In FL-OA, the server collaborates with third-party organization that holds an additional root dataset to perform outsourced auditing, thereby enabling the server to achieve robust aggregation without strong assumptions, demonstrating that FL-OA outperforms existing defense methods against Byzantine attacks.
Abstract
Federated learning (FL) enables multiple intelligent devices to collaboratively train a high-accuracy model without sharing raw data. However, due to its distributed nature, FL is vulnerable to Byzantine attacks. Existing defense methods rely on strong assumptions, such as the proportion of malicious devices not exceeding 50\%, or the server having an additional root dataset that matches the training task. Moreover, they show limited efficacy as they overlook $(i)$ the divergence among benign updates and $(ii)$ the curse of dimensionality involved in comparing two high-dimensional updates. To solve these concerns, we propose FL-OA, a Byzantine-robust federated learning framework utilizing outsourced auditing. In FL-OA, the server collaborates with third-party organization that holds an additional root dataset to perform outsourced auditing, thereby enabling the server to achieve robust aggregation without strong assumptions. Additionally, FL-OA introduces a gradient ascent step and a correction term during local training to mitigate the divergence among benign updates, and designs a parameter importance indicator to extract critical parameters for auditing, alleviating the curse of dimensionality. We further provide a detailed theoretical analysis of FL-OA. Extensive experiments demonstrate that FL-OA outperforms existing defense methods against Byzantine attacks.
A review of federated learning through a structured taxonomy that covers its core architectural paradigms, major learning types, model training approaches, and aggregation mechanisms, and analyzes the principal challenges confronting FL, including privacy and security risks, statistical and system heterogeneity, communication constraints, and global model divergence.
Mahdiyeh Velaei, Hosna Ghahramani, Ali Ghaffari et al.· Cluster Computing· 0 citations
The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.
Hal Ferguson, Rui Ning, Hongyi Wu et al.· IEEE Internet of Things Jour...· 0 citations
Federated learning (FL) has emerged as an important distributed machine learning paradigm allowing many users to train a model together without sharing raw data. However, FL’s decentralized design makes it very susceptible to both Byzantine and coordinated model poisoning attacks, where a few malicious rounds of gradients are strategically inserted to reduce the overall integrity of the model. Even the existing Byzantine-resilient aggregation methods such as geometric median, Krum, and trimmed mean are vulnerable to sophisticated, coordinated poisoning attacks that leverage statistical gaps in outlier detection. In this article, we present FedSentinel, a novel Byzantine-resilient federated learning framework that combines cryptographic gradient attestation with adaptive trust-weighted aggregation to protect against coordinated model-poisoning attacks, which are among the most serious challenges. Three key innovations are introduced in FedSentinel Cryptographic Gradient Attestation Protocol (CGAP) that utilizes commitment schemes and zero-knowledge range proofs to ensure the integrity of the gradients and verify that submitted updates satisfy predefined norm and direction constraints; in the current protocol configuration, CGAP provides gradient integrity verification rather than full gradient confidentiality from the server Dynamic Trust-Weighted Robust Aggregation (DT-RoA): the computation and updating of per-client trust scores based on historical gradient consistency and cross-validation signals; and Coordinated Attack Detection Engine (CADE): based on spectral analysis of the gradient covariance matrices, it detects and isolates colluding Byzantine clients. By participating in up to 100 clients on CIFAR-10, CIFAR-100, FEMNIST, and Sentiment140 datasets, extensive experiments conducted under up to 30% Byzantine adversaries reveal that FedSentinel achieves 91.36% average global accuracy, whereas state-of-the-art defenses such as FLTrust, FLAME, RoFL, ShieldFL, and DnC achieve 83.83–86.94%. FedSentinel outperforms these defenses by 4.42–7.53% in terms of accuracy, while decreasing attack success rates by 53.2% under coordinated Byzantine backdoor attacks. The proposed framework offers a promising approach for federated learning that is verifiable and trustworthy in adversarial environments.
Abdullah Abdulkarim Alnajim· Electronics· 0 citations
Federated Learning enables collaborative model training without sharing raw client data, making it attractive for privacy-sensitive domains. However, its performance degrades when local data are non-independent and identically distributed (non-IID) and when malicious clients inject adversarial updates; robust aggregation alone can be insufficient, especially for imbalanced medical datasets where minority-class degradation is masked by overall accuracy. This paper proposes a Median Absolute Deviation (MAD)-based malicious-update filtering framework for non-IID federated learning. The server flags and excludes abnormal client updates before aggregation, using a coordinate-wise median reference and a modified Z-score over cosine distances. Unlike trust-based defenses, it requires no clean server-side dataset and provides an interpretable, per-round diagnostic. We evaluate it on CIFAR-10 and HAM10000 under noise injection and sign flipping against eight robust aggregation baselines, under a unified protocol that reports Accuracy and Macro-F1 at the same validation-selected checkpoint, averaged over three seeds. On CIFAR-10, the proposed method attains a mean Macro-F1 comparable to or better than the strongest baselines under both attacks (75.9% and 67.6%). On HAM10000 under noise injection it achieves the highest mean accuracy (74.0%) with a competitive Macro-F1, whereas under sign flipping it is only mid-ranked. An ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping. These results characterize both the robustness potential and the boundary conditions of update-level median filtering in non-IID federated learning.
Tae-Wook Kang, Ji-Woo Park, Chulyoung Park et al.· IEEE Access· 0 citations
Federated learning has gained significant attention for its ability to train models without directly accessing raw data. However, the malicious server may falsify the aggregation results to save computational resources. While existing verifiable federated learning methods can validate the results, they exacerbate communication bottlenecks and fail to achieve collusion-resistant verification in the absence of a trusted authority. In this paper, we propose CVFL-Pro, a collusion-resistant verification federated learning framework with adaptive communication optimization. Specifically, we utilize a mask and Shamir’s secret sharing for privacy protection, and it is robust against client dropout. We combine a lightweight MAC scheme and auxiliary nodes to achieve efficient verifiability. Furthermore, we design an adaptive communication optimization algorithm (AOTop-<inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>), which dynamically adjusts the compression rate <inline-formula> <tex-math notation="LaTeX">$p$ </tex-math></inline-formula> based on the gradient magnitude and the gradient variation between rounds, ensuring optimal performance with minimal cost. Finally, we instantiate CVFL-Pro and prove its correctness and security against collusion by up to <inline-formula> <tex-math notation="LaTeX">$|N|-2$ </tex-math></inline-formula> clients (where <inline-formula> <tex-math notation="LaTeX">$|N|$ </tex-math></inline-formula> is the total number of clients) and the server. Extensive evaluations on MNIST, CIFAR-10, and CIFAR-100 datasets demonstrate that CVFL-Pro reduces communication overhead by 58.07% compared to the optimal Top-<inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula> and 95.81% compared to SecAgg. Experiments show that CVFL-Pro reduces communication overhead by up to 95.81% while maintaining accuracy. It dynamically adjusts compression and achieves efficient storage, requiring only 830.16KB compared to 1952.62KB in SecAgg.
Ying Gao, Xiaofeng Chen, Huanghao Deng et al.· IEEE Transactions on Informa...· 0 citations
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.