Abstract:Federated Learning (FL) is a distributed machine learning diagram that enables multiple clients to collaboratively train a global model without sharing their private local data. However, FL systems are vulnerable to attacks that are happening in malicious clients through data poisoning and model poisoning, which can deteriorate the performance of aggregated global model. Existing defense methods typically focus on mitigating specific types of poisoning and are often ineffective against unseen types of attack. These methods also assume an attack happened moderately while is not always holds true in real. Consequently, these methods can significantly fail in terms of accuracy and robustness when detecting and addressing updates from attacked malicious clients. To overcome these challenges, in this work, we propose a simple yet effective framework to detect malicious clients, namely Confidence-Aware Defense (CAD), that utilizes the confidence scores of local models as criteria to evaluate the reliability of local updates. Our key insight is that malicious attacks, regardless of attack type, will cause the model to deviate from its previous state, thus leading to increased uncertainty when making predictions. Therefore, CAD is comprehensively effective for both model poisoning and data poisoning attacks by accurately identifying and mitigating potential malicious updates, even under varying degrees of attacks and data heterogeneity. Experimental results demonstrate that our method significantly enhances the robustness of FL systems against various types of attacks across various scenarios by achieving higher model accuracy and stability.

What problem does this paper attempt to address?

The paper attempts to address the problem of how to effectively detect and defend against data poisoning and model poisoning attacks from malicious clients in Federated Learning (FL) systems to improve the robustness and accuracy of the system. ### Background and Problem Federated Learning is a distributed machine learning paradigm that allows multiple clients to collaboratively train a global model without sharing their local private data. However, FL systems are vulnerable to attacks from malicious clients that degrade the performance of the global model through data poisoning and model poisoning. Existing defense methods are often tailored to specific types of attacks and assume moderate attack intensity, which is not always the case in real-world scenarios. Therefore, these methods have significant shortcomings in terms of accuracy and robustness when detecting and handling malicious client updates. ### Paper Objective To overcome these challenges, the paper proposes a simple yet effective framework—Confidence-Aware Defense (CAD), which uses the confidence scores of local models as a criterion for evaluating the reliability of local updates. The core idea is that regardless of the type of attack, malicious attacks will cause the model to deviate from its previous state, thereby increasing the uncertainty of predictions. Thus, CAD can comprehensively and effectively detect and mitigate various types of data poisoning and model poisoning attacks, maintaining high performance even under different attack intensities and data heterogeneity conditions. ### Main Contributions 1. **Proposed a confidence-based malicious client detection method**: This method is applicable to various types of data poisoning and model poisoning attacks and can work effectively under different data heterogeneity conditions. 2. **Significantly improved the robustness of FL systems**: The method ensures higher model accuracy and stability in the face of moderate (25% malicious clients), severe (50% malicious clients), and extreme (75% malicious clients) attacks. 3. **Validated the effectiveness of the method through extensive experiments**: Experiments conducted on multiple datasets show that the confidence-based defense mechanism outperforms existing methods in detecting and mitigating malicious updates, especially in terms of robustness and accuracy. ### Method Overview 1. **Collect confidence scores of each client update**: In each training round, collect the confidence scores of each client model update. 2. **Establish confidence boundaries**: Based on the collected confidence scores, evaluate the uncertainty of each client model update and set boundaries as a reference. 3. **Detect and handle malicious updates**: Identify high-uncertainty updates based on the boundaries and take appropriate actions, such as discarding or adjusting these updates. ### Experimental Results Experimental results show that the CAD model maintains high accuracy and robustness under different attack intensities (including moderate, severe, and extreme cases), significantly outperforming other existing methods. Additionally, CAD performs well across different model and dataset combinations, demonstrating its broad applicability and reliability. In summary, the paper proposes a confidence-based defense mechanism that effectively addresses the problem of malicious attacks in FL systems, enhancing the robustness and security of the system.

Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense

FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients

MODEL: A Model Poisoning Defense Framework for Federated Learning via Truth Discovery

FLARE: Defending Federated Learning against Model Poisoning Attacks via Latent Space Representations

FedDMC: Efficient and Robust Federated Learning via Detecting Malicious Clients

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency

Secure and Efficient Federated Learning Against Model Poisoning Attacks in Horizontal and Vertical Data Partitioning

FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective

LeadFL: Client Self-Defense against Model Poisoning in Federated Learning

FedDefender: Client-Side Attack-Tolerant Federated Learning

Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learning

Data Poisoning Attacks Against Federated Learning Systems

Leveraging MTD to Mitigate Poisoning Attacks in Decentralized FL with Non-IID Data

Defending Against Data Poisoning Attack in Federated Learning With Non-IID Data

Fake or Compromised? Making Sense of Malicious Clients in Federated Learning

FDSFL: Filtering Defense Strategies Toward Targeted Poisoning Attacks in IIoT-Based Federated Learning Networking System.

Covert Model Poisoning Against Federated Learning: Algorithm Design and Optimization

Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries

A federated learning attack method based on edge collaboration via cloud

Depriving the Survival Space of Adversaries Against Poisoned Gradients in Federated Learning

Mitigation of a poisoning attack in federated learning by using historical distance detection