A Survey of AI-Related Cyber Security Risks and Countermeasures in Mobility-as-a-Service

Since the problem involves the combination of different transport modes, one can add a penalty to the objective function to represent the introduced transition cost of transferring from one mode to another. In [36], Modesti and Sciomachen presented an approach based on the classical shortest path problem on a network representing the urban multi-modal transport system, including unrestricted walking, unrestricted car travel, and public transit. The journeys are obtained by optimising a linear combination of criteria, such as cost, travel time, and user preferences on the transport modes. Aifadopoulou et al. [37] proposed to solve the optimal journey problem using linear programming over multi-modal transportation networks. Antsfeld et al. [38] suggested using a linear utility function that incorporates travel time, ticket cost, and inconvenience of transfers. To merge the fixed and dynamic modes with the fuzzy and flexible nature, Huang et al. [39] considered the concept of drive-time areas and points of action, which can merge them better while maintaining the flexibility of the dynamic modes. Pantelidis et al. [40] formulated the traffic assignment in MaaS as stable matching of multiple transport operators and passengers. This matching aims to allocate costs and determine prices based on the route choices of passengers and the service choices of operators. Xu et al. [41] modelled the concept of congestive capacity on the route choice model, where link capacities depend on traffic flows rather than link costs. They proposed a method to obtain unique shadow prices for congestive capacity in a multi-modal transport network to capture the structural effects of flows on capacities and the resulting impacts on route choice utilities. The aim is to verify the capability to capture congestion effects on capacities. Ma et al. [42] investigated dynamic bus-routing, integrating on-demand services with real-time passenger demand, utilising a two-stage stochastic programming model to optimise vehicle travel time cost and minimise the penalty for rejected requests.

In label-constrained approaches, the weights of the graph are labelled by an alphabet $\Sigma$ that denotes the modes of transport, and a language $L$ is specified in the shortest path problem such that journeys have to obey pre-defined constraints related to the modes of transport [43]. If the languages in the problem are regular, there are techniques to obtain tractable solutions [44, 45]. The label-constrained shortest path problem can be sped up by using an approach proposed by Delling et al. [34], which can handle hierarchical languages that allow constraints such as restricting walking and car travel from the beginning to the end of the journey. Khani [46] developed an online shortest path algorithm and a label-correcting solution algorithm in schedule-based transit networks with stochastic vehicle arrival times.

Although label constraints are valuable in determining possible journeys, there are drawbacks in computing the shortest path with label constraints. Firstly, the characteristics of each transport network must be known in order to set the constraints. Secondly, the computed journeys are limited to certain transport mode combinations, while combining the modes differently is not computed. Therefore, multi-objective optimisation can be considered to determine diverse solutions.

In [47], two algorithms are presented for solving the multi-objective shortest path problem, proving that any pair of non-dominated paths can be connected by non-dominated paths. Zografos et al. [48] formulated the journey planning problem on a multi-modal time-schedule network with time windows and time-dependent travel times that minimise a set of criteria, including the total travel, walking, and waiting time and the number of interchanges. Bast et al. [49] proposed a method called Types aNd Thresholds for identifying significant journeys in the non-dominated solution. It is based on a set of simple axioms that summarise what a majority of consumers as unreasonable journeys. The planner developed by Atasoy et al. [7] provides an optimised menu of travel options complying with seat capacity and committed time schedule constraints to passengers. The model considers the trade-off between consumer surplus and operator profit to improve passenger satisfaction. Song et al. [50] formulated the whole-day multi-modal journey planning problem that considers user-specific modal preferences. The problem aims to minimise the total travel and waiting times and the transfer number in a day. Chu et al. [51] introduced a novel approach for multimodal journey planning in MaaS that considers diverse passenger preferences and dynamic behaviours by modelling passenger experience as a Markov process and formulating a multi-objective optimisation problem. Constraints such as the time window and park-and-ride demands are considered to produce customised journey planning. This method could also be extended to low-carbon MaaS systems by collating and analysing data in the location and capacity of charging stations, as well as temporal changes in local and national energy and ancillary services markets [52].

An example of the magnitude of personal data that can be collected by MaaS systems (see Fig. 4) was given in a study [53], where Cottrill reviewed the privacy policy of Whim, a MaaS app. The data that can be directly collected from consumers include basic personal details (e.g., name and telephone number), additional personal details (e.g., email address, home country and address, information on devices used, language, credit card details, etc.), and verification data (e.g., personal identity number, photo, or driving license details). Other data such as transaction information, location data, travel data can be also collected through the use of the app.

Barreto et al. [54] conducted a study on utilising MaaS for urban mobility digitalisation and found that as a user shares personal data or registers with a MaaS service, the MaaS operator, such as the local authority managing a smart city, has the capability to infer the user’s behaviours and mobility patterns, including their needs, interests, and possible transport means choices. Moreover, Costantini et al. [55] stated that by analysing the mobility patterns extracted from MaaS users, it is possible to infer information related to certain health conditions, which can violate the user’s privacy to some extent. Past research has also addressed the privacy risks of using collected geo-location data for profiling and inference. Costantini et al. [55] pointed out that geo-location data contain a wealth of information that can create additional vulnerabilities, particularly when the data contain a specific user’s sensitive destination information, such as a cult temple, the office of a syndicate or political party, a civil organisation, or a school for their child(ren). This may introduce legal concerns, as the collection and use of such personal data can raise legal compliance issues such as violation of one or more rights of data subjects. In addition, the combination of geo-location data with the corresponding time of use information can be highly valuable to companies operating in the retail and leisure sectors. However, the monetisation of such sensitive data raises serious privacy and ethical concerns, which should not be ignored [56].

While the privacy risks over MaaS consumers’ data is relatively well established in the literature, data from MaaS service providers that can cause privacy risks and concerns is much less discussed. Drivers’ schedule information [57], drivers’ geo-location data [58], and drivers’ performance records [59] were all identified as containing sensitive information that can lead to re-identification risks and violations of location privacy. To mitigate potential risks, Belletti and Bayen [57] proposed a constrained integer quadratic program-based framework that does not require personal availability constraints of drivers to be shared with their system. Kong et al. [59] developed a blockchain-based solution to preserve the privacy of drivers that can be shared across MaaS operators.

The role of data exchange is crucial in MaaS, and there are different stakeholders who need to access and process data to function properly. Cottrill [53] emphasised the significance of examining third-party processors (e.g., payment processors, and hosting providers) of MaaS applications in terms of privacy considerations and implications. Pitera and Marinelli  [61] and He and Chow [62] recommended to have agreements on the type and format of the data that can be shared among different actors of MaaS to best facilitate platform operations. When sharing data via an open data platform, a certain level of privacy control is needed to help public agencies better measure and evaluate the market [62]. Moreover, Butler et al. [14] indicated that one particular barrier to MaaS adoption is the privacy risk and concern related to access to personal data by nefarious sources. Butler et al. [14] also found out that the breach of intellectual properties would lead to businesses losing competition advantage. To this end, the importance of privacy regulations was highlighted in the study for the development of MaaS and to maintain the trust of both users and providers [14]. Along this line of research, researchers have examined whether real-world MaaS systems have policies/measures in place to address these issues. A study [60] investigated the development and deployment of data protection mechanisms in smart cities and MaaS, as illustrated in Table I, revealing poor data protection practices across different cities in Italy and Switzerland to address data privacy risks while deploying smart city programmes. To respond to this, regulations and policies, such as the EU’s General Data Protection Regulation (GDPR), are anticipated to affect the deployment of MaaS significantly. The MaaS ecosystem involving both data controllers and processors must be designed and implemented to comply with these regulations. This includes adhering to principles such as privacy by design, explicit consent, and data protection as mandated by the GDPR [53]. However, to the best of our knowledge, research about MaaS is less studied to cover these perspectives.

Denial-of-service (DoS) attacks have been widely recognised as a critical cyber security attack vector that every designer and developer of MaaS systems should be aware of, as suggested by several studies [63, 64, 65]. In a DoS attack, malicious actors exploit vulnerabilities in the system’s infrastructure, overwhelming it with a flood of traffic or exhausting its resources to disrupt its normal operation, making it unavailable to legitimate customers. Thai et al. [64] suggested that the increasing popularity of MaaS could attract malicious parties’ attention to launch DoS attacks to gain illicit advantages. To address this challenge, Thai et al. [64] introduced a theoretical framework aimed at mitigating the impact of DoS attacks on MaaS systems. Their framework involves analysing the network and considering it as a stochastic control problem with the main objectives of 1) maximising passenger retention within the network in a steady state; and 2) analysing the financial impacts of DoS attacks on MaaS systems. Apart from DoS attacks, several other attack types such as eavesdropping, spoofing attacks, jamming attacks, hijacking attacks, man-in-the-middle (MitM) attacks, replay attacks, relay attacks, remotely exploitable attacks, and ransomware attacks, have also been identified [65, 66, 67].

Depending on how a MaaS system is developed, different approaches have been proposed to mitigate such attacks. For a MaaS system that integrates with edge-oriented computing (EOC), Carvalho et al. [67] suggested deploying machine learning based methodologies in edge servers to help detect EOC-related attacks and security breaches such as fault injection, user impersonation, crowd-sourcing attacks, and data manipulation. Furthermore, Nguyen et al. [68] proposed a blockchain-based approach for MaaS, aiming to enhance trust and transparency among stakeholders. Their proposal involves the utilisation of distributed computational resources allocated to various transport providers situated at the network’s edge. Similarly, several studies [55, 69] suggested that the utilisation of smart contracts on the blockchain could make payment and exchange of other services in MaaS systems somewhat faster and more convenient while also ensuring customer privacy when sharing data. Nguyen et al. [68] further suggested the need of clear specification on the contractual terms and statements, which can be achieved by applying cryptographic zero-knowledge argument schemes (SNARKs) to demonstrate that the terms can be satisfied and agreed on, without disclosing private information related to passengers in the contract. In another study, Bothos et.al. [70] also addressed that the blockchain-based approach could allow conditional transactions by encrypting the data with selective access rights, which can enhance the security and privacy of personal information. The risks of these blockchain-based approaches can be quantified by the risk assessment framework [71].

In addition to those technical threats given above, there are also some socio-technical threats that have been identified from past research. Cruz et.al. [69] adopted a SWOT (Strength-Weakness-Opportunities-Threats) analysis for MaaS used in Lisbon, and identified a number of social issues as potential security threats: 1) reluctance of MaaS consumers to have control over their own apps; 2) conflicting objectives between private and public companies; and 3) unclear regulatory frameworks and data privacy issues. In another study, Vaidya and Mouftah [65] concluded that dishonest individuals, hackers, criminal groups, and dishonest organisations can pose potential security threats to MaaS systems. They also indicated that the main motivations of wrongdoings by dishonest individuals include financial gain and/or theft, leading to potential harms such as identity theft, vehicle theft, and financial loss for both individuals and organisations. Criminal groups have been identified as being motivated by a desire to cause service or business disruptions, leading to significant harm to individuals and organisations. For dishonest organisations, the main motives are to sabotage competitors, and/or industrial espionage [65]. The illegal and unethical use of personal data by MaaS operators/providers is another security risk recognised by some studies [72, 58]. According to the findings of Callegati et al. [58], malicious activities by MaaS operators pose potential security threats. These activities include the transmission of relevant information to competitors and the extraction of sensitive data by aggregating anonymised data. In addition, Callegati et.al. [58] also suggested that the action of disabling the GPS device on drivers’ vehicles can be considered as an insider threat, as it can potentially compromise the reliability of the GPS positioning system and other services that depend on it. Disabling geo-location data would undermine vehicle-to-grid services that transport vehicles and charging systems could offer in low-carbon MaaS systems, highlighting increasing trade-offs for mitigation of cyber security risks vs digitisation of energy and transport systems. Increasing inter-dependencies of transport and energy systems point to the importance of AI in monitoring, planning and coordinating the decisions of millions of individuals and assets like homes, transport vehicles, solar panels, and charging stations. Following an assessment of future challenges of privacy and data risks, we then discuss the risks associated with the use of AI algorithms in MaaS systems.

Evasion attacks are data manipulation attacks targeting particular types of layers, such as convolution layers, as neural network architectures typically consist of a variety of layers to perform tasks such as regression, classification, and text generation. Consequently, any deep learning architecture that relies on convolution tasks will suffer to varying degrees from evasion attacks. Here, we review specific recent developments in evasion attacks relevant to MaaS, as illustrated in Fig. 5a. Evasion attacks can degrade performance in different layers of neural networks for both centralised and federated learning approaches, resulting in errors or insensitivity to consumer demands.

The majority of evasion attacks focus on computer vision applications, which, in MaaS scenarios, translate to real-world perception of intelligent transport, e.g., self-driving vehicles and intelligent traffic infrastructures. In 2019, Thys et al. [78] proposed a basic patch method to fool a YOLO v2 detector, demonstrating CNN detection evasion. This method was extended to the context of aerial surveillance photography for a YOLO v2 object detector, but performance was analysed based on flat images without noise, transformation, or discoloration. In 2020, Xu et al. [79] designed practical evasion attacks, considering both the deformation of evasion patterns caused by movement and the data spectrum differences between the desired and achievable evasion attacks. Consequently, more recent work has focused on training evasion attack data patterns constrained by reality. Of particular relevance to MaaS, several novel variants of patch training using GANs [80] have been developed: 1) generating evasion data patches with data dimensions constrained to personal requirements [81] (e.g., different consumers may have varying data on requirements and preferences); and 2) enabling data dimensions to be flexible to transformations and deformations [82, 83, 84] (e.g., consumers may dramatically change their personal attributes or travel requirements). These constraints are embedded in the evasion pattern generation process by adding general boundary constraints or transformations to the data to mimic real-world scenarios.

Evasion attacks on Large Language Models (LLMs) also pose significant risks. Zou et al. [85] proposed an approach that generates malicious inputs which are efficient and transferable. These attacks manipulate the input data to evade detection mechanisms and compromise the integrity of LLM-based applications.

Membership Inference Attacks (MIAs) and Model Extraction Attacks (MEAs) also represent formidable security challenges to MaaS, as illustrated in Fig. 5b. The former can disclose whether specific user data or travel patterns have been utilised in training MaaS algorithms, leading to privacy breaches, while the latter might replicate proprietary algorithms, eroding competitive edges. Although Federated Learning (FL), a distributed ML paradigm that keeps private data on client devices for local training and then aggregates these models on a server, is widely adopted in MaaS and lauded for enhancing privacy, it is not impervious to these threats. The server-client architecture of FL increases the opportunity for adversaries to perform Man-in-the-Middle (MitM) attacks, threatening AI algorithms via communication channels and household client devices, as shown in Fig. 5. MIAs (b1) can detect data patterns from model updates, while MEAs (b2) can directly target the aggregated model in the client model update process.

• •

  Member Inference Attacks (MIAs): Such attacks were first described by Shokri et al. [86], aiming to infer whether a data record is a member of the training set of the target model. They achieved this by training an attack model with the output vectors of the target model, reporting over 90% and 70% inference accuracy on Google and Amazon services, respectively. Nasr et al. [87] presented a comprehensive analysis of the threats of MIAs on FL. Their experiments compared attacks from both categories of participants, an adversarial aggregator and malicious clients, with different levels of access to the target model. A malicious client can achieve 76.7% inference accuracy, and a malicious server can achieve 82.1%. Hu et al. [88] extended such attacks to infer the source of data records, i.e., the specific client that owns the identified data records.

• •

  Model Extraction Attacks (MEAs): MEAs can be seen as a malicious application of the techniques described by Hinton et al. [89], targeting Machine Learning as a Service (MLaaS). MaaS with an FL architecture naturally inherits susceptibility to MEAs. Tramer et al. [90] first introduced MEAs that train a replica model through prediction queries to the target model. Orekondy et al. [91] proposed Knockoff Nets, which employ reinforcement learning to efficiently select samples for queries, producing a similarly performant replica model of a complex model with a compact architecture at a query cost as low as $30.

In addition to privacy violations and intellectual property breaches, both MIAs and MEAs can serve as stepping stones for evasion attacks.

DRL is an effective method for solving problems modelled as Markov decision processes (MDPs) by approximating the optimal action-value function or policy. In the context of MaaS, many operational tasks can be formalised as MDPs and thus they can be addressed using DRL. For example, the problem of multi-modal journey planning can be represented as a Markov model where consumer experiences are characterised by a transient effect on future satisfaction and retention [51], making the MDP state a representation of the consumer and traffic status, such as consumer profile, satisfaction with the service, and traffic congestion. Although the input of consumer status provides sufficient information for accommodating heterogeneous consumers with dynamic preferences, it creates a channel for consumers to deceive the system by providing false information for their own benefit. During both the training and inference stages, the DRL agent relies on the status of the consumer to perform the model inference. Therefore, incorrect states can influence the learning process of the state transition model of the environment during the training stage, as well as lead to inappropriate output actions during the inference stage. This scenario creates a game between the MaaS planner and consumers with different utility functions (see Fig. 5d).

In this gamification attack, the planner aims to maximise the total utility function, such as consumer satisfaction, in order to increase profit through higher consumer retention. On the other hand, malicious consumers with selfish or destructive utility functions provide false profiles and experiences to the planner. Recently, a new reinforcement learning-based attack called the passenger spoofing attack was identified [92, 93], which reduces the profit and consumer satisfaction of the MaaS system. Another approach is inverse-learning, where an attack learns the reward or objective function of the system (often with the help of some prior model knowledge) [94]. Knowledge of this can be used to gamify the system. In either case, subsequently a malicious consumer spoofs as a consumer with the same origin and destination as another regular consumer. The main difference between these two types of consumers is that the malicious consumer is providing a fake profile and satisfaction. The fake profile and satisfaction are generated by a reinforcement learning-based malicious agent to increase the probability of being prioritised by the MaaS planner over the regular consumer for the malicious goal, such as allocating the limited and ideal mobility service to the malicious consumer instead of the regular consumer. Additionally, these malicious consumers can team up to strengthen the attack. The study also discovered that the attack can be strengthened by multi-agent reinforcement learning, which considers the spatial distribution among the malicious agents and consumers. Consequently, the travel time, cost, and satisfaction of regular consumers may be degraded due to the attack, and thus affecting the consumer experience and retainment.

Behzadan and Munir [95] conducted a study to investigate the vulnerability of Deep Q-networks (DQNs) and to evaluate the transferrability of adversarial examples across different DQN models. They devised an attack that involves perturbing the states from the environment, leading the DRL agent to execute adversary-desired actions based on the perturbed states. The attack comprises two phases: initialisation and exploitation. In the initialisation phase, an adversarial policy is first obtained by training a DQN based on an adversarial reward function. Then, a replica of the target’s DQN is created and initialised from random parameters. In the exploitation phase, adversarial inputs are crafted using adversarial example crafting techniques such as the Fast Gradient Sign Method [96] and Jacobian-based Saliency Map Attack [97], and their amplitude is controlled to ensure the perturbations are imperceptible. These crafted states cause the target DQN to follow actions determined by the adversarial policy. Consequently, the attacker can manipulate the DQN’s learning process and leading to incorrect optimal action choices. Furthermore, the authors manipulated the policy of the DQN by exploiting the transferability of adversarial samples. They used a black-box setting to demonstrate the success rate of their method, achieving a success rate of 70% when adversarial examples were transferred from one model to another.

In principle, defence measures against evasion attacks mainly aim to improve the robustness of the model itself in design and training process. Common approaches for computer vision tasks include the following.

• •

  Adversarial training: Adversarial training, adding adversarial examples to the training set, was proven to be effective in weakening the attack of adversarial samples of the same origin and level of perturbation [96]. Yet, the effectiveness declines significantly when applied against adversarial examples generated by another model. There are also alternative approaches for adversarial training. Metzen et al. [98] proposed a sub-network design, which is a binary classifier within the network that discriminate genuine data from perturbed data. Samangouei et al. [99] proposed a generative adversarial network (GAN) that generates an unperturbed version of the given input, which is then fed into the classifier/detector. Empirical evidence suggested that these methods only take good effect when the source of attack is known, which makes it difficult to validate actual defence performance in experiments.

• •

  Region-based classifier: Cao et a. [100] proposed region-based classification, sampling points in the immediate neighbouring space of the given image to serve as the input for the model. Such a method, equivalent to adding random noises to input, is geometrically intuitive for defending against adversarial examples of minor perturbations. However, when dealing with geometrical attacks such as DeepFool [101], which takes the minimal distance vector to the decision boundary as the perturbation, region-based methods are impotent.

• •

  Defensive distillation: This [102] is essentially the same technique as in knowledge distillation [89]. By learning the soft labels provided by the teacher model, the decision boundary of the student model is smoothed, hence the higher difficulty for minor perturbations to push a sample cross boundary. Yet, unlike in knowledge distillation, in defensive distillation, the student model is not of a smaller capacity, but of the same as the teacher model. In addition, in defensive distillation, a temperature factor $T$ was added to the softmax function, as shown in the equation below, which controls the ‘hardness’ of the maximum with negative correlation, i.e., when $T$ goes to 0, the function produces a quasi one-hot result, and when $T$ goes to infinity, the result is a uniform distribution. In practice, $T$ can be a large value in training but set to 1 in testing, which equivalently makes the inputs to the softmax function larger by the factor of $T$, consequently magnifying the difference of target class and the rest. As reported in [103], the attack success rate dropped from 91% to 0.5%, when $T$ increased from 1 to 100.

As discussed above, for computer vision tasks, different defence approaches against evasion attack varies in advantageous scenarios, in MaaS systems, a combination of these defensive designs can largely weaken the threat posed by evasion attacks.

As for LLMs, the most common defence against adversarial prompting is safety alignment, i.e., aligning the LLM’s behaviour with human values and norms. Approaches of safety alignment mainly take place in the training process and output generation. Mechanisms such as reward engineering, reinforcement learning from human feedback, LLMs-as-a-Judge can be applied to the training process, and rule-based constraints or other output filtering or moderation methods can be applied to the output generation process.

MIAs and MEAs take similar approaches to threat AI-enabled MaaS systems, through APIs, FL interactions, or communication channels, but with different purposes of violating privacy and stealing proprietary models. Defence methodologies naturally align with their respective malicious intention.

• •

  Member Inference Attacks (MIAs): Differential Privacy (DP) is the most straightforward defence methods against MIAs. Abadi et al. [104] proposed Differentially Private Stochastic Gradient Descent (DP-SGD), first introducing differential privacy to deep learning applications. They first clip gradients, then add random noise to the clipped gradients, where both process are parameter. Such a method involve a trade-off between privacy preservation and model performance. Nasr et al. [105] proposed Adversarial Regularisation to optimise the trade-off, maximising the joint score of privacy preservation and model accuracy. Yu et al. [106] proposed Gradient Embedding Perturbation (GEP), in line with other DP approaches, which projects private gradients into a non-sensitive anchor space to produce a low dimensional gradient embedding, which is perturbed according to the privacy budget. They reported superior performance with reasonable computational cost and modest privacy guarantee. Tang et al. [107] introduced the SELENA framework, which address the defence with ensemble training multiple models with subsets of the training set and self distillation, outperforming Adversarial Regularisation techniques.

• •

  Model Extraction Attacks (MEAs): Such attacks exploit the output of the target model to create one or more unauthorised replicas. A primary strategy for defending against these attacks involves degrading the performance of the extracted or cloned models. Current defence methodologies fall into two main categories: output perturbation and malicious query detection. Output perturbation techniques include quantisation of output confidence scores [90], concealment of sub-optimal predictions [91], injection of uncertainty towards the end of the posterior distribution [108]. The efficacy of these defences is contingent upon the degree of perturbation implemented. Aligning with these methods, Orekondy et al. [109] proposed a proactive defence mechanism by poisoning the posterior probabilities. The injected perturbation is designed to misdirect the optimisation of the attacker’s replica model. On the detection front, Juuti et al. [110] proposed a method for detecting malicious queries. However, their approach is predicated on two stringent and potentially unrealistic assumptions that the attacker’s query samples are closely distributed, and the attacker only queries as one user instead of multiple users with smaller query batches. Kariyappa et al. [111] proposed Adaptive Misinformation, which is a combination of output perturbation and malicious query detection, but emphasised on Out-Of-Distribution (OOD) inputs. Their detector is trained to identify OOD inputs from In-Distribution (ID) input, assuming adversarial queries using the former, then inject misinformation to the outputs of malicious queries. They also proposed Ensemble of Diverse Models (EDM) [112], to defend against model extraction attacks by training multiple different models and use a random one for each query.

It is worth noting that actual adversaries can couple MIAs and MEAs, as the two can potentially reinforce each other. Hence, it is important to put joint attacks into consideration when designing defence strategies. Yet, how these joint defence strategies may be implemented across different actors in MaaS ecosystem and their impacts on business models are overlooked as we discussed in the next section.

Mitigation methods for gamification attacks are still under-explored. On one hand, adversarial training mentioned above could also improve the robustness of deep reinforcement learning models such as DQNs. While on the other, as previously mentioned, this attack can benefit from volumne, e.g., attackers with more malicious clients are more successful. Therefore, when designing defence mechanisms, it it important to balance the robustness gain and defence overhead, avoiding potential arms race with attackers.