PaperlayerView exact revision on arXiv

Source-linked AI summary

STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregation

Nawrin Tabassum, Yanzhao Wu

arXiv:2608.14861v1cs.CRcs.LG

TL;DR

Federated Learning remains vulnerable to targeted poisoning attacks, while defenses must distinguish malicious updates and limit their aggregation influence. STAR-FL combines spatial-temporal update analysis with robust aggregation, consistently keeping attack success rates below 7% and remaining robust to adaptive attacks.

  • Problem

    Existing Federated Learning defenses must better distinguish benign from malicious updates and mitigate poisoned updates during aggregation to address targeted poisoning attacks.

  • Method

    STAR-FL jointly analyzes client-update similarity and temporal consistency, removes updates flagged by both analyses, and adaptively adjusts aggregation learning rates.

  • Results

    STAR-FL consistently keeps backdoor attack success rates below 7% and achieves 3.40% and 4.30% ASRs under adaptive attacks on FMNIST and CIFAR-10, respectively.

  • Takeaways & Limitations

    Combining spatial-temporal filtering with robust aggregation improves Federated Learning robustness against backdoor attacks while maintaining high model utility.

Abstract

from arXiv · show

Data poisoning attacks pose serious security threats to Federated Learning (FL) systems in Computer Vision. Despite growing research attention, two key challenges remain for existing defense techniques: (1) accurately distinguishing between benign and malicious model updates and (2) effectively mitigating the influence of poisoned model updates during model aggregation. To address these challenges, we propose a novel defense framework against targeted poisoning attacks with Spatial-Temporal Analysis and Robust aggregation for FL (STAR-FL). First, we employ spatial-temporal clustering to identify and remove potentially malicious updates from the FL training process. Second, we adjust the learning rate during aggregation to mitigate the impact of any malicious updates that evade detection. Third, we conduct extensive experiments across multiple benchmark datasets to evaluate the spatial-temporal analysis and robust aggregation in STAR-FL. Experimental results demonstrate their synergistic effect in enabling STAR-FL to effectively protect FL and consistently outperform state-of-the-art defenses against targeted poisoning attacks, significantly reducing Attack Success Rates (ASRs). The source code is available at https://github.com/mlsysx/STAR-FL.

I. INTRODUCTION · II. RELATED WORK

The introduction presents STAR-FL as a unified defense that combines spatial-temporal analysis with robust aggregation to detect malicious updates and mitigate targeted backdoor attacks in federated learning. Related work covers update filtering and clustering defenses while noting their limitations when malicious clients are not very sparse.

  • I. INTRODUCTION: Federated learning trains a global model by aggregating updates from selected clients that locally train on private data.The server sends the current global model to selected clients each round and aggregates their returned updates.
  • II. RELATED WORK: Other preaggregation defenses analyze spatial characteristics, including gradient similarities or distances, to distinguish benign from malicious updates.Some methods additionally use clients’ temporal behaviors in detection.
  • I. INTRODUCTION: STAR-FL integrates spatial-temporal analysis with robust aggregation to detect malicious client updates and mitigate backdoor attacks.Its analysis examines update similarity and temporal consistency, while robust aggregation suppresses malicious influence and preserves benign contributions.
  • I. INTRODUCTION: STAR-FL was evaluated on FMNIST, CIFAR-10, and CIFAR-100 under Backdoor, Model Replacement, Distributed Backdoor, and Adaptive attacks.The experiments assess the framework across multiple benchmark datasets and attack scenarios.
  • I. INTRODUCTION: Targeted poisoning attacks implant hidden behaviors that misclassify triggered inputs while preserving high accuracy on clean data.Backdoor attacks commonly insert trigger patterns into training samples and associate them with a target label.
  • II. RELATED WORK: Prior defenses filter updates before aggregation by clustering them using distance measures such as cosine distance.PCA-based dimensionality reduction has also been investigated to improve clustering performance.
  • II. RELATED WORK: Existing defenses are typically effective only when malicious clients are very few, while residual poisoned updates can still degrade global model performance.This limitation motivates combining detection with aggregation mechanisms that suppress poisoned updates’ influence.

III. PROBLEM STATEMENT · A. Threat Model · B. Defense Goals

The paper models targeted backdoor attacks that preserve clean-data behavior while forcing triggered inputs into an attacker-chosen label. STAR-FL’s defense goal is to maintain accurate benign classification while preventing backdoor learning and correctly classifying poisoned samples.

  • A. Threat Model: Attackers insert trigger patterns into local datasets rather than directly manipulating the global model.This poisoning aims to preserve high main-task accuracy while inducing targeted misclassification on poisoned samples.
  • A. Threat Model: Given a clean input x and trigger µ, the poisoned input x + µ is classified as target label y′ while clean behavior remains unchanged.The backdoor objective is expressed as f(x+µ) = y′ for poisoned samples.
  • A. Threat Model: The attack objective jointly minimizes loss on clean dataset DH and poisoned dataset DP.The stated formulation captures simultaneous optimization over the honest and poisoned data distributions.
  • B. Defense Goals: At round t, Mt ⊆ Kt denotes malicious clients, while DH and DP denote honest and poisoned data distributions.The defense problem is defined for a global model fW with weights W and loss function ℓ.
  • B. Defense Goals: The defense objective minimizes main-task loss while maximizing backdoor-task loss.This objective directly opposes the attacker’s attempt to make the global model learn the backdoor task.
  • B. Defense Goals: STAR-FL should accurately classify benign samples and prevent attackers from causing target-label misclassification of poisoned samples.The desired global model correctly classifies both benign and poisoned samples into their true labels.
  • B. Defense Goals: The STAR-FL framework processes client updates over T rounds, detects malicious clients through spatial-temporal analysis, and applies robust aggregation.Its stated inputs include N clients, server learning rate η, decay parameter β, sign threshold δ, and local datasets Di.
  • B. Defense Goals: After adjusting the learning rate for each dimension, STAR-FL updates the global model and returns the final model WG.The algorithm specifies a per-round global-model update followed by final-model output.

IV. OVERVIEW OF STAR-FL

STAR-FL detects potentially malicious client updates through complementary spatial and temporal analyses in Horizontal Federated Learning. It reduces update dimensionality, clusters updates, predicts round-specific updates from history, and retains clients identified as honest by both analyses.

  • Setting: STAR-FL operates entirely in Horizontal Federated Learning, where each client holds a distinct subset of the dataset.The problem formulation, threat model, attack, and defense are all implemented within HFL.
  • Spatial Analysis: Spatial analysis extracts final-layer gradients, applies PCA for dimensionality reduction, and separates client updates into two K-means clusters.The resulting clusters are denoted C1 and C2.
  • Temporal Analysis: Temporal analysis predicts each client’s update from historical updates, applies KDE to detect temporal outliers, and returns clients deemed honest by both analyses.The final honest-client set is obtained by intersecting the clients detected as honest spatially and temporally.
  • Spatial Analysis: STAR-FL identifies the potentially malicious cluster by comparing the average cosine similarity of the two clusters.If SC1 > SC2, clients in C1 are considered potentially malicious; otherwise, clients in C2 are considered potentially malicious.

A. Spatial Analysis

STAR-FL’s spatial analysis detects poisoned client updates by projecting final-layer updates with PCA, clustering them, and identifying malicious-like clusters through similarity and outlier analysis. The method exploits the higher uniformity of poisoned updates versus the higher variance of benign updates.

  • Spatial Analysis: PCA reduces final-layer updates to two dimensions, where poisoned updates form more uniform clusters and benign updates show greater variance.The resulting cluster structure is illustrated for benign and malicious updates across communication rounds with m=10%.
  • Spatial Analysis: STAR-FL analyzes final-layer updates because targeted attacks associate triggers with target labels there while preserving benign behavior in earlier layers.This focus is intended to expose attack-specific patterns while accounting for evasion through earlier layers.
  • Spatial Analysis: K-Means partitions the reduced update vectors into two clusters, but STAR-FL further analyzes both because the smaller cluster is not necessarily malicious.This avoids assigning malicious status solely according to cluster size.
  • Spatial Analysis: The cluster with the higher average within-cluster Cosine Similarity is identified as malicious because poisoned clients produce more similar updates.For each cluster, STAR-FL computes SCp = avg S(Vi, Vj) for distinct updates Vi and Vj within that cluster.
  • Spatial Analysis: STAR-FL applies outlier detection by measuring each update’s Euclidean distance from its assigned cluster centroid and removing updates beyond a distance threshold.The passage specifies centroid-distance thresholding as the final detection step.

B. Temporal Analysis

STAR-FL identifies stealthy fixed-frequency attackers through per-client temporal analysis of historical updates. It predicts current gradients with an exponential moving average, compares them with actual updates using cosine similarity, and uses KDE to separate inconsistent malicious clients from consistent benign clusters.

  • Temporal Analysis: Attackers insert a trigger into training samples once every third communication round, reducing attack frequency to become stealthier while retaining influence.
  • Temporal Analysis: STAR-FL predicts each client’s current-round gradient from previous updates using an exponential moving average with decay parameter β.β balances predicted and actual updates.
  • Temporal Analysis: Cosine similarity between predicted and current updates measures temporal consistency, with lower similarity indicating potentially malicious behavior.
  • Temporal Analysis: Kernel Density Estimation identifies malicious clients because benign updates form a dense cluster at high similarity scores, whereas malicious updates form a smaller separate cluster.

C. Robust Aggregation

STAR-FL strengthens aggregation with adaptive server learning rates that vary across training rounds and reduce the influence of malicious updates, including poisoned updates that evade spatial-temporal detection. The strategy uses aggregated update signs in each parameter dimension to guide learning-rate adjustment and preserve global-model robustness.

  • C. Robust Aggregation: Adaptive server learning rates dynamically vary across training rounds instead of remaining fixed, mitigating malicious updates during aggregation.This mechanism is intended to enhance the robustness of the global model.
  • C. Robust Aggregation: The server adjusts its learning rate according to the aggregated signs of client updates in each parameter dimension.Updates are analyzed across clients identified as honest, and sign sums M_tk are computed for dimensions k ∈ {1, 2, 3, ..., K}.
  • C. Robust Aggregation: When |M_tk| exceeds threshold δ, consistent update signs indicate benign updates dominate that dimension, so the server learning rate is multiplied by 1.This allows the global model to learn effectively from the dominant benign updates.
  • C. Robust Aggregation: Adaptive learning rates reduce the impact of poisoned updates that evade spatial-temporal detection while maintaining a strong and robust global model.The aggregation mechanism complements detection by limiting the influence of updates that remain in the training process.

V. EXPERIMENTAL ANALYSIS · A. Experimental Setup · B. Effectiveness of STAR-FL

The experiments evaluate STAR-FL on three benchmark datasets under label-flipping attacks and varying malicious-client proportions. STAR-FL maintains strong task performance while restricting attack success rates below 5% across the reported datasets.

  • A. Experimental Setup: STAR-FL is evaluated on Fashion-MNIST, CIFAR-10, and CIFAR-100, with 60,000/50,000 training images and 10,000 test images per dataset.FMNIST and CIFAR-10 have 10 classes, while CIFAR-100 has 100 classes.
  • A. Experimental Setup: The attacks flip sandal to sneaker on FMNIST, dog to horse on CIFAR-10, and bed to beetle on CIFAR-100.Training runs for 30, 100, and 100 rounds, respectively, with local learning rate 0.1 and initial server learning rate 1.0.
  • B. Effectiveness of STAR-FL: STAR-FL is tested with 10%, 20%, and 30% malicious clients to assess robustness under varying attack fractions.The experiments use batch sizes of 256 for FMNIST and CIFAR-10 and 128 for CIFAR-100.
  • B. Effectiveness of STAR-FL: 91.49% main task accuracy, 97.50% base class accuracy, and 2.30% ASR are achieved on FMNIST with 10% malicious clients.These results indicate resilience to adversarial manipulation while preserving benign-task performance.
  • B. Effectiveness of STAR-FL: 89.96% is reported with an ASR of 3.60% in the FMNIST results, highlighting STAR-FL’s mitigation of adversarial influence.The passage reports the values without specifying an additional metric label for 89.96%.
  • B. Effectiveness of STAR-FL: 74.63% main task accuracy, 57.70% base class accuracy, and 3.20% ASR are obtained on CIFAR-10 with 10% malicious clients.When malicious clients reach 30%, base class accuracy drops to 52.6%, while main task accuracy remains preserved.
  • B. Effectiveness of STAR-FL: Across the reported datasets and attack fractions, STAR-FL consistently restricts ASR to below 5% while balancing robustness and accuracy.The paper attributes this advantage to isolating malicious updates in adversarial federated-learning environments.

C. Comparison to Existing Defenses · D. Ablation Studies

STAR-FL substantially lowers attack success rates compared with existing defenses while preserving competitive accuracy. Ablations show that spatial-temporal filtering and robust aggregation complement each other across datasets, heterogeneity levels, and attack types.

  • C. Comparison to Existing Defenses: FedAvg and RFA fail to defend effectively, reaching ASRs of 100%, 77.50%, and 52% and 100%, 78.80%, and 47% across FMNIST, CIFAR-10, and CIFAR-100.RFA uses geometric-median aggregation but remains vulnerable to carefully designed malicious updates.
  • C. Comparison to Existing Defenses: Median lowers ASR to 77.40%, 66%, and 34% on FMNIST, CIFAR-10, and CIFAR-100 but can degrade accuracy by discarding benign information.STAR-FL is reported as more robust than these existing defenses through spatial-temporal filtering and robust aggregation.
  • D. Ablation Studies: On FMNIST with 10% malicious clients, temporal filtering achieves the lowest ASR (1.90%) and highest base class accuracy (98.79%), while combined filtering reaches 92.19% main task accuracy.Spatial and temporal filtering individually achieve main task accuracies of 92.10% and 92.18%.
  • D. Ablation Studies: Robust aggregation alone reduces FMNIST ASR to 1.30%, whereas temporal+robust achieves 97.89% base class accuracy and 2.70% ASR.The strongest ASR reduction can come at the cost of lower base class accuracy.
  • D. Ablation Studies: On CIFAR-10, robust aggregation alone provides the highest main task accuracy (75.32%) with ASR of 4.70%, while the full framework offers greater benefits on this complex dataset.Temporal+robust reaches 58.99% base class accuracy but the highest ASR, 6.10%.
  • D. Ablation Studies: Greater non-IID heterogeneity lowers accuracy and raises ASR because malicious updates become more diverse, yet STAR-FL maintains robustness through spatial-temporal filtering and robust aggregation.The experiments use 30% malicious clients and vary Dirichlet parameter α.
  • D. Ablation Studies: Across MRA, DBA, and combined MRA+DBA attacks, STAR-FL keeps FMNIST ASR at 3.60%, 3.20%, and 3.63% and CIFAR-10 ASR at 3.30%, 5.10%, and 4.30%.Adaptive attacks add Gaussian noise, repeat attacks every round, and inject multiple triggers, yet STAR-FL remains robust.

E. Computation and Communication Overhead of STAR-FL

STAR-FL adds modest server-side computational overhead while requiring no additional communication beyond standard federated learning exchanges.

  • Computational overhead: ≈44 minutes and ≈1 GB: STAR-FL’s CIFAR-10 training time and GPU memory usage are close to RLR’s.The overhead comes from spatial-temporal analysis and learning-rate adjustments at the server.
  • Computational overhead: Trimmed Mean incurs the highest training time, whereas FoolsGold incurs the highest GPU usage.
  • Communication overhead: 2·s·c·r bytes: STAR-FL’s total communication cost matches standard exchanges of client updates and the aggregated global model.Here, s is the update size, c the participating clients per round, and r the number of rounds.
  • Communication overhead: Server-side spatial and temporal analyses require no additional information from clients, so STAR-FL introduces no additional communication overhead.

VI. CONCLUSION

STAR-FL is a unified defense framework against federated-learning backdoor attacks that combines spatial-temporal analysis, clustering-based detection, and adaptive robust aggregation. Extensive experiments show that it outperforms state-of-the-art defenses while maintaining high model utility.

  • Spatial-Temporal Analysis: STAR-FL jointly analyzes client-update similarity and historical consistency across training rounds to distinguish benign from malicious behaviors.This spatial-temporal analysis examines both current update relationships and consistency over time.
  • Malicious-Update Detection: A clustering-based detection mechanism identifies malicious updates according to their spatial characteristics.The mechanism is designed to remove potentially malicious updates from the training process.
  • Unified Defense: By combining spatial-temporal analysis with robust aggregation, STAR-FL forms a unified defense framework that improves robustness against backdoor attacks.The framework integrates detection and aggregation mechanisms into a single defense approach.
  • Robust Aggregation: STAR-FL adaptively adjusts learning rates for client updates to mitigate adversarial contributions that evade detection.This robust aggregation strategy reduces the influence of undetected malicious updates during aggregation.
  • Experimental Evaluation: Extensive experiments show that STAR-FL outperforms state-of-the-art defense methods while maintaining high model utility.The reported evaluation demonstrates both stronger defense performance and preserved utility.
Loading 2608.14861v1…