AMBER: Robust Federated Learning Based on Client Verification

Abstract

Federated Learning (FL) preserves data privacy by avoiding direct access to local data, but this limits server verification of client model updates. Unreliable participants can inject malformed updates to poison the global model without detection. In this paper, we analyze client-side vulnerabilities in three chained stages of local training: local dataset pollution, model selective inputs, and training process tampering. We refer to this class of threats as Local Chained Attacks (LCAs), which severely degrade global model robustness. To address these challenges, we propose AMBER, a robust FL framework with a novel three-layer verification mechanism for client trust assessment. The first layer ensures dataset integrity via vector commitments for content and distribution of client-held data. The second layer detects selective input attacks through a local consistency-based verification mechanism. The third layer enforces computational integrity by verifying the correlation between model inputs and outputs using secure primitives in a Trusted Execution Environment (TEE). AMBER establishes verifiable integrity links across data, input, and computation stages under an explicit trust boundary. Experimental evaluations covering multiple datasets, models, and attack scenarios show AMBER outperforms existing approaches in defense effectiveness with low overhead, adapting well to Non-IID environments.