses fixed-point quantization with stochastic
rounding to achieve a minor quantization error for each client in the FL
setting. The authors demonstrate through numerical experiments that their
proposed algorithm achieves higher accuracy and lower quantization error than
other quantization methods and can be applied to any deep neural network on
any single device. FedMSQE improves the security of FL and reduces the
transmission cost while maintaining high accuracy.

###  V-E Deep Learning-based solution

By analyzing large datasets of IoT device behavior and network traffic, deep
learning algorithms can detect patterns and anomalies that may indicate
malicious activity [161]. Friha et al. [97] proposed FELIDS, a federated IDS
based on deep learning for mitigating cyberattacks on agricultural IoT
infrastructures. The authors identify gaps in the literature, including
outdated or contextually inappropriate datasets, privacy issues for
centralized models, and limited threat models that only address a subset of
the attack vectors. FELIDS uses three deep learning classifiers - DNNs, CNNs,
and RNNs - and evaluates their performance using three recent real-world
traffic datasets. The paper provides a detailed performance evaluation and
comparative analysis between FELIDS, the centralized machine learning model,
and state-of-the-art works. The paper uses three recent real-world traffic
datasets, namely: CSE-CIC-IDS2018, MQTTset, and InSDN, to evaluate the
performance of each classifier.

###  V-F Homomorphic encryption-based solution

Homomorphic encryption [162] can protect the algorithms and models used in IoT
applications, preventing attackers from reverse engineering or tampering with
these crucial components. Gao et al. [98] proposed a Homomorphic encryption-
based solution, named SVeriFL, that provides a solution to the privacy and
security challenges in federated learning, ensuring data integrity and
correctness of uploaded parameters and aggregated results. It also allows for
consistency verification among multiple participants. The scheme employs a
dynamic successive verification mechanism, running throughout the FL training
process without impacting the original FL performance. The security analysis
and experiments demonstrate the effectiveness of the proposed system with
moderate computational cost.

###  V-G Blockchain and smart contracts-based solution

Integrating blockchain and smart contracts can offer a robust and
decentralized solution for IoT security [163]. By leveraging blockchain
technology, data transactions can be recorded and verified by a distributed
network of nodes, ensuring that data integrity is maintained and tampering is
prevented. Ouyang et al. [99] introduced a privacy framework for FL based on
blockchain and smart contracts. The framework offers complete privacy services
for off-chain federations that want to use on-chain FL. The proposed framework
is implemented and analyzed based on two prevalent blockchain projects,
Ethereum and inter-plenary file systems (IPFS). The experiments show that the
framework has acceptable collaboration costs and has advantages in privacy,
security, and decentralization. Additionally, the framework can enable
automatic on-chain identification and autonomous FL of machine clusters of IoT
devices or distributed participants. Baucas et al. [103] proposes a fog-based
IoT platform that uses federated learning and blockchain technology to address
the challenges of preserving patient data privacy and improving the security
of wearable IoT devices. The platform enforces decentralized servers and
resource reallocation to enhance adaptability and sustainability. Federated
learning preserves patient data privacy, while blockchain technology provides
access control and a cryptographic structure to improve security. The
platform’s testbed effectively simulates and evaluates the proposed
implementation, and the model accuracy shows the platform’s ability to
preserve the integrity of a predictive service.

###  V-H Dynamic Weighted Aggregation-based solution

The dynamic Weighted Aggregation-based solution is a promising approach for
addressing the security challenges associated with IoT. This solution
integrates multiple security measures and assigns weights to each mechanism
based on their importance and effectiveness in a given context. The weights
are then dynamically adjusted based on the changing security environment and
the behavior of IoT devices. Li et al. [101] introduces DAFL, a dynamic
weighted aggregation federated learning system for intrusion detection. The
proposed approach reduces the effect of poorly performing local models on the
global model during training, which improves the global model’s performance in
intrusion detection and reduces communication overhead. The paper presents the
system design and key implementation details of DAFL and evaluates its
performance against existing approaches. The experimental results demonstrate
that DAFL achieves better detection performance with lower communication
overhead. Still, the proposed system does not consider other factors such as
device security or physical attacks.

###  V-I Software-defined networking

Software-defined networking (SDN) can offer a robust solution for addressing
the security risks associated with IoT [164]. SDN-based security solutions
allow for fine-grained access control and enforcement policies, protecting IoT
devices and networks from unauthorized access. Abou El Houda et al. [104]
proposes a framework called MiTFed that enables multiple SDN domains to
collaboratively build a global intrusion detection model using FL, blockchain,
and SDN technologies. The framework achieves high accuracy and efficiency in
detecting new and emerging security threats while preserving the privacy of
collaborators, making it a promising solution to address security threats in
large-scale distributed networks. Further research is needed to assess the
scalability of the proposed framework and address potential performance issues
due to the use of blockchain technology. The dataset used in the performance
evaluation is outdated.

Figure 8: Datasets used for machine learning security implementations and
evaluations TABLE XII: Datasets used as a benchmark experiment in the
evaluation of Machine learning vulnerabilities

Datasets | Attack category | Attack type | Machine learning | Learning mode | Targeted ML | Systems
---|---|---|---|---|---|---
Edge-IIoTset dataset | Sybil attacks | Miscellaneous | LPA | Centralized | Attack classification | [165]
Sybil attacks | Miscellaneous | LightGBM, BiLSTM | Centralized | Attack classification | [166]
Reuters-21578 dataset | Backdoor attack | RNN backdoor attacks | RNN | Centralized | Text classification | [167]
KDDCup dataset | Sybil attacks | Sybil-based poisoning attack | SofT | Distributed | Attack classification | [168]
Poisoning attacks | Federated poisoning attack | SqueezeNet | Federated | Attack classification | [169]
CIFAR-10 dataset | Backdoor attack | Imperceptible backdoor pattern | DNN | Centralized | Image classification | [170]
Poisoning attacks | Clean-label poisoning attack | ResNet and VGG-16 | Centralized | Image classification | [171]
Poisoning attacks | Clean-label poisoning attack | Deep k-NN | Transfer | Image classification | [172]
Poisoning attacks | Federated poisoning attack | ResNet | Federated | Image classification | [173]
Poisoning attacks | Federated poisoning attack | ResNet-18 | Federated | Image classification | [174]
MNIST dataset | Backdoor attack | Distributed backdoor attack | LeNet5 | Centralized | Image classification | [175]
Poisoning attacks | Poisonous label attack | CNN | Centralized | Image classification | [176]
Poisoning attacks | Federated poisoning attack | MLP | Federated | Image classification | [177]
Poisoning attacks | Federated poisoning attack | CNN | Distributed | Image classification | [178]
Sybil attacks | Sybil-based poisoning attack | SofT | Distributed | Image classification | [168]
Poisoning attacks | Federated poisoning attack | LetNet | Federated | Image classification | [173]
Caltech-101 dataset | Synergetic attack | Synergetic attack | ResNet | Centralized | Image classification | [179]
UCR archive | Adversarial attack | blue-box adversarial attack | FCN and ResNet | Centralized | Time series classification | [180]
HARUS Dataset | Poisoning attacks | Federated poisoning attack | FML | Federated | HAR | [181]
CASIA dataset | Poisoning attacks | Generative poisoning attack | FaceNet | Centralized | Face recognition | [182]
TON_IoT dataset | Poisoning attacks | Federated poisoning attack | KNN, LR, RF | Federated | Attack classification | [183]
VGGFace2 dataset | Sybil attacks | Sybil-based poisoning attack | SqueezeNet | Distributed | Face recognition | [168]
LibriSpeech dataset | Adversarial attack | blue-box adversarial attack | DNN | Centralized | Speech Recognition | [184]
Fashion-MNIST | Byzantine attacks | Local model poisoning attack | ResNet20 | Federated | Image classification | [185]
Poisoning attacks | Federated poisoning attack | CNN | Federated | Image classification | [186]
Sybil attacks | Sybil-based collusion attack | CNN | Federated | Image classification | [187]
Dropping Attack | Targeted dropping attack | CNN | Federated | Image classification | [188]
AG’s news dataset | Adversarial attack | White-box adversarial attack | CharCNN-LSTM | Centralized | Text classification | [189]
NSL-KDD dataset | Adversarial attack | White-box adversarial attack | DNN | Centralized | Attack classification | [190]
Parkinson Dataset | Poisoning attacks | Federated poisoning attack | FML | Federated | HAR | [181]
FEMNIST dataset | Poisoning attacks | Federated poisoning attack | DNN | Federated | Image classification | [191]
Poisoning attacks | Federated poisoning attack | N/A | Federated | Image classification | [13]
CICIDS2018 dataset | Poisoning attacks | Clean label attack | CNN-FL | Federated | Attack classification | [192]
IMDB dataset | Poisoning attacks | Federated poisoning attack | SVM | Federated | Sentiment classification | [193]
Poisoning attacks | Label flipping attack | BiLSTM | Federated | Sentiment classification | [194]
AT&T dataset | Poisoning attacks | Federated poisoning attack | CNN | Federated | Face recognition | [195]
GPS trajectory dataset | Poisoning attacks | Data aggregation attack | N/A | Federated | Travel mode detection | [196]
Osteoporotic Fracture | Poisoning attacks | Data poisoning attack | DNN | Centralized | Multivariate numerical | [197]
LFW dataset | Poisoning attacks | Generative poisoning attack | FaceNet | Centralized | Face recognition | [182]
ImageNet10 dataset | Backdoor attacks | Clean label backdoor attack | DNN | Centralized | Image classification | [198]
UNSW-NB15 dataset | Poisoning attacks | Label flipping attack | CNN-FL | Federated | Attack classification | [192]
Stanford Dogs dataset | Poisoning attacks | Data poisoning attack | ResNet-13 | Centralized | Image classification | [197]
Irish Smart Energy Trail | Poisoning attacks | Data poisoning attack | FFNN, GRUs, AEA | Centralized | Electricity theft detection | [199]
Breast Cancer Wisconsin | Byzantine attacks | Local model poisoning attack | ResNet20 | Federated | Image classification | [185]
GTSRB dataset | Combined attacks | Trojaning attack | DNN | Centralized | Sign recognition | [200]
DBPedia-14 dataset | Dropping attacks | Targeted dropping attack | CNN | Federated | Text classification | [188]
DeltaPhish dataset | Adversarial attacks | Grey-Box adversarial attack | 13 classifiers | Centralized | Phishing website detection | [201]

LPA: Label Propagation, LightGBM: light gradient-boosting machine, biLSTM:
Bidirectional LSTM, RNN: Recurrent Neural Network, DNN: Deep Neural Network,
LeNet5: DNN architecture for recognizing the handwritten and machine-printed
characters, ResNet: Residual neural network, FCN: Fully Convolutional Network,
MLP: Multilayer Perceptron, CNN: Convolutional neural network, LSTM: Long
short-term memory, I3D: inflated 3D convolutional network, CharCNN-LSTM:
Consists of a 2-layer stacked LSTM width 6 for temporal convolutions, SVM:
Support Vector Machine, KNN: k-nearest neighbor, LR: linear regression, RF:
random forest, FML: Federated multitask learning, SofT: A single layer fully-
connected softmax for classification, BiLSTM: Bidirectional Long/Short-Term
Memory, VGG-16: Very deep convolutional networks for large-scale image
recognition, FFNN: feed-forward neural networks, GRUs: gated recurrent units,
AEA: deep auto-encoder with attention.

##  VI Datasets for Edge Learning

Following upon a thorough analysis of recent contributions in the literature,
we provide a detailed report on the datasets used by the scientific community
for experimenting and evaluating ML techniques on cyber attacks, which is
provided in Table XII. Based on the content of each dataset, we classify them
into the following nine main categories: 1) IoT-based multi-purpose security,
2) Attack classification, 3) Electricity theft detection, 4) Image
classification, 5) Time series classification, 6) Human Activity Recognition,
7) Sentiment classification, 8) Location awareness, and 9) Text
classification, as illustrated in Figure 8.

###  VI-A IoT-based multi-purpose security

In recent years, addressing IoT security has received much focus from
academia, industry, and governments, mainly motivated by the expanding attack
surface from existing threats across the IoT networks. The availability of
sophisticated, easy-to-run, and easy-to-find exploit scripts and specialized
utility [161]. IoT-based security defenses using AI (specifically anomaly-
based approaches) have provided a good line of defense against these threats,
and the efforts provided by the security community deserve mention [10].
However, given that one of the most critical factors in providing an effective
final model is the data. This means that it is safe to say that the final
model is well-founded if the data is well-grounded. Although different
datasets have been proposed to design, train, and evaluate AI-based security
mechanisms for IoT-related environments, the majority of them are either
context-specific (e.g., a specific protocol), constrained threat model
(limited types and quantities of attacks), or collected within a shallow
generation framework (either real or virtual) [123]. Others, however, have
been designed as IoT-based multi-purpose security-related datasets such as the
Edge-IIoTset dataset.

  * •

Edge-IIoTset dataset [123]: is a comprehensive and realistic dataset collected
within multiple IoT/IIoT environments, intended to be used by ML-based
cybersecurity models for training and assessment under both training
approaches (centralized and FL). Data are collected from a variety of sources,
including notifications, logs, and network traffic. A total of 61 features
were selected from 1176 encountered characteristics. In particular, the
dataset is produced with a designed IoT/IIoT test bed featuring a broad
spectrum of interconnected devices, sensors/actuators, protocols, and multi-
layer implementations. The generation framework is designed in a multi-layer
approach comprising seven layers, including 1) the IoT/IIoT perception layer
where there exist more than 10 types of devices including flame sensors,
ultrasonic sensors, and water level detection sensors, 2) the edge layer where
various brokers and controllers are implemented 3) the fog layer where various
platforms are installed, such as IoT hubs and digital twins 4) the SDN layer
5) the NFV layer 6) the blockchain layer, and 7) the application layer. In
addition to general-purpose protocols such as HTTP, the dataset includes a
range of IoT and IIoT-specific protocols such as MQTT, CoAP, and Modbus. The
dataset includes 14 attack classes: DoS/DDoS, man-in-the-middle, malware, and
injection attacks. ProvNet-IoT proposed in [165], is a forensic provenance-
based scheme for examining IoT-targeted network-level assaults. The system
applies progressive provenance within the network to illustrate various events
within different attack strategies and generate forensic proofs. The authors
employed various community detection algorithms including Label Propagation
(LPA). Experimental results on the Edge-IIoTset dataset assessed and
demonstrated the potential of ProvNet-IoT to recognize specific selective
artifacts in order to generate credible proof in forensic examinations. In the
same context (i.e., IoT security), but in a different space, namely, smart
health system security, Ghourabi et al. [166] proposed a two-tiered security
system. The first is an IDS for smart medical devices, including the Internet
of Medical Things (IoMT), and the second is a malware detection system for
general-purpose devices. The proposed system is built using an optimized
LightGBM and a transformer-based model. Evaluations under the Edge-IIoTset
reached accuracies as high as 99%.

###  VI-B Attack classification

ML techniques provide valuable tools for cybersecurity solutions to detect
intrusions, identify malware and implement mitigation schemes. Various
datasets have been proposed to assist researchers in designing, developing,
and evaluating their cybersecurity defense methods, including:

  * •

KDDCup dataset [202]: since 1999, it has been the most widely used dataset for
assessing anomaly detection systems during that decade. It was built on the
foundation of roughly $4$ GB of tcpdump data from seven weeks of actual
network traffic (collected for the DARPA’98 IDS evaluation program). Within
the training dataset, there are about 4.9 million individual connection
vectors, with each holding 41 features with labels of either normal or attack.
The attack types include DoS, User to Root (U2R), Remote to Local (R2L), and
probing attack. Although this dataset is considered outdated, various modern
studies continue using it. For example, the work of Fung et al. [168] proposed
a defense mechanism against Sybil-based poisoning attacks called FoolsGold,
which is used for securing FL-based learning. The proposed system places no
restriction on the number of expected attackers, nor does it necessitate
additional information beyond the learning process while making minimal
assumptions regarding the clients and their data. For the KDDCup dataset, the
authors trained a single layer fully-connected softmax for the classification
task, using 5 clients performing 5 attacks on the same target class. In the
same context, Li et al. [169] proposed LoMar, a Local Malicious Factor defense
algorithm for addressing poisoning attacks on FL. The proposed algorithm is
based two main phases. The first phase rates each remote client’s model
updates by scaling relative distribution across their neighbors using a kernel
density estimation technique. In the second phase, a statistically optimal
trigger threshold is derived to differentiate between malicious and safe
updates. For the KDD Cup dataset, the authors use 2 classes with over two
hundred thousand data samples as their source and target label, while setting
up three malicious clients with flipped samples. The target label accuracy
reported is 99.1%.

  * •

NSL-KDD dataset [203]: is a proposed dataset to overcome specific issues
associated with the KDDCup dataset, including failure to define the attacks
clearly. It consists of two main parts: 1) KDDTrain+ with 125,973 records and
2) KDDTest+ with 22,544 records, which are created from the KDDCup dataset,
with four main categories of attacks, namely R2L, Prob, DoS, and U2R. A recent
work by Wang et al. [190] proposed IFPA and IUA, two integration-based
adversarial generation techniques. These techniques have the potential to
conduct DNN-targeted white-box attacks. The IFPA is designed for cases where a
specific number of points are to be disturbed, while the IUA is designed for
cases where no perturbation point number is requested. The performance of the
NSL-KDD dataset achieves an overall acceptable accuracy of 78.96% on the test
set.

  * •

UNSW-NB15 dataset [204]: developed in the Cyber Range Lab at the Australian
Cyber Security Centre (ACCS) as a hybrid of real-world and synthetic attack
models. It holds over 2.5 million data instances with 49 features mined from
100 GB of raw traffic. It includes nine attack types: DoS, shellcode,
reconnaissance, generic, exploits, and worms. The work by Zhang et al. [192]
proposed SecFedNIDS, a poisoning attacks-robust FL-based NIDS. To effectively
shadow poisonous traffic data and avoid its participation in further local
training, SecFedNIDS employs a novel detection method for poisonous data based
on the similarity of class paths. The authors followed a layer-wise
suitability propagation technique to retrieve the classpath from the clean
traffic data and transmit it to poisoned clients to assist in discriminating
the poisoned data. The results showed that SecFedNIDS increases accuracy in
case of poisoning attacks on the UNSW-NB15 dataset by up to 48%.

  * •

CICIDS2018 dataset [205]: generated by the Canadian Institute for cyber
security [205] using the profiles notion containing comprehensive descriptions
of attacks and detailed abstract distribution models for applications,
protocols, or lower-level network entities. In addition to the Benin profile,
the dataset includes different attack types such as DoS/DDoS, botnet,
infiltration, web, and brute-force attacks. This dataset has been widely used
for evaluating Host and network IDSs in recent years.

  * •

TON_IoT dataset [206]: generated by collecting and analyzing heterogeneous
data collections from IoT and IIoT domains. The experiment setup to generate
this dataset uses several VMs with different operating systems to support
interconnectivity between IIoT, cloud, and edge/fog layers. Different attack
types can be found in this dataset including DoS/DDoS, ransomware, and web
apps attacks, targeting IoT gateways and systems across the IoT/IIoT domain.
Khan et al. [183] proposed DepoisoningFSL, a data poisoning defense federated
split learning for edge computing. When the proposed system is compared to the
KNN-based semi-supervised defense (KSSD) mechanism with different data
poisoning rates ( up to 25%), it presents an overall increased accuracy.

  * •

DeltaPhish dataset [207]: was gathered from active phishing URLs retrieved
online from the PhishTank feed from Oct 2015 to Jan 2016. The authors gathered
and verified more than 1000 phishing pages manually. Within each phishing
page, they subsequently harvested the related homepage of the hosting domain.
Three to five legitimate pages are collected and manually approved using
hyperlink analysis in the HTML code. 5,511 distinct web pages are included,
out of which 1,012 are phishing pages. The authors in [201] proposed a
collection of Grey-box attacks on phishing detectors that a phishing adversary
can use. The attacks vary according to the adversary who knows the specific
phishing detector. In addition, the authors introduced an associated defense
algorithm named Protective Operation Chain (POC), which is based on a mix of
random feature picking. The feature linkages are exploited to minimize the
attacker’s guess of the target’s phishing detector. Experiment evaluations on
different public datasets including the DeltaPhish dataset showed that the
proposed algorithm is robust to attacks on 13 different classifiers.

###  VI-C Electricity theft detection

Electricity theft is a significant concern for utility systems as it causes
high economic losses. Furthermore, shifting from control to smart devices may
introduce highly sophisticated attacks that are harder to defend against. This
requires AI-based defense mechanisms to mitigate the risks, which in turn
requires Benin profile data to differentiate the pattern of attacks. Examples
of such datasets include:

  * •

Irish Smart Energy Trail: collected by the Sustainable Energy Authority of
Ireland, where the electricity records originate from 3,000 residential units’
smart meters that performed 30-minute readings for 18 months. As a result,
there are 25,000 reports per customer. This dataset is used by Takiddin et al.
[199] as a benign profile dataset to quantify the effect of data poisoning
attacks on smart grids. The authors evaluated the capabilities of customer-
specific and generalized baseline detectors for detecting data poisoning and
power theft attacks.

###  VI-D Image classification

Image classification represents a mighty task for assessing the architectures
and modern methodologies within computer vision. Image classification is a
core discipline concerned with understanding what an image looks like in its
entirety, and the objective is to classify the given image with a specific
category. Various datasets have been proposed to evaluate such security
architectures and systems, including:

  * •

MNIST dataset [208]: built from the NIST Special Databases (1 and 3), and
containing binary images of numbers and handwritten characters. This dataset
is widely used for training various AI-based image processing systems and can
be considered the default dataset for image classification tasks around the
globe. A vast amount of hand-written data is embedded in the dataset with over
70,000 images of 0 to 9 hand-written digits, which have been standardized in
size and focused in a pixel-square grid. Within each image is an array (28 ×
28 × 1) of varying floating-point numbers that depict grayscale shades of
intensity. This dataset has been used widely for evaluating different edge-
located security schemes in recent works [175, 176, 177, 178, 168, 173].

  * •

Fashion-MNIST dataset [209]: Based on the broad success that the MNIST dataset
has achieved, various works have attempted to take a similar approach. For
example, Fashion-MNIST is designed to become a full-scale substitute for the
original MNIST dataset when evaluating ML-based algorithms. The dataset shares
the identical image size (70,000), the same data format (28x28 Grey-scale
imagery), and the identical training (60,000 images) and testing (10,000
images) setup. However, instead of handwritten digits, Fashion-MNIST comprises
fashion items that fall under ten categories, each with 7,000 images per
category. This dataset is also used to evaluate edge-located security schemes
such as in [185, 186, 187, 188].

  * •

FEMNIST dataset [210]: is a federated version of the MNIST dataset containing
341873 samples from over 3300 writers as FL clients. With distinguishable
writing styles, individual authors’ data is Non-Independent and Identically
Distributed (Non-IID). Each client in the FEMNIST dataset has approximately
100 samples with 10 classes. This dataset has been used to evaluate edge-
enabled FL-based security systems recently [191, 13].

  * •

CIFAR-10 and CIFAR-100 datasets [211]: represent labeled subsets from the 80
million tiny images dataset. The CIFAR-10 dataset comprises 60,000 color
images of 32x32 split into 10 classes, each with 6,000 images per class. It
includes 50,000 training and 10,000 test images. The dataset is partitioned
into 5 training batches and 1 test batch, each containing 10000 images. The
testing batch contains 1000 images randomly picked from every class. Each
training batch contains the remaining images randomly, although some may have
more images within 1 class than others. In addition, the training batches hold
5000 images from every class. The work by Xiang et al. [170] used this dataset
to benchmark their proposed backdoor attacks defense mechanism.

  * •

ImageNet10 dataset [212]: is a hand-picked 10-class dataset derived from the
ImageNet dataset, which provides high-resolution images divided into 1000
classes and formed only from the 320x320 core regions of the original images.
The ImageNet10 classes were chosen to be optically distinct and to reflect
natural objects. This dataset is used in different works for benchmarking and
other datasets such as MNIST and CIFAR. [198]

  * •

Caltech-101 dataset: is regarded to be a challenging dataset for different
works in the experimental parts [179]. The dataset includes 101 classes and 1
background scene class. Every class contains between 40 and 800 images and
there are a total of 9146 images in this dataset.

  * •

Stanford Dogs dataset [213]: It was constructed from imagery and annotations
from ImageNet for categorizing fine-grained images. The dataset features a
collection of images representing 120 breeds of dogs worldwide. This dataset
includes 20,580 images with 120 categories. This dataset can be used with
other datasets such as MNIST to benchmark edge learning systems [197].

  * •

Breast Cancer Wisconsin dataset [214]: was developed to identify whether a
person has breast cancer. It contains 569 examples (Benign: 357 and Malignant:
212), each having 30 features for the person’s cell nuclei characteristics.
This dataset was used by [185] to evaluate ML-targeted data poisoning attacks,
which can pose a great danger to human lives in smart healthcare applications.

Figure 9: Various attacks on ML classifiers under different contexts

####  VI-D1 Facial recognition

Facial recognition refers to identifying or verifying a person’s identity
based on their face. It catches, processes, and matches different features
based on the details of the person’s face. Different datasets are used for
such tasks, including:

  * •

AT&T dataset [215]: also known as the Database of Faces. The dataset consists
of 400 grayscale (92×112) images of human faces taken from 40 individuals,
with 10 images for each person. For certain individuals, the images were shot
at varying times, differing in lighting and facial expressions. The work of
Zhang et al. [195] evaluated a GAN-based poisoning attack on this dataset.

  * •

LFW dataset [216]: The Labeled Faces in the Wild is a collection of face
photographs conceived to investigate the unconstrained face recognition task.
It has over 13000 face images gathered from the web. Individual faces are
labeled with their respective names. 1680 of the pictured persons possess two
or more separate photos. This dataset was also used for generating poisoned
training samples in [182].

  * •

CASIA dataset [217]: collected in the period 2007-2010 by the Institute of
Automation, Chinese Academy of Sciences (CASIA), including 725 face images.
The dataset was designed for Near-infrared vs. Visible light (NIR-VIS) face
recognition, with 640×480 resolutions and with 1 to 22 VIS and 5 to 50 NIR
face images per person. This dataset was also used in [182].

  * •

VGGFace2 dataset [218]: comprises more than 3M images featuring 9131 famous
people across a wide range of ethnic groups. All images are downloaded from
Google and exhibit considerable background, age, and lighting variation.
Overall, the entire dataset is relatively balanced (40.7% for females and
59.3% for males). It includes 80-843 images for each individual. Fung et al.
[168] used the VGGFace2 dataset for evaluating a poisoning Sybil’s defense
mechanism.

  * •

CelebA dataset [219]: constructed by labeling selected images from the
CelebFaces dataset, including 10000 celebrities, with 20 images for each one.
And all photos are annotated with 40 face attributes and five key points.
EdgeConnect is a two-stage adversarial scheme composed of an edge generator
tracked by an image completion system, which can be used for scene generation.
The scheme proposed in [220] is evaluated using the CelebA dataset.

###  VI-E Time series classification

Time series classification involves ML techniques designed to analyze several
classes of labeled time series data to forecast or categorize which class a
new dataset falls into.

  * •

UCR time series classification archive [221]: was launched in 2002 and has
since become an extensive resource for the time series data mining field.
While the original version of the archive contained 16 data sets, the archive
has seen periodic updates over the years. A major expansion occurred in 2015
when the archive expanded to 85 datasets. Recent works on adversarial attacks
and defenses against time series classification (TSC) problems have been
proposed as discussed in [180].

###  VI-F Human Activity Recognition

Human Activity Recognition (HAR) has broad applicability in light of the
worldwide use of interconnected sensing devices such as IoT devices,
smartphones, and cameras, as well as its capability to collect data on human
behavior. In addition, progress in AI has dramatically improved the extraction
of profoundly hidden intelligence for precise identification and
interpretation. Different datasets were proposed for HAR tasks including:

  * •

HARUS dataset [222]: gathered from a group of 30 volunteers with ages ranging
between 19-48 years wearing a smartphone. The data about their activities are
split into two classes (dynamic and static) with each having 3 activities. It
includes a total of 10299 samples with 561 attributes. The work in [181]
evaluated their proposed bilevel optimization framework, which is intended to
compute optimal poisoning attacks on FL.

  * •

Parkinson dataset [223]: created to identify people with Parkinson’s disease.
It consists of 5,875 observations from a series of biomedical readings of 31
people’s voices, 23 of whom have Parkinson’s disease. This dataset evaluates
the framework in [181].

TABLE XIII: Attacks on federated ML algorithms. Attack |  ML phases |  Attack Goal |  Attack Description
---|---|---|---
FL model extraction attack |  Post-Deployment |  Obtaining the model weights or AI architecture |  Malicious clients creating local models that are functionally equivalent to target models of honest clients
FL evasion attack |  Post-Deployment |  Bypassing classifiers |  Malicious clients generally will not modify the target model of honest clients but will cheat the model to generate false predictions
FL inversion attack |  Post-Deployment |  Private data search |  Malicious clients require knowledge of labels to retrieve training data from honest clients
FL inference attack |  Post-Deployment |  Private data search |  Identify whether a data point was used in a training set of honest clients
FL poisoning attack |  Pre-Deployment |  Disrupt the functioning the aggregate model |  Malicious clients inject malicious data in a training set of honest clients
FL drooping attack |  Pre-Deployment |  Disrupt the functioning of the aggregate model |  Malicious clients drop the network traffic from selected honest clients

###  VI-G Sentiment classification

Sentiment analytics is a self-learning approach that analyzes the sense of
meaning in text, ranging from positive to negative. Using ML tools that are
trained with instances of sentiment in text, they automatically learn to
recognize sentiment with no human intervention.

  * •

IMDB dataset [224]: consists of a large dataset of different reviews of movies
for sentiment binary classification. Specifically, the dataset is a collection
of 50000 movie reviews and their associated binary labels (positive or
negative). This dataset is also used to benchmark edge learning targeted
attacks such as poisoning and backdoor, and their associated defenses [193,
194].

  * •

Twitter dataset [225]: consists of a dataset for target-dependent Twitter
sentiment analysis which is manually annotated. A total of 6940 tweets is
collected, with 6,248 tweets for the training set and 692 tweets for the test
set. The sentiment labels include negative, neutral, and positive, with class
distribution being 25%, 50%, and 25%, respectively.

###  VI-H Location awareness

Location awareness designates the responsiveness of a particular system in
ascertaining its position. This research field is significant for autonomous
mobile operations. Available datasets for such tasks include:

  * •

GTSRB dataset [226]: for (German Traffic Sign Recognition Benchmark), which is
a dataset that contains more than 50000 traffic sign images with 43 classes.
It was constructed in 2010 from 10 hours of footage recorded using a Prosilica
GC 1380CH camera (1360×1024 pixels), during daytime drives on various types of
roads in Germany. The dataset is populated with over 1700 instances of road
signs, with available image resolutions varying between 15 × 15 and 222 × 193
pixels. A framework for defending against Trojans in DNNs is proposed in
[200]. The proposed framework uses a moving target defense strategy given
multi-dimensional training with random dimensions selection and was evaluated
on this dataset.

  * •

Places database [227]: is designed to provide AI systems with high-level
visual perception training, including background, recognition, and prediction
tasks. It includes over 10M images covering over 400 specific scenes, ranging
from 5000 to 30000 training images per class. In addition, this dataset is
used to evaluate the EdgeConnect system discussed above [220].

###  VI-I Text classification

Manual text classification involves analyzing the text material and making
classifications accordingly, generally conducted by an annotator. Because text
is among the widest kinds of unstructured data, it is difficult and costly to
parse, comprehend, arrange, and classify textual data. Automated text
classification categorizes documents into pre-specified classes, usually using
Natural Language Processing (NLP) and ML algorithms. Diverse parties have
provided datasets for facilitating such tasks, like:

  * •

DBPedia datasets [228]: was conceived to mine organized content from
Wikipedia’s entries. It consists of an archive of information that provides
hierarchical and classification data for more than 4.23M instances covering
685 classes. Variants of this data collection are a widely used reference for
evaluating NLP/text classification projects, giving a valuable baseline for
multi-class/multi-label hierarchical text classification. For instance, the
DBPedia-14 version which consists of 560000 instances from 14 ontological
categories (including film and animal classes), was employed in [188] where
the authors studied the impact of network-level adversaries on FL training and
dropping attacks amplification.

Figure 10: Classification of machine learning vulnerabilities. TABLE XIV:
Machine learning vulnerabilities.

Attack category |  The attacker’s knowledge |  Attack type |  Attack mode |  The attacker’s goal - Vulnerabilities |  Targeted ML |  Mitigation solution
---|---|---|---|---|---|---
Backdoor attacks |  \- Knowledge of the trigger (a small patch) |  RNN backdoor attacks regarding text classification |  CL, FL, DL |  The adversary takes control of the global model training operation |  Text classification |  [167]
\- Knowledge of some poisoned data based on the trigger |  Imperceptible backdoor pattern |  CL, FL, DL |  The adversary poisons the training set with a small ensemble of pictures sourced from a source class (or classes) |  Image classification |  [170]
-Inject maliciously the poisoned data to the victim to train a deep model with |  Distributed backdoor attack |  CL, FL, DL |  Backdoor attack performed by several different collaborative attackers |  Image classification |  [175]
\- The trigger is stored as a secret by the attacker and only then exposed at the time of the test |  Pixel-space backdoor attack |  CL, FL, DL |  Manipulate the pixel data values of the image to poison the images in the training dataset |  Image classification |  [229]
\- The attacker poison training examples and change their labels |  Clean label backdoor attack |  CL, FL, DL |  Requiring zero-knowledge of the target model |  Image classification |  [198]
Combined attacks |  Attack through jointly training neural network classifiers |  Synergetic attack |  CL, FL, DL |  Combines adversarial examples and Trojan backdoor |  Image classification |  [230, 231]
Adversarial examples |  blue-box attack: the configuration of the target ML models is unavailable to adversaries |  blue-box adversarial attack |  CL, FL, DL |  The adversary has restricted information about the model but certainly does not have knowledge of the model’s parameters |  \- Time series classification
\- Speech Recognition
\- Video Recognition |  \- [180]
\- [184]
\- White-box attack: the adversary has access to all the information of the target ML model. |  White-box adversarial attack |  CL, FL, DL |  White-box attacks require complete knowledge of the model being targeted, including its training method, architecture, and parameter values |  \- Text classification
\- Attack classification |  [189]
\- [190]
\- Grey-box attack: the adversary has some knowledge about the target ML model |  Grey-box adversarial attack |  CL, FL, DL |  Requires partial knowledge instead of full knowledge |  Face Recognition |  [232]
Poisoning attacks |  \- There are two distinct attack scenarios blue-box and white-box attacks |  Federated poisoning attack |  FL, DL |  Falsifying machine learning training data to generate unwanted results in a decentralized mode. The adversary’s goal is to modify the parameters learned and manipulate the training data on their device |  \- Image classification
\- Sentiment classification
\- Attack classification
\- Human Activity Recognition |  \- [191, 178, 186]
\- [193]
\- [183]
\- [178]
\- [181]
|  Intrusion poisoning attack |  CL, FL, DL |  The application of poisoning attacks in the intrusion detection datasets |  Attack classification |  [233]
\- White-box attacks: the attacker is assumed to know the trained parameters, the learning algorithm, the feature values, and the training set |  Label flipping attack |  CL, FL, DL |  Attackers can flip the labels of some samples from one class to another, for example from attack to benign |  \- Sentiment classification
\- Attack classification |  -[194]
\- [192]
|  Poisonous label attack |  CL, FL, DL |  Injects fake images with the poisonous label in the training dataset than modifying directly the label of the images |  \- Image classification
|  [176]
\- blue-box attacks, the attacker is assumed to know the learning algorithm and feature set, and collect a substitute data set but does not know the training set as well as the trained parameters |  Clean-label poisoning attack |  CL, FL, DL |  The poison patterns are generated by inserting undetectable changes that will cause the model to misbehave in reaction to particular target inputs |  \- Transfer learning
\- Attack classification |  \- [172]
\- [192]
|  Data poisoning attack |  CL, FL, DL |  The attacker attempts to infect the training data by inserting well-formed samples to impose a harmful model on the learner |  \- Image classification
\- Electricity theft detection |  \- [197]
\- [199]
\- In FL settings, the attacker’s ultimate goal is to modify the source distribution of the raw data based on the corruption of the aggregate model by uploading the parameters of the poisoned local model |  Generative poisoning attack |  CL, FL, DL |  Deploying a GAN model from the attacker’s side to impersonate other participants’ training dataset patterns |  \- Image classification
\- Face recognition |  \- [174]
\- [182]
|  Over-the-air spectrum poisoning attack |  CL, FL, DL |  Confuse the sender into making poor transmission decisions (i.e., an evasion attack) or to tamper with the sender’s recycling process (i.e., a causal attack) |  \- Communication systems |  [234]
Sybil attacks |  \- It assumed that the attackers exploit the Sybils to initiate poisoning attacks against federated learning |  Sybil-based poisoning attack |  FL, DL |  Sybils conduct federated learning poisoning attacks by delivering status updates that lead the distributed model to a poisoned common target. |  \- Face recognition
\- Image classification |  \- [168]
\- [13]
|  Sybil-based collusion attack |  FL, DL |  To complete local poisoning training, the attacker employs the label flipping scheme |  \- Image classification |  [187]
Byzantine attacks |  The attacker’s knowledge can be classified into three levels: (i) no knowledge, (ii) partial knowledge, and (iii) complete knowledge |  Local model poisoning attack |  FL, DL |  Affect the integrity of the learning phase in the training process |  \- Image classification |  [185]
Dropping Attack |  The adversary drops contributions from the clients in every round |  Targeted dropping attack |  FL, DL |  By monitoring more rounds of the FL system; the adversary can drop the network traffic from selected clients |  \- Text classification |  [188]

CL: Centralized Learning, FL: Federated Learning, DL: Distributed Learning

###  VI-J Application of Dataset Types in 6G IoT Security

The categories of datasets, when employed in machine learning models,
substantially bolster security in edge learning environments. IoT-based multi-
purpose security datasets enable the detection of unusual cyber activities in
real-time, safeguarding IoT networks [235]. Attack classification data can
inform the creation of sophisticated intrusion detection systems to protect
against known attack vectors [236]. Electricity theft detection through
anomalous usage patterns ensures the integrity of the power grid, which
indirectly benefits the security of all connected devices. Image
classification allows for local object detection and facial recognition, which
is crucial for many security applications in edge devices [237]. Time series
classification can pinpoint sudden changes in network traffic indicative of a
cyber attack [238]. Human Activity Recognition can identify abnormal or
unauthorized activities in secure areas [239]. Sentiment classification aids
in spotting harmful or threatening digital communications [240]. Location
awareness is crucial in verifying user authenticity based on their usual
geographic patterns, while text classification can help identify spam or
phishing attempts [241].

###  VI-K Highlights of Peer-to-Peer Features in Edge Learning across Various
Dataset Types

In all various dataset types, the peer-to-peer feature of edge learning is
captured by ensuring that each device learns from its unique local data and
shares the model’s insights with the rest of the network. This maintains data
privacy and security, utilizes the computational resources of edge devices,
and enables learning from diverse and heterogeneous datasets.

  * •

Multi-purpose security: IoT devices gather data on potential security threats,
learning from it and sharing insights or models with other devices while
maintaining the privacy of raw data.

  * •

Attack classification: In network infrastructures, devices collect and process
data on different network attacks, updating learning models based on
individual experiences and sharing these models with other devices.

  * •

Image classification: Devices like cameras or smartphones classify images
locally, share the learned models, and keep the original images private to
maintain privacy.

  * •

Time series classification: Sensors that generate time-series data classify it
locally and share their models, adhering to data privacy and decentralized
learning principles.

  * •

Human Activity Recognition (HAR): Wearable devices like smartwatches learn to
recognize human activity from user data and share their learning models,
maintaining the privacy of the raw data.

  * •

Sentiment classification: Devices (e.g., smartphones) classify sentiment on
local data (such as social media posts and messages) and share the learned
models while keeping the actual data private.

  * •

Location awareness: GPS-enabled devices learn from location data and share
their models with other devices in the network, improving location awareness
without revealing individual location data.

  * •

Text classification: Each device performs text classification tasks on its
unique text data, sharing the learned models to collectively improve text
classification tasks, keeping the original text data private.

##  VII Machine learning vulnerabilities

Machine learning systems are vulnerable to attack, which limits the
application of machine learning, especially in 6G–IoT Networks [242]. There
are six attacks on federated ML algorithms, including FL model extraction
attack, FL evasion attack, FL inversion attack, FL inference attack, FL
poisoning attack, and FL drooping attack, as presented in Table XIII. To
visualize some of these threats, Figure 9 illustrates various attacks against
different ML paradigms including centralized, distributed, and decentralized
learning during different model phases, including training, post-training, and
inference phases. And while there are different strategies for targeting AI
models, for instance in centralized learning by poisoning the data on which
the model trains directly, in decentralized learning with poisoned updates,
the result remains the same: a compromised model. This section provides a
comprehensive classification of threats against ML, as presented in Figure 10.
In addition, a thoughtful and comprehensive review of ML vulnerabilities based
on the provided classification and related to three main aspects, namely, the
knowledge already acquired by the attacker, the type of attack employed, and
the final objective, which is provided in Table XIV.

###  VII-A Pre/Post-deployment attacks

Table XIII lists the attacks that can be launched on federated machine
learning (FL) algorithms along with their goals and descriptions. These
attacks can be categorized based on the phase they occur - pre-deployment or
post-deployment. Pre-deployment attacks target the aggregate model before
being deployed to honest clients. Post-deployment attacks occur after the
aggregate model has been deployed to honest clients. The following six attacks
compromise the privacy of the private data of honest clients [181, 243, 120,
244]:

  * •

FL model extraction attack: This attack occurs in the post-deployment phase,
where malicious clients aim to extract private data from honest clients. The
attackers create local models that are functionally equivalent to the target
models of honest clients to extract data.

  * •

FL evasion attack: This attack occurs in the post-deployment phase, where
malicious clients aim to bypass the classifiers of honest clients. The
attackers do not modify the target model of honest clients but instead cheat
the model to generate false predictions.

  * •

FL inversion attack: This attack occurs in the post-deployment phase, where
malicious clients aim to search for the private data of honest clients. The
attackers require knowledge of labels to retrieve training data from honest
clients.

  * •

FL inference attack: This attack occurs in the post-deployment phase, where
malicious clients aim to identify whether a data point was used in the
training set of honest clients. The attackers try to extract private data from
honest clients.

  * •

FL poisoning attack: This attack occurs in the pre-deployment phase, where
malicious clients aim to disrupt the functioning of the aggregate model. The
attackers inject malicious data into the training set of honest clients to
manipulate the model.

  * •

FL drooping attack: This attack occurs in the pre-deployment phase, where
malicious clients aim to disrupt the functioning of the aggregate model. The
attackers drop the network traffic from selected honest clients to manipulate
the model.

###  VII-B Backdoor attacks

Backdoor attacks involve manipulating training data or models to trigger
specific behaviors in the model during the testing phase. Different backdoor
attacks are presented, including RNN backdoor attacks, imperceptible backdoor
pattern attacks, distributed backdoor attacks, pixel-space backdoor attacks,
and clean-label backdoor attacks.

####  VII-B1 RNN backdoor attacks

Backdoor attacks in deep neural networks are based on two assumptions, namely,
the adversary takes control of the global model training operation and the
second assumption is that the adversary only has control over particular
training data. RNN backdoor attacks on 6G could secretly embed malicious
behaviors in network models, potentially compromising data integrity and user
privacy. As 6G relies heavily on AI-driven solutions for efficient network
management and data processing, such attacks can degrade network performance
and security. Consequently, they pose risks to the expected ultra-reliable,
low-latency communication features of 6G. Chen et al. [167] proposed a
mitigating system against backdoor attacks in the text classification based on
Backdoor Keyword Identification. The proposed system can identify the
poisoning patterns in the training dataset with no trust data and no knowledge
of the backdoor release. The following text classification datasets are used
in the performance evaluation with the LSTM models, Reuters-21578 dataset, 20
newsgroups, DBpedia ontology, and IMDB. The results show good results
regarding identification precision and recall of poisoning samples. To remove
poisoning data, the authors proposed the following formula to filter the
keywords in a dictionary and detect the suspicious keyword, which is most
susceptible to be a backdoor keyword:

${Ident}_{backdoor}=\overline{f\left(k\right)}\cdot{log}_{10}gen\\_sam\cdot{log}_{10}\frac{x}{gen\\_sam}$
(1)

$\overline{f\left(k\right)}$ is the average score for the keyword $k$ in the
dictionary. The score could be based on various metrics such as the frequency
of the keyword, the similarity between the keyword and other words in the
dictionary, or other measures. ${log}_{10}gen\\_sam$ uses a logarithmic
function of the number of samples that produce the keyword $gen\\_sam$. The
purpose is to adjust the weight of the keyword based on the number of samples
in which it appears. ${log}_{10}\frac{x}{gen\\_sam}$ represents the logarithm
of the reciprocal of frequencies, which is used to normalize the weight of the
keyword. The $x$ value is a fixed parameter that is higher than 0. By
combining these components, the formula calculates an identifier
$Ident_{backdoor}$ for each keyword, which can be used to detect suspicious
keywords that are more likely to be backdoor keywords, i.e., the higher the
value of $Ident_{backdoor}$, the more suspicious the keyword.

####  VII-B2 Imperceptible backdoor pattern

In image classification, the attacker poisons the training set with a small
ensemble of pictures sourced from a source class (or classes), incorporated
with a backdoor feature, and then tagged to a target class. The imperceptible
backdoor pattern in 6G can subtly introduce vulnerabilities, enabling
unauthorized access or control. This compromises the integrity and security of
ultra-reliable, high-speed 6G networks. As a result, it jeopardizes user
privacy, data confidentiality, and the dependability of critical applications.
Xiang et al. [170] proposed a mitigation technique based on imperceptible
backdoor patterns. The proposed technique can identify if the training set is
poisoned and precisely recognizes the target class and training images in
which the backdoor pattern is integrated. At the end of the process, the
proposed technique performs reverse engineering to provide an estimate of this
backdoor pattern used by the attacker. The CIFAR-10 dataset is used as a
benchmark experiment, and the results show a reduced rate compared to state-
of-the-art to no more than 4.9%.

The poisoned dataset used for training the victim classifier consists of a
combination of the ${Dataset}_{backdoor}$ and the benign ${Dataset}_{train}$.
The ${Dataset}_{backdoor}$ is a set of examples intentionally modified with a
backdoor pattern to trick the classifier into predicting a specific target
class when presented with an image from a particular source class. The
${Dataset}_{backdoor}$ is defined as follows:

${Dataset}_{backdoor}=\\{(f\left(x;{pattern}^{*}\right),y)|x\sim
P_{{Source}^{*}},\\\ \ y={Class}^{*}\\}$ (2)

$f\left(x;;{pattern}^{*}\right)$ is the embedding function that maps an image
$x$ to a feature vector, and ${pattern}^{*}$ is the backdoor pattern that is
added to the image. The resulting image $f\left(x;;{pattern}^{*}\right)$ is
then labeled as ${Class}^{*}$, which is the target class that the backdoor is
designed to trigger. The source class(es) $P_{{Source}^{*}}$ determines which
images the backdoor is applied to. If $P_{{Source}^{*}}$ contains multiple
classes, the backdoor can be triggered by images from any of those classes.
The poisoned dataset is used to train the victim classifier, which learns to
classify images from both benign and poisoned datasets. However, since the
poisoned dataset contains examples with backdoors, the victim classifier can
be manipulated to produce incorrect predictions on images that contain the
backdoor pattern.

Figure 11: Adversarial examples in Edge Learning.

####  VII-B3 Distributed backdoor attack

Backdoor attacks performed by several collaborative attackers, i.e.,
distributed backdoor attacks, can reach very successful rates and are very
difficult to detect. A distributed backdoor attack in 6G networks could
exploit the advanced and decentralized nature of the system, subtly
introducing malicious functionalities without detection. By compromising
multiple nodes or devices, the attack can gain control over data flow, causing
disruptions or unauthorized data access. Based on a dynamic norm clipping
approach, Guo et al. [175] proposed a security system to defend against
distributed backdoor attacks in federated learning. The proposed system is
evaluated with the following four public datasets: MNIST, FMNIST, CIFAR-10,
and Tiny Imagenet. The results show that the proposed system can reduce the
attack access rate by 84.23% compared to the state of the art. With the
distributed backdoor attack, some attackers constitute a group with identical
malicious purposes. More precisely, all attackers conduct the backdoor attack
on their local models independently using their specific local backdoor
trigger ${Trig}_{i}$ and the same target label ${Label}_{target}$. The
attacker’s corresponding goal $i$ is defined as follows :

$G_{i}\left(w\right)=\sum_{j\in{Data}^{i}_{infected}}{\left[f(w;;x^{i}_{j}+{Trig}_{i},{Label}_{target})\right]}+\\\
\sum_{j\in{Data}^{i}_{uninfected}}{\left[\left[f(w;;x^{i}_{j}+y^{i}_{j})\right]\right]}$
(3)

Where $w$ represents the global model parameters, ${Data}^{i}_{infected}$ is
the infected image dataset of attacker $i$, ${Data}^{i}_{uninfected}$ is the
uninfected image dataset of attacker $i$, $x^{i}_{j}$ represents input from
the local dataset and $y^{i}_{j}$ represent the corresponding label sampled
from the local dataset. The objective of each attacker is to maximize the
misclassification rate of the global model on a specific target label
${Label}_{target}$ when presented with inputs that contain a specific backdoor
trigger ${Trig}_{i}$. The goal $G_{i}\left(w\right)$ of attacker $i$ is
defined as the sum of two terms: the first term represents the
misclassification rate of the infected images from attacker $i$ on the target
label ${Label}_{target}$, while the second term represents the
misclassification rate of the uninfected images from attacker $i$ on their
true labels. The function $f(w;x,y)$ represents the output of the global model
with parameters $w$ on input $x$ and label $y$. The double semicolon notation
$w;;x^{i}_{j}+{Trig}_{i}$ indicates that the backdoor trigger ${Trig}_{i}$ is
added to the input $x^{i}_{j}$ before it is fed into the global model.

####  VII-B4 Clean label backdoor attack

A clean-label backdoor attack on 6G could subtly embed malicious triggers in
legitimate data during the system’s training phase. Once deployed, adversaries
can exploit these triggers to manipulate the 6G network’s behavior,
undermining its security and reliability. Such attacks could severely
compromise the advanced functionalities and services anticipated in 6G
ecosystems. Ning et al. [198] proposed a blue box clean label backdoor attack,
which requires zero knowledge of the target model. To detect and eliminate,
the authors propose the following two methods: 1) Supervised poison sample
detection and 2) Unsupervised poison sample detection. For Backdoor injection,
the adversary summarized another dataset by combining the clean database with
a small part of the poisoned dataset as follows:

${Dataset}_{new}={Dataset\ }_{clean}\cup{Dataset}_{poisoned}$ (4)

The adversary uses this dataset during training and verifies that a combined
dataset does not influence other properties. The backdoor injection attack
involves adding malicious data to the training dataset, which can be used to
exploit the model during inference. In this case, the adversary has combined a
clean dataset with a small part of the poisoned dataset to create a new
dataset for training. The poisoned dataset contains inputs and labels
specifically chosen to trigger a backdoor in the model. To train the model
using this dataset, the adversary minimizes a loss function that includes
clean and poisoned data. The goal is to find the parameters of the model that
minimize the total loss on both datasets. The loss function is typically based
on cross-entropy, which measures the difference between the predicted
probabilities and the true labels.

The availability of a poisoned dataset gives the following loss function:

${F_{l}=min}_{model}\sum^{n}_{i=0}{Loss(model,\left(x^{i},y^{j}\right))}+\\\
\sum^{m}_{j=0}{Loss(model,\left(x^{i^{\prime}},y^{j^{\prime}}\right))}$ (5)

$model$ represents the parameters of the model.
$Loss(model,\left(x^{i},y^{j}\right))$ represents the loss incurred by the
model when predicting input $x^{i}$ with label $y^{j}$ from the poisoned
dataset. $Loss(model,\left(x^{i^{\prime}},y^{j^{\prime}}\right))$ represents
the loss incurred by the model when predicting input $x^{i^{\prime}}$ with
label $y^{j^{\prime}}$ from the clean dataset. $n$ is the size of the poisoned
dataset. $m$ is the size of the clean dataset.

####  VII-B5 Pixel-space backdoor attack

Pixel-space backdoor attacks are a type of adversarial attack where an
attacker modifies the pixel values of an image in a way that is imperceptible
to the human eye but causes misclassification by the target model. A Pixel-
space backdoor attack subtly modifies images in a way undetectable to the
human eye but significantly alters the outcome of machine learning models. In
the context of 6G, which heavily relies on AI-driven applications and ultra-
reliable communications, such attacks could mislead autonomous systems or
degrade the quality of service. The integrity and security of 6G-enabled
applications, like autonomous vehicles or telemedicine, could be compromised,
risking user safety and trust. Arshad et al.’s pixel-space backdoor attack
[229] is a type of data poisoning attack where the attacker injects malicious
samples into the training dataset to cause the model to learn a backdoor
trigger. In this attack, the attacker flips certain bits of the pixel values
of the training images, which can be done without significantly changing the
image’s appearance. These modified images are then inserted into the training
dataset, along with their original labels. During training, the model learns
to associate the backdoor trigger with the target label, allowing the attacker
to trigger the attack by adding the trigger to any input image. Arshad et al.
evaluated their backdoor attack strategy on the MNIST digit dataset, which
consists of 28x28 Grey-scale images of handwritten digits. They found that
their attack was successful in 90% of the cases, meaning that the target model
misclassified the poisoned images with the intended target label. Therefore,
it’s important to note that the success of a backdoor attack depends on
several factors, including the size and quality of the training dataset, the
choice of the backdoor trigger, and the strength of the attacker’s evasion
techniques. Therefore, while Arshad et al.’s attack achieved a high success
rate on the MNIST dataset, it may not be as effective on other datasets or
against more robust models with stronger defenses against adversarial attacks.

TABLE XV: Threat models of adversarial examples generation. Attacks examples |  Attacks for the specific tasks |  White/blue/Grey box |  Adversarial Example Generation |  Methods
---|---|---|---|---
Miscellaneous attacks |  Classification |  Feature-space white-box attacks |  The XGBoost can be used as the adversarial feature extraction model |  Miscellaneous malware detectors based on OpCode n-gram features [245]
Adversarial transformation networks |  Classification |  Trained in a white-box or blue-box manner |  Adversarial Autoencoding (AAE) and Perturbation ATN (P-ATN) |  Deterministic/stochastic defense models [246]
Fooling gradient-based attacks |  Classification |  blue/Grey-box attack |  Generating adversarial audio files |  Fooling Deep structured prediction models [247]
Universal perturbations and antagonistic network |  Classification |  blue/Grey-box attack |  Generating rogue images |  Breaking high-performance image classifiers [248]
Carlini and Wagner Attacks (CW) |  Classification |  blue/Grey-box attack |  Generating adversarial examples based on distance metrics |  Defensive distillation [249]
One Pixel Attack |  Classification |  Semiblue-Box Attack |  Generating adversarial examples using differential evolution |  Covariance matrix adaptation evolution strategy [250]
Jacobian-Based Saliency Map Attack (JSMA) |  Classification |  White-box attack |  Generating adversarial samples using the mapping between inputs and outputs of deep learning |  Predictive measure of distance [251]
Basic Least-Likely-Class Iterative Methods |  Classification |  White-Box Attack |  Generating adversarial images based on the linearization of the cost function |  Iterative least likely method [252]
Fast Gradient Sign Method (FGSM) |  Classification |  White-Box Attack |  Generating adversarial examples using a family of fast methods |  Explaining and harnessing adversarial examples [253]
L-BFGS attack |  Classification |  White-Box Attack |  Generating adversarial examples using a box-constrained L-BFGS algorithm |  Intriguing properties of neural networks [254]
Adversarial vulnerability of facial attributes |  Classification/Recognition |  White-Box Attack |  Generating natural adversarial images |  Fast flipping attribute technique [255]
Attacks on Semantic Segmentation object Detection |  Image Segmentation |  blue/Grey/White-box attack |  Adversarial target generation |  Universal adversarial perturbations [256]
Strategically-timed attack |  Classification/Recognition |  blue/Grey/White-box attack |  Combining a planning algorithm and a generative model |  Adversarial attack on deep reinforcement learning systems [257]
Attack on Recurrent Neural Networks |  Classification/Recognition |  blue/Grey/White-box attack |  Creating adversarial sequences |  Fast gradient sign method and Forward derivative method [258]
Figure 12: FL model poisoning attack using generated poisoned samples

###  VII-C Adversarial examples

Adversarial examples refer to inputs specifically crafted to deceive machine
learning models. Different adversarial attacks are presented, including blue-
box attacks, white-box attacks, and Grey-box attacks. Akhtar and Mian [259]
proposed a classification of adversarial examples on deep learning into two
categories: 1) Attacks for Classification and 2) Attacks Beyond
Classification/Recognition. The Attacks for Classification include
miscellaneous attacks, adversarial transformation networks (ATNs), Houdini,
Upset and ANGRI, Universal Adversarial Perturbations, Deepfool, Carlini and
Wagner Attacks (C&W), One Pixel Attack, Jacobian-Based Saliency Map Attack
(JSMA), Basic & Least-Likely-Class Iterative Methods, Fast Gradient Sign
Method (FGSM), and Box-Constrained L-BFGS. Attacks Beyond
Classification/Recognition include Attacks on Face Attributes, Semantic
Segmentation & Object Detection, Deep Reinforcement Learning, Recurrent Neural
Networks, and Attacks on Autoencoders and Generative Models. Table XV presents
the threat models of adversarial examples generation. Figure 11 presents the
adversarial examples in Edge Learning. Therefore, in our work, we propose a
classification of adversarial examples into three categories: 1) White-box
adversarial attacks, 2) blue-box adversarial attacks, and 3) Grey-Box
adversarial attacks.

####  VII-C1 White-box adversarial attacks

White-box attacks require complete knowledge of the targeted model, including
its training method, architecture, parameter values, and, in most cases, its
data training. A white-box adversarial attack on 6G networks exploits
knowledge of the system’s architecture and algorithms to introduce crafted
perturbations, undermining the accuracy and efficiency of data-driven
applications. Such attacks can disrupt the ultra-reliable, low-latency
communication fundamental to 6G, potentially compromising critical services
and applications. To manipulate discrete text structure at its one-hot
representation, Ebrahimi et al. [189] propose white-box adversarial examples,
named HotFlip, which is applied for text classification. The HotFlip system
uses the gradient concerning a one-hot input representation and can produce
conflicting patterns with character substitutions ("flips"). The HotFlip also
provides access to add and remove transactions by displaying them as character
substitution sequences. The performance evaluation with AG’s news dataset and
CharCNN-LSTM architecture shows that the adversary selects the flip
transaction about 80% of the time and prioritizes suppression over insertion
by two-to-one. Wang et al. [190] propose white-box attacks based on the
integrated gradient for fooling deep neural networks. The proposed attacks are
evaluated with the following three datasets: CIFAR-10, MNIST, and NSL-KDD. One
of the most popular algorithms for generating white-box adversarial examples
is the Fast Gradient Sign Method (FGSM) introduced by Goodfellow et al. in
2014 [253]. The FGSM generates adversarial examples by taking the gradient of
the loss function concerning the input and adding a perturbation to the input
in the gradient direction. The formula for generating adversarial examples
using FGSM is as follows:

${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}x_{adv}=x+\epsilon\cdot
sign(\nabla_{x}J(\theta,x,y))}$ (6)

Where $x$ is the input, $y$ is the true label, $J$ is the loss function,
$\theta$ is the model parameters, $\epsilon$ is a small constant that controls
the magnitude of the perturbation, and $sign$ is the sign function.

####  VII-C2 blue-box adversarial attacks

A blue-box adversarial attack targets 6G’s advanced machine learning
algorithms, exploiting vulnerabilities to mislead or manipulate network
functions. By subtly modifying input data, attackers can cause 6G systems to
misinterpret or misclassify information, potentially compromising network
efficiency, security, and reliability. Blue-box attacks provide a trained
model with conflicting examples (during testing) produced without knowledge of
the trained model. In particular cases, it is supposed that the adversary has
restricted information about the model but does not know its parameters. Yang
et al. [180] propose a blue-box method called TSadv, which attacks deep neural
networks on time series. For solving the constrained optimization problem, the
TSadv method uses a gradient-free attack strategy. The performance evaluation
with the University of California Riverside (UCR) time series dataset shows
good success rate, the average number of iterations, and mean squared error.
Therefore, Biolková and Nguyen [184] propose a blue-box adversarial attack in
speech recognition. The proposed attack uses a neural predictor that
approximates the decision boundary’s length, resulting in a wrong audio signal
transcription. The experiments on the LibriSpeech dataset show that the
proposed attack can achieve a better success rate than BayesOpt [260] and
SignOpt [261]. One of the most popular algorithms for generating blue-box
adversarial examples is the Boundary Attack introduced by Brendel and Bethge
in 2019 [262]. The Boundary Attack generates adversarial examples by
iteratively exploring the decision boundary of the model. The formula for
generating adversarial examples using Boundary Attack is as follows:

${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}x_{adv}=x+\alpha\cdot\frac{g}{\left|g\right|_{p}}}$
(7)

Where $x$ is the input, $\alpha$ is a small constant that controls the step
size, $g$ is the gradient of the loss function concerning the input, and
$\left|g\right|_{p}$ is the $l_{p}$ norm of the gradient.

####  VII-C3 Grey-box adversarial attacks

A grey-box adversarial attack targets 6G networks by exploiting partial
knowledge of the system’s architecture and parameters. Leveraging advanced
machine learning techniques and the inherent complexities of 6G, attackers can
introduce carefully crafted perturbations to disrupt network functionality.
Grey-box adversarial attacks involve generating adversarial examples with
limited knowledge of the targeted model. The attacker has access to some, but
not all, of the model’s internal information. For example, the attacker may
know the model’s architecture but not the weights or biases. The goal of a
grey-box attack is to find an adversarial example that can deceive the
targeted model into producing incorrect output, even though the attacker does
not fully know the model’s internal workings. This is often done by leveraging
the gradients of the model concerning the input, which can be computed even if
the attacker does not know the exact values of the model’s parameters [263].
Grey-box attacks are particularly relevant in real-world scenarios, where
attackers may not have access to the full details of a deployed model.
However, they may still be able to mount effective attacks. Defenses against
grey-box attacks typically involve techniques such as input sanitization [264]
or model hardening, which aim to make it harder for attackers to find
effective adversarial examples. One of the most popular algorithms for
generating Grey-box adversarial examples is the Transferability Attack
introduced by Papernot et al. in 2016 [265]. The Transferability Attack
generates adversarial examples by exploiting the transferability property of
adversarial examples, meaning that adversarial examples generated for one
model can also fool another. The formula for generating adversarial examples
using Transferability Attack is as follows:

${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}x_{adv}=x+\epsilon\cdot
sign(\nabla_{x}J(\theta_{target},x,y))}$ (8)

This equation represents the process of generating an adversarial example for
a given input image $x$, concerning a target class $\theta_{target}$ and a
true label $y$, by adding a small perturbation $\epsilon$ to the original
image $x$ in the direction of the sign of the gradient of the target class
probability $J(\theta_{target},x,y)$ concerning the input image $x$.

In most cases, blue-box attacks are viewed as more difficult since the
attacker has less information to operate with. Nevertheless, Grey box attacks
can still be successful if the offensive party has sufficient knowledge of the
pattern to produce successful adversarial examples.

###  VII-D Combined attacks

Combined attacks are a combination of adversarial examples and Trojan
backdoors, which can be used to bypass defenses in the model.

####  VII-D1 Synergetic attack

A synergetic attack consists of a combination of backdoor and adversarial
examples against neural network classifiers.  Synergetic attacks in 6G exploit
the interdependence of heterogeneous technologies, combining vulnerabilities
across multiple layers of the network. By targeting the intricate integration
points in 6G’s collaborative systems, these attacks can disrupt seamless
connectivity, compromising both service quality and security. Consequently,
the complexity of 6G necessitates advanced security measures to counter such
multifaceted threats. Liu et al. [179] proposed a synergetic attack, named
AdvTrojan. The AdvTrojan is enabled based only on the model being infected
through a backdoor during training, and the entries are thoughtfully
disrupted. The AdvTrojan uses two stages that operate in parallel to
progressively relocate the targeted input through the decision-making boundary
to the adversary’s objective class. The model is injected with a Trojan
backdoor during training in the initial stage. The Trojan backdoor is enabled
during inference by incrementing the relevant target inputs using the pre-
specified Trojan trigger. In the second stage, the targeted entry is completed
by a prudent mixture of some adversarial disruption and the Trojan horse
trigger. In the second stage, the targeted entry is completed by a prudent
mixture of the Trojan horse trigger and some adversarial disruption. The
adversary disruption enhances the Trojan horse trigger to exchange the entry
label in the class the adversary targets. In practical terms, the Trojan horse
trigger forwards the entry to an artificial position in the space of the entry
closest to the boundary of the model’s decision. Afterward, the adversarial
disruption makes the terminal push by shifting the forwarded example through
the boundary of the decision, initiating the pre-established backdoor. The
combined attacks can be defined as follows:

${Classifier}_{\theta\uparrow}\left(x\right)=\left\\{\begin{array}[]{c}y_{target},\
\ {\rm if}\ x\ {\rm contains\ Trojan\ trigger}\ t\\\
{Classifier}_{\theta\downarrow}\left(x\right),\ \ {\rm
otherwise}\end{array}\right.$ (9)

Where $y_{target}$ is the attacker’s target,
${Classifier}_{\theta\uparrow}\left(x\right)$ is the classifier with normal
behavior, ${Classifier}_{\theta\downarrow}\left(x\right)$ is the Trojan-
infected classifier, and $x\ $refers to the general input, that can be benign
or malicious.

###  VII-E Poisoning attacks

Poisoning attacks involve manipulating the training data to produce a biased
or inaccurate model. Different types of poisoning attacks are presented,
including federated poisoning attacks, intrusion poisoning attacks, label
flipping attacks, poisonous label attacks, clean-label poisoning attacks, data
poisoning attacks, and generative poisoning attacks [244, 181]. An attacker
will penetrate a machine learning system and inject false or incorrect
information into the database. Over time, as the algorithm learns from this
falsified data, it will produce unwanted and potentially damaging outcomes
[266, 267]. However, data poisoning attacks can be divided into two major
classes: those attacking availability and others attacking integrity.
Availability attacks are frequently not particularly advanced but extensive,
inserting at least as many bad data items as possible into a database. Once an
attack is successful, the machine learning algorithm will be incorrect.
Attacks against the integrity of machine learning are more complicated and
could be more dangerous.

####  VII-E1 Federated poisoning attack

Federated learning uses machine learning in a decentralized mode that does not
directly access clients’ private data. However, Federated learning suffers
from many issues, such as adversarial machine learning-related security
attacks, high communications costs between clients and the server, and high
accuracy [178, 186, 181, 168, 13, 173, 182, 169].  Federated poisoning attacks
can manipulate the aggregated model in 6G by introducing malicious updates
from compromised devices. This could degrade the performance and reliability
of 6G network services that rely on machine learning. As 6G networks are
anticipated to be more AI-driven, such attacks may pose significant threats to
network security and functionality.To address these issues, Tabatabai et al.
[191] present a federated learning algorithm based on evolutionary methods.
The proposed clustering algorithm collects clients in many clusters, each with
a selected model at random to exploit the capabilities of individual models.
Then, the clusters are built in a repeated procedure with the worst cluster
being dropped at every repetition process until only one cluster is available.
Specific clients are kicked out of the clusters for corrupted data usage or
poor overall performance during all iterations. The winning clients are
operated in the upcoming iteration. The cluster that remains with the
surviving clients is then utilized for the best FL model training. The Fast
Gradient Sign Method (FGSM) is adopted for producing adversarial examples to
create a federated poisoning attack.

To mitigate data poisoning attacks, Doku and Rawat [193] proposed a security
system in a federated learning mode. The proposed system uses a Support Vector
Machine to generate the total error a training dataset produces. The
performance evaluation with the IMDB review sentiment dataset shows that the
proposed system achieved an accuracy score of $0.72$. Uprety and Rawat [177]
proposed a technique for mitigating poisoning attacks that focuses on the
nodes’ reputation in the training process. The average reputation score of
every client is computed with the method of probability distribution beta. The
benchmark MNIST dataset is used in the performance evaluation, and the
security analysis demonstrates that the classification model accuracy improved
from $88$% to $93$% over $100$ rounds of communication after eliminating the
attacker nodes by the aggregation servers. The generation of poison attacks in
FL, as illustrated in Figure 12, can be defined by the following steps [195]:

  * •

Step 1: Send the global model ${Model}_{G}$ to honest clients ${Client}_{h}$
and malicious clients ${Client}_{m}$.

  * •

Step 2: The malicious clients ${Client}_{m}$ generate samples of targeted
class.

  * •

Step 3: The malicious clients ${Client}_{m}$ assign wrong label to generated
samples.

  * •

Step 4: The malicious clients ${Client}_{m}$insert poison data to the local
dataset ${Dataset}_{Local}$.

  * •

Step 5: The malicious clients ${Client}_{m}\ $calculate the poisoned update
$L_{{\rm poisoned}}=L^{p}_{t+1}-L^{p}_{t}$.

  * •

Step 6: The honest clients ${Client}_{h}$ calculate the benign update $L_{{\rm
benign}}=L^{h}_{t+1}-L^{h}_{t}$.

  * •

Step 7: Update the local update $L_{{\rm poisoned}}$ and $L_{{\rm benign}}$ to
the server.

Figure 13: FL-targeted label flipping attack

####  VII-E2 Intrusion poisoning attack

Intrusion poisoning attacks can compromise 6G networks by feeding misleading
data into the network’s self-learning systems, leading to suboptimal decisions
and vulnerabilities. Given 6G’s reliance on AI-driven functionalities and
ultra-reliable low-latency communication, malicious data injection can disrupt
real-time operations. This attack can erode trust in the network’s
intelligence, undermining its promise of enhanced connectivity and smarter
applications. Specifically, the intrusion poisoning attack consists of
applying poisoning attacks in the intrusion detection datasets Venkatesan et
al. [233]. An intrusion detection system (IDS) is a network monitoring system
that detects anomalous network behavior and alerts when anomalous activity is
detected. An IDS is a computer program that analyzes a system or network for
malicious activity or policy violations. However, to disturb the IDS systems,
the attackers use intrusion poisoning attacks by implementing the poisoning
attacks in the IDS dataset. The following datasets can be used for evaluating
the performance of ML-based-IDS: Edge-IIoT dataset[123] and X-IIoTID dataset
[268].

####  VII-E3 Label flipping attack

Label flipping attacks involve maliciously altering the data labels to mislead
training processes. In the context of 6G, which promises enhanced machine
learning and AI integrations, a label-flipping attack could compromise the
integrity of AI-driven network functions. Consequently, this could degrade
network performance, compromise user experience, and potentially introduce
vulnerabilities to other integrated systems. Therefore, this attack is
conducted by flipping the labels of specific data samples from one class (the
source class) to another (the target class), as shown in Figure 13. Jebreel et
al. [194] introduced a new security system against the label-flipping attack
in federated learning that dynamically extracts the target and source class
potential gradients of local peer updates, performs an application of a
clustering method on these gradients, and then evaluates the resulting groups
to extract potential bad updates before the aggregation of the model. The
following three data sets are used in the experiments: MNIST, CIFAR10, and
IMDB. The results of three models CNN, ResNet18, and BiLSTM show that the
proposed defense system can offer a lower attack success rate, higher source
class accuracy, and lower test error. The following steps define the
generation of label-flipping attacks in FL:

  * •

Step 1: The malicious clients poison their local training data by flipping the
labels of training examples from a source class ${Class}_{source}$ to a target
class ${Class}_{target}$ without changing the features of the input data.

  * •

Step 2: The honest and malicious clients train their local models using the
same hyper-parameters, model architecture, optimization algorithm, and loss
function sent by the server.

  * •

Step 3: The honest and malicious clients train their local models (i.e., bad
updates from malicious clients and good updates from honest clients) to the
server.

####  VII-E4 Poisonous label attack

Compared to the poisonous attack under the white box requirement, the
poisonous label attack is the blue box, which can enhance the
misclassification error under a more constrained and workable condition of the
poisonous label attack. A Poisonous label attack on 6G could manipulate
training data, skewing the model’s understanding and behavior. As 6G heavily
relies on AI-driven systems for optimization and decision-making, such attacks
could compromise network performance and security. Malicious actors could
exploit this vulnerability, causing communication disruptions or unauthorized
data access. The poisonous label attack involves its capability, the
attacker’s knowledge, and the attacker’s goal. The attackers’ goals are
identified by three components: error specificity, attack specificity, and
security violation. Liu et al. [176] propose the poisonous label attack, which
injects fake images with the poisonous label in the training dataset than
directly modifying the label of the images. The knowledge budget for the
poisonous label attack is defined as:

${Budget}_{know}=\frac{N(w_{know})}{N(w)}+\frac{N({Dataset}_{know})}{N({Dataset}_{train})}$
(10)

Where $N(w)$ is the number of parameters of the victim model,
$N({Dataset}_{train})$ is the number of samples in the training dataset,
$N({Dataset}_{know})$ is the number of samples known by the malicious clients,
$N(w_{know})$ is the number of parameters known by the malicious clients.

####  VII-E5 Clean-label poisoning attack

This is a class of poisoning attacks where the attacker has no control over
the labeling procedure. In this particular threat model, the poison patterns
are generated by inserting undetectable changes that will cause the model to
misbehave in reaction to particular target inputs. Clean-label poisoning
attacks introduce subtly modified, malicious samples into the training data of
machine learning models. In the context of 6G, which heavily relies on AI for
network optimization and decision-making, such attacks could degrade network
performance, compromise security protocols, and disrupt intelligent service
provisions. The ubiquity and complexity of 6G networks amplify the potential
impact and challenges of defending against these sophisticated threats.
Aghakhani et al. [172] propose a scalable clean-label poisoning attack, which
enhances the current state-of-the-art attack success rate by 26.75% in
transfer learning while improving the speed of attack by a factor of 12. This
attack is based on injecting poisoned data into the training dataset so that
the model learns to classify the target input incorrectly. Based on the method
that is based only on first-order information, Zheng et al. [171] proposed a
clean-label data poisoning attack based on first-order information. The
proposed attack is evaluated with the CIFAR-10 dataset on multiple network
architectures: ResNet, VGG, and ConvNet. The attack uses a Convex Polytope
(CP) to solve an optimization problem involving minimizing the distance
between the target feature vector and the poisoned samples set. The
coefficients of the poisoned samples set are specified by $V^{i}_{j}$. The
attack aims to find a set of poisoned samples that can mislead the model when
it encounters specific inputs. The CP adopted solves the following
optimization problem:

$\frac{1}{2n}\sum^{n}_{i=1}{\frac{{\left\|{\alpha}^{i}\left(x_{t}\right)-\sum^{m}_{j=1}{V^{i}_{j}{\alpha}^{i}(x^{j}_{p})}\right\|}^{2}}{{\left\|{\alpha}^{i}\left(x_{t}\right)\right\|}^{2}}}$
(11)

where $x^{j}_{p}$ is a poison samples set, ${\alpha}^{i}$ is the target
feature vector, and $V^{i}_{j}$ specifies the $\ j$-th poison’s coefficient.
The objective function is a convex combination of squared Euclidean distances,
where a positive coefficient weights each distance. The denominator of each
term ensures that the objective function is normalized by the length of the
target feature vector $\alpha^{i}(x_{t})$, which makes it invariant to the
magnitude of the feature vector. The minimization problem seeks to find the
value of $x_{t}$ that minimizes the objective function. Because the objective
function is convex, any local minimum is also a global minimum. Therefore, any
optimization algorithm that converges to a local minimum will also converge to
the global minimum.

####  VII-E6 Data poisoning attack

Data poisoning attacks against machine learning models have emerged as an
influential adversarial machine learning research area. This form of attack
occurs during the training phase of machine learning models. Data poisoning
attacks in 6G can introduce maliciously crafted data into the network’s
training datasets, undermining the AI-driven functions vital for 6G
optimizations. As 6G relies heavily on machine learning for various processes,
tainted data can lead to misinformed network decisions and potential service
disruptions. The attacker attempts to infect the training data by inserting
well-formed samples to impose a harmful model on the learner. Zhang et al.
[269] proposed a data poisoning attack scheme called IMF. The IMF scheme
adopts the bi-level optimization problem to formulate the poisoning attack.
Specifically, the upper-level problem estimates the strength of the actual
fabricated poisoning sample, while the lower-level problem implements the
model parameters based on these poisoning samples. The iterative learning
algorithm is implemented by the IMF scheme to solve the bi-level optimization
problem. The performance evaluation on two datasets, namely, the Stanford Dogs
dataset and the Osteoporotic Fracture dataset, shows that the MFI scheme has
the potential to reshape interpretations of the target samples successfully.
However, Takiddin et al. [199] present a sequential ensemble detector against
data poisoning attacks, which is based on feed-forward neural networks, gated
recurrent units (GRUs), and a deep auto-encoder with attention (AEA).

####  VII-E7 Generative poisoning attack

This type consists of deploying a generative adversarial network (GAN) model
from the attacker’s side to impersonate other participants’ training dataset
patterns, which can initiate the poisoning attack successfully under an
assumption of a more feasible threat. A GAN-based poisoning attack in a 6G
environment involves adversarial manipulation of training datasets, misleading
network algorithms into making incorrect decisions. Zhang et al. [174] propose
a novel poisoning attack, PoisonGAN, which can be applied in federated
learning settings. Specifically, the PoisonGAN attack is based on generative
adversarial networks as presented in Figure 12. Chen et al. [182] propose a
novel adversarial network, DeepPoison, based on one generator and two
discriminators. More precisely, the generator automatically extracts hidden
features from the target class and integrates them into benign training
patterns. The one discriminator monitors the poisoning perturbation ratio. The
second discriminator operates as a target model to witness the poisoning
impacts. The idea of GAN is to build an adversarial game between a generator
${Gen}$ and a discriminator ${Disc}$, where ${Disc}$ is trained on the actual
samples and the generated samples simultaneously, causing the generator
coupled ${Gen}$ to produce samples that are close to the true ones. The
objective functions used by the GAN model are shown as follows:

${{Learn\\_algo}}_{{G}}\left({{Model_{g}}}\right){=}{{E}}_{{z}{\sim}{p}\left({{z}}_{{noise}}\right)}\left[{log}\left({Disc}\left({Gen}\left({z}\right)\right)\right)\right]$
(12)

${{Learn}{\\_}{algo}}_{{D}}\left({{{Model}}_{{d}}{,\
}{Model}}_{{g}}\right){=}{{E}}_{{z}{\sim}{p}\left({{x}}_{{real}}\right)}\\\
\left[{log}\left({Disc}\left({x}\right)\right)\right]{+}{{E}}_{{z}{\sim}{p}\left({{z}}_{{noise}}\right)}\left[{log}\left({1}{-}{Disc}\left({Gen}\left({z}\right)\right)\right)\right]$
(13)

Figure 14: Defense methods against machine learning vulnerabilities

####  VII-E8 Over-the-air spectrum poisoning attack

Over-the-air spectrum poisoning attacks in 6G can maliciously introduce
interference in the radio frequency spectrum, leading to degraded network
performance. By exploiting the intelligent and adaptive nature of 6G’s signal
processing, adversaries can inject, amplify, or manipulate spectrum data. This
disrupts the AI-driven operations in 6G networks, potentially leading to
unreliable communication, misallocated resources, or complete service outages.
This poisoning attack focuses on the spectrum sensing period and handling the
transmitter’s input data in the test and training stage. An adversary performs
these attacks primarily to confuse the sender into making poor transmission
decisions (i.e., an evasion attack) or to tamper with the sender’s recycling
process (i.e., a causal attack). To carry out an over-the-air spectrum
poisoning attack, an attacker must know the transmitter’s sensing parameters
and the communication protocol used. Once the attacker has this information,
he can craft adversarial examples that exploit the vulnerabilities of the
transmitter’s decision-making process. Sagduyu et al. [234] present over-the-
air spectrum sensing poisoning attacks based on the application of adversarial
machine learning. Benchmarking shows that over-the-air spectrum sensing
poisoning attacks are superior to conventional jamming attacks and
substantially decrease the transmitter throughput. Therefore, over-the-air
spectrum poisoning attacks can be more effective than traditional jamming
attacks, which flood the communication channel with noise to disrupt
communication. Additionally, these attacks can significantly reduce the
throughput of the transmitter, which can have significant consequences in
applications such as wireless networks and IoT devices.

TABLE XVI: Defense methods against machine learning vulnerabilities. Defense framework |  Year |  Threat model |  Mitigation solution |  Learning mode |  Targeted ML |  Classifiers |  Datasets |  Pros (+) Open Issues (-)
---|---|---|---|---|---|---|---|---
Blanchard et al. [270] |  2017 |  Byzantine attacks |  Aggregation rules |  Centralized learning |  Spam filtering and image classification |  A multilayer perceptron |  MNIST dataset |  \+ The proposed approach works against attacks involving up to 33% of adversely affected parties
\- Federated poisoning attack is not considered
Fung et al. [168] |  2018 |  Sybil attacks |  Contribution similarity |  Federated learning |  Attack classification, Image classification, and Face recognition |  SqueezeNet model |  MNIST, VGGFace2, KDDCup, and Amazon datasets |  \+ Uses diversity of client updates to identify Sybil’s poisoning.
\- Distributed backdoor attack is not considered
Qu et al. [271] |  2020 |  Poisoning attacks |  Bio-inspired |  Federated Learning |  Image classification |  \- CNN models |  CIFAR-10 dataset |  \+ Fast convergence
\+ Defense against poisoning attacks
\- Distributed backdoor attack is not considered
Wang et al. [272] |  2021 |  Data poisoning attacks |  Experience-based learning |  Centralized learning |  Image classification |  \- Deep Q-Network
\- LSTM model
\- DT model |  Beijing PM 2.5 dataset |  \+ Robustness under data poisoning attacks
\+ Training speed enhancement
\- Generative poisoning attack is not considered
Jangseung et al. [273] |  2021 |  Poisoning attacks |  Preprocessor-based |  Centralized learning |  Image classification |  SVM model |  MNIST and VCI Wisconsin breast cancer datasets |  \+ The protected model outperformed the unprotected model in all best-case scenarios
\- Federated poisoning attack is not considered
Li et al. [274] |  2021 |  Label-flipping attacks |  Dimensionality-reduction and clustering |  Federated learning |  Image classification |  DNN model |  CIFAR-10 and Fashion-MNIST datasets |  \+ Detect and mitigate data-poisoning attacks in Federated learning
\- The authentication using cryptography is not applied
Chan et al. [275] |  2021 |  Label-flipping attacks |  Knowledge Transfer |  Centralized learning |  Security-related applications |  SVM model |  Phishing Website Detection, Spam Assassin, and Letter Recognition datasets |  \+ Can significantly reduce the attack success rate
\- Distributed backdoor attack is not considered
Stokes et al. [276] |  2021 |  Data poisoning attacks |  Cryptography-based authentication |  Centralized learning |  Machine learning software |  N/A |  Text-based datasets |  \+ Authenticate both the trained model and the evaluation set
\- Federated poisoning attack is not considered
Shi et al. [277] |  2021 |  Untargeted attack and targeted attack |  Historical distance detection |  Federated learning |  Image Classification |  CNN model |  MNIST dataset |  \+ It can standardize the scenario of federated learning
\- Generative poisoning attack is not considered
Andreina et al. [278] |  2021 |  Backdoor attacks |  Feedback-based |  Federated learning |  Image classification |  ResNet18 CNN model |  CIFAR-10 and FEMNIST datasets |  \+ Achieve a false-positive rate below 5% with a detection accuracy of 100%
\- The authentication using cryptography is not applied
Gu et al. [279] |  2021 |  Byzantine attacks |  Architectural Style |  Federated learning |  Image classification |  Conditional Variational Autoencoder |  MNIST and FEMINIST datasets |  \+ Can withstand Byzantine attacks and targeted model poisoning attacks
\- Generative poisoning attack is not considered
Liu et al. [280] |  2021 |  Combined attacks |  Asynchronous convergence |  Federated learning |  Image classification |  CNN model |  MNIST and CIFAR-10 datasets |  \+ Achieve accuracy rates of 98.96% with horizontal mode and 95.84% vertical FL mode
\- The authentication using cryptography is not applied
Qiu et al. [200] |  2021 |  Combined attacks |  Moving target defense |  Centralized learning |  Sign recognition and Image classification |  DNN model |  GTSRB and Imagenet datasets |  \+ Resistance against Trojaning attacks
\- Federated poisoning attack is not considered
Shayan et al. [281] |  2021 |  Sybil attacks |  Verifiable random functions |  Federated learning |  Image classification |  A logistic regression and softmax classifiers |  Credit Card fraud and MNIST datasets |  \+ Ability to withstand poisoning attacks and node churn
\- The authentication using cryptography is not applied
Xie et al. [282] |  2022 |  Local poisoning attacks |  Bio-inspired |  Federated learning |  Image and text classification |  \- CNN models
\- LSTM models |  IMDB, CIFAR-10, MNIST, and SST-5 datasets |  \+ Lower success attack rate
\+ Prevents attacks by extracting the benign client’s features
\- Distributed backdoor attack is not considered
Chen et al. [283] |  2022 |  Poisoning attacks |  Reputation-awareness |  Federated learning |  Image classification |  CNN model |  MNIST, Fashion-MNIST, and CIFAR-10 datasets |  \+ Achieve a 30% reduction in learning time and is strong in resistance to representative poisoning attacks
\- The authentication using cryptography is not applied
Hou et al. [284] |  2022 |  Backdoor attacks |  Federated Filters |  Federated learning |  Image classification |  CNN model |  MNIST and CIFAR10 datasets |  \+ Backdoor recognition with the accuracy up to 99%
\- The authentication using cryptography is not applied
Wang et al.[285] |  2023 |  Backdoor attacks |  Adaptive clustering |  Federated learning |  Image classification |  CNN model |  CIFAR-10, MNIST, and FEMNIST datasets |  \+ Defend against backdoor attacks
\- Increased computational overhead and longer training times
Jiang et al. [286] |  2023 |  Label Flipping Attacks |  Data quality detection mechanism |  Federated learning |  Image classification |  CNN model |  CIFAR-10 and Fashion-MNIST datasets |  \+ Defend against label flipping attacks with the lightweight generator
\- Introduce an additional layer of complexity and potential vulnerability

###  VII-F Sybil attacks

Sybil attacks involve the creation of multiple fake identities to manipulate
the training process of a federated learning system. Different types of Sybil
attacks are presented, including Sybil-based poisoning attacks and Sybil-based
collusion attacks [168]. A Sybil attack involves using a single node inside
the targeted network (or system) to generate and operate multiple active false
entities simultaneously. The primary objective of these attacks is to gain the
majority of influence within the targeted system to facilitate its
manipulation.

####  VII-F1 Sybil-based poisoning attack

A Sybil-based poisoning attack in 6G networks involves malicious actors
creating multiple fake identities to influence the network’s decision-making
processes. By overwhelming the network with deceptive information from these
fake nodes, the attack can degrade the quality of service, data integrity, and
trustworthiness. This can lead to compromised network performance, erroneous
decisions, and reduced security in the 6G ecosystem. Sybils conduct federated
learning poisoning attacks by delivering status updates that lead the
distributed model to a poisoned common target. Based on contribution
similarity, Fung et al. [168] propose a new defense system against Sybil-based
poisoning attacks. The proposed system adapts the learning rate of clients
based on contribution similarity.

####  VII-F2 Sybil-based collusion attack

In 6G networks prioritizing decentralized, AI-driven infrastructures and
massive device connectivity, Sybil-based collusion attacks can introduce
numerous malicious identities, misleading the system’s decision-making
processes. By artificially amplifying specific metrics or information,
attackers can disrupt network services, degrade trustworthiness, and
compromise AI-driven functionalities. Xiao et al. [187] propose the Sybil-
based collusion attack, in which the attacker employs the label flipping
scheme to train the poison data locally and collide with other poisoned
patterns. Meanwhile, The malicious adversary will virtually implement several
Sybil nodes in the network so that the server chooses the collusion pattern to
aggregate with a higher probability, constructing a global poisoning pattern.
CIFAR-10 and Fashion-MNIST are benchmark datasets to evaluate attack
performance in federated learning settings with convolutional Neural Networks
(CNN). The experiment analysis shows that the proposed attack can achieve a
more substantial attack effect.

###  VII-G Byzantine attacks

These attacks consist of Byzantine failures in federated learning, which can
exploit the parameters of the local model on the affected devices during the
learning phase. Specifically, Byzantine attacks in federated learning involve
malicious participants that deliberately manipulate the local model to corrupt
the training process. These attacks can severely compromise the integrity and
accuracy of the final global model. The participants performing Byzantine
attacks are known as Byzantine faulty or malicious. These participants can
exhibit arbitrary behavior and send incorrect or intentionally corrupted
updates to the central server, leading to the poisoning of the global model.
The attacker’s knowledge of Byzantine attacks can be classified into No,
Partial, and Complete. Without knowledge, the attacker has no specific
knowledge of the distributed machine learning model, its architecture, or the
data it’s working with. An attacker with partial knowledge has some
information about the distributed machine learning model or its architecture
but not complete details. In the scenario of complete knowledge, the attacker
can access all information related to the distributed machine learning system,
including its architecture, model parameters, training data, and even updates
from other nodes.

####  VII-G1 Federated learning-Byzantine attack

Federated learning in 6G networks decentralizes training across multiple
devices, boosting privacy and efficiency. However, a Byzantine attack, where
malicious nodes provide faulty data or computations, can degrade the model’s
accuracy and compromise the collaborative learning process. Without robust
defense mechanisms, 6G networks might suffer reduced performance, security
vulnerabilities, and data integrity issues. Different from the existing data
poisoning attacks that affect the data collection integrity of the training
datasets, Fang et al. [185] propose Byzantine attacks against federated
learning which affect the integrity of the learning phase in the training
process. The Byzantine attacks are formulated as optimization problems. The
performance evaluation on four real-world datasets (i.e., Breast Cancer
Wisconsin (Diagnostic), CHMNIST, Fashion-MNIST, and MNIST datasets) shows that
the attacks against Byzantine-robust federated learning methods can
substantially increase the error rates.

###  VII-H Inference attacks

In this type of attack, malicious users tend to exploit the already-trained
models.

####  VII-H1 Model Inversion attack

Model inversion attacks in 6G could exploit the advanced machine learning
frameworks, potentially revealing user data processed by these algorithms. As
6G networks rely heavily on AI for optimizing and personalizing services, such
attacks could undermine user privacy. Without robust security measures,
compromised data confidentiality might overshadow the envisioned benefits of
6G. Model inversion attacks are a type of inference attack where an adversary
attempts to infer sensitive information about the training data, such as
inputs or parameters, by analyzing the output of the trained model. Fredrikson
et al. [287] demonstrated the feasibility of such attacks on machine learning
models trained on sensitive data, such as medical records, by using
optimization techniques to reconstruct input data that results in a given
model output.

####  VII-H2 Membership inference attack

Membership inference attacks target machine learning models to determine
whether a specific data point was part of the training set. In the context of
6G, which promises enhanced machine learning integration and ultra-reliable
low-latency communications, such attacks could compromise user privacy by
deducing user-specific data used during network optimizations. A membership
inference attack (MIA) is this kind of security vulnerability exposure where
an adversary seeks to investigate whether an intended sample has been utilized
for training the target ML model or not based on the model’s behavior and
output. Shokri et al. [288] conducted a blue-box MIA attack against ML with a
binary NN classification task-based formalization with a shadow learning
technique to identify members of the training set from non-members. Tang et
al. [289] classified these attacks into two categories, namely, 1) direct
attacks, which often make a single query to interrogate the targeted sample
directly, and 2) indirect attacks, which often makes numerous queries to
interrogate vicinity of the targeted sample to deduce membership.

###  VII-I Highlights the impacts of vulnerabilities in Peer-to-Peer IoT
learning

In this section, we have reviewed a variety of attacks that can significantly
disrupt operations and compromise data in peer-to-peer IoT learning. Backdoor
and poisoning attacks introduce malicious behavior into models or influence
learning processes, while adversarial examples and evasion attacks can cause
widespread model malfunctions or incorrect classifications. Combined attacks
utilize multiple methods, making detection difficult [107]. Sybil and
byzantine attacks can disproportionately impact model learning or introduce
unpredictability into the system. Dropping attacks disrupt the efficiency of
the learning process. Inference, model extraction, and inversion attacks
threaten data privacy by inferring sensitive information, copying proprietary
models, or reconstructing original inputs from outputs. These vulnerabilities
underscore the importance of strong security measures to protect data
integrity, user privacy, and model robustness and accuracy.

TABLE XVII: Impact of ML Attacks on 6G Features.

ML Attack Type |  URLLC |  AI-Centric Networking |  D2D Communication |  Ubiquitous Sensing
---|---|---|---|---
RNN Backdoor |  $\checkmark$ |  $\checkmark$ |  $\checkmark$ |  $\checkmark$
Imperceptible Backdoor Pattern Attack |  |  $\checkmark$ |  $\bigstar$ |
Distributed Backdoor Attack |  $\bigstar$ |  |  $\checkmark$ |
Pixel-space Backdoor Attack |  |  $\checkmark$ |  |  $\checkmark$
Clean-label Backdoor Attack |  |  $\bigstar$ |  |  $\checkmark$
White-box Adversarial Attack |  $\bigstar$ |  $\checkmark$ |  |
Blue-box Adversarial Attack |  $\bigstar$ |  $\checkmark$ |  |
Grey-box Adversarial Attack |  $\bigstar$ |  $\checkmark$ |  |
Synergetic Attack |  $\checkmark$ |  $\checkmark$ |  $\checkmark$ |  $\checkmark$
Federated Poisoning Attack |  |  $\bigstar$ |  $\checkmark$ |
Intrusion Poisoning Attack |  $\checkmark$ |  |  $\checkmark$ |  $\bigstar$
Label Flipping Attack |  |  $\checkmark$ |  |  $\checkmark$
Poisonous Label Attack |  |  |  |  $\checkmark$
Clean-label Poisoning Attack |  |  $\bigstar$ |  |  $\checkmark$
Data Poisoning Attack |  |  |  $\checkmark$ |  $\checkmark$
Generative Poisoning Attack |  |  $\checkmark$ |  |  $\bigstar$
Sybil-based Poisoning Attack |  |  |  $\checkmark$ |
Sybil-based Collusion Attack |  |  |  $\checkmark$ |
Federated learning-Byzantine Attack |  $\checkmark$ |  $\bigstar$ |  $\checkmark$ |
Model Inversion Attack |  |  $\checkmark$ |  |  $\bigstar$
Membership Inference Attack |  |  $\checkmark$ |  |  $\checkmark$

"$\checkmark$" indicates that the attack significantly impacts or exploits the
specific feature of 6G.
"$\bigstar$" indicates a partial impact on the specific 6G feature.
An empty cell indicates that the attack isn’t directly related to the 6G
feature.

###  VII-J Impact of ML Attacks on 6G Features

As the next frontier in wireless communications, 6G is set to bring a myriad
of advancements, particularly in areas such as Ultra-Reliable and Low-Latency
Communication (URLLC), AI-Centric Networking, Device-to-Device (D2D)
Communication, and Ubiquitous Sensing & Data Collection. However, with these
advancements come potential vulnerabilities, especially in the context of
machine learning attacks.

Table XVII gives an in-depth look into how various ML attack types may exploit
or be impacted by the key features of 6G. Notably, RNN Backdoor Attacks appear
to exploit all the highlighted 6G features, underlining the multifaceted
threats posed by this attack type. Moreover, the interplay between AI-Centric
Networking and various adversarial attacks, including White-box, Blue-box, and
Grey-box, emphasizes the potential risks of deeply embedding AI into 6G’s core
functions.

Device-to-Device communication, allowing for direct device interaction without
centralized routing, presents another vulnerable point, susceptible to
Distributed Backdoor Attacks, Federated Poisoning Attacks, and others. This
shows the importance of establishing robust security mechanisms for direct
communication protocols in 6G networks.

Lastly, new vulnerabilities may arise with 6G’s potential to expand sensing
technologies and become more context-aware through Ubiquitous Sensing. This is
evident in its potential susceptibility to Pixel-space Backdoor Attacks, Label
Flipping Attacks, and Data Poisoning Attacks. As 6G develops, understanding
and mitigating these vulnerabilities becomes paramount to ensure a secure,
reliable network.

##  VIII Defense Methods Against Edge Learning Vulnerabilities

The previous section highlighted the potential risks facing future 6G-IoT
systems, as AI will be a key player in ensuring these systems’ proper
functioning, optimizing, and safeguarding. However, to take full advantage of
AI’s benefits while avoiding its associated security risks, the cybersecurity
research community has made significant efforts to make this possible. In this
section, we will attempt to comprehensively shed light on the importance of
such efforts and provide a classification of defensive mechanisms against ML
attacks, as presented in Figure 14. Table XVI lists state-of-the-art methods
proposed for securing machine learning systems. Table XVIII summarizes defense
methods against federated machine learning vulnerabilities.

Figure 15: Training phase defense methods against machine learning vulnerabilities TABLE XVIII: Summary of defense methods against edge learning vulnerabilities. Defense methods |  Defense mechanisms |  Defense strategy | Methodology |  Reference
---|---|---|---|---
Training Phase Defense Methods |  Poisoning Attacks Defense Mechanisms |  Bio-inspired |  The idea is inspired by the biological immune system and deployed in the multi-party learning scenario |  Xie et al. [282]
The authors propose a decentralized cognitive computing model (D2C) |  Qu et al. [271]
Experience-based Learning |  A Deep Q-network (DQN)-based feature selection approach is proposed to mitigate poisoning attacks |  Wang et al. [272]
Preprocessor-based |  A preprocessor for minimizing the effects of poisoning attacks without affecting model performance |  Jangseung et al. [273]
Reputation-Awareness |  Provides a dynamic reputation measurement system among clients participating in learning |  Chen et al. [283]
Dimensionality-reduction and Clustering |  A Kernel Principal Component Analysis (KPCA) and K-mean-based defense strategy against FL-targeted data-poisoning attacks |  Li et al. [274]
Knowledge Transfer |  A transfer learning-based defense against label-flipping attacks |  Chan et al. [275]
Cryptography-based Authentication |  A cryptography-based authentication technique, called VAMP, to protect the integrity of training data |  Stokes et al. [276]
Historical Distance Detection |  A defense strategy based on the analysis of the statistical relationship of the Euclidean distance between clients’ models |  Shi et al. [277]
Backdoor Attacks Defense Mechanisms |  Federated Filters |  The federated backdoor filter defense is proposed in order to identify backdoor inputs |  Hou et al. [284]
Feedback-based |  A feedback-based FL backdoor detection technique called BaFFLE is proposed, which is based on several clients’ data for both training and model tampering discovery |  Andreina et al. [278]
Byzantine Attacks Defense Mechanisms |  Architectural Style |  An unsupervised Conditional Variational Autoencoder (CVAE)-based training anomaly detection system |  Gu et al. [279]
Aggregation Rules |  Chooses and eliminates the most distant vectors with respect to the calculated average from the aggregated gradient updates |  Blanchard et al. [270]
Sybil Attacks Defense Mechanisms |  Verifiable Random Functions |  A secure blockchain-based framework for fully decentralized multi-party privacy-preserving ML |  Shayan et al. [281]
Contribution Similarity |  A defensive discriminant technique to distinguish sybils from legitimate users |  Fung et al. [168]
Combined Attacks Defense Mechanisms |  Moving Target Defense |  an MTD-based defense strategy against Trojan attacks on DNN networks |  Qiu et al. [200]
Asynchronous Convergence |  A security architecture dedicated to a secure FL-based learning workflow |  Liu et al. [280]
Post-Training Phase Defense Methods |  Trained Model Integrity Verification |  Cryptographically-protected Provenance |  A security scheme based on Blockchain and computing fuzzy hash values |  Unal et al. [290]
Optimization-based |  A Bayesian Compromise Detection (BCD) algorithm to solve an optimization problem |  Kuttichira et al. [291]
Inference Phase Defense Methods |  Privacy Leakage Defense Mechanisms |  Gradients Shielding |  Secures exchanged aggregation with homomorphic encryption and differential privacy |  Hao et al. [292]
Self-Distillation |  Generates equivalent member/non-member feedback to alleviate blue-box membership inference threats |  Tang et al. [289]

###  VIII-A Training Phase Defense Methods

We start with the most vulnerable stage of ML, namely the training phase. We
classify the deference mechanisms in the training phase against five threat
categories: poisoning, backdoor, byzantine, Sybil, and combined attacks, as
shown in Figure 15.

####  VIII-A1 Poisoning Attacks Defense Mechanisms

Based on a selection of relevant recent literature, we classify the works that
belong to this class into eight subclasses, namely bio-inspired, experience-
based learning, preprocessor-based, reputation-awareness, dimensionality-
reduction and clustering, knowledge transfer, cryptography-based
authentication, and historical distance detection, as presented below:

  * •

Bio-inspired: These defensive mechanisms are motivated by biological functions
or structures. For example, Xie et al. [282] propose an AI-targeted local
poisoning attacks defense mechanism, which is inspired by the biological
immune system and implemented in a multiple-party training environment. The
proposed system supports antigen identification, immune reaction, and
immunological recall with an adversarial pipeline, with no restrictions
concerning malicious clients’ numbers or the period they participate in the
process. Also, it can make adaptive judgments regarding the aggregation
weights of different local models. Detailed experimental outcomes across image
and text datasets, including MNIST, CIFAR-10, IMDB, and SST-5, with different
neural networks, including CNN and LSTM, and under different poisoning
attacks, such as local label flipping attacks. The results proved the merit of
the proposed system concerning model efficiency and resilience against
poisoning attacks. Specifically, the accuracy reaches 95% even with 75% of the
participating clients being compromised. Another Bio-inspired technique used
for defending against poisoning attacks is the cognitive computing paradigm,
which attempts to reproduce human cognitive processes within a computerized
model. Qu et al. [271] propose a decentralized cognitive computing model (D2C)
using a Blockchained FL framework for IIoT, specifically, for Industry 4.0
systems. The authors introduced blockchain FL into cognitive computing
learning to enhance its privacy-preserving abilities in a fully decentralized
manner. In addition, the authors introduced a modified Markov decision process
(MDP) for performance optimization purposes. Evaluation of the CIFAR-10
dataset regarding three different aspects, global model accuracy, model
convergence, and resistance to poisoning attacks, indicated the feasibility of
the proposed system.

  * •

Experience-based Learning: such defensive mechanisms incorporate practical,
real-life experiences into the systems learning workflow. Wang et al. [272]
propose a Deep Q-network (DQN)-based feature selection approach for cleaning
multi-source data and mitigating poisoning attacks, which RL influences in
terms of an experience-based learning paradigm. Specifically, the problem is
formulated as a contest in dynamic states among agents and the environment. To
circumvent the problem of high computational complexity, the authors provided
SS, a spatial search algorithm for quicker learning of the DQN agent.
Performed simulations on Beijing PM 2.5, Colon Data, and MNIST datasets proved
that the proposed approaches can successfully mitigate data poisoning attacks.

  * •

Preprocessor-based: These defensive mechanisms check the authenticity of the
data before using it for training. Jangseung et al. [273] present Jangseung, a
preprocessor for minimizing the effects of poisoning attacks without affecting
model performance. The system is specifically developed to protect SVMs models
from adversarial perturbations through anomaly detection engines. The approach
involves identifying whether a given data point is an outlier based on
historical training data, and newly entered data elements would be flagged and
rejected as either faulty or malicious. The performance evaluation step using
the MNIST and VCI Wisconsin breast cancer datasets involved training two
replicate models under the same adversarial points, except one is protected by
the proposed system. The results demonstrated that the protected model
outperformed the unprotected model in all best-case scenarios, with 96.2%
versus 53.2% with the MNIST dataset, as well as 88.18% versus 75.51% with the
VCI breast cancer Wisconsin dataset.

  * •

Reputation-Awareness: such defensive mechanisms check the genuineness level of
the clients before allowing them to participate in the model training. Chen et
al. [283] propose RAPFDL, a dynamic asynchronous anti-poisoning FL framework.
The main concept is to provide a dynamic reputation measurement system among
clients participating in learning. Individual clients can collect points by
committing to update their local model parameters and exchange the earned
points. As a result, customers are incentivized to download more updates to
earn more reward points. The correlation coefficient between the accuracy of
the final model and the individual contributions of the parties measures the
level of fairness. Clients use a differentially private GAN (DPGAN) to
generate artificial private data samples, and all of the exchange updates are
encrypted using the improved additive homomorphic encryption. Then, the
updates are stored in the blockchain as unmodifiable records, which ensures
both audibility and transparency. It is demonstrated by the experimental
results on MNIST, Fashion-MNIST, and CIFAR-10 datasets that RAPFDL can achieve
a 30% reduction in learning time and is strong in resistance to representative
poisoning attacks.

  * •

Dimensionality-reduction and Clustering: These defensive mechanisms facilitate
data verification. Li et al. [274] present a Kernel Principal Component
Analysis (KPCA) and K-mean-based defense strategy against FL-targeted data-
poisoning attacks, and precisely, label-flipping attacks. The main reason for
this combination is that KPCA, an algorithm for dimensionality reduction can
handle non-linear data efficiently while coping well with linear data (e.g.,
skewed data). The KPCA algorithm is consequently effective in locating and
filtering out malicious updates, as these updates contain unique features,
while k-mean clustering is used to reduce noise.

  * •

Knowledge Transfer: In these defensive mechanisms, the knowledge already
acquired is used to sustain new training. Chan et al. [275] propose a transfer