## Line Chart: ASR vs. Attack Ratio for Different Federated Learning Methods ### Overview The image is a line chart comparing the Attack Success Rate (ASR) of different federated learning methods against varying attack ratios. The chart plots ASR (in percentage) on the y-axis against the attack ratio (in percentage) on the x-axis. Several federated learning methods are compared, including FedAvg, ShieldFL, PBFL, Median, Biscotti, FoolsGold, and "Ours". ### Components/Axes * **Title:** There is no explicit title on the chart. * **X-axis:** Attack ratio (%), with markers at 0, 10, 20, 30, 40, and 50. * **Y-axis:** ASR (%), with markers at 0, 20, 40, 60, 80, and 100. * **Legend:** Located in the top-left corner, the legend identifies each line by its corresponding federated learning method: * Blue square: FedAvg * Orange diamond: ShieldFL * Green triangle: PBFL * Purple star: Median * Gray pentagon: Biscotti * Brown inverted triangle: FoolsGold * Red circle: Ours ### Detailed Analysis * **FedAvg (Blue):** The ASR remains near 0% until an attack ratio of 40%, then sharply increases to approximately 75% at 50% attack ratio. * (0, ~0), (10, ~0), (20, ~0), (30, ~0), (40, ~0), (50, ~75) * **ShieldFL (Orange):** Similar to FedAvg, the ASR is low until 40% attack ratio, then increases to approximately 72% at 50% attack ratio. * (0, ~0), (10, ~1), (20, ~1), (30, ~2), (40, ~17), (50, ~72) * **PBFL (Green):** The ASR is low until 40% attack ratio, then increases to approximately 73% at 50% attack ratio. * (0, ~0), (10, ~2), (20, ~0), (30, ~3), (40, ~13), (50, ~73) * **Median (Purple):** The ASR is low until 40% attack ratio, then increases to approximately 74% at 50% attack ratio. * (0, ~0), (10, ~2), (20, ~0), (30, ~1), (40, ~0), (50, ~74) * **Biscotti (Gray):** The ASR increases sharply from 20% attack ratio and remains near 100% for attack ratios of 30% and above. * (0, ~0), (10, ~2), (20, ~2), (30, ~99), (40, ~98), (50, ~98) * **FoolsGold (Brown):** The ASR is low until 40% attack ratio, then increases to approximately 72% at 50% attack ratio. * (0, ~0), (10, ~2), (20, ~0), (30, ~1), (40, ~0), (50, ~72) * **Ours (Red):** The ASR remains low until 40% attack ratio, then increases to approximately 27% at 50% attack ratio. * (0, ~0), (10, ~2), (20, ~0), (30, ~0), (40, ~0), (50, ~27) ### Key Observations * Biscotti is highly vulnerable to attacks, with ASR reaching nearly 100% at relatively low attack ratios. * FedAvg, ShieldFL, PBFL, Median, and FoolsGold show similar trends, with low ASR until a 40% attack ratio, followed by a sharp increase. * "Ours" consistently has the lowest ASR compared to other methods, indicating better resilience against attacks. ### Interpretation The chart demonstrates the vulnerability of different federated learning methods to attacks. Biscotti is highly susceptible, while "Ours" appears to be the most robust against the attacks represented in the chart. The other methods (FedAvg, ShieldFL, PBFL, Median, and FoolsGold) exhibit similar vulnerabilities, with a sharp increase in ASR at higher attack ratios. The data suggests that the "Ours" method provides a significant improvement in security compared to the other methods tested. The sharp increase in ASR for most methods at 40% attack ratio suggests a critical threshold where the attacks become significantly more effective.

## Chart Type: Line Chart: ASR (%) vs. Attack Ratio (%) for Different Methods ### Overview This image displays a 2D line chart illustrating the relationship between "Attack ratio (%)" on the x-axis and "ASR (%)" (Attack Success Rate) on the y-axis. The chart compares the performance of seven different methods: FedAvg, ShieldFL, PBFL, Median, Biscotti, FoolsGold, and Ours, as indicated by a legend in the top-left corner. Each method is represented by a distinct colored line and marker. The primary purpose of the chart is to show how the ASR of these methods changes as the attack ratio increases. ### Components/Axes **X-axis:** * **Title:** Attack ratio (%) * **Range:** 0% to 50% * **Major Tick Markers:** 0, 10, 20, 30, 40, 50 **Y-axis:** * **Title:** ASR (%) * **Range:** 0% to 100% * **Major Tick Markers:** 0, 20, 40, 60, 80, 100 **Legend (Positioned in the top-left quadrant of the plot area):** The legend lists the seven methods, each with a unique color and marker: * **FedAvg:** Blue line with square markers (□) * **ShieldFL:** Orange line with diamond markers (◇) * **PBFL:** Green line with upward triangle markers (△) * **Median:** Purple line with star markers (☆) * **Biscotti:** Grey line with downward triangle markers (▽) * **FoolsGold:** Brown line with rightward triangle markers (▷) * **Ours:** Red line with circle markers (○) ### Detailed Analysis The chart presents six data points for each method, corresponding to attack ratios of 0%, 10%, 20%, 30%, 40%, and 50%. 1. **FedAvg (Blue line with square markers):** * **Trend:** The ASR remains at 0% for attack ratios from 0% to 30%. It then sharply increases between 30% and 50% attack ratio. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~0% ASR * 40% Attack: ~18% ASR * 50% Attack: ~97% ASR 2. **ShieldFL (Orange line with diamond markers):** * **Trend:** Similar to FedAvg, the ASR remains at 0% for attack ratios from 0% to 30%. It then sharply increases between 30% and 50% attack ratio. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~0% ASR * 40% Attack: ~19% ASR * 50% Attack: ~97% ASR 3. **PBFL (Green line with upward triangle markers):** * **Trend:** The ASR remains at 0% for attack ratios from 0% to 20%. It shows a slight increase at 30%, a moderate increase at 40%, followed by a sharp increase to 50%. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~2% ASR * 40% Attack: ~12% ASR * 50% Attack: ~96% ASR 4. **Median (Purple line with star markers):** * **Trend:** The ASR remains at 0% for attack ratios from 0% to 40%. It then sharply increases between 40% and 50% attack ratio. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~0% ASR * 40% Attack: ~0% ASR * 50% Attack: ~95% ASR 5. **Biscotti (Grey line with downward triangle markers):** * **Trend:** This method shows a slight increase in ASR at 10% and 20% attack ratios, followed by a very sharp increase between 20% and 30%, reaching near 100% ASR, and remaining high thereafter. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~2% ASR * 20% Attack: ~3% ASR * 30% Attack: ~99% ASR * 40% Attack: ~99% ASR * 50% Attack: ~99% ASR 6. **FoolsGold (Brown line with rightward triangle markers):** * **Trend:** Similar to FedAvg and ShieldFL, the ASR remains at 0% for attack ratios from 0% to 30%. It then sharply increases between 30% and 50% attack ratio. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~0% ASR * 40% Attack: ~19% ASR * 50% Attack: ~97% ASR 7. **Ours (Red line with circle markers):** * **Trend:** The ASR remains at 0% for attack ratios from 0% to 40%. It then shows a moderate increase between 40% and 50% attack ratio, but remains significantly lower than other methods. * **Data Points:** * 0% Attack: ~0% ASR * 10% Attack: ~0% ASR * 20% Attack: ~0% ASR * 30% Attack: ~0% ASR * 40% Attack: ~0% ASR * 50% Attack: ~26% ASR ### Key Observations * At 0% attack ratio, all methods show an ASR of 0%. * Biscotti (grey line) is the first method to show a non-zero ASR, starting at 10% attack ratio (~2%) and rapidly escalating to near 100% ASR by 30% attack ratio. * Most methods (FedAvg, ShieldFL, FoolsGold, PBFL) maintain a very low ASR (near 0%) up to 20% or 30% attack ratio, then experience a sharp increase in ASR, reaching over 95% by 50% attack ratio. * Median (purple line) maintains 0% ASR for the longest among the traditional methods, up to 40% attack ratio, before sharply rising to ~95% at 50% attack ratio. * The "Ours" method (red line) consistently maintains the lowest ASR across all attack ratios, staying at 0% until 40% attack ratio, and only reaching ~26% ASR at 50% attack ratio. ### Interpretation This chart demonstrates the robustness of different methods against increasing attack ratios, where a lower ASR indicates better performance (i.e., the attack is less successful). The data suggests that: * **Biscotti** is highly vulnerable to attacks, with its ASR quickly reaching near 100% even at relatively low attack ratios (30%). This indicates poor resilience against adversarial actions. * **FedAvg, ShieldFL, PBFL, FoolsGold, and Median** show similar vulnerability patterns. They are somewhat resilient at lower attack ratios (up to 20-30%), but their ASR rapidly escalates to near 100% once the attack ratio surpasses a certain threshold (around 30-40%). This implies a critical point beyond which these methods become highly susceptible to attacks. * The **"Ours"** method stands out significantly. It maintains a perfect 0% ASR up to a 40% attack ratio, and even at the highest tested attack ratio of 50%, its ASR is only ~26%. This is substantially lower than all other methods, which are at or near 100% ASR at 50% attack ratio. In conclusion, the "Ours" method demonstrates superior resilience and robustness against increasing attack ratios compared to the other evaluated methods, maintaining a much lower attack success rate, especially under high adversarial conditions. This suggests that "Ours" is a more secure or attack-resistant approach in the context being studied.

## Chart: Attack Success Rate (ASR) vs. Attack Ratio for Federated Learning Defenses ### Overview The image presents a line chart comparing the Attack Success Rate (ASR) of different Federated Learning (FL) defense mechanisms against varying Attack Ratios. The chart visualizes how effectively each defense strategy mitigates attacks as the proportion of malicious participants increases. ### Components/Axes * **X-axis:** "Attack ratio (%)" - Ranges from 0% to 50%, with markers at 0, 10, 20, 30, 40, and 50. * **Y-axis:** "ASR (%)" - Ranges from 0% to 100%, with markers at 0, 20, 40, 60, 80, and 100. * **Legend (Top-Left):** Lists the different defense mechanisms being compared: * FedAvg (Blue, dashed line with square markers) * ShieldFL (Orange, dashed line with circle markers) * PBFL (Green, dashed line with triangle markers) * Median (Gray, solid line with diamond markers) * Biscotti (Black, solid line with asterisk markers) * FoolsGold (Brown, dashed line with plus markers) * Ours (Red, solid line with circle markers) ### Detailed Analysis Here's a breakdown of each line's trend and approximate data points, cross-referencing with the legend colors: * **FedAvg (Blue):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 20% attack ratio, then rises sharply to approximately 95% ASR at 50% attack ratio. * **ShieldFL (Orange):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 30% attack ratio, then increases to approximately 15% ASR at 40% attack ratio, and reaches approximately 95% ASR at 50% attack ratio. * **PBFL (Green):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 30% attack ratio, then increases to approximately 15% ASR at 40% attack ratio, and reaches approximately 95% ASR at 50% attack ratio. * **Median (Gray):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 20% attack ratio, then rises sharply to approximately 95% ASR at 50% attack ratio. * **Biscotti (Black):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 20% attack ratio, then rises sharply to approximately 95% ASR at 50% attack ratio. * **FoolsGold (Brown):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 40% attack ratio, then increases to approximately 5% ASR at 50% attack ratio. * **Ours (Red):** Starts at approximately 0% ASR at 0% attack ratio. Remains at 0% until approximately 30% attack ratio, then increases to approximately 10% ASR at 40% attack ratio, and reaches approximately 25% ASR at 50% attack ratio. ### Key Observations * Most defense mechanisms (FedAvg, ShieldFL, PBFL, Median, Biscotti) exhibit a sharp increase in ASR after approximately 20-30% attack ratio, indicating a vulnerability to attacks when a significant portion of participants are malicious. * FoolsGold demonstrates the most resilience, maintaining a very low ASR even at a 50% attack ratio. * The proposed defense ("Ours") consistently shows a lower ASR compared to other defenses, especially at higher attack ratios, suggesting improved robustness. * ShieldFL and PBFL have identical curves. ### Interpretation The chart demonstrates the effectiveness of different Federated Learning defense mechanisms against adversarial attacks. The ASR represents the probability of a successful attack, and the Attack Ratio represents the proportion of malicious participants in the FL system. The sharp increase in ASR for most defenses at higher attack ratios suggests that these defenses are susceptible to collusion or coordinated attacks when a substantial number of participants are compromised. FoolsGold appears to be the most robust defense, likely due to its specific design principles. The proposed defense ("Ours") shows promising results, offering a lower ASR across the tested attack ratios, indicating a potential improvement in the security of Federated Learning systems. The identical curves for ShieldFL and PBFL suggest that these two defenses are either functionally equivalent or share a common underlying mechanism. Further investigation would be needed to determine the exact relationship between them. The chart highlights the importance of developing robust defense mechanisms that can withstand attacks even in scenarios with a high proportion of malicious participants.

\n ## Line Chart: Attack Success Rate (ASR) vs. Attack Ratio ### Overview This is a line chart comparing the performance of seven different methods (likely federated learning aggregation or defense algorithms) against a poisoning attack. The chart plots the Attack Success Rate (ASR) as a percentage against the Attack Ratio (the proportion of malicious clients or poisoned data) as a percentage. The data suggests an evaluation of algorithmic robustness. ### Components/Axes * **Chart Type:** Multi-line chart with markers. * **X-Axis:** Labeled "Attack ratio (%)". Scale ranges from 0 to 50, with major tick marks at 0, 10, 20, 30, 40, and 50. * **Y-Axis:** Labeled "ASR (%)". Scale ranges from 0 to 100, with major tick marks at 0, 20, 40, 60, 80, and 100. * **Legend:** Located in the top-left corner of the plot area. It lists seven data series with corresponding colors and markers: 1. **FedAvg:** Blue line with square markers (□). 2. **ShieldFL:** Orange line with diamond markers (◇). 3. **PBFL:** Green line with upward-pointing triangle markers (△). 4. **Median:** Purple line with circle markers (○). 5. **Biscotti:** Gray line with star/asterisk markers (☆). 6. **FoolsGold:** Brown line with downward-pointing triangle markers (▽). 7. **Ours:** Red line with circle markers (○). ### Detailed Analysis The chart tracks the ASR for each method at six discrete attack ratios: 0%, 10%, 20%, 30%, 40%, and 50%. **Trend Verification & Data Points (Approximate):** 1. **Biscotti (Gray, ☆):** This line shows a dramatically different trend. It remains near 0% ASR at 0%, 10%, and 20% attack ratio. It then experiences a **sharp, near-vertical increase** between 20% and 30%, reaching approximately **98-99% ASR** at 30%. It plateaus at this very high level (~98-99%) for attack ratios of 40% and 50%. This is a clear outlier in behavior. 2. **FedAvg (Blue, □), ShieldFL (Orange, ◇), PBFL (Green, △), FoolsGold (Brown, ▽):** These four methods follow a very similar pattern. They all maintain a very low ASR (approximately 0-5%) from 0% up to a 40% attack ratio. Between 40% and 50%, they all exhibit a **steep, simultaneous increase**, converging to a high ASR in the range of **~92-98%** at the 50% attack ratio point. Their lines are tightly clustered, especially at the 50% mark. 3. **Median (Purple, ○):** This method follows a trend similar to the group above but with a slightly less severe final increase. It stays near 0-5% ASR until 40% attack ratio. At 50%, it rises to approximately **~90% ASR**, which is slightly lower than the FedAvg/ShieldFL/PBFL/FoolsGold cluster. 4. **Ours (Red, ○):** This method demonstrates the most robust performance. It maintains an ASR near 0% from 0% to 40% attack ratio. At the 50% attack ratio, it shows a **moderate increase** to approximately **~25% ASR**. This is significantly lower than all other methods at the highest tested attack ratio. **Spatial Grounding:** The legend is positioned in the top-left quadrant, overlapping slightly with the upper part of the Biscotti line's plateau. The data points for all series at 0%, 10%, and 20% are clustered very closely near the bottom of the chart (0-5% ASR). The most significant visual separation occurs at the 30% mark (where Biscotti diverges) and the 50% mark (where "Ours" separates from the high-ASR cluster). ### Key Observations 1. **Critical Threshold:** For six of the seven methods (all except Biscotti), there appears to be a critical threshold between 40% and 50% attack ratio where their defense collapses, leading to a dramatic spike in ASR. 2. **Biscotti's Early Failure:** The Biscotti method fails at a much lower attack ratio (30%) compared to the others, but its ASR saturates near 100% immediately. 3. **"Ours" Outperforms:** The method labeled "Ours" is the only one that maintains a relatively low ASR (~25%) even at the highest tested attack ratio of 50%, indicating superior resilience. 4. **Clustering of Baselines:** FedAvg, ShieldFL, PBFL, and FoolsGold perform almost identically across the entire range, suggesting similar vulnerability profiles under this specific attack scenario. ### Interpretation This chart is likely from a research paper evaluating a new federated learning defense mechanism ("Ours") against poisoning attacks. The data demonstrates that the proposed method ("Ours") significantly outperforms several established baselines (FedAvg, ShieldFL, PBFL, Median, FoolsGold) and one other method (Biscotti) in terms of maintaining a low Attack Success Rate as the proportion of malicious participants increases. The key finding is that while most traditional aggregation methods (like FedAvg, Median) and some defenses (ShieldFL, PBFL, FoolsGold) are effective up to a 40% attack ratio, they become highly vulnerable at 50%. Biscotti appears to be vulnerable at even lower attack ratios (30%). The proposed "Ours" method shows a much more gradual and limited increase in ASR, suggesting it incorporates a more robust mechanism for identifying and mitigating the influence of poisoned updates, even when they constitute half of the total updates. The chart effectively argues for the practical superiority of the "Ours" method in high-threat environments.

## Line Graph: Attack Success Rate (ASR) vs. Attack Ratio (%) ### Overview The graph compares the Attack Success Rate (ASR) of seven different methods across varying attack ratios (0% to 50%). ASR is plotted on the y-axis (0–100%), while the x-axis represents the attack ratio percentage. The legend identifies methods by color and marker, with "Ours" (red circles) and "FoolsGold" (brown triangles) showing distinct performance patterns. ### Components/Axes - **X-axis**: Attack ratio (%) ranging from 0 to 50. - **Y-axis**: Attack Success Rate (ASR) (%) ranging from 0 to 100. - **Legend**: Located in the top-left corner, associating colors/markers with methods: - FedAvg (blue squares) - ShieldFL (orange diamonds) - PBFL (green triangles) - Median (purple pentagons) - Biscotti (gray stars) - FoolsGold (brown triangles) - Ours (red circles) ### Detailed Analysis 1. **Biscotti (gray stars)**: - Starts near 0% ASR at 0% attack ratio. - Sharp upward spike at 30% attack ratio, reaching ~100% ASR. - Maintains ~100% ASR until 50% attack ratio. 2. **FoolsGold (brown triangles)**: - Remains near 0% ASR until 40% attack ratio. - Steep rise at 40%, reaching ~100% ASR by 50% attack ratio. 3. **Ours (red circles)**: - Stays near 0% ASR until 40% attack ratio. - Sharp increase at 50%, reaching ~25% ASR. 4. **FedAvg (blue squares)**: - Gradual rise from 0% to ~15% ASR at 50% attack ratio. 5. **ShieldFL (orange diamonds)**: - Gradual rise from 0% to ~20% ASR at 50% attack ratio. 6. **PBFL (green triangles)**: - Gradual rise from 0% to ~10% ASR at 50% attack ratio. 7. **Median (purple pentagons)**: - Gradual rise from 0% to ~5% ASR at 50% attack ratio. ### Key Observations - **Biscotti** and **FoolsGold** exhibit the highest ASR at 50% attack ratio (~100%), with abrupt performance jumps at 30% and 40% attack ratios, respectively. - **Ours** shows the steepest late-stage increase but lags behind Biscotti and FoolsGold at 50% attack ratio. - Methods like FedAvg, ShieldFL, and PBFL demonstrate gradual, linear improvements, peaking at ~15–20% ASR at 50% attack ratio. - All methods maintain near-0% ASR until attack ratios exceed 30%. ### Interpretation The graph highlights a threshold effect in ASR performance: Biscotti and FoolsGold achieve near-perfect success rates only after attack ratios surpass 30% and 40%, respectively. This suggests these methods are highly resilient but may underperform at lower attack ratios. "Ours" demonstrates competitive late-stage performance but requires a 50% attack ratio to activate. Gradual improvements in FedAvg, ShieldFL, and PBFL imply incremental robustness, though they lack the dramatic efficiency of Biscotti and FoolsGold. The data underscores a trade-off between attack ratio tolerance and ASR efficiency, with Biscotti and FoolsGold excelling in high-threat scenarios.