Client-Side Validation

Gradient Norm Clipping bounds the L2 norm of a client's model update before transmission. This limits the influence any single client can exert on the global model, mitigating both accidental outliers from non-IID data and deliberate poisoning attacks. For differential privacy, clipping is a prerequisite before adding calibrated noise.

• Mechanism: Compute the L2 norm of the update vector. If it exceeds a threshold C, scale the vector by C / norm.
• Purpose: Controls update magnitude, enhances stability, and enables privacy guarantees.

Local Outlier Detection involves statistical analysis of a client's own computed update to identify anomalies before submission. This can flag potential data poisoning or corrupted local training runs.

• Methods: Clients can compute the mean and standard deviation of their update's parameters over several local epochs, flagging updates where values diverge significantly from the client's own historical behavior.
• Benefit: Prevents a client from inadvertently sending a malicious or faulty update, acting as a self-audit mechanism.

Update Sanitization is the process of filtering or modifying a client's model update to remove components suspected to be malicious or noisy. This is a proactive defensive measure executed on the device.

• Techniques: Includes applying sparse filtering to zero out extremely small or large parameter changes, or using principal component analysis (PCA) to project the update onto a subspace that captures 'typical' update directions learned from past behavior.
• Goal: To submit a 'cleaner' update that contributes to global learning without introducing harmful artifacts.

Local Differential Privacy (LDP) Enforcement is where the client itself adds calibrated noise to its model update to provide a formal, distributed privacy guarantee. This ensures privacy even against a curious central server.

• Process: After clipping the gradient norm, the client adds noise from a distribution like Gaussian or Laplace. The noise scale is determined by the desired privacy budget (epsilon, delta).
• Key Property: Privacy is guaranteed at the source. The server only ever sees the noisy update, providing strong protection against reconstruction and membership inference attacks.

Data Quality & Integrity Checks validate the client's local training dataset before the learning process begins. This prevents training on corrupted, mislabeled, or adversarial data that would produce a poisoned update.

• Checks Include: Verifying label consistency (e.g., no impossible class labels), detecting label flipping anomalies, checking for adversarial examples in the training batch using local detection models, and ensuring dataset size meets a minimum threshold.
• Outcome: Increases confidence that the local training process starts from a valid foundation.

Trusted Execution Environment (TEE) Attestation allows a client to cryptographically prove to the server that its update was computed within a secure, isolated hardware enclave (e.g., Intel SGX, ARM TrustZone). This is a form of client-side integrity validation.

• Flow: The client's TEE generates a signed attestation report containing a hash of the code (the training algorithm) and the model update. The server verifies this signature and code hash before accepting the update.
• Assurance: Guarantees the update was produced by unmodified, authorized code, preventing tampering by malware on the client device.

The counterpart to client-side checks, server-side validation encompasses all defensive operations performed by the central aggregator after receiving client updates. This includes:

• Anomaly Detection: Statistical analysis of update distributions to flag outliers.
• Norm Bounding: Clipping updates that exceed a magnitude threshold.
• Credibility Scoring: Weighting contributions based on historical consistency. Its goal is to filter malicious or low-quality updates before they influence the global model.

A class of algorithms designed to produce a correct global update even when a fraction of clients are malicious (Byzantine) and send arbitrary data. Unlike simple averaging, these algorithms are provably robust. Key methods include:

• Krum & Multi-Krum: Selects the update closest to its neighbors.
• Trimmed Mean: Discards extreme values in each parameter dimension.
• Median Aggregation: Uses the coordinate-wise median, highly resilient to outliers. These are essential when client-side validation cannot be fully trusted.

Local Differential Privacy (LDP) is a privacy model where each client adds calibrated noise to their data or model update before sending it to the server. This provides a strong, distributed guarantee without needing a trusted central party. Common mechanisms:

• Gaussian Mechanism: Adds Gaussian noise, used for (ε,δ)-DP.
• Laplace Mechanism: Adds Laplace noise for pure ε-DP. LDP acts as a formal, mathematical complement to heuristic client-side validation, ensuring privacy even if the server is curious.

A cryptographic protocol that allows the server to compute the sum of client updates without learning any individual update. This protects client privacy against the server itself. Core principles:

• Uses Masking with secret shares that cancel out upon summation.
• Often employs Multi-Party Computation (MPC) techniques.
• Ensures the server only sees the aggregated result. This is a stronger guarantee than validation alone, as it prevents the server from inspecting individual contributions.

A dynamic defense that assigns a credibility score to each client based on their historical behavior. This score weights their contribution during aggregation. Factors influencing the score:

• Update Quality: Consistency with the population distribution.
• Data Volume: Contribution size (guarding against free-riders).
• Participation History: Reliability over multiple rounds. It creates a feedback loop where well-behaved clients gain influence, while anomalous ones are marginalized.

A proactive defense where clients locally train their models not only on clean data but also on adversarially perturbed examples. This aims to improve the global model's intrinsic robustness. In a federated setting:

• Clients generate adversarial examples (e.g., via PGD) from their local data.
• The model learns to be invariant to small, malicious perturbations.
• This complements validation by hardening the model itself against evasion attacks post-deployment.