FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective

1 Introduction

• Server-based defenses may fail under extremely strong attacks, and their impact can persist in later rounds even when no further attacks occur.The paper focuses on targeted poisoning attacks.Source: §1 · p. 2
• The Attack Effect on Parameter estimator quantifies poisoning effects on global-model parameters and supports FL-WBC, a client-based defense for already-polluted models.The estimator also helps infer how susceptible different FL instantiations are to poisoning.Source: §1 · p. 2
• FL-WBC mitigates attack effects within 1 communication round under IID settings and within 5 rounds under non-IID settings, with nearly no accuracy drop.The experiments cover Fashion-MNIST and CIFAR10.Source: §1 · p. 2
• The authors report that combining FL-WBC with robust aggregation can mitigate attacks even when robust aggregation alone is ineffective under extremely strong attacks.Source: §1 · p. 2
• The paper reports a robustness guarantee in terms of AEP and a convergence guarantee to FedAvg when applying FL-WBC.Source: §1 · p. 2

2 Related work

• Untargeted attacks seek high global-model error on any test input, while targeted attacks seek attacker-desired misclassifications on selected inputs.The paper focuses on targeted attacks introduced in.Source: §2 · pp. 2–3
• Figure 2 compares Coordinate Median and Coordinate Trimmed Mean aggregation performance, with black circles marking adversarial rounds.Source: Figure 2 · p. 3
• Server-side defenses include coordinate- and geometric-median aggregation, client-clustering heuristics, and differential-privacy perturbation, but aggregation alone may fail when malicious updates are prevalent.The cited methods include [14] [15], [14], [20] [3] [23], and [7] [24].Source: §2 · p. 3

3 Motivation

• The experiment varies the number of malicious devices from 1 to 5 among 10 participating devices per round under an IID Fashion-MNIST setting.The attack follows the settings in.Source: §3 · p. 3
• Both Coordinate Median and Coordinate Trimmed Mean aggregation degrade dramatically when 50% of devices are malicious during adversarial rounds.Source: §3 · p. 4
• Attack impact remains in subsequent rounds even when no additional attacks occur, motivating mitigation once the global model is polluted.Source: §3 · p. 4

4.1 Problem Formulation

• Malicious devices optimize a shared malicious objective alongside the benign objective, with α controlling the trade-off, before the server averages participating clients’ local models.The malicious dataset shares the benign data distribution but uses adversarial labels, and the attack seeks targeted misclassification on that dataset.Source: §4.1 · p. 4

4.2 Estimation of Attack Effect on Model Parameters

• Attack Effect on Parameter (AEP) δ_t measures the accumulated change in global model parameters caused by malicious devices through round t.The section uses a counterfactual global model in which attackers do not perform attacks to quantify this effect.Source: §4.2 · p. 5
• AEP’s impact on the malicious objective can persist for several rounds even when the global model keeps updating without further attacks.The analysis assumes the persistent effect is dominated by δ_t relative to the benignly learned model component.Source: §4.2 · p. 5

4.3 Unveil Long-lasting Attack Effect

• The persistence mechanism is that AEP lies in the kernels of benign clients’ Hessians, so local training does not remove that attack effect.The analysis also reports near-zero Hessian–AEP products under effective attacks.Source: §4.3 · p. 5
• Because AEP transmission is determined by Hessians inaccessible to the server, server-based defenses cannot efficiently mitigate attacks that have already polluted the global model.The section motivates a client-side defense for this post-pollution setting.Source: §4.3 · p. 5

5.1 Defense Design

• FL-WBC perturbs benign local training to prevent AEP from remaining in Hessian kernels while minimizing benign-task loss.Direct perturbation of the high-dimensional Hessian is computationally unaffordable, so the design targets small-magnitude diagonal elements and uses Laplace noise.Source: §5.1 · pp. 5–6
• The defense derives a certified robustness guarantee that lower-bounds the distance of AEP between an adversarial round and subsequent rounds.FL-WBC’s local-training perturbation is generated by a random matrix, making the defensive operation unpredictable to attackers.Source: §5.1 · p. 6, §5.2 · p. 6

5.2 Robustness to Adaptive attacks

• Even if attackers know benign clients’ data and can predict the next sampled clients, the defense remains robust because its operation is dominated by unpredictable random perturbations.The text characterizes this combined attacker knowledge as an unrealistic, extreme assumption.Source: §5.2 · p. 6

6 Convergence Guarantee

• FL-WBC changes the local training update for benign devices, and the section derives FedAvg’s convergence guarantee for this modified process.The stated theorem uses Assumptions 1–4 and specifies a learning-rate schedule.Source: §6 · p. 7
• The theorem’s conditions include smooth and strongly convex local objectives and bounded stochastic-gradient quantities.These are among the assumptions listed for the convergence analysis.Source: §6 · p. 7

7.1 Experimental Setup

• The experiments use targeted attacks with malicious devices sharing a dirty-label dataset, and compare defenses using attack mitigation rounds and benign accuracy.The setup includes IID and non-IID Fashion-MNIST and CIFAR10, with one- and ten-image malicious datasets and 50% attackers in adversarial rounds.Source: §7 · p. 7, §7.1 · pp. 7–8

7.2 Effectiveness of FL-WBC with Single Image in The Malicious Dataset

• With one malicious image and s = 0.4, FL-WBC mitigates attacks within 5 rounds in both settings, while CMA and CTMA fail within 10 subsequent rounds.The comparison includes Figure 3; CTMA trims 80% of local updates at β = 0.4.Source: Figure 3 · p. 8, §7.2 · pp. 8–9

7.3 Effectiveness of FL-WBC with Multiple Images in The Malicious Dataset

• For multiple malicious images, robust aggregation cannot guarantee mitigation within 5 rounds in either setting; this case is easier than the single-image case.The reported explanation is that multiple images’ AEP requires a larger parameter space; Table 1 presents robust-aggregation mitigation-round results.Source: §7.3 · p. 9, Table 1 · p. 9
• With multiple malicious images, FL-WBC mitigates attacks in one round with less than 3% benign-accuracy loss for IID and 10% for non-IID, outperforming DP methods.DP methods incur more than 9% benign-accuracy loss for IID and 40% for non-IID to achieve the same robustness.Source: Figure 5 · p. 10, §7.3 · p. 10

7.4 Integration of The Robustness Aggregation and FL-WBC

• With CMA and FL-WBC, attack effects are mitigated within 1 round under IID and 5 rounds under non-IID settings; benign accuracy loss stays below 7%.CMA alone does not mitigate the attack effect in this experimental setting.Source: Figure 6 · p. 10, §7.4 · p. 10

• FL-WBC targets model-poisoning attacks that have already broken through server-based defenses and polluted the global model.The paper focuses on targeted poisoning attacks and says the defense can be extended to attacks such as backdoors.Source: §8 · p. 10

9 Funding Transparency Statement

• The work lists support from NSF OIA-2040588, CNS-1822085, SPX-1725456, and IIS-2140247.Source: §9 · p. 11

A Algorithm for training process applying FL-WBC

• FL-WBC adds storage for W−1 and W−2 during local training on a benign device.Algorithm 1 identifies this as the defense’s only overhead.Source: A Algorithm for training process… · p. 13
• During local training, the algorithm generates Laplace noise and adds it to parameters whose update-difference magnitude is no greater than the scaled noise magnitude.The algorithm outputs the trained model parameters with the defense applied.Source: A Algorithm for training process… · p. 13

B Experiments to Support Analysis in §4.3

• The validation experiment uniformly distributes Fashion-MNIST data across 100 devices, with five malicious devices and five benign participants in adversarial rounds.Ten benign devices participate in other rounds; training uses one local epoch, batch size 32, SGD, and learning rate 0.01.Source: B Experiments to Support Analysis in… · p. 13
• For each adversarial round, malicious devices train twice with α set to 1 and 0; the difference between the resulting aggregated models estimates δ_t.The two aggregates are formed with and without the malicious devices, respectively.Source: B Experiments to Support Analysis in… · p. 13
• RH(W) adds a term that encourages δ_t to lie in the null space of H; its approximation uses a cheaper sum-based calculation and is weaker than the exact regularization.The exact expectation-based calculation is described as having unacceptable computational costs.Source: B Experiments to Support Analysis in… · p. 14
• After the first adversarial round, Φ_t is nearly 0 and malicious-data misclassification loss stays low until another attack; applying RH reduces Φ_t at rounds 5, 60, and 67 and boosts those attacks.In the baseline, Φ_t exceeds 3 in round 5, and the attack is rapidly mitigated.Source: Figure 7 · p. 13, B Experiments to Support Analysis in… · p. 14, Table 2 · p. 14

C.1 Detailed data preparation and hyperparameter configurations for §7

• IID data are distributed uniformly across 100 devices; non-IID data are sorted by digit label, split into 200 shards, and assigned two shards per device.The appendix also identifies the dataset architectures in Table 3 and specifies 500 Fashion-MNIST rounds and 1,000 CIFAR10 rounds.Source: §C.1 · p. 14, Table 3 · p. 15
• Training uses one local epoch (E=1), batch size 32 (B=32), SGD with learning rate 0.01, and 5 malicious devices out of 100 total devices.Source: §C.1 · p. 14

D Derivation of Equation 7

• Between rounds τ1 and τ2, with no malicious devices selected, the two model trajectories differ because they start from different initial models.The local training processes are otherwise the same.Source: D Derivation of Equation 7 · p. 15
• The derivation applies a first-order Taylor approximation and the chain rule, then combines Equations 15–17 to obtain an estimator of δ_t.The steps also use Equation 4.Source: D Derivation of Equation 7 · p. 15

E Certified robustness guarantee

• Certified robustness is the AEP distance between the adversarial round and subsequent rounds using FL-WBC; a larger distance indicates more efficient attack mitigation.Source: E Certified robustness guarantee · p. 15
• The guarantee assumes a nearly full-rank post-defense benign Hessian, a lower bound on expected AEP norms, and independent, zero-mean Hessian elements across rounds, devices, and iterations.Source: E Certified robustness guarantee · pp. 15–16
• Under Assumptions 5–7, Theorem 2 states a FedAvg robustness guarantee when an attack occurs at tadv and no attack follows through T.The result concerns FedAvg after applying FL-WBC.Source: E Certified robustness guarantee · p. 16

F Proof of Theorem 1

• The convergence proof derives new bounds after applying the defense and adapts the FedAvg convergence theorem in [27].Source: F Proof of Theorem 1 · pp. 17–18
• The stated convergence guarantee assumes Assumptions 1–4 and uses a specified learning-rate schedule with κ = L/µ and γ = max{8κ, I}.Source: F Proof of Theorem 1 · p. 18