Strategic Client-Level Defense Placement in Mobile Federated Learning

Abstract

Federated learning (FL) enables mobile and edge devices to train jointly without centralizing private data, but compromised clients can poison the global model. When client-level protections cover only part of the population, a rational attacker can exploit predictable placement. We introduce SGDP-FL (Stackelberg Game-Based Defense Placement for Federated Learning), a budget-constrained Stackelberg game between a defender and an attacker. Before each round, the defender decides which clients to protect. The attacker observes this placement only through noisy reconnaissance, updates its belief about which clients are protected, and then chooses which clients to attack. We model the noisy observation as a Binary Symmetric Channel, and we model imperfect defenses by letting each protection block an attack only with a fixed probability. Monte Carlo estimation and a greedy knapsack oracle make the resulting bilevel problem tractable. We evaluate SGDP-FL on EMNIST, CIFAR-10, and CIFAR-100 under IID and non-IID partitions. The evaluation covers single- and multi-client attacks, with attack targets either fixed or periodically reshuffled. In every tested setting, SGDP-FL achieves the highest mean accuracy among Random, Highest-Value, and UCB allocation. Under multi-client attacks with periodic reshuffling, it raises CIFAR-10 IID accuracy from 55.68% for the strongest baseline to 59.78%, and CIFAR-100 IID from 32.42% to 34.49%. It also transfers to label-flipping and backdoor attacks and complements robust aggregation.