PaperlayerView exact revision on arXiv

Source-linked AI summary

Edge Learning for 6G-enabled Internet of Things: A Comprehensive Survey of Vulnerabilities, Datasets, and Defenses

Mohamed Amine Ferrag, Othmane Friha, Burak Kantarci, Norbert Tihanyi, Lucas Cordeiro, Merouane Debbah, Djallel Hamouda, Muna Al-Hawawreh, Kim-Kwang Raymond Choo

arXiv:2306.10309v2cs.CR

TL;DR

Existing machine-learning vulnerabilities raise security concerns as edge learning is considered for 6G IoT. This survey reviews federated machine-learning vulnerabilities and defenses, classifies attacks into eight categories, and compares defense methods. It concludes that adopting edge learning without adequate security considerations can expose networks to threats.

  • Problem

    Existing machine-learning vulnerabilities raise security concerns for edge learning in 6G-enabled IoT networks.

    Source: §X · p. 54

  • Method

    The paper surveys vulnerabilities and defenses of federated machine learning for 6G-enabled IoT.

    Source: §X · p. 54

  • Results

    The survey classifies attacks into eight categories and provides a taxonomy and side-by-side comparison of state-of-the-art defenses.

    Source: §I · p. 6

  • Takeaways & Limitations

    The authors warn that adopting edge learning without adequate security considerations can expose networks to threats.

    Source: §X · p. 54

Abstract

from arXiv · show

The ongoing deployment of the fifth generation (5G) wireless networks constantly reveals limitations concerning its original concept as a key driver of Internet of Everything (IoE) applications. These 5G challenges are behind worldwide efforts to enable future networks, such as sixth generation (6G) networks, to efficiently support sophisticated applications ranging from autonomous driving capabilities to the Metaverse. Edge learning is a new and powerful approach to training models across distributed clients while protecting the privacy of their data. This approach is expected to be embedded within future network infrastructures, including 6G, to solve challenging problems such as resource management and behavior prediction. This survey article provides a holistic review of the most recent research focused on edge learning vulnerabilities and defenses for 6G-enabled IoT. We summarize the existing surveys on machine learning for 6G IoT security and machine learning-associated threats in three different learning modes: centralized, federated, and distributed. Then, we provide an overview of enabling emerging technologies for 6G IoT intelligence. Moreover, we provide a holistic survey of existing research on attacks against machine learning and classify threat models into eight categories, including backdoor attacks, adversarial examples, combined attacks, poisoning attacks, Sybil attacks, byzantine attacks, inference attacks, and dropping attacks. In addition, we provide a comprehensive and detailed taxonomy and a side-by-side comparison of the state-of-the-art defense methods against edge learning vulnerabilities. Finally, as new attacks and defense technologies are realized, new research and future overall prospects for 6G-enabled IoT are discussed.

I. INTRODUCTION

As 6G is envisioned with AI as a core component, edge learning offers distributed model training, while ML vulnerabilities create a security challenge for 6G-enabled IoT. The paper reviews those threats and defenses and describes its literature-review process.

I. INTRODUCTION

  • 6G is envisioned with AI as an indispensable component, while edge learning brings model training to the network edge using coordinated distributed paradigms such as federated learning.The survey frames this alongside 5G's potential limits in supporting future IoE applications and argues that AI and IoT's expanded utility also creates a cyber-vulnerability surface.Source: §I · pp. 2, 4
  • The survey examines ML vulnerabilities and countermeasures across centralized, federated, and decentralized learning, treating security for ML and ML for security as interconnected.It lists enabling technologies, cyber-attack datasets, eight ML threat categories, and a comparative taxonomy of defenses among its contributions.Source: §I · pp. 4, 6

II. REVIEW METHODOLOGY

  • The review begins by stating its objectives and research questions, then describes its search, data extraction, and quality-assessment process.The methodology says some relevant primary sources may have been missed during searching.Source: §II · p. 6, B. Search strategy · p. 6

A. Objectives and research questions

  • The review investigates edge-learning vulnerabilities, datasets, and defenses for 6G-enabled IoT, including threats and proposed protections for systems distinguishing benign from malicious traffic.Its stated objectives also include examining the potential effectiveness of defenses against large-scale machine-learning attacks.Source: A. Objectives and research questions · p. 6

B. Search strategy

  • The authors searched six academic databases using terms related to federated, edge, and distributed learning for 6G IoT, cybersecurity, and ML attacks.They evaluated proposed ML attacks and defenses published from 2015 to 2023 using reputation, relevance, originality, date, and influence, then ranked sources and selected the highest-scoring.Source: B. Search strategy · p. 6

C. Data extraction

  • After an initial quality assessment, the authors extracted pertinent information from the selected papers and report the extracted metadata in Table V.The assessment reduced the set of papers carried forward for data extraction.Source: C. Data extraction · p. 6

D. Quality assessment

This section surveys 6G-IoT intelligence across network architecture, technology prospects, and security, while outlining quality-assessment criteria and applications across network layers. It also describes testbeds and prospective in-network and application-level capabilities.

D. Quality assessment

  • The quality assessment covers research-question clarity, literature review, dataset relevance, classification methods, proposed solutions, experimental support, and result presentation.The passage describes a ten-question questionnaire and says the criteria in Table III are based on eight questions.Source: D. Quality assessment · p. 6

A. Architectural Landscape; 1) Physical (PHY) Layer Enhancements:

  • AI and deep learning are presented as ways to improve 6G networks across physical and core layers, with advances in wireless communications also influencing AI architectures.Physical-layer examples include channel prediction, interference reduction, and non-convex optimization tasks; RIS can manipulate electromagnetic waves for data delivery and positioning.Source: A. Architectural Landscape · p. 8, 1) Physical (PHY) Layer Enhancements · pp. 8–9

2) Medium Access Control (MAC):

  • AI is proposed for MAC-layer resource allocation, power management, mobility prediction, offloading, link adaptation, and caching.The passage identifies reinforcement learning as suitable for adaptive network tasks with combinatorial action spaces and multiple agents.Source: 2) Medium Access Control (MAC) · p. 9

3) Core-Network and Services Intelligence:

  • Edge-node training and inference support intelligent data collection and delivery, while device-server co-inferencing distributes a large DNN across devices and servers.The passage links these capabilities to improved service quality and reliable, cost-effective inference.Source: 3) Core-Network and Services… · p. 9

4) 6G architecture for energy-efficient communication:

  • QoE can be aligned with QoS factors—specifically packet loss and transfer delay—to assess user satisfaction in energy-efficient 6G multimedia transmission.The reviewed QJEEO approach jointly optimizes energy and entropy and relates surveyed user scores to IoT-device performance metrics.Source: 4) 6G architecture for… · pp. 9–10

5) 5G/6G IoT testbeds:

  • Listed 5G/6G IoT testbeds support applications including transportation, energy management, healthcare, and industrial automation, using technologies such as MEC, virtualization, and AI.The examples include EU-funded testbeds as well as initiatives in the United States, Canada, and Germany.Source: 5) 5G/6G IoT testbeds · p. 10

B. Supported Technological Prospects

  • For mission-critical and XR applications, xURLLC emphasizes data-driven ML predictability, radio and non-radio modalities, and collaborative communication-management co-design.The passage groups future AI-based 6G methods into in-network and in-application domains.Source: B. Supported Technological Prospects · p. 10

1) In-Network Domains; 2) In-Application Domains:

  • Network slicing, SDN, NFV, predictive analytics, and proactive caching are described as in-network capabilities, while ML-based flow prediction selects interfaces for delay-tolerant transfers.The flow-prediction module programs transfers based on expected resource availability within an application-specific delay window.Source: 1) In-Network Domains · p. 10, 2) In-Application Domains · p. 10

C. 5G/6G peer-to-peer IoT communications

The section surveys 5G/6G technologies relevant to IoT and peer-to-peer learning, alongside prospective 6G security and privacy measures. It highlights how connectivity, edge computing, and network capabilities relate to distributed learning.

C. 5G/6G peer-to-peer IoT communications

  • 5G/6G technologies are presented as supporting peer-to-peer IoT communication and learning through expanded bandwidth, reliability, and edge capabilities.The overview identifies Table VI as presenting 5G/6G IoT communication technologies.Source: C. 5G/6G peer-to-peer IoT communications · p. 10

D. 5G IoT Technologies

  • The described 5G technologies include eMBB, URLLC, mMTC, network slicing, and edge computing for bandwidth, critical links, large device deployments, resource allocation, and local processing.Examples include video and VR/AR for eMBB, and autonomous vehicles and remote surgery for URLLC.Source: D. 5G IoT Technologies · pp. 10–11

E. 6G IoT Technologies

  • Prospective 6G IoT technologies include terahertz communication, AI/ML, satellite-terrestrial integration, advanced positioning and sensing, and security and privacy features.The passage gives possible centimeter-level positioning accuracy and projected THz rates of 100 Gbps or more.Source: E. 6G IoT Technologies · p. 12

F. Security and Privacy

  • The section groups 6G security intelligence into infrastructural measures and additional services to address threats across emerging network environments.AI is envisioned as a central driver for security and privacy challenges.Source: F. Security and Privacy · p. 12

1) Infrastructural Measures:

  • Infrastructural measures include distributed training and inference, over-the-air federated aggregation, context-aware security, and moving-target defense.The passage says over-the-air FL aggregates wirelessly without accessing nodes' private data; MTD can dynamically reshape systems and direct SDN reprogramming after an attack is noticed.Source: 1) Infrastructural Measures · p. 12

2) Additional Services:

  • Additional services include AI-enabled intrusion prevention and blockchain or distributed-ledger support for privacy, transparency, immutability, and tasks such as authentication and access control.The passage also describes smart-contract operations and consensus mechanisms for verifying candidate blocks.Source: 2) Additional Services · p. 12

G. Highlights 5G/6G in Peer-to-Peer IoT Learning

  • The integration of 5G/6G technology into IoT ecosystems is described as transformative, providing a powerful impetus for peer-to-peer learning among IoT devices; the study explores unique aspects of 5G/6G that enhance P2P IoT learning.Source: G. Highlights 5G/6G in Peer-to-Peer… · p. 13

1) Network Slicing:

This block describes how 5G/6G networking features support IoT learning and surveys 6G-IoT perspectives and machine-learning security. It also reviews ML paradigms and prior IoT security research.

1) Network Slicing:

  • Network slicing can tailor service levels so high-priority IoT devices can learn from one another without lower-priority devices impeding them.The passage distinguishes AI for managing slices from slicing designed to support AI services.Source: 1) Network Slicing · p. 13

2) Increased Speed and Capacity; 3) Ultra-Low Latency:

4) Reliability and Availability:

  • Improved reliability and availability are described as allowing IoT devices to maintain network connections and continue peer-to-peer learning without interruptions.Source: 4) Reliability and Availability · p. 13

5) Edge Computing Support; 6) Energy minimization:

  • Edge computing supports local IoT learning, while reviewed energy-oriented approaches optimize wireless power, transmission, and computation delay.RIS-assisted FL seeks to minimize transmit power subject to harvested-energy and data-rate requirements; a DRL framework is reported to learn faster than federated DQN and nonfederated DDQN, while another strategy targets near-minimal computation delay.Source: 6) Energy minimization · p. 13, 5) Edge Computing Support · p. 13

H. Perspectives on 6G IoT

  • The 6G-IoT perspectives include higher rates, low latency, reliability, massive connectivity, autonomous decision-making, ubiquitous coverage, and energy efficiency.The passage also describes edge computing as potentially allowing real-time device decisions without a central hub or cloud.Source: H. Perspectives on 6G IoT · pp. 13–14

IV. AN OVERVIEW OF ML-ASSOCIATED AND 6G-ENABLED IOT SECURITY

  • The security overview compares reviews of ML-based 6G-IoT security with reviews of threats to centralized, federated, and distributed learning.Threats include data breaches, denial of service, unauthorized access, and model tampering; vulnerabilities include outdated software, unsecured connections, weak passwords, and insecure authentication.Source: §IV · pp. 14–15

A. Machine Learning For 6G–IoT security; 1) Usage of ML Paradigms in 6G-enabled IoT Applications:

2) IoT-related security:

  • Prior IoT-security surveys cover layer-based threats and learning-based responses, while also noting constraints such as device resources and ML protection overhead.The reviewed work includes applications such as malicious-code detection, access control, malware identification, and secure offloading.Source: 2) IoT-related security · p. 15

3) Vision For 6G networks:

The reviewed 6G vision places AI and collaborative edge intelligence within networks expected to sustain performance in dynamic environments. The section surveys security threats and defenses across centralized, federated, and distributed learning.

3) Vision For 6G networks:

  • 6G is envisioned as a self-sustaining network where AI can help maintain KPIs, manage resources, and support collaborative edge intelligence.The vision also anticipates services such as Massive URLLC.Source: 3) Vision For 6G networks · pp. 15–16
  • Reviews of 6G security describe architectural and technology threats, with proposed protections including edge-based federated learning, differential privacy, blockchain, and quantum-based cryptography,.The surveyed 6G vision also covers edge intelligence, reconfigurable intelligent surfaces, and non-terrestrial networks,.Source: 3) Vision For 6G networks · p. 16

B. Machine Learning Associated Threats

  • The review organizes ML-associated threats around centralized, federated, and distributed learning paradigms.It introduces these threats in the context of ML-based defenses’ susceptibility to adversarial attacks.Source: B. Machine Learning Associated Threats · p. 16

1) Centralized Edge Learning:

  • Centralized-learning reviews address lifecycle threats, classifier attacks, adversarial examples, APTs, and privacy risks, alongside defenses including sanitization and cryptography,,, [11],,,,,.Reported defenses include robust statistics, defensive distillation, gradient masking, ensemble classifiers, and differential privacy [11],,,.Source: 1) Centralized Edge Learning · pp. 16–17

2) Federated Edge Learning:

  • Federated-learning reviews cover poisoning, backdoor, and inference risks, while also examining blockchain integration, IoT deployment challenges, and non-IID data,, [19],,,.One review identifies client-side attacks as significant threats and discusses defenses such as differential privacy, robust aggregation, and outlier detection.Source: 2) Federated Edge Learning · pp. 17–18

3) Distributed Learning:

  • Distributed-learning reviews span wireless-network layers and classify risks across preprocessing, learning, knowledge extraction, and result intermediation,, [42].Discussed risks include gradient leakage, poisoning, inversion, inference, label leakage, and data reconstruction, [42].Source: 3) Distributed Learning · p. 18

1) Comparative Analysis of Edge Learning:

The section contrasts centralized and federated edge learning by where training data resides, and compares edge-learning conditions across network generations. It also presents communication-process figures for centralized, federated, and distributed learning.

1) Comparative Analysis of Edge Learning:

  • Edge learning processes data near its source, and the section compares its features across 4G, 5G, and 6G IoT.The comparison is presented in Table IX.Source: 1) Comparative Analysis of Edge Learning · pp. 18, 20, Table IX · p. 20
  • Federated edge learning trains models across device datasets while keeping data on devices, unlike centralized learning, which gathers data at a central location,.The suitable approach depends on the task’s needs and constraints,.Source: 1) Comparative Analysis of Edge Learning · pp. 19–20
  • The communication-process figures distinguish centralized and federated edge learning from distributed edge learning in 6G-enabled IoT.Figures 6 and 7 show the respective communication processes.Source: Figure 6 · p. 21, Figure 7 · p. 22
  • 4G IoT latency is reported at 50–1000 ms, compared with 1–10 ms for 5G IoT and less than 1 ms for 6G IoT,,.The survey describes generational improvements in bandwidth, supported devices, and computational power as well, [126],.Source: 1) Comparative Analysis of Edge Learning · p. 21
  • 6G IoT is described as supporting more than 1M devices and more than 10 GFLOPS, with bandwidth above 1000 Mbps and latency below 1 ms.The passage also reports decreasing energy consumption and cost per device from 4G to 6G.Source: 1) Comparative Analysis of Edge Learning · p. 21

2) Comparative Analysis of Security:

The section compares security concerns across 4G, 5G, and 6G IoT, then surveys AI-enabled edge/fog deployments and edge-learning defenses. It describes differential-privacy and federated anomaly-detection approaches alongside their reported settings and trade-offs.

2) Comparative Analysis of Security:

  • The security comparison moves from 4G access, spoofing, DoS, and privacy threats to 5G distributed-network and model security challenges, then 6G quantum and AI-driven threats,,.Proposed 6G protections include quantum-resistant algorithms, AI-based detection, and privacy-preserving methods.Source: 2) Comparative Analysis of Security · p. 22

D. Practical Deployments of AI in Edge/Fog

  • Edge computing processes data near its source, while fog computing distributes compute, storage, and networking across layers from edge devices to cloud.The section describes edge/fog AI deployments spanning chips, software platforms, cameras, sensors, and robots,,.Source: D. Practical Deployments of AI in… · pp. 22–23
  • Resource scarcity, heterogeneous workloads, and unpredictable environments complicate edge/fog management; AI/ML is used for sequential decisions and workload-aware resource orchestration,,.Cloud-only AI can face bandwidth shortages and elevated latency, while edge/fog computing places processing closer to users and devices.Source: D. Practical Deployments of AI in… · pp. 22–23

V. EDGE LEARNING FOR CYBER SECURITY

  • Edge learning is presented as supporting real-time cyber-threat detection and mitigation while reducing latency and bandwidth use.The section frames these capabilities as contributions to system resilience.Source: §V · p. 23

A. Differential privacy-based solutions

  • Federated-learning defenses include differential privacy with secure multiparty computation, a differentially private industrial IDS, FedAAC, and the PPT protocol,,,.PPT is reported to outperform Google’s Secure Aggregation and LDP-based FL methods in computation efficiency and prediction performance, but remains vulnerable to adversarial attacks.Source: A. Differential privacy-based solutions · pp. 23–24

B. Ensemble Learning-based solution

  • A decentralized federated approach uses LSTM and GRU models for IoT intrusion prediction on Modbus data, with on-device training and no network-data transfer to a central server [94].The cited work describes the approach as privacy-preserving and computationally inexpensive [94].Source: B. Ensemble Learning-based solution · p. 24

C. GAN-based solution

The survey reviews edge-learning defenses and datasets for IoT security, covering methods based on GANs, quantization, deep learning, encryption, blockchain, weighted aggregation, and SDN. It also organizes security datasets into nine categories and describes examples used for attack-classification evaluation.

C. GAN-based solution

  • DP-GAN adds a differential-privacy identifier to generate noise while approximating raw data, and blockchain supports global aggregation; experiments report accuracy, privacy, and convergence effectiveness.The approach is decentralized and asynchronous and targets IoT anomaly detection.Source: C. GAN-based solution · pp. 24–25

D. Fixed-point quantization method-based solution

  • FedMSQE uses fixed-point quantization with stochastic rounding to reduce model-transmission cost while maintaining accuracy and lowering quantization error.The work reports higher accuracy and lower quantization error than other quantization methods.Source: D. Fixed-point quantization… · p. 25

E. Deep Learning-based solution

  • FELIDS evaluates DNN, CNN, and RNN federated intrusion detectors on CSE-CIC-IDS2018, MQTTset, and InSDN, comparing them with centralized learning and prior work.The study identifies outdated or contextually inappropriate datasets, privacy concerns in centralized models, and limited attack coverage as gaps.Source: E. Deep Learning-based solution · p. 25

F. Homomorphic encryption-based solution

  • SVeriFL uses dynamic successive verification to check uploaded parameters, aggregated results, and participant consistency throughout federated training, with moderate computational cost.The authors report that verification does not affect original federated-learning performance.Source: F. Homomorphic encryption-based solution · p. 25

G. Blockchain and smart contracts-based solution

  • Blockchain and smart contracts support privacy services for off-chain federations using on-chain federated learning; a separate fog-based platform combines federated learning with blockchain for wearable-device security.The framework reports acceptable collaboration costs and privacy, security, and decentralization advantages; the testbed evaluates the wearable platform’s implementation.Source: G. Blockchain and smart… · p. 25

H. Dynamic Weighted Aggregation-based solution

  • DAFL dynamically weights local models to limit the influence of poorly performing clients, reporting better intrusion-detection performance with lower communication overhead.The approach does not consider device security or physical attacks.Source: H. Dynamic Weighted Aggregation-based… · p. 25

I. Software-defined networking

  • MiTFed combines federated learning, blockchain, and SDN for collaborative intrusion detection across SDN domains, while its evaluation uses an outdated dataset and leaves scalability for further assessment.The paper also notes possible performance issues from blockchain use.Source: §I · p. 26

C. Electricity theft detection

The survey describes datasets spanning electricity-theft detection, image classification, and facial recognition. These datasets vary in task, scale, and collection design, and several are used to evaluate security attacks or defenses.

C. Electricity theft detection

  • Smart-meter records from 3,000 Irish residential units, sampled every 30 minutes for 18 months, serve as benign profiles for evaluating poisoning and power-theft detectors.The cited work compared customer-specific and generalized baseline detectors.Source: C. Electricity theft detection · p. 29

D. Image classification

  • Image-classification benchmarks include MNIST and Fashion-MNIST, while FEMNIST represents federated, non-IID writing data from more than 3,300 writers.CIFAR-10 is also used to benchmark a backdoor-defense mechanism.Source: D. Image classification · p. 29

1) Facial recognition:

  • Facial-recognition datasets range from AT&T’s 400 images of 40 people to LFW’s more than 13,000 web photographs, and both have been used in poisoning-related studies.AT&T supported evaluation of a GAN-based poisoning attack; LFW was used to generate poisoned training samples.Source: 1) Facial recognition · p. 30

E. Time series classification

This section surveys datasets for time series, human activity, sentiment, location, and text tasks, then describes their security applications and how peer-to-peer edge learning can use local data while sharing learned models.

E. Time series classification

  • The UCR archive supports time-series classification research and expanded from 16 datasets initially to 85 in 2015; recent work uses it for adversarial-attack and defense studies.Source: E. Time series classification · p. 30

F. Human Activity Recognition

  • HAR datasets include smartphone activity records from 30 volunteers and voice measurements from 31 people, with the latter dataset created to identify Parkinson’s disease.HARUS was used to evaluate a framework for computing poisoning attacks on federated learning.Source: F. Human Activity Recognition · p. 30

G. Sentiment classification

  • Sentiment datasets include 50,000 binary-labeled IMDB reviews and a manually annotated Twitter set of 6,940 target-dependent tweets.The IMDB dataset is used to benchmark edge-learning poisoning and backdoor attacks and defenses.Source: G. Sentiment classification · pp. 30–31

H. Location awareness

  • Location-awareness examples include GTSRB, with more than 50,000 traffic-sign images, used to evaluate a moving-target defense against DNN Trojans.Source: H. Location awareness · p. 31

I. Text classification

  • DBPedia provides hierarchical text-classification data, including a 560,000-instance, 14-category variant used to study network-level adversaries and dropping attacks in federated training.Source: §I · p. 32

J. Application of Dataset Types in 6G IoT Security

K. Highlights of Peer-to-Peer Features in Edge Learning across Various Dataset Types

  • Peer-to-peer edge learning keeps raw data local while devices share learned models or insights, supporting privacy and learning from heterogeneous data across the surveyed task types.Examples include local image classification and sharing models, and text classification that keeps source text private.Source: K. Highlights of Peer-to-Peer Features… · p. 32

VII. MACHINE LEARNING VULNERABILITIES

The survey classifies machine-learning vulnerabilities by attack type and learning phase, then reviews backdoor attacks and selected defenses. It distinguishes federated attacks that target privacy or model behavior from backdoors embedded in training data or models.

VII. MACHINE LEARNING VULNERABILITIES

  • The survey organizes ML vulnerabilities by attacker knowledge, attack type, and objective, and illustrates threats across centralized, distributed, and decentralized learning and model phases.It identifies eight broad attack categories in the paper context and describes six attacks on federated algorithms.Source: §VII · p. 32

A. Pre/Post-deployment attacks

  • Federated attacks include post-deployment evasion and inference attacks, while pre-deployment poisoning and dropping target the aggregate model before deployment.The survey frames these as part of a six-attack taxonomy, with the attacks distinguished by phase and goal.Source: A. Pre/Post-deployment attacks · p. 33

B. Backdoor attacks

  • Backdoor variants reviewed include RNN, imperceptible-pattern, distributed, pixel-space, and clean-label attacks, which manipulate training data or models to induce test-time behavior.Source: B. Backdoor attacks · p. 33

1) RNN backdoor attacks:

  • For text-classification RNN backdoors, Backdoor Keyword Identification filters dictionary keywords to find suspicious poisoning patterns without trusted data or prior knowledge of the backdoor release.Evaluation used Reuters-21578, 20 Newsgroups, DBpedia ontology, and IMDB, with reported identification precision and recall results.Source: 1) RNN backdoor attacks · p. 35

2) Imperceptible backdoor pattern:

  • For imperceptible image backdoors, the reviewed defense identifies poisoned training sets, target classes, and affected images, then reverse-engineers an estimate of the pattern.The CIFAR-10 evaluation reports a rate no more than 4.9%.Source: 2) Imperceptible backdoor pattern · p. 35

3) Distributed backdoor attack:

  • 84.23% compared to the state of the art: a dynamic norm-clipping defense reduced distributed-backdoor attack access rate across MNIST, FMNIST, CIFAR-10, and Tiny ImageNet.Collaborative attackers use distinct local triggers but share a target label.Source: 3) Distributed backdoor attack · p. 35

4) Clean label backdoor attack:

This section describes clean-label backdoors and pixel-space poisoning, then organizes adversarial examples by the attacker’s knowledge of the target model. It outlines white-box and blue-box methods and their reported evaluations.

4) Clean label backdoor attack:

  • Ning et al. proposed a clean-label backdoor requiring zero knowledge of the target model and described supervised and unsupervised poison-sample detection.The attacker combines clean data with a small portion of poisoned data for training.Source: 4) Clean label backdoor attack · p. 36

5) Pixel-space backdoor attack:

  • Arshad et al.’s pixel-space backdoor attack achieved 90% success on MNIST, with success depending on the dataset, trigger, and evasion techniques.The attack flips pixel bits while retaining original labels, so training associates the trigger with the target label.Source: 5) Pixel-space backdoor attack · p. 37

C. Adversarial examples

  • The paper classifies edge-learning adversarial examples as white-box, blue-box, or grey-box attacks.This classification distinguishes attacks by the information available about the targeted model.Source: C. Adversarial examples · p. 37

1) White-box adversarial attacks:

  • White-box attacks assume complete knowledge of the target model; FGSM adds a small perturbation in the input-gradient direction.HotFlip [189] uses gradients over one-hot text inputs; its AG’s news and CharCNN-LSTM evaluation reports selecting flip transactions about 80% of the time and preferring suppression over insertion two-to-one.Source: 1) White-box adversarial attacks · p. 37

2) blue-box adversarial attacks:

  • Blue-box attacks can be generated without knowledge of the trained model, and reported examples include time-series and speech-recognition attacks.On LibriSpeech, Biolková and Nguyen [184] report a better success rate than BayesOpt and SignOpt [261].Source: 2) blue-box adversarial attacks · pp. 37–38

3) Grey-box adversarial attacks:

The section covers grey-box attacks, combined synergetic attacks, and poisoning in federated learning. It describes a federated clustering defense and reports accuracy outcomes for two poisoning defenses.

3) Grey-box adversarial attacks:

  • Grey-box attackers have some, but not all, internal model information and can exploit transferability, where examples generated for one model may fool another.The section notes that these attacks can remain successful when the attacker knows enough about the pattern to produce adversarial examples.Source: 3) Grey-box adversarial attacks · pp. 38–39

1) Synergetic attack:

  • Combined synergetic attacks pair a training-time Trojan backdoor with inference-time adversarial disruption to move a target input across the decision boundary.The trigger moves the input toward the boundary, and the adversarial disruption supplies the final push toward the attacker’s objective class.Source: D. Combined attacks · p. 39, 1) Synergetic attack · p. 39

E. Poisoning attacks

  • Poisoning attacks manipulate training data and include availability attacks that insert many bad items and integrity attacks described as more complicated and potentially more dangerous.The listed forms include federated, intrusion, label-flipping, clean-label, data, and generative poisoning.Source: E. Poisoning attacks · pp. 39–40

1) Federated poisoning attack:

  • A federated poisoning method groups clients into clusters, repeatedly drops the worst cluster, and excludes clients for corrupted data or poor performance.The surviving cluster is used to train the FL model, while FGSM generates adversarial examples for the poisoning attack.Source: 1) Federated poisoning attack · p. 40
  • The MNIST model accuracy improved from 88% to 93% over 100 communication rounds after attacker nodes were removed; an IMDB sentiment defense achieved 0.72 accuracy.The methods use client reputation for MNIST and an SVM-generated dataset error for IMDB.Source: 1) Federated poisoning attack · p. 40

2) Intrusion poisoning attack:

This section surveys poisoning attacks from intrusion-data manipulation through Sybil attacks, alongside a federated label-flipping defense. It also describes clean-label, data, generative, and over-the-air spectrum poisoning methods.

2) Intrusion poisoning attack:

  • Intrusion poisoning applies data poisoning to intrusion-detection datasets; Edge-IIoT and X-IIoTID are identified for evaluating ML-based IDS performance.The attack manipulates the IDS dataset with the aim of disturbing intrusion detection.Source: 2) Intrusion poisoning attack · p. 40

3) Label flipping attack:

  • The federated label-flipping defense clusters gradients from local updates to identify potentially malicious updates before aggregation, and reports lower attack success, higher source-class accuracy, and lower test error.Experiments used MNIST, CIFAR10, and IMDB with CNN, ResNet18, and BiLSTM models.Source: 3) Label flipping attack · p. 40

4) Poisonous label attack:

  • A poisonous-label attack injects fake images carrying the poisonous label rather than directly modifying image labels, and is described as a blue-box attack.The section contrasts it with a poisonous attack under a white-box requirement.Source: 4) Poisonous label attack · p. 41

5) Clean-label poisoning attack:

  • Clean-label poisoning is described as operating without attacker control over the labeling procedure; one scalable attack reportedly improves transfer-learning success rate by 26.75% and attack speed by a factor of 12.Another described approach uses first-order information and a convex-polytope optimization over poisoned samples.Source: 5) Clean-label poisoning attack · pp. 41–42

6) Data poisoning attack:

  • The IMF data-poisoning scheme formulates poisoning as bilevel optimization, estimating fabricated-sample strength above and model parameters below; evaluation on Stanford Dogs and Osteoporotic Fracture reports potential to reshape target-sample interpretations.The section also describes a sequential ensemble detector based on feed-forward neural networks, GRUs, and an attention auto-encoder.Source: 6) Data poisoning attack · p. 42

7) Generative poisoning attack:

  • PoisonGAN is presented for federated learning, while DeepPoison uses one generator and two discriminators to extract target-class features and integrate them into benign training patterns.The discriminators monitor the poisoning perturbation ratio and witness poisoning impacts through a target model.Source: 7) Generative poisoning attack · p. 42

8) Over-the-air spectrum poisoning attack:

  • Over-the-air spectrum poisoning targets spectrum sensing and transmitter input data during training or testing, and requires knowledge of sensing parameters and the communication protocol.Reported benchmarking finds these attacks superior to conventional jamming and substantially decreasing transmitter throughput.Source: 8) Over-the-air spectrum poisoning… · p. 42

F. Sybil attacks

  • Sybil attacks use multiple false identities to influence federated learning, including poisoning and collusion variants.The stated objective is to gain majority influence in the targeted system.Source: F. Sybil attacks · pp. 42–43

1) Sybil-based poisoning attack:

The section reviews Sybil and Byzantine attacks, inference threats, and the impacts of ML vulnerabilities on peer-to-peer IoT learning and 6G features. It then introduces the paper’s classification of training-phase defenses.

1) Sybil-based poisoning attack:

  • A Sybil-based poisoning defense adapts client learning rates according to contribution similarity, while Sybils send status updates that steer the distributed model toward a poisoned target.The defense is attributed to Fung et al. [168].Source: 1) Sybil-based poisoning attack · p. 43

2) Sybil-based collusion attack:

  • Sybil-based collusion uses label flipping and multiple virtual Sybil nodes to increase the chance that the server aggregates a collusion pattern; experiments report a stronger attack effect.CIFAR-10 and Fashion-MNIST with CNNs were used in federated-learning evaluations.Source: 2) Sybil-based collusion attack · p. 43

1) Federated learning-Byzantine attack:

  • Byzantine attacks target integrity in the learning phase rather than data-collection integrity, and evaluations on four real-world datasets found increased error rates against Byzantine-robust FL methods.The attacks are formulated as optimization problems.Source: 1) Federated learning-Byzantine attack · p. 45

H. Inference attacks

I. Highlights the impacts of vulnerabilities in Peer-to-Peer IoT learning

  • In peer-to-peer IoT learning, backdoor and poisoning attacks can influence learning, Sybil and Byzantine attacks can affect learning, dropping attacks disrupt efficiency, and inference-related attacks threaten privacy.The passage also identifies model extraction and inversion as privacy threats.Source: §I · p. 45

J. Impact of ML Attacks on 6G Features

  • RNN backdoor attacks are described as exploiting all highlighted 6G features, while white-box, blue-box, and grey-box attacks are linked to AI-centric networking.The feature discussion also identifies D2D communication and ubiquitous sensing as potentially vulnerable to several attack types.Source: J. Impact of ML Attacks on 6G Features · pp. 45–46, Table XVII · p. 46

VIII. DEFENSE METHODS AGAINST EDGE LEARNING VULNERABILITIES

  • The paper presents a classification of defenses against ML attacks and points to state-of-the-art methods for ML and federated-learning vulnerabilities.The cited defense summaries are Table XVI and Table XVIII.Source: §VIII · p. 46

A. Training Phase Defense Methods

1) Poisoning Attacks Defense Mechanisms:

The survey organizes training-phase defenses across poisoning, backdoor, Byzantine, Sybil, and combined attacks, describing methods from client filtering and aggregation rules to feedback and moving-target strategies. Reported evaluations cover diverse datasets and threat settings, including compromised-client shares of up to 75% for one poisoning defense.

1) Poisoning Attacks Defense Mechanisms:

  • The survey groups poisoning defenses into eight subclasses, including KPCA/K-means filtering, knowledge transfer, cryptographic authentication, and historical-distance selection, evaluated on IID and non-IID MNIST.The historical-distance method selects possible benign clients based on the minimal sum of their pairwise model distances.Source: 1) Poisoning Attacks Defense Mechanisms · pp. 46, 48, 49
  • 95% accuracy with 75% of participating clients compromised was reported for Xie et al.’s immune-inspired poisoning defense.The system supports antigen identification, immune reaction, and immunological recall; the same passage also describes D2C, a decentralized blockchain-FL cognitive-computing model.Source: 1) Poisoning Attacks Defense Mechanisms · p. 46
  • Jangseung outperformed unprotected models at MNIST 96.2% versus 53.2% and VCI Wisconsin 88.18% versus 75.51%; Wang et al. also reported DQN-based mitigation across three datasets.Jangseung flags and rejects suspected outliers; Wang et al. use spatial search to reduce DQN learning complexity.Source: 1) Poisoning Attacks Defense Mechanisms · pp. 46–47

2) Backdoor Attacks Defense Mechanisms:

  • Backdoor defenses use server-side federated filters or client feedback; reported results include up to 99% backdoor-sample recognition and 100% accuracy with less than 5% false positives,.BaFFLE benchmarks updated-model classification against the former model and excludes updates showing unexpected behavior.Source: 2) Backdoor Attacks Defense Mechanisms · p. 49

3) Byzantine Attacks Defense Mechanisms:

  • Fedcvae uses an encoder-decoder anomaly detector, while a Byzantine-resilient aggregation rule removes distant gradient vectors; evaluations report tolerance of up to 30% malicious clients and resilience against up to 33% adversely affected parties.Fedcvae was evaluated under IID and non-IID data; the aggregation rule uses Euclidean distances from the calculated average.Source: 3) Byzantine Attacks Defense Mechanisms · p. 49

4) Sybil Attacks Defense Mechanisms:

  • Sybil defenses use verifiable-random-function subgroup selection or contribution similarity; Biscotti’s evaluations with 26 committee sizes report immunity to an opponent controlling 30% of system stakes.Contribution-similarity detection was evaluated on four datasets and five attack scenarios, including cases where Sybils submerge legitimate users [168].Source: 4) Sybil Attacks Defense Mechanisms · pp. 49–50

5) Defense Mechanisms Against Combined Attacks:

  • Combined-attack defenses include MT-MTD’s signaling-game approach and FedBlock/FedAC’s blockchain-based asynchronous FL; the latter reached 98.96% horizontal-FL and 95.84% vertical-FL accuracy on Raspberry Pi 4b.FedAC performs global aggregation asynchronously while accounting for a staleness coefficient.Source: 5) Defense Mechanisms Against Combined… · p. 50

B. Post-Training Phase Defense Methods

The survey describes post-training model-integrity defenses and inference-phase privacy defenses, then draws lessons about datasets, threat categories, and evaluation. It recommends systematically accounting for network infrastructure, learning models, attacks, defenses, data distribution, and system performance.

1) Trained Model Integrity Verification:

  • For trained-model integrity, the survey contrasts blockchain-based fuzzy-hash storage with cryptographic provenance for model protection against alteration and poisoning,.The described provenance approach also protects training data and software packages through authenticated manifests.Source: 1) Trained Model Integrity Verification · p. 50
  • Bayesian Compromise Detection combines a VAE’s low-dimensional representation with Bayesian optimization to identify sensitive samples, with detection rates up to 100% across MNIST, Olivetti, and CIFAR-100.The optimization addresses a non-convex search, large input-distribution space, and the cloud client’s blue-box view of a compromised model.Source: 1) Trained Model Integrity Verification · p. 50

1) Privacy Leakage Defense Mechanisms:

  • Inference-phase privacy defenses include gradient shielding, self-distillation, and overfitting control; PEFL uses homomorphic encryption and differential privacy, while SELENA targets blue-box membership inference,, [293].SELENA combines Split-AI feedback with self-distillation; the survey also identifies dropout and model stacking as overfitting-control approaches.Source: 1) Privacy Leakage Defense Mechanisms · pp. 50–51

A. Lessons learned

  • The survey classifies 21 attacks into eight categories and defense methods into training, post-training, and inference phases, alongside nine categories of cybersecurity-evaluation datasets.The attack categories include backdoor, adversarial-example, combined, poisoning, Sybil, Byzantine, inference, and drop attacks.Source: A. Lessons learned · p. 51
  • The authors recommend defining network infrastructure and learning models, identifying attacks and threat dimensions, and selecting defenses and datasets for the target 6G-enabled network.The listed threat-model dimensions are adversarial goal, attack strategies, and malicious-client selection.Source: A. Lessons learned · p. 51
  • Effective 6G-enabled IoT defenses require a systematic view of infrastructure, edge-learning models, attack and threat models, defenses, datasets, data distribution, and system performance.The survey identifies IID/non-IID distribution, accuracy, precision, recall, attack rate, scalability, and interoperability as evaluation considerations.Source: A. Lessons learned · pp. 51–52

B. Open issues and Challenges

The section identifies open challenges for secure 6G-IoT edge learning, spanning trustworthy AI, data and device constraints, defense trade-offs, and emerging edge LLM attacks. It concludes that further research on attacks and defenses remains necessary.

1) Reliable and Trustworthy Learning for 6G-IoT Intelligence:

  • Natively secured AI builds security into data preparation, learning, storage, and inference, but complex models must also accommodate IoT devices’ limited processing and storage.Trustworthy AI adds transparency, explainability, accountability, and ethical constraints; adaptable security solutions are also needed across heterogeneous wireless settings [294].Source: 1) Reliable and Trustworthy Learning… · p. 52
  • Ethics by Design addresses AI ethics at the design stage, though the concept is difficult to define consistently across humans and nations,.The paper also notes that machine intelligence does not accommodate ethical guidelines in the same way as humans.Source: 1) Reliable and Trustworthy Learning… · p. 52

2) Datasets Formation/Availability for Edge Learning:

3) ML Vulnerabilities Elimination and Defense Strategies Implementations:

  • Defense design must balance security with performance and profitability, simplicity with complexity, and backward compatibility with future security.In federated learning, adding noise for privacy reduces accuracy; backward compatibility can expose old vulnerabilities, while AI-based security may need prior-generation parameters.Source: 3) ML Vulnerabilities Elimination and… · pp. 53–54

4) Large language models at the Edge:

  • Deploying LLMs at the 6G-IoT edge raises security, privacy, resource, latency, consistency, and software-update challenges across diverse devices.The section notes that device constraints can affect model performance and efficiency, while high device density can strain network resources and delay real-time responses.Source: 4) Large language models at the Edge · p. 54

5) Universal Multi-prompt and Multi-model attacks:

  • Automated greedy and gradient-based searches can produce transferable adversarial suffixes that prompt LLMs to generate objectionable content, leaving effective defenses as a challenge.The cited study reports transfer across several LLMs, including ChatGPT, Bard, and Claude, with notable susceptibility in GPT-based models [301].Source: 5) Universal Multi-prompt and… · p. 54

X. CONCLUSIONS

  • The survey classifies ML threats into eight categories and reviews defenses for federated-learning vulnerabilities, while identifying further attack and defense research as necessary.The categories include backdoor, adversarial-example, combined, poisoning, Sybil, Byzantine, inference, and dropping attacks.Source: §X · p. 54
Loading 2306.10309v2…