Source-linked AI summary
CARVY-FL: Client Anticlustering for Robust Voting in Provably Secure Federated Learning
Masaki Nakada, Honoka Anada, Tatsuya Kaneko, Hiroshi Nakamura, Shinya Takamaeda-Yamazaki, Hideki Takase
TL;DR
Class-disjoint non-IID data makes distribution-oblivious grouping produce unstable certified accuracy. CARVY-FL estimates client distribution types from one-epoch updates and anticlusters clients, improving vote margins and robustness while retaining voting-based certification.
Problem
Distribution-oblivious grouping makes certified accuracy highly sensitive to grouping and produces large variance in class-disjoint settings.
Method
CARVY-FL estimates client distribution types from one-epoch model updates and forms groups containing diverse distribution types for plurality-voting inference.
Results
CARVY-FL tolerates approximately twice as many malicious clients as FLCert at 80% certified accuracy, with m=5 versus m=2.
Takeaways & Limitations
CARVY-FL improves attack robustness by replacing random grouping with Anticlustering-based grouping under class-disjoint non-IID data.
Takeaways & Limitations
The approach addresses neither the grouping problem through learning algorithms alone nor guarantees the intuitive link between distribution diversity and correct predictions formally.
Abstract
from arXiv · showhide
Federated learning (FL) enables collaborative training without directly sharing raw data, but remains vulnerable to malicious clients. Voting-based FL improves robustness by partitioning clients into groups, training one model per group, and aggregating predictions by plurality voting. However, under class-disjoint non-IID data, distribution-oblivious grouping can yield highly variable certified accuracy (CA). We propose CARVY-FL, which estimates client distribution types from one-epoch model updates and uses anticlustering to increase within-group distributional diversity. Under a fixed grouping, CARVY-FL retains the voting-based CA guarantee while increasing vote margins. Experiments on MNIST and Fashion-MNIST show higher CA than FLCert. Under BadNets with model replacement, CARVY-FL improves the AUC of 100-ASR by 11.1% and 14.9%, respectively.
1 Introduction
Federated learning preserves privacy by exchanging model updates rather than raw data, but malicious clients can poison training. CARVY-FL addresses unstable certified accuracy under class-disjoint non-IID data by using distribution-aware anticlustering.
- Federated learning collaboratively trains models without sharing raw data, yet malicious clients can manipulate data or model updates.
- Certified Accuracy (CA) lower-bounds inference accuracy when up to m malicious clients induce arbitrary misclassifications.
- Voting-based FL trains one model per client group and aggregates predictions by plurality voting, but random grouping can produce unstable CA under non-IID data.
- CARVY-FL estimates client distribution types from one-epoch model updates and forms groups containing as many distribution types as possible.
- The paper evaluates CARVY-FL using CA and ASR, reporting improved robustness over FLCert and a clustering-based baseline.
2 Background and Related Works
Federated learning coordinates local training through a central server while keeping client data local. Its threat model includes injected or compromised clients, targeted backdoors, and model replacement attacks designed to preserve clean-data performance.
- Federated learning coordinates clients through a server while keeping training data on their devices.
- In each round, selected clients train locally from the distributed global model and return updated models or updates for server aggregation.
- Malicious clients may be fake injected clients or compromised legitimate clients that distort global-model behavior.
- Targeted attacks misclassify selected inputs, including backdoors that activate only when a trigger is present.
- Model replacement adjusts malicious updates to steer aggregation toward attacker-chosen behavior without significantly degrading standard performance.
2.3 Defenses against Malicious Clients
Defenses against malicious clients include robust aggregation methods, but many depend on detecting statistically separable malicious updates. Certified Accuracy instead provides a provable robustness measure against arbitrary malicious behavior.
- Krum, trimmed mean, and FLTrust defend against malicious updates using distance, coordinate trimming, or consistency-weighted aggregation.
- Many robust aggregation methods can be evaded when attackers adjust updates to avoid appearing as outliers.
- Certified Accuracy provides a provable lower bound on inference accuracy in the presence of malicious clients.
2.4 Certified Accuracy
Certified Accuracy measures the accuracy guaranteed under up to m malicious clients, while voting-based FL uses group models and plurality voting to preserve predictions when benign groups remain dominant. Disjoint hash-based grouping is computationally attractive but distribution-oblivious.
- CA(m) is the lower bound on accuracy guaranteed when at most m malicious clients behave arbitrarily.
- Voting-based FL trains one model per group and aggregates group predictions by plurality vote, allowing benign groups to outvote compromised groups.
- Disjoint grouping assigns each client to one group, reducing training cost relative to overlapping grouping.
- Random grouping assigns clients pseudorandomly through a hash function from client identifiers to group indices.
- At inference, each group model produces a class prediction, and the final output is selected by plurality vote with ties broken by the smallest class index.
- The vote margin measures how much the correct class’s votes exceed those of the strongest incorrect class.
- An attacker controlling up to m clients can reduce the vote margin by 2m in the worst case when compromised clients occupy distinct correctly voting groups.
- CA is evaluated from vote margins on benign-client test data and interpreted as a deployment-time accuracy lower bound under up to m malicious clients.
2.5 Data Heterogeneity and Countermeasures
Non-IID data creates client drift because local objectives differ, with especially severe effects when client class sets are disjoint. Existing countermeasures either group similar distributions or correct updates algorithmically.
- Class-disjoint non-IID data creates multiple client distribution types with mutually disjoint class sets.
- Client drift arises when each client’s local objective differs from the global objective, degrading convergence and accuracy.
- Clustering-based grouping trains clients with similar distributions together, making their gradient directions more consistent and potentially mitigating client drift.
- SCAFFOLD addresses non-IID degradation through server-side and client-side control variates that correct local-update bias.
2.6 Challenges When Data Diversity and Hard-to-Detect Attacks Coexist
Under class-disjoint data and hard-to-detect attacks, existing grouping and learning approaches do not reliably provide stable certified robustness. The paper therefore identifies a need for grouping that enlarges vote margins while retaining plurality-vote certification.
- Hash-based random grouping ignores client data distributions, making certified accuracy highly sensitive to grouping realization under class-disjoint data.
- Clustering-based grouping can stabilize per-group learning yet harm plurality-vote accuracy because groups may omit decision boundaries between distribution types.
- SCAFFOLD stabilizes within-group learning but does not determine which distribution types should be mixed within each group.
- Existing methods or naive combinations are insufficient to achieve both certified robustness against hard-to-detect attacks and stable certified accuracy under high data diversity.
3 CARVY-FL Design
CARVY-FL replaces random grouping with distribution-aware Anticlustering while retaining plurality-vote inference and certified accuracy. It infers distribution types from model updates, builds diverse groups, trains group models, and votes across their predictions.
- CARVY-FL Design: CARVY-FL retains voting-based plurality inference and the certified accuracy framework while replacing random grouping with distribution-aware grouping.
- Distribution-Type Inference: The server infers distribution-type clusters from one-epoch client update differences without collecting raw training data.
- Distribution-Type Inference: PCA compresses stacked update differences, and X-means estimates the number of distribution-type clusters.
- Anticlustering Grouping: The grouping hypothesis is to maximize vote margin by placing each class in many groups and minimizing groups lacking that class, although this is not a formal guarantee.
- Anticlustering Grouping: Anticlustering repeatedly selects one client from each non-empty inferred cluster, producing groups with diverse distribution types and automatically determining group count as maxℓ|hℓ|.
- Design Limitation: Using update information for grouping can let an adversary manipulate the inferred cluster assignment, a disadvantage shared with clustering-based grouping.
- Per-Group Training and Inference: Each group trains independently with SCAFFOLD, while group-model predictions are combined by plurality voting with smallest-index tie breaking.
4 Evaluation
The evaluation tests CARVY-FL in class-disjoint environments using certified accuracy and attack success rate, while also examining how group count affects certified accuracy.
- The evaluation measures certified accuracy and attack success rate in class-disjoint environments with highly skewed, non-overlapping client class sets.
- The study also examines the impact of the number of groups on certified accuracy in an appendix.
4.1 Evaluation Setup
The evaluation uses synchronous grouped federated learning on MNIST and Fashion-MNIST, measuring certified accuracy and attack success rate under class-disjoint non-IID data and backdoor attacks. CARVY-FL is compared with randomized, oracle-clustered, and single-global-model baselines under specified grouping and attacker-placement conditions.
- Data and federated-learning setup: The simulation uses one server and 100 clients, with 20 clients in each of five class-disjoint distribution types.Each client has data from only two classes, with equal class representation.
- Data and federated-learning setup: Training is synchronous for 200 rounds on MNIST and 300 rounds on FMNIST, with one local epoch per client per round.SCAFFOLD is used by all methods, with cosine-annealed local learning rates, equal-weight group aggregation, mini-batch size 16, and early stopping.
- Attack and evaluation: The attack combines BadNets with model replacement, targeting class 0 using a 3 × 3 bottom-right trigger and poisoned non-target images.Model replacement is designed so the attacker’s update dominates equal-weight aggregation within the group.
- Methods and baselines: CARVY-FL estimates distribution types by applying PCA to one-epoch model updates before X-means clustering, with a maximum of 100 clusters.The implementation uses 20-dimensional representations, Euclidean distance, and X-means tolerance 0.001.
- Methods and baselines: The comparison includes FLCert with hash-based random grouping, FLCert+clustering with oracle distribution information, and a single-global-model baseline.CARVY-FL determines its group count internally, while the baselines use 20 groups; FLCert groups average about five clients and oracle groups contain exactly five.
- Attack and evaluation: Certified accuracy measures a lower bound under up to m arbitrary misclassifying clients, while ASR measures successful triggered predictions toward the target label.ASR disperses malicious clients across as many groups as possible, whereas CA is a worst-case lower-bound evaluation over attacker placement.
4.2 Attack Resilience Evaluation
Across MNIST and FMNIST, CARVY-FL generally maintains or improves certified accuracy and attack resilience over FLCert, though FMNIST variability increases in some settings. Its AUC results also show stronger resistance to actual attacks, while performance can worsen when malicious clients reach about half the groups.
- Certified accuracy: Nearly 0% CA with one malicious client makes the single-global-model baseline non-resilient on both datasets across all training sizes.This motivates group-based certified defenses.
- Certified accuracy: 90.2% CA(0) for CARVY-FL on MNIST with 50 samples compares with 89.7% for FLCert and 26.7% for FLCert+clustering.The same trend holds for 100, 200, and 500 training samples, with 20 CARVY-FL groups.
- Certified accuracy: 15.0 and 13.3 are CARVY-FL’s maximum FMNIST standard deviations for 50 and 500 samples, exceeding FLCert’s 8.54 and 8.95.Thus, CARVY-FL’s certified-accuracy variability increases in these FMNIST settings.
- Attack success rate: At m=6, CARVY-FL reduces mean ASR by approximately 15% on MNIST and 10% on FMNIST; at m=8, reductions reach approximately 50% and 40%.At m=10 and 11, CARVY-FL’s ASR increases in some cases because malicious clients can dominate half the groups.
- Attack success rate: 877.00 and 844.58 are CARVY-FL’s AUC values for 100−ASR on MNIST and FMNIST, exceeding FLCert’s 789.36 and 734.84.The improvement rates are 11.1% on MNIST and 14.9% on FMNIST.
5 Conclusion
CARVY-FL replaces random grouping with anticlustering-based grouping that estimates client distribution types from single-epoch model updates. Experiments report stronger certified and attack robustness, while identifying broader evaluation settings as future work.
- CARVY-FL estimates distribution types from model updates, constructs maximally diverse groups, trains per-group models, and aggregates predictions by plurality voting.
- The single-global-model baseline reaches nearly 0% certified accuracy with one malicious client, while CARVY-FL tolerates approximately twice as many malicious clients as FLCert.
- Evaluation remains scoped to MNIST and FMNIST, with future work extending to more complex datasets, models, and non-IID settings beyond class-disjoint data.
A CA Under Varying Numbers of Groups
The study evaluates how group count affects certified accuracy for CARVY-FL, FLCert, and FLCert+clustering. Under the reported settings, CARVY-FL’s automatically selected 20 groups provides the strongest attack resilience, while alternatives show distinct trade-offs.
- Evaluation settings: The comparison varies group counts from 1 to 100 using 100 clients, with evenly balanced allocation for CARVY-FL and FLCert+clustering.
- Evaluation settings: The evaluation uses MNIST and FMNIST with 500 training samples per client, averaging 3 trials for CARVY-FL and FLCert+clustering and 6 for FLCert.
- CARVY-FL: 20 groups yields CARVY-FL’s highest attack resilience: it maximizes the smallest malicious-client count at which certified accuracy reaches zero.
- CARVY-FL: CARVY-FL’s group-count logic balances inference cost, proportional to the number of groups, against attack resilience represented by certified accuracy.
- Baselines: For FLCert, 20 groups consistently achieves near-best certified accuracy and maximizes the certified-accuracy AUC.
- Baselines: For FLCert+clustering, AUC is maximized at one group, but certified accuracy becomes nearly zero with one malicious client, making that configuration impractical for comparison.