Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification

1. The proposed method relies on the assumption that malicious local models will deviate significantly from reference models (the previous global model and the client’s local model). However, this assumption only holds against weaker attacks. For more advanced attacks (such as LIE, MinMax, MinSum, and 3DFed), the differences between malicious and benign models are minimal, making detection extremely challenging. Unfortunately, the authors neither discuss these attacks in the Related Works section nor compare their method against them in the experiments.
2. The authors evaluate only four weak Byzantine and backdoor attacks, all of which are relatively outdated, published before 2020, which is insufficient to demonstrate the effectiveness of the method. Furthermore, label flipping is not a backdoor attack. On the defense side, only five weak and outdated baselines were considered. I recommend that the authors include a broader set of stronger attacks and defenses.
3. The default scenario of only considering 10 clients is unrealistic, as real-world FL settings generally involve a much larger number of participants, with current defenses typically tested on 100 clients or more. Although the authors do explore different client counts in Figure 4(d), most experiments still rely on the 10-client setup, which limits confidence in the method’s overall effectiveness.
4. Several important evaluations are missing. For example, there is no analysis of whether the accuracy of the global model is affected in non-adversarial settings or whether the defense remains effective under attacker-dominated conditions. Additionally, the impact of varying levels of data heterogeneity has not been evaluated. Lastly, there is no ablation study or experimental analysis of robustness against adaptive attacks.
5. Why are Cross-Round Detection and Cross-Client Detection effective? What is the convergence behavior of the proposed method? The authors should provide theoretical analysis for these aspects.

1. The assumption that each local model and its reference model to be high seems to be only true under i.i.d. settings. Under non-i.i.d. settings

2. The paper does not provide any theorems to guarantee the defensive performance.

3. There is no table in the paper to clearly compare the results of different baselines and the proposed method under both i.i.d. and non-i.i.d. settings.

4. The paper does not use some advanced baselines such as FLTrust and FLDetector.

The limitations of this study are not clearly defined. This study only addresses horizontal FL, with no mention of vertical FL.

• The robustness of the proposed defense is only tested against attacks that typically do not consider detection mechanisms. It would be necessary to test the defense against more advanced attacks, including, for example, stealthy model poisoning attacks e.g., Bhagoji et al. “Analzying federated learning through and adversarial lens”, the poisoning attacks in Fung et al, Fang et al. “Local Model Poisoning Attacks to Byzantine-Robust Federated Learning”, or distributed backdoor attacks, to cite some. It would be also convenient to test the algorithm against adaptive attacks, but even if these are not considered, I believe the paper lacks an evaluation on more advanced attack scenarios.

• Related to the previous point, the cross-client detection algorithm in Section 3.2, relies on the assumption that the malicious model updates are outliers. However, smart adversaries can try to create more subtle attacks in order to subvert the training of the FL algorithm without being detected (as some of the attack strategies mentioned before). The cosine similarity can be an interesting approach to defend against some attacks, like the ones used in the experiments, but present some limitations against more challenging attacks.

• There are other papers in the related literature that aim to detect malicious clients. See for example, Li et al. “Learning to Detect Malicious Clients for Robust Federated Learning”, Muñoz-González et al. “Byzantine-Robust Federated Learning through Adaptive Model Averaging”, Zhang et al. “FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients.” However, the authors did not compare to any existing method for detecting malicious participants in FL.

• The strategy discussed in Section 3.3 for reducing the computational complexity, by choosing a layer for the reference models, opens the door to different types of attacks against the target model. Thus, attackers can modify freely parameters from other layers bypassing detection. It is unclear how the defense can overcome this type of situations.

• The scalability of the proposed approach is not well discussed in the main paper. For example, storing the reference models from all participants in cross-device settings with hundreds of thousands of participants can be computationally very expensive.

• Some of the results in the experiments see for example Figures 4 c) and d) and Figure 5, do not show the performance after model’s convergence. It would be necessary to run the experiments for more training rounds to have a more meaningful view of the model’s performance after training is completed.