Update Sanitization

A fundamental technique where the server bounds the L2-norm (Euclidean length) of each client's gradient update vector before aggregation. This limits the influence of any single client and mitigates the impact of updates with excessively large magnitudes, which can be a sign of malicious intent or poor local data.

• Process: For each client update g, compute g' = g / max(1, ||g||_2 / C), where C is a clipping threshold.
• Purpose: Prevents a single malicious client from arbitrarily distorting the global model. It is also a prerequisite step for applying differential privacy via noise addition.

This technique involves analyzing the distribution of submitted updates to identify and filter statistical outliers before aggregation. The server computes metrics like the mean and standard deviation of updates for each model parameter or the update vector as a whole.

• Z-score Filtering: Updates with parameter values exceeding a set number of standard deviations from the mean are discarded or down-weighted.
• Multi-Krum: An extension of the Krum algorithm that selects a committee of m client updates whose vectors are mutually closest, effectively filtering out updates that are far from the consensus.
• Use Case: Highly effective against Byzantine clients that send updates diverging significantly from the honest majority.

These are robust aggregation rules that function as inherent sanitization by design. Instead of a simple mean, they use order statistics to produce a global update resilient to extreme values.

• Coordinate-wise Median: For each model parameter (coordinate), the server computes the median value across all client updates. This is highly robust to arbitrary outliers but can have higher variance.
• Trimmed Mean: For each parameter, the server discards a fraction (e.g., top and bottom 10%) of the submitted values and computes the mean of the remaining ones. This balances robustness and statistical efficiency.
• Key Property: These methods do not require an explicit 'filtering' step; the aggregation itself sanitizes the input.

A more granular form of clipping that operates on individual parameter values rather than the overall vector norm. The server enforces minimum and maximum allowable values for each gradient element.

• Process: For each value v in the update tensor, apply v' = clamp(v, min=v_min, max=v_max).
• Rationale: Malicious updates may not have an abnormally large overall norm but could contain a few parameters with extreme, destabilizing values. Clamping prevents this.
• Implementation: Often used in conjunction with norm clipping for defense-in-depth. The range [v_min, v_max] can be set empirically from historical updates or based on model architecture.

This advanced technique separates the analysis of an update's magnitude (norm) from its direction (angle relative to other updates). Malicious updates often have both anomalous magnitude and misaligned direction.

• Direction Cosines: The server computes the cosine similarity between each client's update vector and a reference vector (e.g., the update median). Low cosine similarity indicates directional divergence.
• Composite Scoring: A client's trust score can be computed as a weighted function of its update norm (after clipping) and its directional alignment. Updates with poor composite scores are heavily down-weighted.
• Advantage: Catches sophisticated attacks where magnitude alone is not a reliable signal.

Sanitization based on a client's update history over multiple training rounds. The server monitors the temporal pattern of a client's contributions to detect sudden, anomalous changes.

• Process: Track metrics like update norm, directional alignment, or loss improvement for each client over time.
• Detection: A client that suddenly submits an update orders of magnitude larger or pointing in a radically different direction than its historical pattern is flagged for review or filtering.
• Benefit: Helps distinguish between a persistently malicious client (handled by other methods) and a previously honest client that has been compromised or is experiencing catastrophic local training failure.

This is the core security application. The server inspects incoming updates for signs of malicious intent designed to corrupt the global model.

• Filters outlier updates using statistical bounds or geometric distance metrics.
• Applies robust aggregation rules like trimmed mean or median, which inherently discard extreme values.
• Detects data poisoning and backdoor attacks by identifying updates that deviate significantly from the consensus direction of honest clients.

Sanitization is used to apply calibrated noise, providing formal privacy guarantees for client contributions.

• Implements the Gaussian or Laplace mechanism by adding noise to the aggregate of updates.
• Performs gradient clipping to bound each client's influence (sensitivity), which is a prerequisite for accurate noise calibration.
• Manages the privacy budget across rounds by controlling the noise scale applied during sanitization, ensuring total privacy loss remains within limits.

Even without malice, statistical heterogeneity (non-IID data) can cause unstable updates. Sanitization smooths this process.

• Reduces client drift by clipping update norms, preventing any single client's update from overpowering the global model direction.
• Filters high-variance updates from clients with small or noisy local datasets.
• Acts as a regularizer, improving convergence when client data distributions are vastly different, a common challenge in real-world federated systems.

Sanitization often operates in conjunction with cryptographic secure aggregation protocols for a layered defense.

• Sanitization is applied after decryption in a secure enclave (e.g., Intel SGX), where the server can compute on plaintext updates without exposing them.
• This combination ensures individual privacy (via crypto) and collective integrity (via sanitization).
• It prevents a malicious server from viewing raw client data while still allowing it to perform essential defensive operations.

Devices vary in compute power, leading to stale or low-quality updates. Sanitization helps maintain model quality.

• Detects and down-weights stale updates from slow or intermittently connected clients.
• Filters updates corrupted by local hardware faults or low-precision computation.
• Normalizes update magnitudes across device types, ensuring a fair contribution from both powerful and constrained edge devices.

Sanitization can enforce contribution quality, ensuring clients who submit poor updates don't degrade the model or benefit unfairly.

• Implements contribution-aware filtering based on update quality metrics.
• Uses trust scoring to dynamically weight updates; low-trust clients have their updates more heavily sanitized or clipped.
• Promotes fairness by preventing a small set of high-quality clients from being drowned out by noise from many low-effort participants.

A class of server-side algorithms designed to produce a correct global model update even when a fraction of clients are malicious or faulty. Unlike simple averaging, these methods are provably resilient to arbitrary adversarial updates. Core examples include:

• Krum & Multi-Krum: Select updates closest to their neighbors.
• Trimmed Mean: Discards extreme values per parameter dimension.
• Median Aggregation: Uses the coordinate-wise median. These are often the first line of defense, with update sanitization techniques applied before or within them.

A server-side validation technique that analyzes the statistical properties of client-submitted model updates (gradients) to detect anomalies. This is a precursor or component of sanitization. Common inspection metrics include:

• Update Norm: Clipping overly large gradients (norm bounding).
• Distribution Analysis: Detecting deviations from expected gradient distributions (e.g., using PCA).
• Geometric Consistency: Checking if an update points in a similar direction to a reference subset. Failed inspections trigger sanitization or outright rejection of the update.

A dynamic reputation system that assigns a credibility score to each federated client based on their historical behavior. This score directly influences the sanitization and aggregation process.

• Score Calculation: Based on update quality, consistency, and contribution to global model improvement.
• Application: Low-trust clients may have their updates more heavily clipped, filtered, or down-weighted during aggregation.
• Adaptive Defense: Scores can decay over time, allowing clients to rehabilitate trust, or plummet upon detecting malicious activity.

Cryptographic techniques that mathematically guarantee privacy by adding calibrated noise. DP is often applied as a sanitization step.

• Local DP (LDP): Clients add noise to their updates before sending them (e.g., using the Gaussian Mechanism).
• Central DP: The server adds noise to the aggregated update.
• Privacy Accounting: Tracks cumulative privacy loss (epsilon, delta) across rounds. Sanitization via DP noise directly defends against model inversion and membership inference attacks by limiting information leakage.

A cryptographic protocol that allows the server to compute the sum of client updates without learning any individual update. This protects client privacy during transmission and aggregation.

• Process: Clients encrypt their updates using multi-party computation (MPC) or homomorphic encryption.
• Relationship to Sanitization: Secure aggregation happens before the server can inspect or sanitize updates, creating a tension. Verifiable or transparent sanitization methods must be designed to work within cryptographic constraints.

Defensive measures executed on the edge device before its update is submitted. This complements server-side sanitization by reducing the attack surface.

• Data Quality Checks: Validating local dataset integrity.
• Gradient Clipping: Applying a norm bound locally to prevent excessively large updates.
• Robust Local Training: Using robust loss functions (e.g., Huber loss) less sensitive to poisoned data points. Effective client-side validation means the server receives pre-sanitized, higher-quality updates, making its job easier.