RDTSM: Robust Defense Based on Trusted Shadow Model Against Poisoning Attacks for Federated Learning

Abstract

Federated learning enables collaborative model training without sharing raw data, but remains vulnerable to poisoning attacks from malicious clients. These adversarial participants craft harmful updates to degrade global model performance or induce targeted misclassification. Without trusted reference gradients, the central model cannot be properly aggregated only based on updates provided by untrustworthy clients. In this paper, we propose RDTSM, a robust defense method based on a trusted shadow model. By leveraging a clean shadow dataset, the central server generates reference updates and evaluates each client’s update via a reputation scoring mechanism. A clustering algorithm is then applied to identify and exclude suspicious updates before model aggregation. Extensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 demonstrate that RDTSM consistently outperforms state-of-the-art defenses across a wide range of poisoning attacks. Notably, RDTSM maintains high accuracy even when the proportion of malicious clients is large, and remains robust under varying degrees of data heterogeneity and shadow dataset sizes. This robustness stems from the fact that shadow-guided reputation scores of benign and malicious clients remain well separated under homogeneous attack patterns, even when malicious clients constitute the majority. These results show RDTSM’s effectiveness and practicality for secure federated learning in adversarial environments.