PaperlayerView exact revision on arXiv

Source-linked AI summary

Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities

Pravija Raj P V, Ashish Gupta, Andrea Augello, Sajal K. Das

arXiv:2609.28722v1cs.LG

TL;DR

FL faces robustness challenges involving performance impairment, information theft, and vulnerable aggregation. This paper synthesizes threats, aggregation strategies, defenses, and evaluation practices. The review finds that studies often focus on familiar attacks and evaluate robustness under limited data-partition settings.

  • Problem

    FL robustness spans performance-impairment and information-stealing threats, while studies commonly use a single non-IID setting and simple label-skew variants.

    Source: §1 · p. 2, §5.1 · p. 24

  • Method

    The paper synthesizes FL robustness through a threat taxonomy, an outcome-centric versus security-centric aggregation taxonomy, a layered defense taxonomy, and a review of evaluation trends.

    Source: §1.2 · p. 3

  • Results

    The review finds that FL attack research is dominated by familiar backdoor, model-poisoning, and data-poisoning threats, while many evaluations use simple label-skew settings.

    Source: §5.1 · p. 24, §5.3 · p. 25

  • Takeaways & Limitations

    The review identifies cross-domain robustness and quantum-enhanced or quantum-resilient FL as areas for future research.

    Source: §6.3 · p. 28

    Most studies consider a single non-IID setting and relatively simple label skew, overlooking stronger volume, label, and feature skews and dynamic trends.

    Source: §5.1 · p. 24

Abstract

from arXiv · show

While Federated Learning (FL) has been widely adopted for protecting user privacy in machine learning, it remains vulnerable to various robustness challenges, including performance-impairment risks, information-stealing threats, and aggregation vulnerabilities. This work offers a holistic synthesis of FL robustness along three tightly coupled angles: (i) a threat-centric view of robustness that categorizes the multifaceted attack surfaces, (ii) a structured taxonomy of robust aggregation strategies distinguishing outcome-centric approaches from security-centric strategies, and (iii) a layered taxonomy of defensive strategies. We rigorously examine current evaluation practices for FL robustness and identify major applications and open research challenges to guide future research.

1 Introduction

FL robustness must address adversarial and heterogeneous conditions across threats, aggregation, and defenses. The survey unifies these perspectives and reviews how the literature evaluates them.

1 Introduction

  • Robust FL must address threats, aggregation vulnerabilities, and defensive mechanisms amid adversarial environments, heterogeneous devices, and inconsistent evaluation practices.Different datasets, partitioning choices, attack settings, mitigations, and metrics complicate comparison and assessment of real-world relevance.Source: §1 · pp. 1–2

1.1 Motivation

  • Prior surveys often examine one dominant robustness angle or adversary type, leaving a fragmented view across the FL pipeline.The paper identifies a need to bring these strands together under a unified perspective.Source: §1.1 · pp. 2–3

1.2 Survey Scope

  • The survey presents a multi-layer threat taxonomy, separates robust aggregation into outcome-centric and security-centric strategies, and classifies defenses by stage of action.It also reviews evaluation trends, applications, robustness gaps, and open research challenges.Source: §1.2 · p. 3

1.3 Research Protocol

  • The research protocol searches selected digital libraries for 2017–2026 papers, screens them against stated criteria, and categorizes the selected studies.The review then organizes its synthesis around threats, robust aggregation, defenses, evaluation trends, and future directions.Source: §1.3 · pp. 3–4

2 Threats to Robustness in FL

The paper defines FL robustness as resistance to threats or automatic recovery. It groups threats by whether they impair performance or steal information.

2 Threats to Robustness in FL

  • FL robustness is the system’s ability to remain unaffected by threats and adversarial conditions or recover automatically.Source: §2 · p. 4
  • Performance-impairment threats reduce model performance through malicious actors or structural conditions.Source: §2 · p. 4
  • Information-stealing threats aim to extract sensitive information, creating privacy and security risks.Source: §2 · p. 4

2.1 FL Training: The Essentials

FL training uses clients’ private datasets to train local models, while an aggregator server supports collaborative training and inference without accessing client data. The section also defines local objectives using per-sample losses and specifies normalized, nonnegative participant weights.

2.1 FL Training: The Essentials

  • Clients use private local datasets to train local models in communication rounds, with training and inference as the two main phases.The section describes collaborative training through local updates without disclosing client data.Source: §2.1 · p. 4
  • Participant weight coefficients are nonnegative and sum to one.Source: §2.1 · p. 4
  • Each participant’s local objective is defined using per-sample losses, with n_p denoting the number of local data samples.The corresponding loss function is f_lq(φ; x_q, y_q).Source: §2.1 · p. 4

2.2 Security Challenges in FL

FL adversaries may compromise participants or servers, act externally, and target client-side models or data or server-side aggregated parameters and gradients. Their knowledge varies, and attacks include performance degradation, information extraction, and sample reconstruction.

2.2 Security Challenges in FL

  • Adversaries may compromise a participant or server, or act externally, targeting client-side models and data or server-side parameters and gradients.Their capabilities vary with their role and knowledge of data, features, methods, parameters, and cost functions.Source: §2.2 · p. 5
  • Adversarial knowledge ranges from null to partial or complete, with an iterative progression from black-box to white-box scenarios.Fig. 3 presents attack strength based on adversarial knowledge levels.Source: §2.2 · p. 5, Figure 3 · p. 6
  • Attacks are categorized as targeted, untargeted, inference, or reconstruction according to their objectives and targets.Targeted and untargeted attacks impair task-specific or overall performance; inference and reconstruction attacks seek sensitive information or training samples.Source: §2.2 · p. 5, Table 2 · p. 6

2.3 Performance-Impairment Threats

Performance-impairment threats target model performance through poisoning and other disruptions across training, communication, and inference. Poisoning can manipulate training data or local models, while backdoors, free-riding, channel attacks, DoS, and evasion pose additional risks.

2.3.1 Poisoning Attacks.

  • Poisoning targets training data or local models: data attacks alter training examples, while model attacks manipulate parameters or gradients to disrupt convergence or misclassify samples.Data attacks include label changes, clean-label and GAN-generated samples, out-of-distribution data, and collusion; model updates may be crafted to resemble benign ones.Source: §2.3 · p. 6, §2.3.1 · p. 7

2.3.2 Backdoor Attacks.

  • Backdoors selectively impair performance when a trigger is present, and coordinated or evolving triggers can be harder to detect than a shared single pattern.Backdoors may persist after fine-tuning on clean data; in feature-partitioned FL, gradient aggregation can help alleviate attacks that inject triggers without changing labels.Source: §2.3.1 · p. 8, §2.3.2 · p. 8

2.3.3 Free-riders.

  • Free-riders conserve resources by contributing weak, noisy, or arbitrary updates while relying on others’ training work, compromising the model through inferior data quality.Random parameter sampling can make their updates harder to detect.Source: §2.3.3 · p. 9

2.3.4 Channel Attack.

  • Channel attacks can intercept or alter client-server communications, disrupt training through delays or bandwidth cuts, or use FL updates to exchange concealed messages.FedComm encodes disguised messages into weights while adjusting updates to remain stealthy.Source: §2.3.4 · p. 9

2.3.5 Denial-of-Service (DoS) Attack.

  • DoS and DDoS attacks disrupt communication and model convergence, affecting output accuracy and making it difficult for clients to connect to servers.DDoS attacks may target FL servers, resource allocation, or network traffic and can go undetected.Source: §2.3.5 · pp. 10–11

2.3.6 Evasion Attack.

  • Evasion attacks perturb inputs at inference or deployment to cause misclassification, using white-box access or black-box system interactions and queries.Internal evasion attacks can be executed by adversarial clients at test time to deceive other clients.Source: §2.3.6 · p. 11

2.4 Information Stealing Threats

FL’s exchanged gradients and model outputs can expose private information, including membership and participant attributes, or enable sample reconstruction. Information-stealing threats also include model extraction and eavesdropping on client-server interactions.

2.4.1 Inference Attacks.

  • Gradient exchanges can expose class representations and data membership, and in some cases allow attackers to recover training samples or labels.Inference attacks include membership, source, attribute, and label inference; label inference can bypass secure aggregation, and client-specific fishing models have been reported to infer labels with 100% accuracy.Source: §2.4 · p. 12, §2.4.1 · p. 12

2.4.2 Model Extraction Attacks.

  • Model extraction uses queries to recreate a functionally equivalent model, while direct analysis can reconstruct models and support deceptive ownership claims.The recreated model’s outputs are iteratively adjusted to match the original; an internal adversary may claim the aggregated model as its intellectual property.Source: §2.4.2 · pp. 12–13

2.4.3 Reconstruction and Inversion Attacks.

  • Reconstruction and inversion attacks infer training data from model parameters, outputs, or intercepted gradients, with server-side attacks potentially exposing data from all participants.Gradient inversion uses an auxiliary model to iteratively create samples resembling a client’s data; increased privacy controls lower inference accuracy, but moderate differential privacy may still leave stored data inferable.Source: §2.4.3 · p. 13

2.4.4 Eavesdropping.

  • Eavesdropping exploits inadequate client security to monitor client-server interactions and obtain confidential details, often through passive methods or re-encryption tricks.Although generally untargeted, an intruder can target specific information.Source: §2.4.4 · p. 13

3 Robust Aggregation Strategies

The section reviews aggregation robustness and proposes a taxonomy separating methods that improve global-model outcomes from those that secure the aggregation process. It also highlights unresolved challenges, including heterogeneity, fairness, communication, and the robustness–efficiency trade-off.

3.1 Aggregation Robustness Challenges

  • Aggregation can combine local models through trainable parameters such as weights or gradients, or through model representations such as logits and compressed sketches.The section notes that parameter-based aggregation is more common and identifies underexplored concerns in training quality, heterogeneity, efficacy, and scalability.Source: §3.1 · p. 14

3.2 Proposed Taxonomy of Aggregation Strategies

  • The taxonomy divides robust aggregation into outcome-centric methods that improve global-model learning under falsified updates and security-centric methods that protect aggregation integrity, verifiability, and confidentiality.It is presented as a framework for analyzing and classifying aggregation solutions.Source: §3.2 · p. 15

3.2.1 Outcome-centric Aggregation.

  • Outcome-centric methods select and evaluate clients, redesign model fusion, cluster clients, or adjust statistical aggregation and training objectives to reduce attackers’ impact.Examples include similarity-based client weighting, stale-model handling, clustering, robust estimators, regularization, and adaptive clipping.Source: §3.2.1 · pp. 15–16

3.2.2 Security-centric Aggregation.

  • Security-centric methods use MPC, homomorphic encryption, quantum secure aggregation, blockchain, or TEEs to protect updates and aggregation outcomes.MPC can compute a global model without revealing local models; HE key management affects robustness and privacy, while TEEs can decrypt and aggregate updates inside an enclave.Source: §3.2.2 · pp. 16–18
  • Figure 9 depicts the blockchain-based flow: encrypted updates and aggregated results are recorded, while miner servers perform model aggregation.The section also describes blockchain reputation systems that report model quality and reward contributions based on performance and reputation.Source: §3.2.2 · p. 17, Figure 9 · p. 18

3.3 Key Insights on Robust Aggregators

  • Non-IID data, fairness, and communication constraints remain key challenges; adaptive methods can improve performance and reliability, but robustness must be balanced against efficiency.The section also identifies hardware constraints and quantum noise as stability and scalability challenges for QSA.Source: §3.3 · pp. 18–19

4 Robustness via Defensive Strategies

Federated learning faces diverse threats, and conventional centralized defenses are not directly viable when servers have limited ability to inspect local updates. The section’s figure presents a taxonomy of defensive strategies and their relative publication proportions.

4 Robustness via Defensive Strategies

  • Because FL servers have confined ability to monitor local updates or parameters, centralized anomaly detection and robust-loss defenses are not directly viable in this setting.The section also stresses protecting training data and local updates against distinct challenges.Source: §4 · p. 19
  • Local updates are vulnerable to diverse challenges, while protecting training data supports the development of robust models.These concerns motivate early-phase security measures.Source: §4 · p. 19
  • Figure 10 presents a taxonomy of defensive strategies alongside the relative proportion of reviewed publications.The caption supplies no individual proportions or category names.Source: Figure 10 · p. 19

4.1 Proposed Taxonomy of Defensive Strategies

The proposed defensive taxonomy takes a comprehensive view because individual mechanisms can address multiple attacks and vulnerabilities may arise at both local and aggregation levels. It organizes defenses across data manipulation, model updates, global integrity, malicious servers, aggregation, and cryptographic strategies.

4.1 Proposed Taxonomy of Defensive Strategies

  • The taxonomy treats defenses comprehensively because mechanisms can address multiple attacks, while risks to confidentiality, integrity, and availability arise at both local and global levels.Aggregation can expose personal information or tilt the global model without rigorous safeguards.Source: §4.1 · p. 19

4.1.1 Defenses against Training Data Manipulation.

  • For training-data manipulation, preprocessing, differential privacy, and distillation are described as defenses against poisoning, inference, reconstruction, and backdoor risks.An enhanced VAE is reported to reduce poisoning and inference attack success while maintaining model accuracy.Source: §4.1.1 · p. 20

4.1.2 Defenses against Malicious Model Updates.

  • For malicious updates, defenses include robust aggregation, similarity-based detection and trust weighting, perturbation of compromised parameter regions, autoencoders, sparsification, watermarking, and blockchain verification.Some approaches require extra datasets or TEEs, tolerate only limited adversaries, or lack robustness across poisoning types; a truth-discovering method is reported to work without extra datasets even when adversaries exceed half of users.Source: §4.1.2 · pp. 20–21

4.1.5 Adversarial-resistant Aggregation.

  • Robust aggregation is described as a common defense against poisoning that need not explicitly identify hostile clients.The section directs readers to its aggregation-strategy discussion for these methods.Source: §4.1.2 · p. 20, §4.1.5 · p. 22

4.1.3 Preserving Global Model Integrity.

  • Global-model integrity defenses include decentralized aggregation and client validation, but validation-set quality constrains the effectiveness of centralized trust assessment.One alternative selects validation clients to assess a modified global model and discard updates flagged by most of them.Source: §4.1.3 · p. 21

4.1.4 Defenses against Malicious Servers.

  • Malicious servers can threaten privacy, accuracy, and fairness through update inspection or model manipulation; described defenses include blockchain, image augmentation, and enhanced ciphertext.The image-augmentation defense is reported to preserve model performance while resisting such attacks.Source: §4.1.4 · pp. 21–22

4.1.6 Advanced Cryptographic Strategies.

  • Cryptographic defenses include zero-knowledge proofs for public verification without revealing model or data information, post-quantum cryptography, and homomorphic encryption for identifying malicious updates.Homomorphic schemes can incur memory, latency, and nonlinear-model approximation costs; the two-trapdoor method is reported to withstand up to 50% adversarial users in heterogeneous scenarios.Source: §4.1.6 · p. 22

4.2 Key Insights on Defensive Strategies

The section concludes that robust FL requires layered defenses rather than reliance on one mechanism. It summarizes protections across data, updates, global-model verification, server behavior, and cryptographic safeguards, alongside their costs.

4.2 Key Insights on Defensive Strategies

  • Robust FL requires layered defenses covering data, updates, adversarial aggregation, global-model verification, server behavior, and cryptographic safeguards.The section presents Tables 10 and 11 as summaries of defensive mechanisms and their key insights.Source: §4.2 · p. 22
  • AEs, DP, KD, and client-side preprocessing are described as working together against inference risk and poisoning while maintaining accuracy amid training-data manipulation.The section also notes costs such as additional computation, validation data, or protocol complexity.Source: §4.2 · pp. 22–23
  • For practical deployments, the section recommends carefully selected hybrid defenses rather than relying on one mechanism, noting that cryptographic techniques can add overhead.It also identifies blockchain auditing and enhanced ciphertext as defenses against malicious servers, and cryptographic techniques as sources of confidentiality and verifiability.Source: §4.2 · p. 23

5 Experimental Evaluation Trends

Robust-FL evaluations use varied client data partitions and common datasets, while current research emphasizes adversarial threats more than aggregation reliability and heterogeneity.

5 Experimental Evaluation Trends

  • The evaluation-trends analysis examines data partitioning and commonly used datasets to identify strengths, weaknesses, and areas needing more robust evaluation.IID partitions distribute data randomly and evenly, whereas non-IID partitions model client heterogeneity.Source: §5 · p. 23, §5.1 · p. 23

5.1 Data Partitioning Approaches

  • Non-IID evaluations commonly use class-based or Dirichlet partitions, but often test only one simple label-skew setting on vision benchmarks.The same defense can behave differently across partition choices; dynamic settings, combined skews, and systematic variation of skew remain areas for further attention.Source: §5.1 · pp. 23–24

5.2 Common Datasets in FL Research

  • CIFAR-10 and MNIST remain foundational FL datasets, while use of Fashion-MNIST for image classification has recently increased.Table 12 summarizes dataset type, description, suitability for data distribution, and real-world application scenarios.Source: §5.2 · p. 24, Table 12 · p. 24

5.3 Research Trends in Robust FL

  • Research on robust FL focuses mainly on attack-surface analysis and threat-specific defenses, with less attention to aggregation reliability and heterogeneity.Backdoor, model-poisoning, and data-poisoning threats receive particular attention.Source: §5.3 · p. 25

6 Discussion and Future Directions

The discussion surveys emerging robustness trends and application settings, then outlines how robust FL is used across sectors. Across these settings, systems must address threats alongside heterogeneous data, clients, and deployment conditions.

6.1 Emerging Robustness Trends in FL

  • Communication scheduling, pruning, and asynchronous updates target communication costs, while cryptography, clustered architectures, lightweight learners, and personalization address other FL needs.The discussion also identifies Quantum ML and quantum-influenced optimization as emerging avenues.Source: §6.1 · p. 25

6.2 Major Application Scenarios for Robust FL

  • Robustness remains a critical but underexplored challenge across real-world FL application scenarios.The discussion introduces healthcare, recommendation, finance, smart cities, and IoT and edge computing.Source: §6.2 · p. 25

6.2.1 Intelligent Healthcare.

  • Healthcare FL must address noisy labels, diverse patient populations, and poisoned local updates while supporting dependable decision-making without sharing patient data externally.Decentralized aggregation and coordination are used to improve robustness against data manipulation and single points of failure.Source: §6.2.1 · p. 25

6.2.2 Recommender Systems.

  • Robust federated recommendation uses anomaly-resilient aggregation, client trust scoring, or privacy protections against preference extraction and recommendation manipulation.The discussion describes collaborative-filtering, deep-learning, and meta-learning approaches; overlooked robustness could reduce user confidence and cause monetary losses.Source: §6.2.2 · p. 26

6.2.3 Finance and Banking.

  • Financial FL applications remain largely in their infancy, with robustness supported by threat-resilient optimization, secure aggregation, and cryptography-oriented defenses.Examples include credit-risk assessment and internet banking that combines DP, SMC, and collaborative modeling.Source: §6.2.3 · pp. 26–27

6.2.4 Smart Cities.

  • Smart-city FL addresses malicious clients, corrupted sensors, and unreliable communication in applications such as traffic prediction, pollution monitoring, and infrastructure management.The cited traffic framework uses personalized FL based on meta-learning to mitigate heterogeneous and noisy data sources.Source: §6.2.4 · p. 27

6.2.5 IoT and Edge Computing.

  • Edge FL must handle malicious updates, device heterogeneity, and unstable connectivity; examples use anomalous-update inspection, fair aggregation, adaptive learning rates, and selective updates.The cited asynchronous method down-weights distrustful contributions and selects updates based on device capacity and data quality.Source: §6.2.5 · p. 27

6.3 Challenges and Future Research Directions

The paper proposes future directions for robust FL spanning attribution, adaptive defenses, recovery, verifiability, domain-specific robustness, and quantum resilience.

6.3 Challenges and Future Research Directions

  • Causal inference could help distinguish malicious poisoning from benign statistical heterogeneity and support more precise detection and source attribution.The discussion also calls for defenses that adapt to temporal, environmental, and contextual changes rather than relying on fixed parameters.Source: §6.3 · p. 27
  • Future work should explore self-healing FL that separates infected sub-modules and activates recovery, alongside neuro-symbolic models with verifiable reasoning and logical constraints.These directions are presented as relevant to high-stakes settings such as healthcare and autonomous navigation.Source: §6.3 · p. 27
  • The paper calls for defenses tailored to non-vision modalities and for quantum FL research on compression, personalization, multimodal data, and post-quantum security.It notes that image classification dominates much existing robustness literature and that standard encryption solutions may become obsolete as quantum computing advances.Source: §6.3 · p. 28

Related papers

Loading 2609.28722v1…