Server-Side Validation

The server analyzes the distribution of submitted model updates to identify statistical outliers. Common methods include:

• Z-score or IQR filtering: Flagging updates where parameter values fall outside a defined number of standard deviations or the interquartile range.
• Multivariate analysis: Using Principal Component Analysis (PCA) or clustering (e.g., DBSCAN) to detect updates that deviate from the main cluster of benign contributions.
• Likelihood tests: Comparing the update's distribution against an expected model, often established from historical rounds.

This technique limits the influence of any single client by constraining the magnitude (norm) of their update vector. The server computes the L2-norm of each update g_i and applies: g_i_clipped = g_i * min(1, C / ||g_i||) Where C is a clipping threshold. This is fundamental for:

• Controlling outlier influence: Preventing a single malicious update from dominating aggregation.
• Enabling differential privacy: Clipping is a prerequisite for adding calibrated noise in DP-SGD frameworks.
• Stabilizing training: Mitigates exploding gradients from clients with heterogeneous or noisy data.

Specialized aggregation functions replace the simple weighted average to tolerate a fraction f of malicious clients. Key algorithms include:

• Trimmed Mean: For each parameter, discards the top and bottom f fraction of values before averaging.
• Median/Mode: Uses the coordinate-wise median, highly resistant to arbitrary outliers.
• Krum & Multi-Krum: Selects the update vector closest to its neighbors, filtering distant outliers.
• Bulyan: A meta-algorithm that applies a robust rule (e.g., Krum) to select a candidate set, then performs trimmed mean on that set for final aggregation.

The server maintains a dynamic trust score τ_i for each client i, which weights their contribution during aggregation. Scores are updated each round based on:

• Update consistency: How similar the client's update is to the consensus (e.g., cosine similarity with the aggregated update).
• Historical contribution: Past performance and reliability.
• Data quality signals: Inferred from update characteristics. The global update becomes a weighted sum: ΔG = Σ (τ_i * g_i) / Σ τ_i. This progressively diminishes the influence of unreliable or adversarial clients.

This technique examines the geometric properties of the high-dimensional update vectors for signs of malice.

• Inner-product tests: Malicious updates designed to create a backdoor often lie in a different directional subspace. The server checks the alignment (g_i · ΔG_benign) of each update with an estimated benign update direction.
• Update magnitude distribution: Malicious clients may submit updates with norms that are consistently too small (free-riding) or too large (attempting to dominate).
• Gradient cancellation analysis: Detects Sybil attacks where multiple fake clients send updates that cancel each other's benign components, leaving only the malicious signal.

Before any algorithmic validation, the server can cryptographically verify the integrity and origin of an update.

• Federated Attestation: Using hardware Trusted Execution Environments (TEEs) like Intel SGX, the server verifies that the client's update was computed by genuine, unmodified code in a secure enclave.
• Digital Signatures: Each client signs its update with a private key. The server verifies the signature against a registered public key, ensuring authenticity and preventing spoofing.
• Secure Aggregation Protocols: While primarily for privacy, protocols like SecAgg also allow the server to verify that the sum of updates is valid without seeing individuals, providing a form of integrity check on the collective.

A class of algorithms designed to produce a correct global model update even when a fraction of participating clients are malicious or faulty. Unlike simple averaging, these methods are mathematically proven to tolerate Byzantine failures, where clients send arbitrary or adversarial updates.

• Core Principle: Assumes a bound on the maximum number of malicious clients (e.g., f out of n).
• Key Methods: Includes Krum, Bulyan, trimmed mean, and median aggregation.
• Trade-off: Provides strong security guarantees but often at the cost of statistical efficiency, especially under high client heterogeneity.

Cryptographic protocols that allow a server to compute the sum or average of client updates without learning any individual client's contribution. This prevents the server from being a single point of privacy failure.

• Secure Multi-Party Computation (MPC): Clients cryptographically mask their updates so only the aggregate sum can be unmasked.
• Homomorphic Encryption: Allows the server to perform computations on encrypted updates.
• Purpose: Complements server-side validation by ensuring privacy during aggregation, while validation ensures integrity before aggregation.

A dynamic, behavioral defense mechanism where the central server assigns and updates a credibility score to each client based on the historical consistency and utility of their submissions.

• How it works: Scores are computed using metrics like update similarity to a robust aggregate, contribution to global model improvement, or consistency over time.
• Application: Scores directly weight a client's update during aggregation (e.g., weighted FedAvg). Low-trust clients have minimal influence.
• Adaptive: Allows the system to learn client reliability, automatically down-weighting newly malicious actors.

A mathematical framework for quantifying and limiting privacy loss. In federated learning, DP is applied by adding calibrated noise to updates or queries.

• Local DP (LDP): Each client adds noise to its update before sending it to the server. Provides a strong, distributed guarantee.
• Central DP: The server adds noise to the aggregated global update. Requires a trusted server but is more statistically efficient.
• Gaussian/Laplace Mechanisms: Common noise addition techniques.
• Role in Validation: DP noise can obscure malicious signals, so validation often occurs before noise addition in the LDP setting.

Defensive checks performed locally by the federated client on its own data or computed model updates before submission to the server. This is a first line of defense.

• Common Techniques:
  • Gradient Norm Clipping: Bounds the L2 norm of the update to limit a single client's influence and improve stability.
  • Data Quality Checks: Identifying corrupted or out-of-distribution local samples.
  • Local Adversarial Training: Training on perturbed examples to improve local model robustness.
• Synergy: Works in tandem with server-side validation, creating a layered defense-in-depth strategy.

The structured process of identifying, quantifying, and prioritizing potential security and privacy threats specific to a federated learning system's architecture and use case.

• Key Threats Modeled:
  • Data Poisoning: Malicious clients corrupt their local data.
  • Model Poisoning: Clients submit manipulated model updates.
  • Privacy Inference Attacks: Model inversion or membership inference.
  • Free-Riding & Sybil Attacks.
• Output: A risk assessment that directly informs the selection and configuration of server-side validation techniques and other defenses.