Federated Poisoning Detection

A detection technique that analyzes the high-dimensional structure of client updates rather than just their magnitude. It assumes that honest updates lie on a low-dimensional manifold, while poisoned updates introduce detectable spectral signatures.

• Singular Value Decomposition (SVD): Decomposes the matrix of client updates to identify vectors with high projection onto anomalous singular vectors.
• Clustering-Based Detection: Groups updates using algorithms like DBSCAN or HDBSCAN to isolate a minority cluster of malicious actors.
• Dimensionality Reduction: Uses PCA or t-SNE to visualize the update space, allowing a human operator or heuristic to flag statistical outliers for exclusion.

A stateful defense that maintains a persistent reputation score for each participating client across training rounds. This transforms detection from a per-round anomaly check into a continuous trust evaluation.

• Beta Reputation Systems: Models client trustworthiness using a Beta probability distribution, updating the posterior based on audit results.
• Blockchain Audit Trails: Immutably logs hashed model updates and aggregation decisions to provide non-repudiable provenance for forensic analysis.
• Differential Privacy Auditing: Correlates a client's claimed privacy budget expenditure with its update characteristics to detect attempts to bypass clipping norms.

Understanding the adversary's tactics is essential for building effective detection. These attacks aim to manipulate the model's behavior on specific inputs while maintaining overall accuracy to evade naive detection.

• Backdoor Injection: The attacker trains on data with a specific trigger pattern (e.g., a pixel artifact in an X-ray) to cause a targeted misclassification at inference time.
• Model Replacement: A single, heavily weighted malicious update is designed to completely overwrite the global model's weights for a specific sub-task.
• Gradient Cancellation: Malicious updates are crafted to cancel out the contributions of honest clients on a targeted feature, effectively erasing the model's ability to learn that pattern.

A defensive protocol that requires clients to prove the integrity of their update by evaluating it against a secret, globally held validation dataset before aggregation.

• Loss Thresholding: The server rejects any client update that causes a statistically significant spike in loss on the holdout set.
• Directional Divergence: Measures the cosine similarity between the proposed update and the direction of true gradient descent on the holdout set; low similarity suggests poisoning.
• Homomorphic Validation: Uses homomorphic encryption to allow the server to compute the loss on the encrypted holdout set without revealing the raw data to itself or other clients.

The reactive component of a poisoning defense strategy. Once a poisoned round is detected, the system must surgically remove its influence without requiring a full retraining from scratch.

• Checkpointing: The server maintains a sliding window of previous global model states, allowing for an immediate rollback to a known clean checkpoint.
• Certified Unlearning: Algorithms that mathematically guarantee the removal of a specific client's data influence from the model weights, restoring the decision boundary to its pre-attack state.
• Historical Gradient Analysis: Re-evaluates past updates from a newly identified malicious client to determine the exact round of first compromise and the scope of the required rollback.