ABSTRACT Federated learning distributes model training among a multitude of agents, who, guided by privacy concerns, perform training using their local data but share only model parameter updates, for iterative aggregation at the server. In this work, we explore the threat of model poisoning attacks on federated learning initiated by a single, non-colluding malicious agent where the adversarial objective is to cause the model to mis-classify a set of chosen inputs with high confidence. We explore a number of strategies to carry out this attack, starting with simple boosting of the malicious agent's update to overcome the effects of other agents' updates. To increase attack stealth, we propose an alternating minimization strategy, which alternately optimizes for the training loss and the adversarial objective. We follow up by using parameter estimation for the benign agents' updates to improve on attack success. Finally, we use a suite of interpretability techniques to generate visual explanations of model decisions for both benign and malicious models, and show that the explanations are nearly visually indistinguishable. Our results indicate that even a highly constrained adversary can carry out model poisoning attacks while simultaneously maintaining stealth, thus highlighting the vulnerability of the federated learning setting and the need to develop effective defense strategies.
The paper considers the federated learning setting as introduced by McMahan et al. (2017) and aims at securing it against model poisoning attacks.
Cons: 
While I appreciated the writing clarity of the paper, the paper misses the whole point of defensive ML research: in the model poisoning case, a minimal requirement for a defense mechanism is to be formally proven *whatever is the behavior of the attacker* (within the threat model). Experiments alone are not sufficient for this purpose given the size of the space of possible attacks. Especially that (unlike evasion attacks) proofs are relatively easy to be made in the poisoning case.
For instance the literature cited by the paper (Chen 2017, Chen 2018, Blanchard 2017) + the recent follow-ups ((1)Alistarh et al. NIPS 2018, (2) El Mhamdi  et al. ICML 2018,  (3) Yin et al. ICML 2018 etc) are full of approaches the authors can follow to formally support their claims.
Also, the literature review has been done very lightly: Chen et al. 2017b (And most cited above) do *not* assume a single Byzantine agent as said in the paper, but assume up to <50% malicious (potentially colluding) agents. 
Besides absence of formal support, how does the approach compare to the optimal results in (1) and (3) at least in the convex case ?
In the abstract, it is said (ii) that in the i.i.d situation, it will be easy to make spurious update standout among benign ones), this was proven wrong in (2) when the dimension of the model is large and the loss function highly non-convex, the case of neural networks for example. As a general comment, the defense mechanisms of the paper are all relying on a distance computation and thus will all provide the sqrt(d) leeway for an attacker as described in (2) and will fail preventing high-dimensionality attacks.
Pros: 
I was very excited by the ideas in section 5, this work is the first to my knowledge to attempt at interpreting poisoning attacks. I suggest to the authors to either fix the issues mentioned above (and formally analyze their work), or to focus more on the interoperability question, if they want to keep the paper in the empiricist nature.