learning-based defense against label-flipping attacks. At the same time,
different studies aim to exclude malicious data from the training process. The
authors considered the problem of fully using contaminated samples in training
in cases where the first approach cannot be achieved. The problem is expressed
as transfer learning where the footprint of malicious samples is downplayed by
retrieving only information similar to non-malicious samples in the affected
datasets. In addition, a weight initialization technique is proposed which
allocates a sample weight according to the appropriateness of its predicted
cost provided by a classifier against poisoning attacks.

  * •

Cryptography-based Authentication: These defensive mechanisms are designed to
detect any possible manipulation of the previously verified data, which
protects the data from tampering. Stokes et al. [276] present a cryptography-
based authentication technique, called VAMP, to protect the integrity of
training data. To provide the metadata for the media objects, the manifest is
used. The main idea behind this concept involves protecting the data sets for
training and validation and safeguarding any existing software package
utilized to train and evaluate the model. To protect, the data sets manifests
for the training and validation datasets such as metadata and data bindings
are created to be either published on the VAMP service or integrated directly
into the respective datasets. Then, both the training and evaluation packages
are then uploaded to the service. The proposed system uses SHA2 (256 or 512)
to create manifests, while their serialization can be performed using JSON for
textual datasets or CBOR for binary implemented datasets.

  * •

Historical Distance Detection: In such mechanisms, the objective is to inspect
each client update before using it. Shi et al. [277] propose a defense
mechanism based on analyzing the statistical relationship of the Euclidean
distance between clients’ models. This defense mechanism is constructed based
on the following statements. The distance between honest clients’ models is
not similar to the distance between harmful clients’ models. Most distances
are similar because the number of malicious clients is much lower than that of
honest clients. Based on this, the primary solution proposed is to force the
aggregation server to choose the possible benign clients, which are
established on the minimal sum of their distance from each other. Experiment
evaluations on MNIST with different data distribution techniques (IID and non-
IID) validated the feasibility of the proposed system.

####  VIII-A2 Backdoor Attacks Defense Mechanisms

We classify the works that belong to this class into two subclasses, namely
federated filters and feedback-based mechanisms, as given below:

  * •

Federated Filters: In these mechanisms, the implementation takes place on the
aggregation server side and it can be used for client monitoring and security
attack filter distribution. Hou et al. [284] focused on proposing a defensive
mechanism against backdoor attacks in IIoT-FL environments. The authors
trained multiple backdoor filters and various combinations of XAI models and
classifiers on the server side to guarantee the identification of the backdoor
entries. In addition, the authors proposed a blur-label-flipping strategy to
sanitize the backdoor locations, allowing data availability reclaiming. The
results of experimental evaluations on MNIST and CIFAR10 datasets prove the
system’s validity with an accuracy of up to 99% in recognizing backdoor
samples.

  * •

Feedback-based: Such mechanisms are designed to monitor and provide
authenticity feedback on participating clients continuously. Andreina et al.
[278] propose a feedback-based FL backdoor detection technique called BaFFLE,
which uses several clients’ data for training and model tampering discovery.
The defense strategy consists of taking advantage of the existence of diverse
datasets across clients by embedding a feedback loop within the FL workflow.
To address the various challenges of running a distributed protocol in a
Byzantine environment, the authors used an off-the-shelf procedure to locally
(clients-side) benchmark and compare the updated model’s classification
performance against the former one while excluding updates that demonstrate
unexpected behavior. The proposed system is evaluated using the CIFAR-10 and
FEMNIST datasets, which results show 100% accuracy with less than 5% false
positive rate.

####  VIII-A3 Byzantine Attacks Defense Mechanisms

We organize the works that belong to this class into two subclasses, namely
architectural style and aggregation rules, as provided below:

  * •

Architectural Style: Such mechanisms exploit the architectural learning style
to detect and eliminate malicious updates. Gu et al. [279] proposed an
unsupervised Conditional Variational Autoencoder (CVAE)-based training anomaly
detection system, called Fedcvae, which aims to accurately discover and
eradicate malicious model updates to negate their harmful consequences. The
architecture of Fedcvae consists of an encoder-decoder design. Using the
encoder, the original variables are mapped into low-dimensional embeddings
while the decoder rebuilds their initial variables. The performance evaluation
under four different datasets, namely Vehicle, Synthetic, MNIST, and FEMINIST
(under both IID and non-IID data distribution approaches) shows that the
proposed system can withstand Byzantine attacks and targeted model poisoning
attacks with up to 30% of the participating clients being malicious.

  * •

Aggregation Rules: The main purpose of these mechanisms is to ensure safe
learning, whether all clients are honest or there is a subset of malicious
clients. Blanchard et al. [270] investigated Byzantine failure robustness for
distributed Stochastic Gradient Descent (SGD)-based frameworks. The research
seeks to address the problem of Byzantine failure resilience of an SGD system
with no limitation on the dimension or parameter space size. The proposed
solution entails formulating a resilience property of the aggregation rule
that grasps the core demands for ensuring convergence regardless of having a
subset of Byzantine parties. This technique chooses and eliminates the most
distant vectors concerning the calculated average from the aggregated gradient
updates. The distance is computed using the Euclidean spacing among the
gradient vectors. The approach works well against attacks involving up to 33%
of adversely affected parties.

####  VIII-A4 Sybil Attacks Defense Mechanisms

We classify the works that belong to this class into two subclasses, including
verifiable random functions and contribution similarity, as presented below:

  * •

Verifiable Random Functions: In short, a verifiable random function (VRF) is
given two inputs (a secret key and a seed) and returns two associated values
(hash and proof). The proof allows everyone who is carrying the public key of
the given peer to confirm that the given hash was indeed produced by a peer
who has the private key. Shayan et al. [281] present Biscotti, a secure
blockchain-based framework for fully decentralized multi-party privacy-
preserving ML. The proposed system implements a robust protocol built upon the
most recent block hash and VRFs for subgroup selection among peers carrying
out individual steps (noise addition, updates validations, and secure
aggregations). The proposed system is based on the Proof of Federation (PoF)
protocol, a blockchain consensus protocol that employs FL defenses and renders
them enforceable across decentralized P2P environments. As the selection of
subgroups is performed by the VRF, the stake of the peer is treated as the
individual’s reputation acquired by contributing favorably to the shared
model. This guarantees that an opponent cannot expand its leverage in the
system by establishing too many peers and still not enhancing the model, which
helps mitigate the effect of Sybils. The experimental results with 26
committee sizes provide immunity against an opponent who controls 30% of the
system’s stakes.

  * •

Contribution Similarity: Fung et al. [168] present a defensive discriminant
technique to distinguish Sybils from legitimate users based on the diversity
of their relative gradient updates. The proposed learning parameters use a
per-client adaptive learning rate that relies on the contribution similarity
among the clients. The identification of malicious users is based on a common
goal. Therefore their model updates are susceptible to low variance, which is
done by searching for similarities regarding indicative characteristics.
Experimental evaluations on four datasets, namely MNIST, VGGFace2, KDDCup, and
Amazon, with 5 attack scenarios indicated that the proposed system, in
conjunction with other modules (such as Multi-Krum), can successfully mitigate
a range of different attack types and even when Sybils submerge legitimate
users.

####  VIII-A5 Defense Mechanisms Against Combined Attacks

We organize the works in this class into two subclasses, including Moving
Target Defense and Asynchronous Convergence.

  * •

Moving Target Defense: MTD aims to shift the surface available for attacks
actively. Qiu et al. [200] propose MT-MTD, an MTD-based defense strategy
against Trojan attacks on DNN networks. The framework takes an attack-defense
game approach, specifically, a signaling game. MT-MTD has four main steps. The
first is a dimensional division of the training set by the defender and then
passed to the attacker for training. The second is a random selection from the
resulting collection of dimensional combinations. The third step is the weight
adjustment. The last is the consensus process.

  * •

Asynchronous Convergence: used when aggregation can be done asynchronously.
Liu et al. [280] propose a security architecture dedicated to a secure FL-
based learning workflow. The architecture is composed of two parts. The first
one, named FedBlock, is proposed to introduce decentralization in the learning
process through the use of the blockchain, while the second one, named FedAC,
permits the FL to carry out a global aggregation in an asynchronous manner
while considering a staleness coefficient. The system is dedicated to securing
the learning process against many threats, including Single Point Of Failure
(SPOF), unconventional learning failures, and dedicated attacks. Experimental
evaluation on a physical deployment, namely a Raspberry Pi (4b) under the
MNIST dataset, shows that the system can reach accuracy scores as high as
98.96% in horizontal FL and 95.84% in vertical FL. The reported results of
experimental evaluations on the CIFAR-10 and Fashion-MNIST datasets show that
the proposed approach can be effective in identifying and differentiating
honest updates from malicious ones.

###  VIII-B Post-Training Phase Defense Methods

The defense mechanisms in this class tend to safeguard the model from
tempering after the training phase.

####  VIII-B1 Trained Model Integrity Verification

We organize the works that belong to this class into two subclasses, namely
cryptographically-protected Provenance and optimization-based techniques, as
provided below:

  * •

Cryptographically-protected Provenance: these defensive mechanisms protect the
model trained using encryption. Unal et al. [290] propose a security scheme
based on Blockchain and computing fuzzy hash values for protecting FL
algorithms operating in IoT systems. Notably, the proposed scheme stores the
model parameters in the blockchain, although this is true to some extent, the
model parameters on the blockchain are not stored unchanged. In other words,
the authors applied a one-way hash function upon these model parameters before
their storage on the blockchain. Thus, the introduced scheme provides an
efficient approach that does not affect FL’s privacy concerns. In another
approach under the same context, Stokes et al. [276] propose a cryptography-
based authentication, which provides a cryptography-based provenance module to
protect trained models against alteration of their settings or underlying
structure. The proposed authentication can protect against model poisoning
attacks.

  * •

Optimization-based: in a work by Kuttichira et al. [291], the authors propose
a Bayesian Compromise Detection (BCD) algorithm that aims to address the
potential security risk associated with malignant modification of stored
models in the cloud. The main solution consists of solving an optimization
problem that seeks to maximize the discrepancies in prediction outcomes by
comparing the genuine and damaged models. Although this task seems easy at
first glance, the problem’s difficulty lies in three points, according to the
authors. First, its non-convex nature; second, the large space dimensionality
when searching through the training input distribution for the sensitive
sample; and third, a blue-box view of the compromised model is all that cloud
clients can have. The proposed solution consists of two parts. First, a
Variational Autoencoder (VAE) is used to associate high-dimensional data with
a low-dimensional nonlinear space, and second, Bayesian optimization (BO) is
applied to determine the generally ideal sensitive sample, which can identify
the model corruption with little overhead. Experiments on MNIST, Olivetti, and
CIFAR-100 datasets illustrate the capability of the proposed approach, with
results of up to 100% detection rate.

###  VIII-C Inference Phase Defense Methods

The defense mechanisms in this class are designed to prevent attacks against
ML models during the inference phase.

####  VIII-C1 Privacy Leakage Defense Mechanisms

We classify the work belonging to this class into three subclasses, namely
privacy leakage, self-distillation, and overfitting control, as provided
below:

  * •

Gradients Shielding: The main objective of these mechanisms is to protect the
model’s gradient cryptographically. Hao et al. [292] implemented a privacy-
preserving IDS for FL-based industrial environments named PEFL. The proposed
system secures exchanged aggregation with homomorphic encryption and
differential privacy. In essence, the homomorphically encrypted data of the
private gradients is incorporated into the A-LWE (augmented learning with
error). Benchmarking on the MNIST dataset exhibits good performance, along
with computational and communication cost efficiency.

  * •

Self-Distillation: in a work by Tang et al. [289], the authors propose SELENA.
This privacy-preserving model learning framework generates equivalent
member/non-member feedback to alleviate blue-box membership inference threats.
The proposed system consists of two major components. The first is the Split
Adaptive Inference Ensemble (Split-AI), which allows the model to behave
similarly to members and non-members samples. This is done by training sub-
models through random subsets within the training set. The second is a self-
distillation mechanism that transfers knowledge about the model created by
Split-AI to deliver a protected end model. To do this, Split-AI is first
interrogated with the exact training data to retrieve the related prediction
sequences. Then, the protected end model is trained with these predictions as
soft labels. Evaluations on three different datasets (Purchase100, Texas100,
and CIFAR100), with ResNet-18 and a fully connected four-layer NN, and
different MIA attacks, including direct single-query attacks, label-only
attacks, and adaptive attacks, showed that the proposed system achieved a good
tradeoff between practicality and privacy.

  * •

Overfitting Control: when given a data point on which models have been
trained, they return a high aftereffect value on a class relative to the
others, reflecting the underlying overfitting nature of ML models, which is
taken to be one of the reasons for the effectiveness of MIAs. Hence, according
to Salem et al. [293] controlling overfitting is one way to mitigate such
attacks. The authors propose using two approaches: classical and relatively
new, namely dropout and model stacking. The first is a regularization
technique that prevents complex co-matching on training data and is used
explicitly for DL models. The second one is proposed to be used for other ML
classifiers. The main concept is to organize several ML models to avoid
overfitting hierarchically.

##  IX Lessons learned, Open issues and Challenges

Despite the significant efforts made by the scientific community to strengthen
security in the cyber world in general, and for future networks such as 6G, in
collaboration with emerging technologies such as IoT and AI in particular,
there is however a long way to be traveled, if we are to achieve a fully
secure cyber environment. This section presents the lessons learned, open
issues, and challenges.

###  IX-A Lessons learned

Through comprehensive reviews and in-depth analysis, we were able to classify
the datasets used by the scientific community for experimenting and evaluating
ML techniques on cyber attacks into nine main categories, including, IoT-based
multi-purpose security, attack classification, image classification, time
series classification, human activity recognition, sentiment classification,
location awareness, and text classification. From the attacks against machine
learning systems, we found twenty-one attacks. According to the actual context
of the attack in Edge Learning, we were able to classify them into eight
categories, including backdoor attacks, adversarial examples, combined
attacks, poisoning attacks, Sybil attacks, byzantine attacks, inference
attacks, and drop attacks. Based on the deployment strategy of each security
defense, we classified the defense methods against Edge Learning
vulnerabilities into three categories, including training phase defense
methods, post-training phase defense methods, and inference phase defense
methods.

From the above analysis and reviews that we completed, we suggest the
following steps for proposing defense methods against Edge Learning
vulnerabilities in 6G-enabled IoT networks:

  * •

Definition of the infrastructure of the 6G-enabled IoT network and the
emerging technologies adopted for each layer (e.g., Edge layer, Fog Layer, SDN
Layer, Blockchain Layer, Digital twins layer…etc.).

  * •

Definition of the edge learning model (i.e., centralized, federated,
distributed learning).

  * •

Identification of the attacks against machine learning systems (e.g., backdoor
attacks, adversarial examples, poisoning attacks, inference attacks, … etc.)

  * •

Systematize the threat models based on three dimensions: adversarial goal,
attack strategies, and malicious client selection.

  * •

Selection of the defense method against edge learning vulnerabilities (i.e.,
training phase defense methods, post-training phase defense methods, or
inference phase defense methods).

  * •

Selection of the datasets adopted for the 6G-enabled network (e.g., attack
classification dataset, image classification dataset, human activity
recognition dataset, sentiment classification dataset, and text classification
dataset).

  * •

Selection of the data distribution (i.e., IID and Non-IID).

  * •

Experimenting and evaluating the defense method regarding accuracy, precision,
recall, and attack rate.

  * •

Study the system’s performances with the application of the proposed defense
method regarding scalability and interoperability.

The use of network slicing, multi-access edge computing, cloud computing,
virtualization, terahertz, and sub-terahertz communications, and artificial
intelligence in the 5G/6G IoT testbeds demonstrates the complexity and
diversity of the technologies being developed. These testbeds offer an
opportunity to explore new possibilities in smart transportation, energy
management, healthcare, and industrial automation.

In summary, the development of effective defense methods against Edge Learning
vulnerabilities in 6G-enabled IoT networks requires a systematic approach that
considers the network infrastructure, edge learning models, attack types,
threat models, defense methods, datasets, data distribution, and system
performance. With a comprehensive understanding of these factors, researchers
can better develop and evaluate defense methods to improve the security and
resilience of 6G-enabled IoT networks.

TABLE XIX: Open Issues and Challenges in 6G-IoT Edge Learning vulnerabilities. Challenge |  Description |  Key Considerations
---|---|---
Reliable and Trustworthy Learning |  Ensuring the security of AI-based systems by building security into every aspect of AI, from data preparation to inference |  \- Adoption of secure AI practices
\- Development of secure hardware and software architectures
\- Development of lightweight and efficient ML algorithms
Security Solutions Adaptability |  Developing security solutions that are highly adaptive to the dynamic and heterogeneous nature of wireless networks |  \- Use of pre-trained models, unified datasets, and agreed-upon models between gNB and UEs.
Ethics by Design |  Addressing the ethical dimensions of AI systems at the earliest stage of their design through the "Ethics by Design" approach |  \- Adoption of ethical guidelines
\- Consideration of the specific requirements and constraints of different
applications and industries.
Datasets Formation/Availability |  Creating dependable Edge Learning datasets as well as managing complexity, and ensuring high-quality data availability |  \- Use of Explainable AI (XAI) techniques
\- Introduction of a confidence level and validations, and layered security
models
Learning Complexity |  Managing complexity in mobile communication systems and other complex environments through Explainable AI (XAI) techniques |  \- Use of XAI to provide transparency, understanding, and trust in AI models
High-Quality Data Availability |  Ensuring the availability of high-quality data and using techniques that introduce a confidence level and validations for FL |  \- Adoption of techniques that introduce a confidence level and validations
ML Vulnerabilities Elimination |  Balancing security, performance, profitability, simplicity and complexity, and backward compatibility with future security |  \- Striking a balance between security, performance, and profitability
\- Implementing a layered security model
Defense Strategies Implementations |  Ongoing research and development of security solutions to stay ahead of emerging threats, such as zero-day attacks |  \- Use of ML-based security for detecting zero-day attacks
Large language models at the Edge |  Deploying large language models at the edge for 6G-enabled IoT systems introduces several challenges |  \- Edge devices are often battery-powered and have strict energy consumption limits
\- Latency affect real-time responses and system efficiency.
Real-time Decision Making |  Enabling 6G-IoT devices to make real-time decisions despite some ML models being computationally expensive |  \- Development of lightweight ML algorithms
\- Optimizing computational resources for real-time processing
Model Generalization |  Ensuring ML models generalize well across various 6G-IoT devices despite differences in data distributions |  \- Development of diverse training datasets
\- Adoption of model validation techniques to assess generalization
Scalability |  Dealing with the increasing number of IoT devices and the data they generate |  \- Deployment of distributed ML algorithms
\- Development of efficient data storage solutions

###  IX-B Open issues and Challenges

Table XIX overviews the open issues and challenges in 6G-IoT machine learning
vulnerabilities. The challenges covered include reliable and trustworthy
learning for 6G-IoT intelligence, security solutions adaptability, ethics by
design, datasets formation/availability, learning complexity, high-quality
data availability, ML vulnerabilities elimination, and defense strategies
implementations.

####  IX-B1 Reliable and Trustworthy Learning for 6G-IoT Intelligence

AI capabilities have proven to be a key component of future technologies.
However, there is more involved in ensuring security. Here we present some
challenges when creating reliable and trustworthy learning environments.

  * •

Natively Secured AI: Adversary-aware AI, or natively secured AI, is an
upcoming class for AI-based systems that focuses on building security into the
data preparation, learning, storage, and inference stages. This paradigm is
necessary because cyberattacks can compromise the integrity, confidentiality,
and availability of AI models and their associated data, leading to adverse
consequences. Similar to how cyber attacks forced developers to write secure
code and libraries for programming languages, the increasing adoption of AI-
based systems will necessitate the adoption of secure AI practices. This will
involve not only the development of secure AI algorithms but also the design
and implementation of secure hardware and software architectures to support
these algorithms. Given the complexity and uncertainty associated with AI
techniques, the challenges associated with implementing natively secured AI
are considerable. Additionally, the limitations of IoT devices, such as their
limited processing and storage resources, may pose a challenge to running
complex AI models. To address this challenge, lightweight and efficient ML
algorithms tailored for these devices must be developed, similar to the
situation encountered in the case of lightweight IoT-based authentication
protocols. In summary, natively secured AI is an upcoming class for AI-based
systems that focuses on building security into every aspect of AI, from data
preparation to inference. While significant challenges are associated with
implementing this paradigm, ensuring the security of AI-based systems in the
face of increasingly sophisticated cyber attacks is necessary.

  * •

Trustworthy AI: Trustworthy AI is a key component of natively secure AI,
assuring that AI-based systems operate reliably, transparently, and ethically.
Specifically, Trustworthy AI refers to AI designed to be transparent,
explainable, and accountable. Trustworthy AI systems focus on minimizing the
risks associated with AI algorithms and their decision-making processes by
ensuring that they operate within specific ethical constraints. To achieve
trustworthy AI, secure AI algorithms must be developed that incorporate
ethical and legal standards, including human rights, data protection, and
privacy. This is essential to ensure that AI-based systems are transparent and
explainable and that users can understand how the system works, makes
decisions and uses data.

  * •

Security Solutions Adaptability: The dynamic nature of settings shifts across
wireless networks requires the proposed security solutions to be highly
adaptive. Because many operators collaborate, this diversity can pose a
significant heterogeneity problem if not handled effectively. Solutions to
this problem have been briefly discussed, including pre-trained models,
unified datasets, and agreed-upon models between Next Generation NodeB (gNB)
and user equipment (UEs) [294]. However, real-world implementations and
further tests are different stories with varying perspectives, posing a future
challenge for these networks. Hence, the adaptability of security solutions is
crucial for the security of wireless networks, and ongoing research and
testing are necessary to address the challenges posed by these networks’
dynamic and heterogeneous nature.

  * •

Ethics by Design: While machine intelligence is a promising addition to future
networks, making them fully automated, they do not accommodate ethical
guidelines in the same way as humans [8]. The "Ethics by Design" approach
addresses the ethical dimensions of AI systems at the earliest stage of their
design [295]. And as much as it is not an easy subject for a machine to learn,
the concept itself is difficult to define, as even among humans and nations,
the concept sometimes has wide variations in how it is described. By adopting
the Ethics by Design approach, AI designers and developers can help ensure
that AI systems are developed responsibly and ethically.

####  IX-B2 Datasets Formation/Availability for Edge Learning

In addition to introducing security into AI, other challenges may arise along
the way, including the availability and the creation of dependable Edge
Learning datasets. We highlight two important issues: managing complexity and
ensuring reliable data resource availability.

  * •

Learning Complexity: In a complex environment such as mobile communication
systems, which is likely to be even more complex with the projected
introduction of a range of technologies for future networks such as 6G, and
given the limited hardware capabilities of IoT devices and cellular entities,
particularly in terms of processing power, battery life, and storage, this is
going to be a serious problem in terms of how well these entities can handle
complexity in the interests of functionality. Explainable AI (XAI) can solve
part of the problem, unlike the black-box concept, as it effectively
introduces understanding, management, and trust in AI models, making it easier
to reduce complexity without affecting accuracy. XAI is an important tool for
managing complexity in mobile communication systems and other environments. By
providing transparency, understanding, and trust in AI models, XAI can help
stakeholders navigate complex environments while maintaining functionality and
accuracy.

  * •

High-Quality Data Availability: The FL paradigm solves the problem of
compromising the privacy of private data in the learning phase. However, as we
have seen in the previous sections, this paradigm is subject to different
threats. One is related to data, which can be a significant danger for future
wireless networks since distributed learning is supposed to be a key component
of future networks. It can be tricky to trust models trained on data the
operator has not seen or validated, such as when relying on UEs for the
training task. Similarly, even when dealing with internal components such as
gNBs and Intelligent Radios (IRs), it can be dangerous to trust data collected
from the surrounding environment and used for training directly without the
proper validations. Techniques that introduce a confidence level and
validations must be applied before incorporating the models directly into the
networks. Overall, high-quality data availability and techniques that
introduce a confidence level and validations are critical to ensuring the
success of federated learning in wireless networks. By adopting these
techniques, operators can trust the models generated by the learning process
and use them to make informed decisions about the network’s configuration and
performance.

####  IX-B3 ML Vulnerabilities Elimination and Defense Strategies
Implementations

Developing a security solution that guarantees equal levels for conflicting
aspects is challenging. Here we discuss the trade-offs that can arise when
trying to eliminate ML vulnerabilities and develop security solutions.

  * •

Security vs. Performance and/or Profit: The high data rates promised by 6G
will enable various time-sensitive IoE applications, requiring real-time
security techniques to be deployed, as conventional security schemes are
subject to short-term and long-term failure under such circumstances. This
results in different trade-offs, on the one hand, between security and
performance, e.g., between privacy and accuracy in FL, since introducing a lot
of noise to protect the data will result in reduced accuracy, and vice versa.
On the other hand, the effort for real-time security techniques is costly and
depends on what the telecom industry is willing to pay and their priorities.
The effort for developing and implementing real-time security techniques is
costly, and the telecom industry may have to prioritize security, performance,
and profitability. In some cases, the industry may decide to prioritize
performance or profitability over security, which could compromise the
security of the network and the data transmitted over it. Therefore, it is
essential to balance security, performance, and profitability while deploying
real-time security techniques for 6G networks. This will require careful
consideration of different applications and industries’ specific requirements
and constraints and collaboration between telecom, academia, and government
stakeholders.

  * •

Simplicity vs. Complexity: Since future networks are expected to be more
complex than previous generations, which is natural, this has persisted in the
evolution of all preceding generations. A trivial conclusion that could be
drawn directly is that security solutions need to be complex as well; however,
this can be seen as a double-edged sword since, to keep the system stable,
more secure, and have fewer vulnerabilities, simplicity, and transparency are
keys [58]. In the case of 6G-enabled IoT networks, which are expected to be
more complex, it is important to consider both simplicity and complexity in
security solutions. One approach could be implementing a layered security
model, where multiple layers of security are used to protect against different
attacks. Each layer can be designed with a simple and transparent solution
that is easy to understand and audit while also being integrated into a
larger, more complex security architecture. ML-based security is a promising
approach for detecting zero-day attacks, which are attacks that exploit
vulnerabilities that are unknown to security experts. However, zero-day
attacks targeting ML algorithms can be difficult to detect. This highlights
the need for ongoing research and development in security solutions to stay
ahead of emerging threats.

  * •

Backwards Compatibility vs. Future Security: In addition to the increased
complexity, maintaining backward compatibility is another feature that
persists in all previous generations. While it has benefits, including reduced
deployment costs compared to a new standalone deployment and ease of
upgrading, the backward compatibility functionality potentially exposes old
vulnerabilities. In addition, AI-based security must also consider some of the
previous generation’s parameters to function properly. This may be something
to be carefully examined in the future. Overall, balancing the need for
backward compatibility with the need for future security is a complex
challenge that requires careful consideration. It may be necessary to
prioritize security over backward compatibility in certain cases, but in other
cases, it may be possible to reach a trade-off between the two.

####  IX-B4 Large language models at the Edge

Large language models, like OpenAI’s GPT-4, FalconLLM, and Bert, are
increasingly being used in a wide range of applications, from content
generation to customer service and much more [296, 297, 298]. However,
deploying large language models at the edge for 6G-enabled IoT systems
introduces several challenges. First, security and privacy issues are
magnified in a 6G environment due to the sheer volume and variety of devices
[132]. The immense data flow, which includes sensitive data, presents a
significant risk of cyber threats and vulnerabilities. Second, despite 6G’s
promise of higher data rates and lower latencies, managing the scale and
complexity of these models can be a challenge due to the inherent resource
constraints of IoT devices, potentially affecting model performance and
efficiency. The high density of IoT devices in 6G networks could also strain
network resources and introduce latency issues, impacting real-time responses
and decision-making [64]. Third, maintaining consistency of the model’s
deployment across a diverse range of IoT devices is difficult, and software
updates become challenging due to the vast distribution of devices. Therefore,
deploying large language models at the edge of 6G IoT environments
necessitates careful attention to these challenges to ensure security,
efficiency, and compliance.

####  IX-B5 Universal Multi-prompt and Multi-model attacks

Creating adversarial attacks for discrete forms of data such as text is
substantially more challenging than for continuous data types like images
[299]. This is primarily due to the difficulties in generating adversarial
samples through gradient-based techniques. Existing successful strategies for
attacking text data typically involve heuristic replacement methods at either
the character or word level [300]. Recently, Zou et al. [301] presented a
novel method for creating adversarial attacks on large language models (LLMs)
to generate objectionable content. This method, unlike previous human-centric
or inefficient automated techniques, generates adversarial suffixes through
automated greedy and gradient-based search techniques, prompting LLMs to
produce undesired responses. These generated prompts were highly transferable
across several LLMs, including ChatGPT, Bard, Claude, and others, with a
notable susceptibility in GPT-based models. The study’s findings advance the
understanding of adversarial attacks against LLMs and highlight the need to
improve these systems’ resistance to producing inappropriate content. The
challenge is developing effective defenses against adversarial attacks that
prompt large language models to generate objectionable content.

##  X Conclusions

While 5G is being deployed and commercialized around the world, researchers
are getting excited about what 6G can and should be. One of the most endorsed
views is that AI should be a core component of 6G rather than just an add-on
utility. Edge learning involves making the edge of the network intelligent,
where models are trained at the edge using coordinated distributed learning
paradigms such as FL, with data available across various edge devices.
However, given the existing vulnerabilities in ML, its adoption without
adequate security considerations can expose the network to various threats. In
this paper, we have surveyed the state-of-the-art of existing vulnerabilities
and defenses of federated machine learning for 6G-enabled IoTs. We have
summarized the existing surveys on machine learning for 6G–IoT security and
machine learning-associated threats in three different learning modes:
centralized, federated, and distributed. Through extensive research and
analysis that has been conducted, we have classified the threat models against
machine learning into eight categories, including backdoor attacks,
adversarial examples, combined attacks, poisoning attacks, Sybil attacks,
byzantine attacks, inference attacks, and dropping attacks. In addition, we
have analyzed the state-of-the-art defense methods against federated machine
learning vulnerabilities. Finally, as new attacks and defense technologies are
realized, new research and future overall prospects for 6G-enabled IoTs are
discussed. There still exist several challenging research areas on new attacks
and defense technologies, which should be further investigated in the near
future.

## References

  * [1] F. Tariq, M. R. Khandaker, K.-K. Wong, M. A. Imran, M. Bennis, and M. Debbah, “A speculative study on 6g,” _IEEE Wireless Communications_ , vol. 27, no. 4, pp. 118–125, 2020.
  * [2] E. Batista, P. Lopez-Aguilar, and A. Solanas, “Smart health in the 6g era: Bringing security to future smart health services,” _IEEE Communications Magazine_ , 2023.
  * [3] S. Dang, O. Amin, B. Shihada, and M.-S. Alouini, “What should 6g be?” _Nature Electronics_ , vol. 3, no. 1, pp. 20–29, 2020.
  * [4] D. P. M. Osorio, I. Ahmad, J. D. V. Sánchez, A. Gurtov, J. Scholliers, M. Kutila, and P. Porambage, “Towards 6g-enabled internet of vehicles: Security and privacy,” _IEEE Open Journal of the Communications Society_ , vol. 3, pp. 82–105, 2022.
  * [5] G. Zhu, D. Liu, Y. Du, C. You, J. Zhang, and K. Huang, “Toward an intelligent edge: Wireless communication meets machine learning,” _IEEE communications magazine_ , vol. 58, no. 1, pp. 19–25, 2020.
  * [6] F. Naeem, M. Ali, G. Kaddoum, C. Huang, and C. Yuen, “Security and privacy for reconfigurable intelligent surface in 6g: A review of prospective applications and challenges,” _IEEE Open Journal of the Communications Society_ , 2023.
  * [7] W. Saad, M. Bennis, and M. Chen, “A vision of 6g wireless systems: Applications, trends, technologies, and open research problems,” _IEEE network_ , vol. 34, no. 3, pp. 134–142, 2019.
  * [8] Y. Siriwardhana, P. Porambage, M. Liyanage, and M. Ylianttila, “Ai and 6g security: Opportunities and challenges,” in _2021 Joint European Conference on Networks and Communications & 6G Summit (EuCNC/6G Summit)_. IEEE, 2021, pp. 616–621.
  * [9] A. Chouman, D. M. Manias, and A. Shami, “Towards supporting intelligence in 5g/6g core networks: Nwdaf implementation and initial analysis,” in _2022 International Wireless Communications and Mobile Computing (IWCMC)_. IEEE, 2022, pp. 324–329.
  * [10] M. A. Ferrag, O. Friha, L. Maglaras, H. Janicke, and L. Shu, “Federated deep learning for cyber security in the internet of things: Concepts, applications, and experimental analysis,” _IEEE Access_ , vol. 9, pp. 138 509–138 542, 2021.
  * [11] A. Oseni, N. Moustafa, H. Janicke, P. Liu, Z. Tari, and A. Vasilakos, “Security and privacy for artificial intelligence: Opportunities and challenges,” _arXiv preprint arXiv:2102.04661_ , 2021.
  * [12] M. Kuzlu, C. Fair, and O. Guler, “Role of artificial intelligence in the internet of things (iot) cybersecurity,” _Discover Internet of things_ , vol. 1, no. 1, pp. 1–14, 2021.
  * [13] V. Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2022, pp. 1354–1371.
  * [14] Q. Yang, Y. Liu, T. Chen, and Y. Tong, “Federated machine learning: Concept and applications,” _ACM Transactions on Intelligent Systems and Technology (TIST)_ , vol. 10, no. 2, pp. 1–19, 2019.
  * [15] Y. Sun, J. Liu, J. Wang, Y. Cao, and N. Kato, “When machine learning meets privacy in 6g: A survey,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 4, pp. 2694–2724, 2020.
  * [16] F. Hussain, R. Hussain, S. A. Hassan, and E. Hossain, “Machine learning in iot security: Current solutions and future challenges,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 3, pp. 1686–1721, 2020.
  * [17] A. H. Sodhro, S. Pirbhulal, Z. Luo, K. Muhammad, and N. Z. Zahid, “Toward 6g architecture for energy-efficient communication in iot-enabled smart automation systems,” _IEEE Internet of Things Journal_ , vol. 8, no. 7, pp. 5141–5148, 2020.
  * [18] B. K. Mohanta, D. Jena, U. Satapathy, and S. Patnaik, “Survey on iot security: challenges and solution using machine learning, artificial intelligence and blockchain technology,” _Internet of Things_ , vol. 11, p. 100227, 2020.
  * [19] L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” _arXiv preprint arXiv:2003.02133_ , 2020.
  * [20] X. Fang, W. Feng, T. Wei, Y. Chen, N. Ge, and C.-X. Wang, “5g embraces satellites for 6g ubiquitous iot: Basic models for integrated satellite terrestrial networks,” _IEEE Internet of Things Journal_ , vol. 8, no. 18, pp. 14 399–14 417, 2021.
  * [21] O. A. Wahab, A. Mourad, H. Otrok, and T. Taleb, “Federated machine learning: Survey, multi-level classification, desirable criteria and future directions in communication and networking systems,” _IEEE Communications Surveys & Tutorials_, vol. 23, no. 2, pp. 1342–1397, 2021.
  * [22] F. Guo, F. R. Yu, H. Zhang, X. Li, H. Ji, and V. C. Leung, “Enabling massive iot toward 6g: A comprehensive survey,” _IEEE Internet of Things Journal_ , vol. 8, no. 15, pp. 11 891–11 915, 2021.
  * [23] R. Chen, M. Liu, Y. Hui, N. Cheng, and J. Li, “Reconfigurable intelligent surfaces for 6g iot wireless positioning: A contemporary survey,” _IEEE Internet of Things Journal_ , vol. 9, no. 23, pp. 23 570–23 582, 2022.
  * [24] D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, J. Li, D. Niyato, O. Dobre, and H. V. Poor, “6g internet of things: A comprehensive survey,” _IEEE Internet of Things Journal_ , vol. 9, no. 1, pp. 359–383, 2021.
  * [25] F. Tang, B. Mao, Y. Kawamoto, and N. Kato, “Survey on machine learning for intelligent end-to-end communication toward 6g: From network access, routing to traffic control and streaming adaption,” _IEEE Communications Surveys & Tutorials_, vol. 23, no. 3, pp. 1578–1598, 2021.
  * [26] D. C. Nguyen, M. Ding, Q.-V. Pham, P. N. Pathirana, L. B. Le, A. Seneviratne, J. Li, D. Niyato, and H. V. Poor, “Federated learning meets blockchain in edge computing: Opportunities and challenges,” _IEEE Internet of Things Journal_ , vol. 8, no. 16, pp. 12 806–12 825, 2021.
  * [27] M. Alazab, S. P. RM, M. Parimala, P. K. R. Maddikunta, T. R. Gadekallu, and Q.-V. Pham, “Federated learning for cybersecurity: concepts, challenges, and future directions,” _IEEE Transactions on Industrial Informatics_ , vol. 18, no. 5, pp. 3501–3509, 2021.
  * [28] S. Zaman, K. Alhazmi, M. Aseeri, M. R. Ahmed, R. T. Khan, M. S. Kaiser, and M. Mahmud, “Security threats and artificial intelligence based countermeasures for internet of things networks: a comprehensive survey,” _Ieee Access_ , 2021.
  * [29] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava, “A survey on security and privacy of federated learning,” _Future Generation Computer Systems_ , vol. 115, pp. 619–640, 2021.
  * [30] B. Ghimire and D. B. Rawat, “Recent advances on federated learning for cybersecurity and cybersecurity for federated learning for internet of things,” _IEEE Internet of Things Journal_ , 2022.
  * [31] X. Ma, J. Zhu, Z. Lin, S. Chen, and Y. Qin, “A state-of-the-art survey on solving non-iid data in federated learning,” _Future Generation Computer Systems_ , vol. 135, pp. 244–258, 2022.
  * [32] X. Lu, L. Xiao, P. Li, X. Ji, C. Xu, S. Yu, and W. Zhuang, “Reinforcement learning based physical cross-layer security and privacy in 6g,” _IEEE Communications Surveys & Tutorials_, 2022.
  * [33] M. Vaezi, A. Azari, S. R. Khosravirad, M. Shirvanimoghaddam, M. M. Azari, D. Chasaki, and P. Popovski, “Cellular, wide-area, and non-terrestrial iot: A survey on 5g advances and the road toward 6g,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 2, pp. 1117–1174, 2022.
  * [34] Z. M. Fadlullah, B. Mao, and N. Kato, “Balancing qos and security in the edge: Existing practices, challenges, and 6g opportunities with machine learning,” _IEEE Communications Surveys & Tutorials_, 2022.
  * [35] D. Serghiou, M. Khalily, T. W. Brown, and R. Tafazolli, “Terahertz channel propagation phenomena, measurement techniques and modeling for 6g wireless communication applications: a survey, open challenges and future research directions,” _IEEE Communications Surveys & Tutorials_, 2022.
  * [36] Z. Liu, J. Guo, W. Yang, J. Fan, K.-Y. Lam, and J. Zhao, “Privacy-preserving aggregation in federated learning: A survey,” _IEEE Transactions on Big Data_ , 2022.
  * [37] P. Boobalan, S. P. Ramu, Q.-V. Pham, K. Dev, S. Pandya, P. K. R. Maddikunta, T. R. Gadekallu, and T. Huynh-The, “Fusion of federated learning and industrial internet of things: A survey,” _Computer Networks_ , vol. 212, p. 109048, 2022.
  * [38] Z. Yang, M. Chen, K.-K. Wong, H. V. Poor, and S. Cui, “Federated learning for 6g: Applications, challenges, and opportunities,” _Engineering_ , vol. 8, pp. 33–41, 2022.
  * [39] I. H. Sarker, A. I. Khan, Y. B. Abushark, and F. Alsolami, “Internet of things (iot) security intelligence: a comprehensive overview, machine learning solutions and research directions,” _Mobile Networks and Applications_ , pp. 1–17, 2022.
  * [40] M. M. Azari, S. Solanki, S. Chatzinotas, O. Kodheli, H. Sallouha, A. Colpaert, J. F. M. Montoya, S. Pollin, A. Haqiqatnejad, A. Mostaani _et al._ , “Evolution of non-terrestrial networks from 5g to 6g: A survey,” _IEEE communications surveys & tutorials_, 2022.
  * [41] L. Qian, P. Yang, M. Xiao, O. A. Dobre, M. Di Renzo, J. Li, Z. Han, Q. Yi, and J. Zhao, “Distributed learning for wireless communications: Methods, applications and challenges,” _IEEE Journal of Selected Topics in Signal Processing_ , vol. 16, no. 3, pp. 326–342, 2022.
  * [42] C. Ma, J. L. Wei, B. Liu, M. Ding, L. Yuan, Z. Han, H. V. Poor _et al._ , “Trusted ai in multi-agent systems: An overview of privacy and security for distributed learning,” _arXiv preprint arXiv:2202.09027_ , 2022.
  * [43] T. Zhang, L. Gao, C. He, M. Zhang, B. Krishnamachari, and A. S. Avestimehr, “Federated learning for the internet of things: applications, challenges, and opportunities,” _IEEE Internet of Things Magazine_ , vol. 5, no. 1, pp. 24–29, 2022.
  * [44] B. Veith, D. Krummacker, and H. D. Schotten, “The road to trustworthy 6g: A survey on trust anchor technologies,” _IEEE Open Journal of the Communications Society_ , 2023.
  * [45] B. Mao, J. Liu, Y. Wu, and N. Kato, “Security and privacy on 6g network edge: A survey,” _IEEE Communications Surveys & Tutorials_, 2023.
  * [46] A. Alotaibi and A. Barnawi, “Securing massive iot in 6g: Recent solutions, architectures, future directions,” _Internet of Things_ , p. 100715, 2023\.
  * [47] H. Hua, Y. Li, T. Wang, N. Dong, W. Li, and J. Cao, “Edge computing with artificial intelligence: A machine learning perspective,” _ACM Computing Surveys_ , vol. 55, no. 9, pp. 1–35, 2023.
  * [48] M. M. Y. Al-Quraan, L. Mohjazi, L. Bariah, A. Centeno, A. Zoha, K. Arshad, K. Assaleh, S. Muhaidat, M. Debbah, and M. A. Imran, “Edge-native intelligence for 6g communications driven by federated learning: a survey of trends and challengesf,” _IEEE Transactions on Emerging Topics in Computational Intelligence_ , 2023.
  * [49] G. Xia, J. Chen, C. Yu, and J. Ma, “Poisoning attacks in federated learning: A survey,” _IEEE Access_ , vol. 11, pp. 10 708–10 722, 2023.
  * [50] W. Issa, N. Moustafa, B. Turnbull, N. Sohrabi, and Z. Tari, “Blockchain-based federated learning for securing internet of things: A comprehensive survey,” _ACM Computing Surveys_ , vol. 55, no. 9, pp. 1–43, 2023.
  * [51] J. Zhu, J. Cao, D. Saxena, S. Jiang, and H. Ferradi, “Blockchain-empowered federated learning: Challenges, solutions, and future directions,” _ACM Computing Surveys_ , vol. 55, no. 11, pp. 1–31, 2023.
  * [52] M. Chafii, L. Bariah, S. Muhaidat, and M. Debbah, “Twelve scientific challenges for 6g: Rethinking the foundations of communications theory,” _IEEE Communications Surveys & Tutorials_, 2023.
  * [53] C.-X. Wang, X. You, X. Gao, X. Zhu, Z. Li, C. Zhang, H. Wang, Y. Huang, Y. Chen, H. Haas _et al._ , “On the road to 6g: Visions, requirements, key technologies and testbeds,” _IEEE Communications Surveys & Tutorials_, 2023.
  * [54] W. Khalid, M. A. U. Rehman, T. Van Chien, Z. Kaleem, H. Lee, and H. Yu, “Reconfigurable intelligent surface for physical layer security in 6g-iot: Designs, issues, and advances,” _IEEE Internet of Things Journal_ , 2023\.
  * [55] K. B. Letaief, Y. Shi, J. Lu, and J. Lu, “Edge artificial intelligence for 6g: Vision, enabling technologies, and applications,” _IEEE Journal on Selected Areas in Communications_ , vol. 40, no. 1, pp. 5–36, 2021.
  * [56] S. Ali, W. Saad, N. Rajatheva, K. Chang, D. Steinbach, B. Sliwa, C. Wietfeld, K. Mei, H. Shiri, H.-J. Zepernick _et al._ , “6g white paper on machine learning in wireless communication networks,” _arXiv preprint arXiv:2004.13875_ , 2020.
  * [57] A. Chorti, A. N. Barreto, S. Köpsell, M. Zoli, M. Chafii, P. Sehier, G. Fettweis, and H. V. Poor, “Context-aware security for 6g wireless: the role of physical layer security,” _IEEE Communications Standards Magazine_ , vol. 6, no. 1, pp. 102–108, 2022.
  * [58] V.-L. Nguyen, P.-C. Lin, B.-C. Cheng, R.-H. Hwang, and Y.-D. Lin, “Security and privacy for 6g: A survey on prospective technologies and challenges,” _IEEE Communications Surveys & Tutorials_, vol. 23, no. 4, pp. 2384–2428, 2021.
  * [59] K. B. Letaief, W. Chen, Y. Shi, J. Zhang, and Y.-J. A. Zhang, “The roadmap to 6g: Ai empowered wireless networks,” _IEEE communications magazine_ , vol. 57, no. 8, pp. 84–90, 2019.
  * [60] Z. Yang, M. Chen, K.-K. Wong, H. V. Poor, and S. Cui, “Federated learning for 6g: Applications, challenges, and opportunities,” _Engineering_ , 2021.
  * [61] J. Park, S. Samarakoon, H. Shiri, M. K. Abdel-Aziz, T. Nishio, A. Elgabli, and M. Bennis, “Extreme urllc: Vision, challenges, and key enablers,” _arXiv preprint arXiv:2001.09683_ , 2020.
  * [62] S. A. Abdel Hakeem, H. H. Hussein, and H. Kim, “Security requirements and challenges of 6g technologies and applications,” _Sensors_ , vol. 22, no. 5, p. 1969, 2022.
  * [63] M. U. A. Siddiqui, H. Abumarshoud, L. Bariah, S. Muhaidat, M. A. Imran, and L. Mohjazi, “Urllc in beyond 5g and 6g networks: An interference management perspective,” _IEEE Access_ , 2023.
  * [64] L.-H. Shen, K.-T. Feng, and L. Hanzo, “Five facets of 6g: Research challenges and opportunities,” _ACM Computing Surveys_ , vol. 55, no. 11, pp. 1–39, 2023.
  * [65] J. Wang, J. Liu, J. Li, and N. Kato, “Artificial intelligence-assisted network slicing: Network assurance and service provisioning in 6g,” _IEEE Vehicular Technology Magazine_ , 2023.
  * [66] X. Zhou, M. Bilal, R. Dou, J. J. Rodrigues, Q. Zhao, J. Dai, and X. Xu, “Edge computation offloading with content caching in 6g-enabled iov,” _IEEE Transactions on Intelligent Transportation Systems_ , 2023.
  * [67] C. Han, Y. Wang, Y. Li, Y. Chen, N. A. Abbasi, T. Kürner, and A. F. Molisch, “Terahertz wireless channels: A holistic survey on measurement, modeling, and analysis,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 3, pp. 1670–1707, 2022.
  * [68] Y. Liu, Y. Deng, A. Nallanathan, and J. Yuan, “Machine learning for 6g enhanced ultra-reliable and low-latency services,” _IEEE Wireless Communications_ , vol. 30, no. 2, pp. 48–54, 2023.
  * [69] X. Zhu and C. Jiang, “Creating efficient integrated satellite-terrestrial networks in the 6g era,” _IEEE Wireless Communications_ , vol. 29, no. 4, pp. 154–160, 2022.
  * [70] A. Behravan, V. Yajnanarayana, M. F. Keskin, H. Chen, D. Shrestha, T. E. Abrudan, T. Svensson, K. Schindhelm, A. Wolfgang, S. Lindberg _et al._ , “Positioning and sensing in 6g: Gaps, challenges, and opportunities,” _IEEE Vehicular Technology Magazine_ , 2022.
  * [71] M. Al-Ali and E. Yaacoub, “Resource allocation scheme for embb and urllc coexistence in 6g networks,” _Wireless Networks_ , pp. 1–20, 2023.
  * [72] C. She, T. Q. Duong, T. Q. Quek, H. Viswanathan, and D. Lopez-Perez, “Guest editorial: Intelligent ultra-reliable and low-latency communications in 6g,” _IEEE Wireless Communications_ , vol. 30, no. 2, pp. 12–13, 2023.
  * [73] C.-W. Hsu and H.-S. Kim, “Hyper-dimensional modulation for robust short packets in massive machine-type communications,” _IEEE Transactions on Communications_ , vol. 71, no. 3, pp. 1388–1402, 2023.
  * [74] J. Huang, F. Yang, C. Chakraborty, Z. Guo, H. Zhang, L. Zhen, and K. Yu, “Opportunistic capacity based resource allocation for 6g wireless systems with network slicing,” _Future Generation Computer Systems_ , vol. 140, pp. 390–401, 2023.
  * [75] W. Xu, Z. Yang, D. W. K. Ng, M. Levorato, Y. C. Eldar, and M. Debbah, “Edge learning for b5g networks with distributed signal processing: Semantic communication, edge computing, and wireless sensing,” _IEEE journal of selected topics in signal processing_ , vol. 17, no. 1, pp. 9–39, 2023.
  * [76] H.-J. Song and N. Lee, “Terahertz communications: Challenges in the next decade,” _IEEE Transactions on Terahertz Science and Technology_ , vol. 12, no. 2, pp. 105–117, 2021.
  * [77] M. A. Ferrag, M. Debbah, and M. Al-Hawawreh, “Generative ai for cyber threat-hunting in 6g-enabled iot networks,” _arXiv preprint arXiv:2303.11751_ , 2023.
  * [78] H. Yu, T. Taleb, K. Samdanis, and J. Song, “Towards supporting holographic services over deterministic 6g integrated terrestrial & non-terrestrial networks,” _IEEE Network_ , 2023.
  * [79] A. Alkhateeb, G. Charan, T. Osman, A. Hredzak, J. Morais, U. Demirhan, and N. Srinivas, “Deepsense 6g: A large-scale real-world multi-modal sensing and communication dataset,” _IEEE Communications Magazine_ , 2023.
  * [80] O. Friha and M. A. Ferrag, “Blockchain technology for 6g communication networks: A vision for the future,” in _Cybersecurity Issues in Emerging Technologies_. CRC Press, 2021, pp. 77–96.
  * [81] N. Docomo, “White paper: 5g evolution and 6g,” Tech. Rep.
  * [82] ITU-R, “Imt traffic estimates for the years 2020 to 2030,” Tech. Rep.
  * [83] U. Cisco, “Cisco annual internet report (2018–2023) white paper,” _Cisco: San Jose, CA, USA_ , 2020.
  * [84] T. B. Ahammed, R. Patgiri, and S. Nayak, “A vision on the artificial intelligence for 6g communication,” _ICT Express_ , vol. 9, no. 2, pp. 197–210, 2023.
  * [85] W. Wu, C. Zhou, M. Li, H. Wu, H. Zhou, N. Zhang, X. S. Shen, and W. Zhuang, “Ai-native network slicing for 6g networks,” _IEEE Wireless Communications_ , vol. 29, no. 1, pp. 96–103, 2022.
  * [86] J. Pei, S. Li, Z. Yu, L. Ho, W. Liu, and L. Wang, “Federated learning encounters 6g wireless communication in the scenario of internet of things,” _IEEE Communications Standards Magazine_ , vol. 7, no. 1, pp. 94–100, 2023\.
  * [87] J. Ye, L. Xiang, and X. Ge, “Spatial-temporal modeling and analysis of reliability and delay in urban v2x networks,” _IEEE Transactions on Network Science and Engineering_ , 2023.
  * [88] E. Peltonen, M. Bennis, M. Capobianco, M. Debbah, A. Ding, F. Gil-Castiñeira, M. Jurmu, T. Karvonen, M. Kelanti, A. Kliks _et al._ , “6g white paper on edge intelligence,” _arXiv preprint arXiv:2004.14850_ , 2020.
  * [89] Q. N. Le, L. Bariah, O. A. Dobre, and S. Muhaidat, “Reconfigurable intelligent surface-enabled federated learning for power-constrained devices,” _IEEE Communications Letters_ , vol. 26, no. 11, pp. 2725–2729, 2022.
  * [90] S. Zarandi and H. Tabassum, “Federated double deep q-learning for joint delay and energy minimization in iot networks,” in _2021 IEEE International Conference on Communications Workshops (ICC Workshops)_. IEEE, 2021, pp. 1–6.
  * [91] K. Zheng, G. Jiang, X. Liu, K. Chi, X. Yao, and J. Liu, “Drl-based offloading for computation delay minimization in wireless-powered multi-access edge computing,” _IEEE Transactions on Communications_ , 2023.
  * [92] S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y. Zhou, “A hybrid approach to privacy-preserving federated learning,” in _Proceedings of the 12th ACM workshop on artificial intelligence and security_ , 2019, pp. 1–11.
  * [93] C. Zhou, A. Fu, S. Yu, W. Yang, H. Wang, and Y. Zhang, “Privacy-preserving federated learning in fog computing,” _IEEE Internet of Things Journal_ , vol. 7, no. 11, pp. 10 782–10 793, 2020.
  * [94] V. Mothukuri, P. Khare, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and G. Srivastava, “Federated-learning-based anomaly detection for iot security attacks,” _IEEE Internet of Things Journal_ , vol. 9, no. 4, pp. 2545–2554, 2021.
  * [95] L. Cui, Y. Qu, G. Xie, D. Zeng, R. Li, S. Shen, and S. Yu, “Security and privacy-enhanced federated learning for anomaly detection in iot infrastructures,” _IEEE Transactions on Industrial Informatics_ , vol. 18, no. 5, pp. 3492–3500, 2021.
  * [96] Z. Xu, Y. Guo, C. Chakraborty, Q. Hua, S. Chen, and K. Yu, “A simple federated learning-based scheme for security enhancement over internet of medical things,” _IEEE Journal of Biomedical and Health Informatics_ , 2022.
  * [97] O. Friha, M. A. Ferrag, L. Shu, L. Maglaras, K.-K. R. Choo, and M. Nafaa, “Felids: Federated learning-based intrusion detection system for agricultural internet of things,” _Journal of Parallel and Distributed Computing_ , vol. 165, pp. 17–31, 2022.
  * [98] H. Gao, N. He, and T. Gao, “Sverifl: Successive verifiable federated learning with privacy-preserving,” _Information Sciences_ , vol. 622, pp. 98–114, 2023.
  * [99] L. Ouyang, F.-Y. Wang, Y. Tian, X. Jia, H. Qi, and G. Wang, “Artificial identification: a novel privacy framework for federated learning based on blockchain,” _IEEE Transactions on Computational Social Systems_ , 2023.
  * [100] O. Friha, M. A. Ferrag, M. Benbouzid, T. Berghout, B. Kantarci, and K.-K. R. Choo, “2df-ids: Decentralized and differentially private federated learning-based intrusion detection system for industrial iot,” _Computers & Security_, p. 103097, 2023.
  * [101] J. Li, X. Tong, J. Liu, and L. Cheng, “An efficient federated learning system for network intrusion detection,” _IEEE Systems Journal_ , 2023.
  * [102] X. You, X. Liu, X. Lin, J. Cai, and S. Chen, “Accuracy degrading: Towards participation-fair federated learning,” _IEEE Internet of Things Journal_ , 2023.
  * [103] M. J. Baucas, P. Spachos, and K. N. Plataniotis, “Federated learning and blockchain-enabled fog-iot platform for wearables in predictive healthcare,” _IEEE Transactions on Computational Social Systems_ , 2023.
  * [104] Z. Abou El Houda, A. S. Hafid, and L. Khoukhi, “Mitfed: A privacy preserving collaborative network attack mitigation framework based on federated learning using sdn and blockchain,” _IEEE Transactions on Network Science and Engineering_ , 2023.
  * [105] Q. Chen, Z. Wang, W. Zhang, and X. Lin, “Ppt: a privacy-preserving global model training protocol for federated learning in p2p networks,” _Computers & Security_, vol. 124, p. 102966, 2023.
  * [106] B. Mao, F. Tang, Y. Kawamoto, and N. Kato, “Ai models for green communications towards 6g,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 1, pp. 210–247, 2021.
  * [107] M. Mitev, A. Chorti, H. V. Poor, and G. Fettweis, “What physical layer security can do for 6g security,” _IEEE Open Journal of Vehicular Technology_ , 2023.
  * [108] N. Kato, B. Mao, F. Tang, Y. Kawamoto, and J. Liu, “Ten challenges in advancing machine learning technologies toward 6g,” _IEEE Wireless Communications_ , vol. 27, no. 3, pp. 96–103, 2020.
  * [109] U. Demirhan and A. Alkhateeb, “Integrated sensing and communication for 6g: Ten key machine learning roles,” _IEEE Communications Magazine_ , 2023.
  * [110] L. Xiao, X. Wan, X. Lu, Y. Zhang, and D. Wu, “Iot security techniques based on machine learning: How do iot devices use ai to enhance security?” _IEEE Signal Processing Magazine_ , vol. 35, no. 5, pp. 41–49, 2018.
  * [111] S. M. Tahsien, H. Karimipour, and P. Spachos, “Machine learning based solutions for security of internet of things (iot): A survey,” _Journal of Network and Computer Applications_ , vol. 161, p. 102630, 2020.
  * [112] Q. Liu, P. Li, W. Zhao, W. Cai, S. Yu, and V. C. Leung, “A survey on security threats and defensive techniques of machine learning: A data driven view,” _IEEE access_ , vol. 6, pp. 12 103–12 117, 2018.
  * [113] M. Xue, C. Yuan, H. Wu, Y. Zhang, and W. Liu, “Machine learning security: Threats, countermeasures, and evaluations,” _IEEE Access_ , vol. 8, pp. 74 720–74 742, 2020.
  * [114] Y. Hu, W. Kuang, Z. Qin, K. Li, J. Zhang, Y. Gao, W. Li, and K. Li, “Artificial intelligence security: threats and countermeasures,” _ACM Computing Surveys (CSUR)_ , vol. 55, no. 1, pp. 1–36, 2021.
  * [115] J. Liu, M. Nogueira, J. Fernandes, and B. Kantarci, “Adversarial machine learning: A multilayer review of the state-of-the-art and challenges for wireless and mobile systems,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 1, pp. 123–159, 2022.
  * [116] J. Hao and Y. Tao, “Adversarial attacks on deep learning models in smart grids,” _Energy Reports_ , vol. 8, pp. 123–129, 2022.
  * [117] Z. Chen, J. Liu, Y. Shen, M. Simsek, B. Kantarci, H. T. Mouftah, and P. Djukic, “Machine learning-enabled iot security: Open issues and challenges under advanced persistent threats,” _ACM Computing Surveys (CSUR)_ , 2022.
  * [118] M. Al-Rubaie and J. M. Chang, “Privacy-preserving machine learning: Threats and solutions,” _IEEE Security & Privacy_, vol. 17, no. 2, pp. 49–58, 2019\.
  * [119] P. Liu, X. Xu, and W. Wang, “Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives,” _Cybersecurity_ , vol. 5, no. 1, pp. 1–19, 2022.
  * [120] M. S. Jere, T. Farnan, and F. Koushanfar, “A taxonomy of attacks on federated learning,” _IEEE Security & Privacy_, vol. 19, no. 2, pp. 20–28, 2020\.
  * [121] M. Chen, D. Gündüz, K. Huang, W. Saad, M. Bennis, A. V. Feljan, and H. V. Poor, “Distributed learning in wireless networks: Recent progress and future challenges,” _IEEE Journal on Selected Areas in Communications_ , 2021\.
  * [122] J. He, S. Guo, M. Li, and Y. Zhu, “Acefl: Federated learning accelerating in 6g-enabled mobile edge computing networks,” _IEEE Transactions on Network Science and Engineering_ , 2022.
  * [123] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” _IEEE Access_ , vol. 10, pp. 40 281–40 306, 2022.
  * [124] T. Gong, I. Vinieratou, R. Ji, C. Huang, G. C. Alexandropoulos, L. Wei, Z. Zhang, M. Debbah, H. V. Poor, and C. Yuen, “Holographic mimo communications: Theoretical foundations, enabling technologies, and future directions,” _arXiv preprint arXiv:2212.01257_ , 2022.
  * [125] S. Naser, L. Bariah, S. Muhaidat, P. C. Sofotasios, M. Al-Qutayri, E. Damiani, and M. Debbah, “Toward federated-learning-enabled visible light communication in 6g systems,” _IEEE Wireless Communications_ , vol. 29, no. 1, pp. 48–56, 2022.
  * [126] G. C. Alexandropoulos, A. Mokh, R. Khayatzadeh, J. de Rosny, M. Kamoun, A. Ourir, A. Tourin, M. Fink, and M. Debbah, “Time reversal for 6g spatiotemporal focusing: Recent experiments, opportunities, and challenges,” _IEEE Vehicular Technology Magazine_ , 2022.
  * [127] L. Wei, C. Huang, G. C. Alexandropoulos, E. Wei, Z. Zhang, M. Debbah, and C. Yuen, “Multi-user wireless communications with holographic mimo surfaces: A convenient channel model and spectral efficiency analysis,” in _2022 Joint European Conference on Networks and Communications & 6G Summit (EuCNC/6G Summit)_. IEEE, 2022, pp. 488–493.
  * [128] C. Chaccour, M. N. Soorki, W. Saad, M. Bennis, P. Popovski, and M. Debbah, “Seven defining features of terahertz (thz) wireless systems: A fellowship of communication and sensing,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 2, pp. 967–993, 2022.
  * [129] M. A. Ferrag, L. Maglaras, A. Argyriou, D. Kosmanos, and H. Janicke, “Security for 4g and 5g cellular networks: A survey of existing authentication and privacy-preserving schemes,” _Journal of Network and Computer Applications_ , vol. 101, pp. 55–82, 2018.
  * [130] J. Cao, M. Ma, H. Li, Y. Zhang, and Z. Luo, “A survey on security aspects for lte and lte-a networks,” _IEEE communications surveys & tutorials_, vol. 16, no. 1, pp. 283–302, 2013.
  * [131] A. Boualouache and T. Engel, “A survey on machine learning-based misbehavior detection systems for 5g and beyond vehicular networks,” _IEEE Communications Surveys & Tutorials_, 2023.
  * [132] K. Ramezanpour, J. Jagannath, and A. Jagannath, “Security and privacy vulnerabilities of 5g/6g and wifi 6: Survey and research directions from a coexistence perspective,” _Computer Networks_ , vol. 221, p. 109515, 2023\.
  * [133] E. M. Ghourab, W. Jaafar, L. Bariah, S. Naser, S. Muhaidat, and H. Yanikomeroglu, “Interplay between physical layer security and blockchain technology for 5g and beyond: A comprehensive survey,” 2023.
  * [134] M. Mukherjee, M. A. Ferrag, L. Maglaras, A. Derhab, and M. Aazam, “Security and privacy issues and solutions for fog,” _Fog and fogonomics: challenges and practices of fog computing, communication, networking, strategy, and economics_ , pp. 353–374, 2020.
  * [135] S. Iftikhar, S. S. Gill, C. Song, M. Xu, M. S. Aslanpour, A. N. Toosi, J. Du, H. Wu, S. Ghosh, D. Chowdhury _et al._ , “Ai-based fog and edge computing: A systematic review, taxonomy and future directions,” _Internet of Things_ , p. 100674, 2022.
  * [136] S. Iftikhar, M. M. M. Ahmad, S. Tuli, D. Chowdhury, M. Xu, S. S. Gill, and S. Uhlig, “Hunterplus: Ai based energy-efficient task scheduling for cloud–fog computing environments,” _Internet of Things_ , vol. 21, p. 100667, 2023.
  * [137] C. Liu, C. Liu, Y. Shang, S. Chen, B. Cheng, and J. Chen, “An adaptive prediction approach based on workload pattern discrimination in the cloud,” _Journal of Network and Computer Applications_ , vol. 80, pp. 35–44, 2017\.
  * [138] “Nvidia edge ai chips,” accessed: 12-03-2023. [Online]. Available: https://www.nvidia.com/en-in/deep-learning-ai/solutions/ai-at-the-edge/
  * [139] “Google cloud iot edge,” accessed: 12-03-2023. [Online]. Available: https://cloud.google.com/blog/products/gcp/bringing-intelligence-edge-cloud-iot
  * [140] F. Morishita, N. Kato, S. Okubo, T. Toi, M. Hiraki, S. Otani, H. Abe, Y. Shinohara, and H. Kondo, “A cmos image sensor and an ai accelerator for realizing edge-computing-based surveillance camera systems,” in _2021 Symposium on VLSI Circuits_. IEEE, 2021, pp. 1–2.
  * [141] “Philips rpm,” accessed: 12-03-2023. [Online]. Available: https://www.usa.philips.com/healthcare/services/population-health-management/patient-engagement/remote-patient-monitoring
  * [142] “Ge - predix platform,” accessed: 12-03-2023. [Online]. Available: https://www.ge.com/digital/iiot-platform
  * [143] P. Joshi, M. Hasanuzzaman, C. Thapa, H. Afli, and T. Scully, “Enabling all in-edge deep learning: A literature review,” _IEEE Access_ , 2023.
  * [144] T. Cui, R. Yang, C. Fang, and S. Yu, “Deep reinforcement learning-based resource allocation for content distribution in iot-edge-cloud computing environments,” _Symmetry_ , vol. 15, no. 1, p. 217, 2023.
  * [145] G. Pan, H. Zhang, S. Xu, S. Zhang, and X. Chen, “Joint optimization of video-based ai inference tasks in mec-assisted augmented reality systems,” _IEEE Transactions on Cognitive Communications and Networking_ , 2023.
  * [146] N. Cheng, F. Lyu, W. Quan, C. Zhou, H. He, W. Shi, and X. Shen, “Space/aerial-assisted computing offloading for iot applications: A learning-based approach,” _IEEE Journal on Selected Areas in Communications_ , vol. 37, no. 5, pp. 1117–1129, 2019.
  * [147] “5g-transformer,” accessed: 12-03-2023. [Online]. Available: https://5g-ppp.eu/5g-transformer/
  * [148] “5g mobile network architecture,” accessed: 12-03-2023. [Online]. Available: https://5g-monarch.eu/
  * [149] “H2020 project 5g-picture,” accessed: 12-03-2023. [Online]. Available: https://www.5g-picture-project.eu/
  * [150] “5g-coral: A 5g convergent virtualised radio access network living at the edge,” accessed: 12-03-2023. [Online]. Available: https://cordis.europa.eu/project/id/761586
  * [151] “5g-empower project,” accessed: 12-03-2023. [Online]. Available: https://5g-empower.io/
  * [152] “6g flagship project,” accessed: 12-03-2023. [Online]. Available: https://www.6gflagship.com/
  * [153] “5g open innovation lab,” accessed: 12-03-2023. [Online]. Available: https://www.5goilab.com/about/
  * [154] “Encqor 5g,” accessed: 12-03-2023. [Online]. Available: https://www.encqor.ca/
  * [155] “5g city,” accessed: 12-03-2023. [Online]. Available: https://www.5gcity.eu/
  * [156] “5g-acia,” accessed: 12-03-2023. [Online]. Available: https://5g-acia.org/
  * [157] “6g-platform,” accessed: 12-03-2023. [Online]. Available: https://www.6g-platform.com/
  * [158] M. U. Hassan, M. H. Rehmani, and J. Chen, “Differential privacy techniques for cyber physical systems: a survey,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 1, pp. 746–789, 2019.
  * [159] A. Mohammed and R. Kora, “A comprehensive review on ensemble deep learning: Opportunities and challenges,” _Journal of King Saud University-Computer and Information Sciences_ , 2023.
  * [160] A. Dunmore, J. Jang-Jaccard, F. Sabrian, and J. Kwak, “Generative adversarial networks for malware detection: a survey,” _arXiv preprint arXiv:2302.08558_ , 2023.
  * [161] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, “Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study,” _Journal of Information Security and Applications_ , vol. 50, p. 102419, 2020.
  * [162] C. Marcolla, V. Sucasas, M. Manzano, R. Bassoli, F. H. Fitzek, and N. Aaraj, “Survey on fully homomorphic encryption, theory, and applications,” _Proceedings of the IEEE_ , vol. 110, no. 10, pp. 1572–1609, 2022.
  * [163] M. A. Ferrag and L. Shu, “The performance evaluation of blockchain-based security and privacy systems for the internet of things: A tutorial,” _IEEE Internet of Things Journal_ , vol. 8, no. 24, pp. 17 236–17 260, 2021\.
  * [164] W. Rafique, L. Qi, I. Yaqoob, M. Imran, R. U. Rasool, and W. Dou, “Complementing iot services through software defined networking and edge computing: A comprehensive survey,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 3, pp. 1761–1804, 2020.
  * [165] L. Sadineni, E. S. Pilli, and R. B. Battula, “Provnet-iot: Provenance based network layer forensics in internet of things,” _Forensic Science International: Digital Investigation_ , vol. 43, p. 301441, 2022.
  * [166] A. Ghourabi, “A security model based on lightgbm and transformer to protect healthcare systems from cyberattacks,” _IEEE Access_ , vol. 10, pp. 48 890–48 903, 2022.
  * [167] C. Chen and J. Dai, “Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification,” _Neurocomputing_ , vol. 452, pp. 253–262, 2021.
  * [168] C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” _arXiv preprint arXiv:1808.04866_ , 2018.
  * [169] X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, and Y. Liu, “Lomar: A local defense against poisoning attack on federated learning,” _IEEE Transactions on Dependable and Secure Computing_ , 2021.
  * [170] Z. Xiang, D. J. Miller, and G. Kesidis, “Reverse engineering imperceptible backdoor attacks on deep neural networks for detection and training set cleansing,” _Computers & Security_, vol. 106, p. 102280, 2021.
  * [171] T. Zheng and B. Li, “First-order efficient general-purpose clean-label data poisoning,” in _IEEE INFOCOM 2021-IEEE Conference on Computer Communications_. IEEE, 2021, pp. 1–10.
  * [172] H. Aghakhani, D. Meng, Y.-X. Wang, C. Kruegel, and G. Vigna, “Bullseye polytope: A scalable clean-label poisoning attack with improved transferability,” _arXiv preprint arXiv:2005.00191_ , 2020.
  * [173] X. Zhou, M. Xu, Y. Wu, and N. Zheng, “Deep model poisoning attack on federated learning,” _Future Internet_ , vol. 13, no. 3, p. 73, 2021.
  * [174] J. Zhang, B. Chen, X. Cheng, H. T. T. Binh, and S. Yu, “Poisongan: Generative poisoning attacks against federated learning in edge computing systems,” _IEEE Internet of Things Journal_ , vol. 8, no. 5, pp. 3310–3322, 2021.
  * [175] Y. Guo, Q. Wang, T. Ji, X. Wang, and P. Li, “Resisting distributed backdoor attacks in federated learning: A dynamic norm clipping approach,” in _2021 IEEE International Conference on Big Data (Big Data)_. IEEE, 2021, pp. 1172–1182.
  * [176] H. Liu, D. Li, and Y. Li, “Poisonous label attack: Black-box data poisoning attack with enhanced conditional dcgan,” _Neural Processing Letters_ , vol. 53, no. 6, pp. 4117–4142, 2021.
  * [177] A. Uprety and D. B. Rawat, “Mitigating poisoning attack in federated learning,” in _2021 IEEE Symposium Series on Computational Intelligence (SSCI)_. IEEE, 2021, pp. 01–07.
  * [178] D. Cao, S. Chang, Z. Lin, G. Liu, and D. Sun, “Understanding distributed poisoning attack in federated learning,” in _2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS)_. IEEE, 2019, pp. 233–239.
  * [179] G. Liu, I. Khalil, A. Khreishah, and N. Phan, “A synergetic attack against neural network classifiers combining backdoor and adversarial examples,” in _2021 IEEE International Conference on Big Data (Big Data)_. IEEE, 2021, pp. 834–846.
  * [180] W. Yang, J. Yuan, X. Wang, and P. Zhao, “Tsadv: Black-box adversarial attack on time series with local perturbations,” _Engineering Applications of Artificial Intelligence_ , vol. 114, p. 105218, 2022.
  * [181] G. Sun, Y. Cong, J. Dong, Q. Wang, L. Lyu, and J. Liu, “Data poisoning attacks on federated machine learning,” _IEEE Internet of Things Journal_ , 2022\.
  * [182] J. Chen, L. Zhang, H. Zheng, X. Wang, and Z. Ming, “Deeppoison: Feature transfer based stealthy poisoning attack for dnns,” _IEEE Transactions on Circuits and Systems II: Express Briefs_ , vol. 68, no. 7, pp. 2618–2622, 2021\.
  * [183] F. Khan, R. L. Kumar, M. H. Abidi, S. Kadry, H. Alkhalefah, and M. K. Aboudaif, “Federated split learning model for industry 5.0: A data poisoning defense for edge computing,” _Electronics_ , vol. 11, no. 15, p. 2393, 2022.
  * [184] M. Biolková and B. Nguyen, “Neural predictor for black-box adversarial attacks on speech recognition,” _arXiv preprint arXiv:2203.09849_ , 2022\.
  * [185] M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to $\\{$Byzantine-Robust$\\}$ federated learning,” in _29th USENIX Security Symposium (USENIX Security 20)_ , 2020, pp. 1605–1622.
  * [186] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in _European Symposium on Research in Computer Security_. Springer, 2020, pp. 480–501.
  * [187] X. Xiao, Z. Tang, C. Li, B. Xiao, and K. Li, “Sca: Sybil-based collusion attacks of iiot data poisoning in federated learning,” _IEEE Transactions on Industrial Informatics_ , 2022.
  * [188] G. Severi, M. Jagielski, G. Yar, Y. Wang, A. Oprea, and C. Nita-Rotaru, “Network-level adversaries in federated learning,” in _2022 IEEE Conference on Communications and Network Security (CNS)_. IEEE, 2022, pp. 19–27.
  * [189] J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adversarial examples for text classification,” _arXiv preprint arXiv:1712.06751_ , 2017\.
  * [190] Y. Wang, J. Liu, X. Chang, J. Mišić, and V. B. Mišić, “Iwa: integrated gradient-based white-box attacks for fooling deep neural networks,” _International Journal of Intelligent Systems_ , vol. 37, no. 7, pp. 4253–4276, 2022.
  * [191] S. Tabatabai, I. Mohammed, B. Qolomany, A. Albaseer, K. Ahmad, M. Abdallah, and A. Al-Fuqaha, “Exploration and exploitation in federated learning to exclude clients with poisoned data,” in _2022 International Wireless Communications and Mobile Computing (IWCMC)_. IEEE, 2022, pp. 407–412.
  * [192] Z. Zhang, Y. Zhang, D. Guo, L. Yao, and Z. Li, “Secfednids: Robust defense for poisoning attack against federated learning-based network intrusion detection system,” _Future Generation Computer Systems_ , vol. 134, pp. 154–169, 2022\.
  * [193] R. Doku and D. B. Rawat, “Mitigating data poisoning attacks on a federated learning-edge computing network,” in _2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)_. IEEE, 2021, pp. 1–6.
  * [194] N. M. Jebreel, J. Domingo-Ferrer, D. Sánchez, and A. Blanco-Justicia, “Defending against the label-flipping attack in federated learning,” _arXiv preprint arXiv:2207.01982_ , 2022.
  * [195] J. Zhang, J. Chen, D. Wu, B. Chen, and S. Yu, “Poisoning attack in federated learning using generative adversarial nets,” in _2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)_. IEEE, 2019, pp. 374–380.
  * [196] P. Zhao, H. Jiang, J. Li, Z. Xiao, D. Liu, J. Ren, and D. Guo, “Garbage in, garbage out: Poisoning attacks disguised with plausible mobility in data aggregation,” _IEEE Transactions on Network Science and Engineering_ , vol. 8, no. 3, pp. 2679–2693, 2021.
  * [197] J. Wu and J. He, “Indirect invisible poisoning attacks on domain adaptation,” in _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining_, 2021, pp. 1852–1862.
  * [198] R. Ning, J. Li, C. Xin, and H. Wu, “Invisible poison: A blackbox clean label backdoor attack to deep neural networks,” in _IEEE INFOCOM 2021-IEEE Conference on Computer Communications_. IEEE, 2021, pp. 1–10.
  * [199] A. Takiddin, M. Ismail, U. Zafar, and E. Serpedin, “Robust electricity theft detection against data poisoning attacks in smart grids,” _IEEE Transactions on Smart Grid_ , vol. 12, no. 3, pp. 2675–2684, 2020.
  * [200] Y. Qiu, J. Wu, S. Mumtaz, J. Li, A. Al-Dulaimi, and J. J. Rodrigues, “Mt-mtd: Muti-training based moving target defense trojaning attack in edged-ai network,” in _ICC 2021-IEEE International Conference on Communications_. IEEE, 2021, pp. 1–6.
  * [201] G. Apruzzese and V. Subrahmanian, “Mitigating adversarial gray-box attacks against phishing detectors,” _IEEE Transactions on Dependable and Secure Computing_ , 2022.
  * [202] “Kdd cup 1999,” http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html. last accessed 04 November 2022.
  * [203] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the kdd cup 99 data set,” in _2009 IEEE symposium on computational intelligence for security and defense applications_. Ieee, 2009, pp. 1–6.
  * [204] N. Moustafa and J. Slay, “Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),” in _2015 military communications and information systems conference (MilCIS)_. IEEE, 2015, pp. 1–6.
  * [205] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization.” in _ICISSP_ , 2018, pp. 108–116.
  * [206] “Ton_iot datasets,” https://ieee-dataport.org/documents/toniot-datasets, last accessed 3 March 2021.
  * [207] I. Corona, B. Biggio, M. Contini, L. Piras, R. Corda, M. Mereu, G. Mureddu, D. Ariu, and F. Roli, “Deltaphish: Detecting phishing webpages in compromised websites,” in _European Symposium on Research in Computer Security_. Springer, 2017, pp. 370–388.
  * [208] “The mnist database of handwritten digits.” .http://yann.lecun.com/exdb/mnist/, last accessed 11-2022.
  * [209] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” _arXiv preprint arXiv:1708.07747_ , 2017.
  * [210] S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Konečnỳ, H. B. McMahan, V. Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” _arXiv preprint arXiv:1812.01097_ , 2018.
  * [211] A. Krizhevsky, G. Hinton _et al._ , “Learning multiple layers of features from tiny images,” 2009.
  * [212] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein _et al._ , “Imagenet large scale visual recognition challenge,” _International journal of computer vision_ , vol. 115, no. 3, pp. 211–252, 2015.
  * [213] A. Khosla, N. Jayadevaprakash, B. Yao, and F.-F. Li, “Novel dataset for fine-grained image categorization: Stanford dogs,” in _Proc. CVPR workshop on fine-grained visual categorization (FGVC)_ , vol. 2, no. 1. Citeseer, 2011.
  * [214] W. Wolberg, N. Street, and O. Mangasarian, “Uci machine learning repository: breast cancer wisconsin (diagnostic) data set,” 2011.
  * [215] A. Cambridge, “The database of faces,” 2002, http://www.cl.cam.ac.uk/research/dtg/attarchive/facedatabase.html.
  * [216] G. B. Huang, M. Mattar, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database forstudying face recognition in unconstrained environments,” in _Workshop on faces in’Real-Life’Images: detection, alignment, and recognition_ , 2008.
  * [217] S. Li, D. Yi, Z. Lei, and S. Liao, “The casia nir-vis 2.0 face database,” in _Proceedings of the IEEE conference on computer vision and pattern recognition workshops_ , 2013, pp. 348–353.
  * [218] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in _2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018)_. IEEE, 2018, pp. 67–74.
  * [219] Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learning face attributes in the wild,” in _Proceedings of the IEEE international conference on computer vision_ , 2015, pp. 3730–3738.
  * [220] K. Nazeri, E. Ng, T. Joseph, F. Z. Qureshi, and M. Ebrahimi, “Edgeconnect: Generative image inpainting with adversarial edge learning,” _arXiv preprint arXiv:1901.00212_ , 2019.
  * [221] Y. Chen, E. Keogh, B. Hu, N. Begum, A. Bagnall, A. Mueen, and G. Batista, “The ucr time series classification archive,” July 2015, www.cs.ucr.edu/~eamonn/time_series_data/.
  * [222] D. Anguita, A. Ghio, L. Oneto, X. Parra Perez, and J. L. Reyes Ortiz, “A public domain dataset for human activity recognition using smartphones,” in _Proceedings of the 21th international European symposium on artificial neural networks, computational intelligence and machine learning_ , 2013, pp. 437–442.
  * [223] M. Little, P. Mcsharry, S. Roberts, D. Costello, and I. Moroz, “Exploiting nonlinear recurrence and fractal scaling properties for voice disorder detection,” _Nature Precedings_ , pp. 1–1, 2007.
  * [224] A. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y. Ng, and C. Potts, “Learning word vectors for sentiment analysis,” in _Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies_ , 2011, pp. 142–150.
  * [225] L. Dong, F. Wei, C. Tan, D. Tang, M. Zhou, and K. Xu, “Adaptive recursive neural network for target-dependent twitter sentiment classification,” in _Proceedings of the 52nd annual meeting of the association for computational linguistics (volume 2: Short papers)_ , 2014, pp. 49–54.
  * [226] J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The german traffic sign recognition benchmark: a multi-class classification competition,” in _The 2011 international joint conference on neural networks_. IEEE, 2011, pp. 1453–1460.
  * [227] B. Zhou, A. Lapedriza, A. Khosla, A. Oliva, and A. Torralba, “Places: A 10 million image database for scene recognition,” _IEEE transactions on pattern analysis and machine intelligence_ , vol. 40, no. 6, pp. 1452–1464, 2017\.
  * [228] J. Lehmann, R. Isele, M. Jakob, A. Jentzsch, D. Kontokostas, P. N. Mendes, S. Hellmann, M. Morsey, P. Van Kleef, S. Auer _et al._ , “Dbpedia–a large-scale, multilingual knowledge base extracted from wikipedia,” _Semantic web_ , vol. 6, no. 2, pp. 167–195, 2015.
  * [229] I. Arshad, M. N. Asghar, Y. Qiao, B. Lee, and Y. Ye, “Pixdoor: A pixel-space backdoor attack on deep learning models,” in _2021 29th European Signal Processing Conference (EUSIPCO)_. IEEE, 2021, pp. 681–685.
  * [230] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2019, pp. 707–723.
  * [231] Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in _Proceedings of the 35th Annual Computer Security Applications Conference_ , 2019, pp. 113–125.
  * [232] H. Wang, S. Wang, Z. Jin, Y. Wang, C. Chen, and M. Tistarelli, “Similarity-based gray-box adversarial attack against deep face recognition,” in _2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021)_. IEEE, 2021, pp. 1–8.
  * [233] S. Venkatesan, H. Sikka, R. Izmailov, R. Chadha, A. Oprea, and M. J. De Lucia, “Poisoning attacks and data sanitization mitigations for machine learning models in network intrusion detection systems,” in _MILCOM 2021-2021 IEEE Military Communications Conference (MILCOM)_. IEEE, 2021, pp. 874–879.
  * [234] Y. E. Sagduyu, Y. Shi, and T. Erpek, “Adversarial deep learning for over-the-air spectrum poisoning attacks,” _IEEE Transactions on Mobile Computing_ , vol. 20, no. 2, pp. 306–319, 2021.
  * [235] H. Ahmetoglu and R. Das, “A comprehensive review on detection of cyber-attacks: Data sets, methods, challenges, and future research directions,” _Internet of Things_ , p. 100615, 2022.
  * [236] C. Chakraborty, S. M. Nagarajan, G. G. Devarajan, T. Ramana, and R. Mohanty, “Intelligent ai-based healthcare cyber security system using multi-source transfer learning method,” _ACM Transactions on Sensor Networks_ , 2023.
  * [237] M. M. Badr, M. Mahmoud, M. Abdulaal, A. J. Aljohani, F. Alsolami, and A. Balamsh, “A novel evasion attack against global electricity theft detectors and a countermeasure,” _IEEE Internet of Things Journal_ , 2023\.
  * [238] M. Shabani, D. T. Tran, J. Kanniainen, and A. Iosifidis, “Augmented bilinear network for incremental multi-stock time-series classification,” _Pattern Recognition_ , vol. 141, p. 109604, 2023.
  * [239] I. Priyadarshini, R. Sharma, D. Bhatt, and M. Al-Numay, “Human activity recognition in cyber-physical systems using optimized machine learning techniques,” _Cluster Computing_ , vol. 26, no. 4, pp. 2199–2215, 2023.
  * [240] L. F. Chaparro, C. Pulido, J. Rudas, A. M. Reyes, J. Victorino, L. Á. Narváez, F. Gómez, and D. Martinez, “Sentiment analysis of social network content to characterize the perception of security,” in _2020 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM)_. IEEE, 2020, pp. 685–691.
  * [241] Y. Wang, Z. Su, N. Zhang, R. Xing, D. Liu, T. H. Luan, and X. Shen, “A survey on metaverse: Fundamentals, security, and privacy,” _IEEE Communications Surveys & Tutorials_, 2022.
  * [242] I. Rosenberg, A. Shabtai, Y. Elovici, and L. Rokach, “Adversarial machine learning attacks and defense methods in the cyber security domain,” _ACM Computing Surveys (CSUR)_ , vol. 54, no. 5, pp. 1–36, 2021.
  * [243] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in _International Conference on Artificial Intelligence and Statistics_. PMLR, 2020, pp. 2938–2948.
  * [244] M. A. Ferrag, B. Kantarci, L. C. Cordeiro, M. Debbah, and K.-K. R. Choo, “Poisoning attacks in federated edge learning for digital twin 6g-enabled iots: An anticipatory study,” 2023.
  * [245] X. Li, K. Qiu, C. Qian, and G. Zhao, “An adversarial machine learning method based on opcode n-grams feature in malware detection,” in _2020 IEEE Fifth International Conference on Data Science in Cyberspace (DSC)_. IEEE, 2020, pp. 380–387.
  * [246] S. Lee, H. Kim, and J. Lee, “Graddiv: Adversarial robustness of randomized neural networks via gradient diversity regularization,” _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2022.
  * [247] M. Cisse, Y. Adi, N. Neverova, and J. Keshet, “Houdini: Fooling deep structured prediction models,” _arXiv preprint arXiv:1707.05373_ , 2017.
  * [248] S. Sarkar, A. Bansal, U. Mahbub, and R. Chellappa, “Upset and angri: Breaking high performance image classifiers,” _arXiv preprint arXiv:1707.01159_ , 2017\.
  * [249] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in _2017 ieee symposium on security and privacy (sp)_. Ieee, 2017, pp. 39–57.
  * [250] J. Su, D. V. Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” _IEEE Transactions on Evolutionary Computation_ , vol. 23, no. 5, pp. 828–841, 2019.
  * [251] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in _2016 IEEE European symposium on security and privacy (EuroS &P)_. IEEE, 2016, pp. 372–387.
  * [252] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in _Artificial intelligence safety and security_. Chapman and Hall/CRC, 2018, pp. 99–112.
  * [253] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv preprint arXiv:1412.6572_ , 2014.
  * [254] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199_ , 2013.
  * [255] A. Rozsa, M. Günther, E. M. Rudd, and T. E. Boult, “Facial attributes: Accuracy and adversarial robustness,” _Pattern Recognition Letters_ , vol. 124, pp. 100–108, 2019.
  * [256] J. Hendrik Metzen, M. Chaithanya Kumar, T. Brox, and V. Fischer, “Universal adversarial perturbations against semantic image segmentation,” in _Proceedings of the IEEE international conference on computer vision_ , 2017, pp. 2755–2764.
  * [257] Y.-C. Lin, Z.-W. Hong, Y.-H. Liao, M.-L. Shih, M.-Y. Liu, and M. Sun, “Tactics of adversarial attack on deep reinforcement learning agents,” _arXiv preprint arXiv:1703.06748_ , 2017.
  * [258] N. Papernot, P. McDaniel, A. Swami, and R. Harang, “Crafting adversarial input sequences for recurrent neural networks,” in _MILCOM 2016-2016 IEEE Military Communications Conference_. IEEE, 2016, pp. 49–54.
  * [259] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _Ieee Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [260] B. Ru, A. Cobb, A. Blaas, and Y. Gal, “Bayesopt adversarial attack,” in _International Conference on Learning Representations_ , 2019.
  * [261] M. Cheng, S. Singh, P. Chen, P.-Y. Chen, S. Liu, and C.-J. Hsieh, “Sign-opt: A query-efficient hard-label adversarial attack,” _arXiv preprint arXiv:1909.10773_ , 2019.
  * [262] W. Brendel and M. Bethge, “Approximating cnns with bag-of-local-features models works surprisingly well on imagenet,” _arXiv preprint arXiv:1904.00760_ , 2019.
  * [263] P.-Y. Chen and P. Das, “Ai maintenance: A robustness perspective,” _arXiv preprint arXiv:2301.03052_ , 2023.
  * [264] P. Zhao, P.-Y. Chen, P. Das, K. N. Ramamurthy, and X. Lin, “Bridging mode connectivity in loss landscapes and adversarial robustness,” _arXiv preprint arXiv:2005.00060_ , 2020.
  * [265] N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” _arXiv preprint arXiv:1605.07277_ , 2016.
  * [266] M. Fang, M. Sun, Q. Li, N. Z. Gong, J. Tian, and J. Liu, “Data poisoning attacks and defenses to crowdsourcing systems,” in _Proceedings of the Web Conference 2021_ , 2021, pp. 969–980.
  * [267] M. Kravchik, B. Biggio, and A. Shabtai, “Poisoning attacks on cyber attack detectors for industrial control systems,” in _Proceedings of the 36th Annual ACM Symposium on Applied Computing_ , 2021, pp. 116–125.
  * [268] M. Al-Hawawreh, E. Sitnikova, and N. Aboutorab, “X-iiotid: A connectivity-agnostic and device-agnostic intrusion data set for industrial internet of things,” _IEEE Internet of Things Journal_ , vol. 9, no. 5, pp. 3962–3977, 2021.
  * [269] H. Zhang, J. Gao, and L. Su, “Data poisoning attacks against outcome interpretations of predictive models,” in _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining_, 2021, pp. 2165–2173.
  * [270] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” _Advances in Neural Information Processing Systems_ , vol. 30, 2017.
  * [271] Y. Qu, S. R. Pokhrel, S. Garg, L. Gao, and Y. Xiang, “A blockchained federated learning framework for cognitive computing in industry 4.0 networks,” _IEEE Transactions on Industrial Informatics_ , vol. 17, no. 4, pp. 2964–2973, 2021.
  * [272] Q. Wang, Y. Guo, L. Yu, X. Chen, and P. Li, “Deep q-network-based feature selection for multisourced data cleaning,” _IEEE Internet of Things Journal_ , vol. 8, no. 21, pp. 16 153–16 164, 2021.
  * [273] S. Wolf, W. Gamboa, and M. Borowczak, “Jangseung: A guardian for machine learning algorithms to protect against poisoning attacks,” in _2021 IEEE International Smart Cities Conference (ISC2)_. IEEE, 2021, pp. 1–7.
  * [274] D. Li, W. E. Wong, W. Wang, Y. Yao, and M. Chau, “Detection and mitigation of label-flipping attacks in federated learning systems with kpca and k-means,” in _2021 8th International Conference on Dependable Systems and Their Applications (DSA)_. IEEE, 2021, pp. 551–559.
  * [275] P. P. Chan, F. Luo, Z. Chen, Y. Shu, and D. S. Yeung, “Transfer learning based countermeasure against label flipping poisoning attack,” _Information Sciences_ , vol. 548, pp. 450–460, 2021.
  * [276] J. W. Stokes, P. England, and K. Kane, “Preventing machine learning poisoning attacks using authentication and provenance,” in _MILCOM 2021-2021 IEEE Military Communications Conference (MILCOM)_. IEEE, 2021, pp. 181–188.
  * [277] Z. Shi, X. Ding, F. Li, Y. Chen, and C. Li, “Mitigation of poisoning attack in federated learning by using historical distance detection,” in _2021 5th Cyber Security in Networking Conference (CSNet)_. IEEE, 2021, pp. 10–17.
  * [278] S. Andreina, G. A. Marson, H. Möllering, and G. Karame, “Baffle: Backdoor detection via feedback-based federated learning,” in _2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS)_. IEEE, 2021, pp. 852–863.
  * [279] Z. Gu and Y. Yang, “Detecting malicious model updates from federated learning on conditional variational autoencoder,” in _2021 IEEE International Parallel and Distributed Processing Symposium (IPDPS)_. IEEE, 2021, pp. 671–680.
  * [280] Y. Liu, Y. Qu, C. Xu, Z. Hao, and B. Gu, “Blockchain-enabled asynchronous federated learning in edge computing,” _Sensors_ , vol. 21, no. 10, p. 3335, 2021.
  * [281] M. Shayan, C. Fung, C. J. Yoon, and I. Beschastnikh, “Biscotti: A blockchain system for private and secure federated learning,” _IEEE Transactions on Parallel and Distributed Systems_ , vol. 32, no. 7, pp. 1513–1525, 2021.
  * [282] F. Xie, Y. Gao, J. Wang, and W. Zhao, “Defending local poisoning attacks in multi-party learning via immune system,” _Knowledge-Based Systems_ , vol. 238, p. 107850, 2022.
  * [283] Z. Chen, H. Cui, E. Wu, and X. Yu, “Dynamic asynchronous anti poisoning federated deep learning with blockchain-based reputation-aware solutions,” _Sensors_ , vol. 22, no. 2, p. 684, 2022.
  * [284] B. Hou, J. Gao, X. Guo, T. Baker, Y. Zhang, Y. Wen, and Z. Liu, “Mitigating the backdoor attack by federated filters for industrial iot applications,” _IEEE Transactions on Industrial Informatics_ , 2022.
  * [285] Y. Wang, D.-H. Zhai, Y. He, and Y. Xia, “An adaptive robust defending algorithm against backdoor attacks in federated learning,” _Future Generation Computer Systems_ , vol. 143, pp. 118–131, 2023.
  * [286] Y. Jiang, W. Zhang, and Y. Chen, “Data quality detection mechanism against label flipping attacks in federated learning,” _IEEE Transactions on Information Forensics and Security_ , 2023.
  * [287] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in _Proceedings of the 22nd ACM SIGSAC conference on computer and communications security_ , 2015, pp. 1322–1333.
  * [288] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in _2017 IEEE symposium on security and privacy (SP)_. IEEE, 2017, pp. 3–18.
  * [289] X. Tang, S. Mahloujifar, L. Song, V. Shejwalkar, M. Nasr, A. Houmansadr, and P. Mittal, “Mitigating membership inference attacks by $\\{$Self-Distillation$\\}$ through a novel ensemble architecture,” in _31st USENIX Security Symposium (USENIX Security 22)_ , 2022, pp. 1433–1450.
  * [290] D. Unal, M. Hammoudeh, M. A. Khan, A. Abuarqoub, G. Epiphaniou, and R. Hamila, “Integration of federated machine learning and blockchain for the provision of secure big data analytics for internet of things,” _Computers & Security_, vol. 109, p. 102393, 2021.
  * [291] D. P. Kuttichira, S. Gupta, D. Nguyen, S. Rana, and S. Venkatesh, “Verification of integrity of deployed deep learning models using bayesian optimization,” _Knowledge-Based Systems_ , p. 108238, 2022.
  * [292] M. Hao, H. Li, X. Luo, G. Xu, H. Yang, and S. Liu, “Efficient and privacy-enhanced federated learning for industrial artificial intelligence,” _IEEE Transactions on Industrial Informatics_ , vol. 16, no. 10, pp. 6532–6542, 2019.
  * [293] A. Salem, Y. Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” _arXiv preprint arXiv:1806.01246_ , 2018.
  * [294] M. K. Shehzad, L. Rose, M. M. Butt, I. Z. Kovacs, M. Assaad, and M. Guizani, “Artificial intelligence for 6g networks: Technology advancement and standardization,” _arXiv preprint arXiv:2204.00914_ , 2022.
  * [295] M. d’Aquin, P. Troullinou, N. E. O’Connor, A. Cullen, G. Faller, and L. Holden, “Towards an" ethics by design" methodology for ai research projects,” in _Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society_ , 2018, pp. 54–59.
  * [296] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” _Advances in neural information processing systems_ , vol. 30, 2017.
  * [297] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” _arXiv preprint arXiv:1810.04805_ , 2018.
  * [298] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” _The Journal of Machine Learning Research_ , vol. 21, no. 1, pp. 5485–5551, 2020.
  * [299] L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “Bert-attack: Adversarial attack against bert using bert,” _arXiv preprint arXiv:2004.09984_ , 2020.
  * [300] W. E. Zhang, Q. Z. Sheng, A. Alhazmi, and C. Li, “Adversarial attacks on deep-learning models in natural language processing: A survey,” _ACM Transactions on Intelligent Systems and Technology (TIST)_ , vol. 11, no. 3, pp. 1–41, 2020.
  * [301] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” _arXiv preprint arXiv:2307.15043_ , 2023.