A Byzantine-Resilient Federated Learning Framework with Cryptographic Gradient Attestation Against Coordinated Model Poisoning Attacks

Exploiting Feature Non-IIDness for Untargeted Data Poisoning Attacks in Byzantine-Robust Federated Learning

A Comprehensive Defense Framework Against Poisoning Backdoor Attacks in Federated Learning

This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.

Defending Poisoning Attacks in Federated Learning Under System and Data Heterogeneity

Federated learning (FL) is susceptible to poisoning attacks, where malicious clients manipulate local data or models to disrupt training. The system and data heterogeneity inherent in practical FL systems exacerbates these vulnerabilities, rendering existing defense mechanisms ineffective or infeasible. Specifically, distinguishing benign local models, trained on heterogeneous client data, from poisoned ones presents a significant challenge. Moreover, semi-asynchronous FL (SAFL) paradigms, commonly employed to address system heterogeneity, further complicate this issue by preventing fair evaluation of local models originating from different global models (i.e., with varying staleness). In this work, we propose a novel defensive framework (namely Fed-Beta) for robust and accurate FL model training under system and data heterogeneity. First, we introduce a staleness-aware SAFL paradigm, where the server accepts only a fixed number of local models per round and groups them based on their staleness. Then, we implement a two-stage aggregation mechanism. Specifically, we develop a robust intra-group aggregation method using model inversion to evaluate data-domain discrepancies among clients. This method accurately identifies and excludes malicious local models from aggregation, producing a reliable representative model for each group. Moreover, we design a model-consistency-aware inter-group aggregation method, which selectively aggregates group representative models with consistent update directions to update the global model. Theoretically, we conduct rigorous convergence analysis of Fed-Beta, offering insights into how system and data heterogeneity affect the defensive performance. Empirically, extensive experiments corroborate its superiority over existing schemes.

TAR-DT: A Trusted and Attack-Resilient Mechanism for Distributed DNN Training in Agentic Edge Intelligence

As deep neural networks continue to scale and enable emerging applications such as agentic AI systems, training increasingly relies on distributed paradigms across heterogeneous edge devices. However, this shift introduces significant security challenges, particularly model poisoning attacks, which are largely underexplored in model-parallel settings. To address these challenges, we propose a trusted and attack-resilient mechanism for distributed DNN training that supports both data and model parallelism. The mechanism leverages a blockchain-enabled infrastructure to ensure the tamper-resistant and auditable execution of security-critical operations. It introduces a Loss-aware Credit Evaluation mechanism to assess agent reliability based on group-level training dynamics and a Shuffling-based Isolation Mechanism to progressively cluster and isolate malicious agents across training epochs. In addition, Byzantine-tolerant aggregation (BTA) is employed to further mitigate adversarial influence during model aggregation. Extensive experiments demonstrate that the proposed mechanism achieves superior robustness and efficiency compared with state-of-the-art methods under diverse poisoning attack scenarios.

SiftFL: Scheduling-Based Robust Backdoor Detection in Federated Learning

Backdoor attacks pose a serious threat to federated learning, particularly when client data are non-IID and the attacker ratio is high. FilterFL is a recent server-side defense that employs two Conditional Generative Adversarial Networks (CGANs) to generate synthetic samples and identify malicious client models without requiring clean server data. However, executing both CGAN stages in every communication round makes the defense robust but computationally expensive. In this paper, we propose SiftFL, a scheduling-based robust backdoor detection method that sifts out malicious client models at a fraction of the original cost. SiftFL decouples the cost of the CGAN stages from the number of communication rounds by executing them periodically rather than every round and complements this schedule with a trust history score that stabilizes client filtering across rounds. This design preserves and, in several settings, improves the robustness of CGAN-based detection while sharply lowering its server-side cost. Experiments using MNIST, CIFAR-10, and GTSRB benchmark dataset show that SiftFL reduces server defense computation by up to 99% while keeping the drop in main accuracy within about 4% in the most challenging non-IID cases compared to the original baseline. At the same time, the attack success rate is reduced by roughly 97–99%, and robustness accuracy improves significantly to 85%, in settings where the original FilterFL becomes unstable. The results indicate that scheduling and trust history make SiftFL a more practical and reliable backdoor detection method under non-IID data distribution and high attacker presence.

Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning

The Krum-Proxy attack is introduced, a selection-aware backdoor injection strategy that consistently bypasses Byzantine-robust aggregation and constructs adversarial updates that are not only similar to benign updates but are also optimized to lie in regions of the update space that are favored during aggregation.