2026· IEEE Transactions on Network and Service Management· Vol 23, pp. 6063-6081· 0 citations· 35 references
Computer Science
Abstract
Federated learning enables collaborative model training without sharing raw data, but remains vulnerable to poisoning attacks from malicious clients. These adversarial participants craft harmful updates to degrade global model performance or induce targeted misclassification. Without trusted reference gradients, the central model cannot be properly aggregated only based on updates provided by untrustworthy clients. In this paper, we propose RDTSM, a robust defense method based on a trusted shadow model. By leveraging a clean shadow dataset, the central server generates reference updates and evaluates each client’s update via a reputation scoring mechanism. A clustering algorithm is then applied to identify and exclude suspicious updates before model aggregation. Extensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 demonstrate that RDTSM consistently outperforms state-of-the-art defenses across a wide range of poisoning attacks. Notably, RDTSM maintains high accuracy even when the proportion of malicious clients is large, and remains robust under varying degrees of data heterogeneity and shadow dataset sizes. This robustness stems from the fact that shadow-guided reputation scores of benign and malicious clients remain well separated under homogeneous attack patterns, even when malicious clients constitute the majority. These results show RDTSM’s effectiveness and practicality for secure federated learning in adversarial environments.
Federated Learning enables collaborative model training without sharing raw client data, making it attractive for privacy-sensitive domains. However, its performance degrades when local data are non-independent and identically distributed (non-IID) and when malicious clients inject adversarial updates; robust aggregation alone can be insufficient, especially for imbalanced medical datasets where minority-class degradation is masked by overall accuracy. This paper proposes a Median Absolute Deviation (MAD)-based malicious-update filtering framework for non-IID federated learning. The server flags and excludes abnormal client updates before aggregation, using a coordinate-wise median reference and a modified Z-score over cosine distances. Unlike trust-based defenses, it requires no clean server-side dataset and provides an interpretable, per-round diagnostic. We evaluate it on CIFAR-10 and HAM10000 under noise injection and sign flipping against eight robust aggregation baselines, under a unified protocol that reports Accuracy and Macro-F1 at the same validation-selected checkpoint, averaged over three seeds. On CIFAR-10, the proposed method attains a mean Macro-F1 comparable to or better than the strongest baselines under both attacks (75.9% and 67.6%). On HAM10000 under noise injection it achieves the highest mean accuracy (74.0%) with a competitive Macro-F1, whereas under sign flipping it is only mid-ranked. An ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping. These results characterize both the robustness potential and the boundary conditions of update-level median filtering in non-IID federated learning.
Tae-Wook Kang, Ji-Woo Park, Chulyoung Park et al.· IEEE Access· 0 citations
This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
Federated learning (FL) has emerged as an important distributed machine learning paradigm allowing many users to train a model together without sharing raw data. However, FL’s decentralized design makes it very susceptible to both Byzantine and coordinated model poisoning attacks, where a few malicious rounds of gradients are strategically inserted to reduce the overall integrity of the model. Even the existing Byzantine-resilient aggregation methods such as geometric median, Krum, and trimmed mean are vulnerable to sophisticated, coordinated poisoning attacks that leverage statistical gaps in outlier detection. In this article, we present FedSentinel, a novel Byzantine-resilient federated learning framework that combines cryptographic gradient attestation with adaptive trust-weighted aggregation to protect against coordinated model-poisoning attacks, which are among the most serious challenges. Three key innovations are introduced in FedSentinel Cryptographic Gradient Attestation Protocol (CGAP) that utilizes commitment schemes and zero-knowledge range proofs to ensure the integrity of the gradients and verify that submitted updates satisfy predefined norm and direction constraints; in the current protocol configuration, CGAP provides gradient integrity verification rather than full gradient confidentiality from the server Dynamic Trust-Weighted Robust Aggregation (DT-RoA): the computation and updating of per-client trust scores based on historical gradient consistency and cross-validation signals; and Coordinated Attack Detection Engine (CADE): based on spectral analysis of the gradient covariance matrices, it detects and isolates colluding Byzantine clients. By participating in up to 100 clients on CIFAR-10, CIFAR-100, FEMNIST, and Sentiment140 datasets, extensive experiments conducted under up to 30% Byzantine adversaries reveal that FedSentinel achieves 91.36% average global accuracy, whereas state-of-the-art defenses such as FLTrust, FLAME, RoFL, ShieldFL, and DnC achieve 83.83–86.94%. FedSentinel outperforms these defenses by 4.42–7.53% in terms of accuracy, while decreasing attack success rates by 53.2% under coordinated Byzantine backdoor attacks. The proposed framework offers a promising approach for federated learning that is verifiable and trustworthy in adversarial environments.
Abdullah Abdulkarim Alnajim· Electronics· 0 citations
Federated Learning (FL) is vulnerable to backdoor attacks, where adversaries can stealthily manipulate the global model. Most existing defense methods are developed under IID assumptions, an assumption that rarely holds in practice. In highly non-IID settings, heterogeneous data distributions across clients make it difficult to distinguish malicious updates from benign ones, particularly when benign clients exhibit atypical patterns due to minority-class data. To address this challenge, existing defenses operate at different levels of granularity. Coarse-grained methods perform client-level filtering, which often mistakenly excludes benign clients under non-IID conditions. Fine-grained methods instead analyze data at the sample level for more precise detection, but typically rely on explicit per-sample gradient analysis, leading to substantial memory and computational overhead. As a result, defending against backdoor attacks in non-IID environments involves a fundamental trade-off between robustness and computational efficiency. To address this challenge, we propose FedRGD, a federated risk-guided dynamic defense framework that enables efficient fine-grained protection. FedRGD maps sample-level risks into structured parameter masking without requiring explicit per-sample gradient storage. It combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency. Extensive experiments on CIFAR-10 and Fashion-MNIST demonstrate that FedRGD consistently reduces the attack success rate while maintaining high main-task accuracy, achieving a favorable security-utility balance with low computational overhead.
Ruiying Wang· Poster Volume 0008 The 2026...· 0 citations
Federated Learning (FL) enables collaborative model training while preserving data privacy. However, it remains highly vulnerable to poisoning attacks, particularly coordinated label- flipping attacks. In this paper, we propose DualFed, a dual-side defense framework for detecting coordinated poisoning behaviors in FL. DualFed combines client-side adaptive behavioral anomaly detection with a server-side Collective Behavioral Correlation (CBC) mechanism. On the client side, an Adaptive Adversarially Robust Statistics (AARS) mechanism integrates trimmed estimation with Exponential Moving Average (EMA) and Exponential Moving Variance (EMV) to robustly quantify abnormal performance degradation. On the server side, CBC aggregates client anomaly reports over a sliding temporal window to detect coordinated attacks. Once an attack is confirmed, DualFed activates a non-punitive self-recovery mechanism. Under non-IID settings, DualFed achieves benign accuracies exceeding 84.0MNIST, 52.0dataset, while reducing malicious attack accuracy to near zero and outperforming recent defense baselines.
Hanene Hamdani, Emna Benmohamed, Hela Ltifi· International Conference on...· 0 citations
Artificial intelligence (AI) systems are increasingly deployed in high-stakes domains, where poisoning attacks can corrupt training data, manipulate model updates, or implant covert backdoors. This survey examines poisoning attacks in federated learning (FL), using centralized learning as a baseline to explain how distributed data, client heterogeneity, privacy-preserving aggregation, and untrusted coordination expand the threat surface. It positions prior surveys and synthesizes representative primary studies through an accountability-oriented lens focused on attribution, audit evidence, traceability, and forensic readiness. The review compares major attack classes, including data poisoning, model poisoning, backdoor insertion, server-side manipulation, Sybil behavior, collusion, and multi-round poisoning. It also evaluates countermeasures such as Byzantine-robust aggregation, anomaly detection, validation-based filtering, malicious-secure aggregation, authenticated update handling, provenance mechanisms, ledger-based evidence, and verifiable aggregation protocols. The analysis shows that robustness alone is insufficient for trustworthy FL unless defenses also preserve evidence that supports independent verification, post-incident reconstruction, and governance review. Persistent gaps remain in causal forensic attribution, privacy-preserving evidence governance, malicious-server threat modeling, scalable verifiability tooling, recovery after poisoning, and deployment-ready benchmarks. The survey concludes that accountable FL should be designed as an evidence-producing system, not merely as a privacy-preserving or attack-resistant training architecture, especially for regulated, cross-silo, and high-risk real-world deployments.
S. Mohammed, D. Alhadidi, A. Ngom· Journal of Cybersecurity and...· 0 citations