An Approach Utilizing Frequency Analysis to Counteract Poisoning Attacks in Federated Learning

A Comprehensive Defense Framework Against Poisoning Backdoor Attacks in Federated Learning

This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.

MONZA: A Score System for Malicious Clients Detection

Federated Learning (FL) is a machine learning training method that uses a collaborative model for training across a diverse set of clients, while preserving data privacy in accordance with the General Data Protection Regulation (GDPR) for clients' data. The classification and similarity within many clients can become an issue, often leading to decreased model accuracy and slower convergence, or reducing the number of parameters to the point of not learning anything during aggregation. However, the presence of non-IID data and malicious clients poses significant challenges to the significance of generalization models and distribution data. Malicious clients can perform poisoning attacks by sending harmful model updates that degrade the performance of the global model. This article introduces MONZA, a scoring system designed to detect and exclude malicious clients in FL environments. In a scenario where clients can also engage in various attacks, including model poisoning and data poisoning, this can lead to incorrect training. The proposed method uses cosine similarity to calculate client scores. It employs L2 normalization to identify biased models; in some cases, the similarity is not sufficient to classify a client, effectively filtering out malicious participants before aggregation and implementing a penalty with a quarentine method. Our evaluation shows that MONZA achieves an accuracy of 54.5% in a scenario with 30% malicious clients, while zPROBE (i.e., existing resilient methods) only reached an accuracy of 50%. Furthermore, MONZA reduces the simulation execution time by 66% and the computational effort to 83 MFLOP/s compared to zPROBE, which demonstrates to be a more efficient and resilient method. These results confirm that MONZA maintains the integrity of the model, making a security aggregation while minimizing resource consumption in malicious FL settings.

Poison-Resilient and Privacy-Preserving Federated Learning Scheme in Mobile Systems

Defending Poisoning Attacks in Federated Learning Under System and Data Heterogeneity

Federated learning (FL) is susceptible to poisoning attacks, where malicious clients manipulate local data or models to disrupt training. The system and data heterogeneity inherent in practical FL systems exacerbates these vulnerabilities, rendering existing defense mechanisms ineffective or infeasible. Specifically, distinguishing benign local models, trained on heterogeneous client data, from poisoned ones presents a significant challenge. Moreover, semi-asynchronous FL (SAFL) paradigms, commonly employed to address system heterogeneity, further complicate this issue by preventing fair evaluation of local models originating from different global models (i.e., with varying staleness). In this work, we propose a novel defensive framework (namely Fed-Beta) for robust and accurate FL model training under system and data heterogeneity. First, we introduce a staleness-aware SAFL paradigm, where the server accepts only a fixed number of local models per round and groups them based on their staleness. Then, we implement a two-stage aggregation mechanism. Specifically, we develop a robust intra-group aggregation method using model inversion to evaluate data-domain discrepancies among clients. This method accurately identifies and excludes malicious local models from aggregation, producing a reliable representative model for each group. Moreover, we design a model-consistency-aware inter-group aggregation method, which selectively aggregates group representative models with consistent update directions to update the global model. Theoretically, we conduct rigorous convergence analysis of Fed-Beta, offering insights into how system and data heterogeneity affect the defensive performance. Empirically, extensive experiments corroborate its superiority over existing schemes.

SecureFedShield: An Adaptive Privacy-Preserving Federated Defense Framework Against Adversarial Attacks in Financial Fraud Detection

SecureFedShield is proposed, a privacy-preserving federated learning framework designed for secure financial fraud detection in adversarial environments that integrates adaptive privacy protection, trust-aware client evaluation, adversarial update detection, and robust model aggregation into a unified architecture.

MAD-Based Update Filtering for Non-IID Federated Learning: Robustness Analysis Under Poisoning Attacks

A ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping.