Federated Adversarial Robustness

The core defense mechanism that replaces standard weighted averaging with robust statistical operators to neutralize malicious updates.

• Krum: Selects the single update most similar to its neighbors, ignoring outliers.
• Trimmed Mean: Discards extreme values for each parameter coordinate before averaging.
• Median: Uses the coordinate-wise median, inherently resistant to skewed values.
• Bulyan: A two-phase defense combining Krum selection with trimmed mean aggregation to withstand stronger attacks.

A formal privacy framework that clips and noisifies local model updates before aggregation, bounding the influence of any single client.

• Update Clipping: Constrains the L2-norm of each client's gradient to a fixed threshold, preventing arbitrarily large malicious contributions.
• Gaussian Noise Addition: Injects calibrated noise proportional to the sensitivity of the query, providing provable privacy guarantees.
• Privacy Budget (ε, δ): Quantifies the maximum information leakage, with lower epsilon values indicating stronger protection against data poisoning and inference attacks.

Techniques that analyze the statistical properties of client submissions to identify and exclude outliers before aggregation.

• Cosine Similarity Analysis: Flags updates whose directional alignment with the aggregate deviates significantly from the norm.
• Clustering-Based Detection: Groups updates using algorithms like DBSCAN to isolate a small cluster of potentially colluding adversaries.
• Loss-Value Inspection: Monitors the local loss reported by clients; malicious actors often struggle to fabricate consistent loss metrics.

Extends standard adversarial training to the federated paradigm, where clients locally generate adversarial examples to harden the global model.

• FAT (Federated Adversarial Training): Clients perform PGD attacks on their local data during training, sharing robustified model updates.
• Ensemble Adversarial Training: Leverages the diversity of client models as an ensemble to generate transferable adversarial examples, improving global robustness.
• Computational Trade-off: Local adversarial training significantly increases client-side compute, requiring careful resource allocation in cross-device FL.

Cryptographic protocols that ensure the central server can only compute the sum of client updates without inspecting individual contributions, preventing targeted manipulation.

• Secret Sharing: Clients split their updates into shares distributed among other clients, reconstructing only the aggregate via polynomial interpolation.
• Homomorphic Encryption: Clients encrypt updates so the server can perform addition on ciphertexts, decrypting only the final sum.
• Dual Benefit: These protocols simultaneously defend against honest-but-curious servers and prevent the server from selectively filtering updates based on content.

Specialized defenses against adversaries who implant hidden triggers that cause targeted misclassification only for specific inputs.

• Norm Clipping: Limits the magnitude of updates, preventing the large parameter shifts required to embed backdoors.
• Differential Privacy: The noise added for privacy also degrades the signal of subtle backdoor triggers.
• Spectral Signatures: Analyzes the covariance spectrum of updates to detect the distinct statistical footprint left by backdoor training.
• Trigger Synthesis: The server attempts to reverse-engineer potential triggers by optimizing for inputs that cause misclassification, then audits the model.