Source-linked AI summary
RobustFed: A Truth Inference Approach for Robust Federated Learning
Farnaz Tahmasebian, Jian Lou, Li Xiong
TL;DR
Federated learning lets clients train a shared model while keeping local data private, but aggregation can be compromised by malicious or arbitrary client updates. This paper uses truth inference to incorporate client reliability into aggregation, and reports that RobustFed variants outperform conventional and state-of-the-art methods against several attacks on three real-world datasets.
Problem
Federated aggregation is vulnerable to malicious or arbitrary client updates, which can severely affect the global model.
Source: §1 · p. 3Method
The paper adapts truth inference by estimating client reliability from submitted model parameters and incorporating those reliability estimates into aggregation.
Source: §1 · pp. 2–3Results
RobustFed+ and RobustFedt are robust to label-flipping, noisy-data, and Byzantine attacks compared with conventional and state-of-the-art aggregation methods on three real-world datasets.
Source: §6 · p. 15Takeaways & Limitations
The authors conclude that using historical statistics alongside client reliability further improves the robustness of the global model estimate.
Source: §6 · p. 15The adversarial model assumes IID client data and fewer than 50% adversarial clients.
Source: §3.2 · p. 6
Abstract
from arXiv · showhide
Federated learning is a prominent framework that enables clients (e.g., mobile devices or organizations) to train a collaboratively global model under a central server's orchestration while keeping local training datasets' privacy. However, the aggregation step in federated learning is vulnerable to adversarial attacks as the central server cannot manage clients' behavior. Therefore, the global model's performance and convergence of the training process will be affected under such attacks.To mitigate this vulnerability issue, we propose a novel robust aggregation algorithm inspired by the truth inference methods in crowdsourcing via incorporating the worker's reliability into aggregation. We evaluate our solution on three real-world datasets with a variety of machine learning models. Experimental results show that our solution ensures robust federated learning and is resilient to various types of attacks, including noisy data attacks, Byzantine attacks, and label flipping attacks.
1 Introduction
The introduction frames cross-silo federated learning as a way to train shared models without centralizing private data, but notes that malicious or arbitrary client updates can undermine aggregation. It presents reliability-aware truth inference as the proposed defense and reports improved results against baselines.
1 Introduction
- Cross-silo FL supports joint model training without sharing raw private datasets, addressing privacy concerns and the risk of poor generalization from one organization’s data.The paper focuses on cross-silo FL involving organizations.Source: §1 · p. 1
- FedAvg’s weighted averaging is vulnerable because adversarial behavior or infrastructure failures can cause clients to submit manipulated or arbitrary values.The introduction names label-flipping, Gaussian-noise attacks, and Byzantine faults as examples.Source: §1 · p. 2
- Truth inference cannot be applied directly to model parameters reliably: attacks can alter training data before the server sees parameters, and the server lacks a golden validation set.The paper identifies multi-round communication as both a challenge and an opportunity for detecting unreliable clients.Source: §1 · p. 3
- RobustFed models client reliability from submitted local parameters, incorporates reliability into aggregation, and uses a pruning algorithm to remove outlier reliability estimates.The method also uses parameters submitted in previous and current rounds to evaluate reliability.Source: §1 · p. 3
- The proposed aggregation methods mitigate attacks and outperform other baselines in experiments on three image datasets.The experiments compare the method with several baselines.Source: §1 · p. 3
2 Related Works
Related work covers data-poisoning and Byzantine defenses in federated learning, alongside crowdsourcing methods for inferring truth from worker answers. It identifies limits of existing defenses and motivates an optimization-based truth-inference baseline for dense numeric model updates.
2 Related Works
- The related-work review spans federated-learning attacks and defenses as well as truth-inference methods in crowdsourcing.It introduces these topics before discussing attack types, Byzantine robustness, and truth inference approaches.Source: §2 · p. 3
2.1 Adversarial Attacks on Federated Learning
- Data poisoning includes label flipping and noisy features; validation-set defenses require data that may be difficult to obtain in practice.The review also notes that one or two adversarial clients can compromise global-model performance.Source: §2.1 · p. 4
2.2 Byzantine-Robust Federated Learning
- Byzantine defenses include coordinate-wise median and trimmed mean, while Krum-family methods select updates by similarity; some require an upper bound on compromised workers.Multi-Krum combines Krum with averaging, and Bulyan combines Krum with trimmed mean.Source: §2.2 · pp. 4–5
2.3 Truth Inference Methods
- Truth inference assesses worker reliability, while majority voting can fail with sparse data or unreliable workers; the paper uses optimization-based PM for dense numeric updates.Prior comparisons cited in the review report PGM and neural-network methods as generally robust in adversarial binary-task settings.Source: §2.3 · p. 5
3 Preliminaries
The preliminaries describe federated learning as round-based local training followed by server aggregation, and define the attacker’s capabilities and the assumptions used in the paper’s adversarial model.
3.1 Federated Learning (FL)
- In each round, selected clients train locally from the latest global model, return updated weights, and the server aggregates them; FedAvg uses a weighted average.The clients’ datasets remain local while model parameters are shared with the server.Source: §3.1 · pp. 5–6
3.2 Adversarial Model
- The adversary may poison local data or directly alter uploaded parameters, under assumptions of IID client data and fewer than 50% adversarial clients.The attacker is assumed to have access to local data, model structure, algorithms, hyperparameters, and model parameters.Source: §3.2 · p. 6
4 Proposed Robust Model Aggregation
The section develops a truth-inference approach that estimates client reliability and uses it in federated aggregation. It progressively adds outlier-client removal and historical parameter statistics.
4 Proposed Robust Model Aggregation
- The proposed server uses reliability scoring and aggregation, with three methods that build on one another.The approach first estimates update reliability, then adds outlier removal and multi-round historical information.Source: §4 · pp. 6–7
4.1 Truth Inference Method
- Reliability-aware PM can improve truth estimates over averaging by modeling each worker’s reliability; RobustFed adapts truth inference to unknown model parameters.It initializes reliability equally and parameter truths with the median, then iteratively infers truths and estimates client reliability.Source: §4.1 · p. 8
4.2 Robust Aggregation Method: RobustFed
- RobustFed jointly estimates parameter truths and client reliabilities, then weights clients by reliability when aggregating continuous updates.It uses Euclidean distance between client updates and the estimated truth; clients with higher reliability carry more weight.Source: §4.2 · pp. 9–10
4.3 Reduce Effect of Malicious Clients: RobustFed+
- RobustFed+ selects clients whose reliability lies within one standard deviation of the median, then excludes the others from aggregation.This filtering addresses cases such as label flipping, where malicious clients can receive high reliability because their outlier gradients bias the aggregate.Source: §4.3 · pp. 10–11
4.4 Incorporate the Temporal Data to Improve the Defense Capability: RobustFedt
- RobustFedt incorporates previous-round parameter statistics into reliability estimation to use temporal information when identifying malicious clients.With static client selection it adds counts of large and small weights, median, and average as tasks; with dynamic selection it uses prior-round median and average for new clients.Source: §4.4 · p. 11
5 Evaluation
The evaluation tests the aggregation methods across three datasets and adversarial settings. It compares robustness, examines client reliability under attacks, and studies the effect of malicious-client counts.
5.1 Experiment Settings
- Experiments use MNIST, Fashion-MNIST, and CIFAR-10, with 60,000/10,000 train/test samples for the first two and 50,000/10,000 for CIFAR-10.The datasets contain handwritten digits, clothing and footwear images, and natural color images, respectively.Source: §5.1 · p. 12
- The evaluation uses a three-layer CNN for MNIST and FMNIST and VGG-11 for CIFAR-10, with data split equally across clients.Static mode repeatedly selects the same 10 clients; dynamic mode selects 10 from a pool of 100 each round.Source: §5.1 · p. 12, Experiment Setup and Adversarial Attacks · p. 12
Experiment Setup and Adversarial Attacks
- The attacks include label flipping, uniform input noise for MNIST and FMNIST, and Byzantine model-update perturbations drawn from a Gaussian with μ=0 and σ=20.The experiments assume 30% adversarial clients.Source: Experiment Setup and Adversarial Attacks · p. 12
5.2 Experiment Results
- RobustFed's reliability ordering reverses under label flipping, while RobustFed_t's historical statistics generally favor benign clients and assign malicious clients near-zero reliability across attacks.RobustFed_t's client separation is especially strong under Byzantine attack.Source: §5.2 · pp. 12–13, Figure 4 · p. 13
- Robust+ disregards clients with both high and low reliability to help mitigate malicious clients' impact.This addresses the observed risk that malicious clients can receive high reliability under some attacks.Source: §5.2 · pp. 12–13
- As malicious-client counts rise, global-model performance drops slightly; RobustFed_t improves over RobustFed+ on FMNIST and MNIST, but not CIFAR-10.The reported improvement is associated with higher clean-data accuracy on FMNIST and MNIST.Source: Figure 5 · p. 13, §5.2 · p. 13
- RobustFed+ and RobustFed_t provide more consistent, better robustness against all three attacks with comparable clean-data accuracy versus state-of-the-art methods.The static comparison uses 10 fixed clients, 30% malicious; the table covers static and dynamic modes.Source: Table 1 · p. 14, §5.2 · p. 14
- RobustFed+ shows stronger robustness by incorporating historical information; the cited setting has a 100-client pool with 30 malicious clients and 70 normal clients.Source: §5.2 · pp. 14–15
6 Conclusions & Future Works
The paper proposes truth-inference reliability for federated aggregation and reports robustness against malicious clients across three datasets. Its experiments assume IID client data, with non-IID distributions left for future research.
6 Conclusions & Future Works
- Truth-inference reliability aggregation, enhanced with historical statistics, is reported robust to label-flipping, noisy-data, and Byzantine attacks on three datasets; experiments assume IID client data, leaving non-IID distributions for future work.The conclusion contrasts the proposed approaches with conventional and state-of-the-art aggregation methods.Source: §6 · p. 15