PaperlayerView exact revision on arXiv

Source-linked AI summary

Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning

Sachi Shome, William Eiers

arXiv:2609.40312v1cs.LG

TL;DR

Conventional poisoning defenses inspect update geometry, while lossy compression is generally treated as an error source. This paper uses compression footprints in CRAFT to assign trust to updates; across evaluated settings, CRAFT often leads or stays close to the best accuracy. Its analysis and scope center on an honest-majority regime with coherent honest footprints.

  • Problem

    Lossy compression is widely used in federated learning but usually treated as an error source, while conventional poisoning defenses inspect update geometry rather than compression-induced structure.

    Source: §I · p. 1

  • Method

    CRAFT uses server-controlled compression footprints to assign trust weights before aggregation, assuming an honest majority without requiring the malicious-client count.

    Source: §I · p. 2

  • Results

    7 of 18 dataset-attack settings achieve the highest final accuracy with CRAFT, which is within 1.7 percentage points of the best method in the others.

    Source: §I · p. 2

  • Takeaways & Limitations

    EBLC-induced information loss can serve as a security signal, and CRAFT is competitive with established Byzantine-robust aggregators without prior knowledge of the exact malicious-client count.

    Source: §IX · p. 13

    The analysis targets IID or mildly heterogeneous data with coherent honest footprints; stronger non-IID dispersion can weaken distance from the majority region as a reliability signal, and diagnostic recompression adds server-side overhead.

    Source: §VIII · p. 12

Abstract

from arXiv · show

Lossy compression is widely used in Federated Learning (FL) but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior induced by lossy compression can expose differences between honest and attack-generated updates. We introduce the concept of a \emph{compression footprint}: the low-dimensional collection of reconstruction, directional, sparsity, and payload statistics induced by a lossy compressor. We characterize sufficient conditions under which compression footprints separate honest and malicious updates, and operationalize our findings in the CRAFT (\emph{Compression-guided Robust Aggregation via Footprint Trust}) server-side robust aggregation method. Crucially, under a strict honest-majority assumption, CRAFT uses server-verifiable footprints, requires no client-side metadata nor knowledge of the number of malicious clients, and adds no communication beyond the compressed FL pipeline. Moreover, while CRAFT assumes a strict honest majority, it does not require the number of malicious clients to be known in advance. We observe that error-bounded lossy compressor (EBLC) footprints provide stronger separation than Top-K footprints and that footprint trust suppresses malicious influence. We evaluate CRAFT under IID client data with 36\% malicious participation across six standard model-poisoning attacks, three datasets, and six robust aggregation baselines, finding that CRAFT consistently achieves the best accuracy in 7 out of 18 settings and within 1.7 percentage points of the best in the others. Our results show that lossy compression can serve as both a communication mechanism and a security signal for robust aggregation in FL.

I. INTRODUCTION

The introduction reframes compression-induced loss as a security signal for distinguishing honest and malicious updates, then presents CRAFT and its evaluation. It situates this approach against model-poisoning attacks and defenses that rely on update geometry.

I. INTRODUCTION

  • Compression footprints summarize compressor-induced reconstruction, directional, sparsity, and payload behavior that can reveal attack-sensitive structure obscured by raw-update statistics.The introduction contrasts EBLC's multiple structural dimensions with Top-K's retained-versus-discarded squared-magnitude statistic.Source: §I · p. 1
  • CRAFT achieves the highest final accuracy in 7 of 18 dataset-attack settings and is within 1.7 percentage points of the best method in the others.The evaluation uses three datasets, six model-poisoning attacks, six robust aggregation baselines, and 9 of 25 malicious clients.Source: §I · p. 2

A. Poisoning Attacks in Federated Learning

  • Model-poisoning attacks can manipulate submitted updates directly, including by preserving plausible coordinate values, distances, or directions while degrading the global model.The cited examples include ALIE, IPM, Min-Max, and Min-Sum.Source: A. Poisoning Attacks in Federated… · p. 2

B. Existing Robust Aggregation Algorithms

  • Existing defenses use coordinate values, update distances, directions, filtering, trust scores, or historical consistency, assumptions that plausible poisoning updates can challenge.CRAFT instead evaluates response to a fixed, server-controlled lossy transformation and assigns trust from a majority-supported footprint core without knowing the malicious-client count.Source: §I · p. 2, B. Existing Robust Aggregation… · p. 3

C. Error-Bounded Lossy Compression

This section describes lossy compression in the FL pipeline, the threat-model boundaries, and compression footprints as a representation for robust aggregation. It presents footprinting as a use of compression-induced structure rather than treating compression only as an error to control.

C. Error-Bounded Lossy Compression

  • Compression reduces communication costs for repeated transmission of high-dimensional updates, while prior compression-aware robust-learning methods treat compression as a constraint or error to control.The paper instead proposes using the structure of information loss as a security signal against model-poisoning attacks.Source: C. Error-Bounded Lossy Compression · p. 3, D. Compression-aware robust aggregation · p. 3
  • EBLC controls reconstruction error using a user-specified bound, and the paper considers SZ2, ZFP, and TTHRESH as representative compressors.These compressors use prediction-based or transform-based mechanisms.Source: C. Error-Bounded Lossy Compression · p. 3

III. THREAT MODEL

  • The threat model allows Byzantine clients to replace updates arbitrarily but assumes an honest server and an honest majority; the evaluated adversary seeks untargeted performance degradation.Backdoor, privacy, data-compromise, server-compromise, and compression-library attacks are outside the stated scope.Source: §III · p. 3

IV. COMPRESSION-FOOTPRINT SEPARATION OF MALICIOUS UPDATES

  • The paper compares submitted updates with their decompressed outputs after a shared EBLC pass and summarizes the relationship as a low-dimensional compression footprint.The footprint is a five-dimensional vector, including reconstruction-fidelity, sparsity-change, and payload-size measures.Source: §IV · p. 3, A. From Raw-Update Statistics to… · p. 4

A. From Raw-Update Statistics to Compression Footprints

  • Compression footprinting applies a nonlinear feature map to emphasize compressor-sensitive structure without creating information absent from the submitted update.Its five coordinates measure reconstruction fidelity, sparsity change, and payload-size reduction; if an attack alters this structure, the footprint can help distinguish malicious from honest clients.Source: A. From Raw-Update Statistics to… · p. 4, Table I · p. 4

B. Mathematical Motivation for Footprint Separability

EBLC footprints can shift when attacks alter input-dependent compression behavior, but useful separation depends on the shift exceeding the spread of honest and malicious footprints. The paper formalizes this as a sufficient condition, not a guarantee for every attack.

B. Mathematical Motivation for Footprint Separability

  • EBLC residuals and payload sizes depend on how input values interact with the compressor, so attacks can shift the induced footprint distribution.Honest optimization under IID or mildly heterogeneous data is expected to produce a dominant benign pattern in value distributions, reconstruction errors, angular changes, near-zero behavior, and compressed sizes.Source: B. Mathematical Motivation for… · p. 4
  • An attack that is too weak may remain difficult to distinguish but is less likely to substantially affect the global model; more influential attacks are more likely to alter EBLC response.The paper describes this as an impact–separation tradeoff.Source: B. Mathematical Motivation for… · p. 4
  • Footprint regions are separated with probability at least 1 − γH − γA when the distance between their centers exceeds the combined concentration radii.This is a sufficient condition, and is most plausible when honest footprints are coherent and attacks systematically perturb compressor-sensitive structure.Source: B. Mathematical Motivation for… · p. 5

C. EBLC vs. Top-K: Structural Difference

Top-K footprints are largely governed by retained-versus-discarded coordinate energy, whereas EBLC footprints can reflect richer properties of update structure. This difference motivates comparing their capacity to distinguish updates.

C. EBLC vs. Top-K: Structural Difference

  • Under Top-K, Relative Distortion and Cosine Similarity are two views of the same retained-versus-discarded squared-magnitude ratio.Mean Squared Error follows the same mechanism.Source: C. EBLC vs. Top-K: Structural Difference · p. 5
  • Fixed-K sparsification retains exactly K entries, so Sparsity Change and Compression Ratio are largely determined by the retained count and its indices.Source: C. EBLC vs. Top-K: Structural Difference · p. 5
  • EBLC residuals and payload sizes also depend on prediction, quantization, and error-bound mechanisms, exposing variation in local structure, dynamic range, predictability, and coordinate-wise reconstruction error.This gives EBLC a richer footprint than Top-K's narrower concentration between retained and discarded coordinates.Source: C. EBLC vs. Top-K: Structural Difference · p. 5

V. METHODOLOGY

CRAFT turns compression from a communication mechanism into a security signal, using server-side compression footprints to assign trust before robust aggregation.

V. METHODOLOGY

  • CRAFT reuses the communication compression stage as a source of structural signal for robustness.It assigns continuous trust weights from compression footprints before aggregation.Source: §V · p. 5
  • The server recomputes footprint measurements through a uniform, server-controlled compression–decompression pass rather than trusting client-reported statistics.CRAFT does not require the number of attackers to be known in advance.Source: §V · p. 5
  • CRAFT decompresses received payloads, derives a diagnostic footprint path, assigns trust weights, and aggregates the decompressed updates with a weighted coordinate-wise median.The normalized updates and recompression outputs support footprint diagnosis; the recovered decompressed updates are used for final aggregation.Source: §V · p. 5

A. Robust Round-Wise Update Normalization

CRAFT robustly normalizes decompressed updates, measures their responses to a controlled recompression, and scales the resulting footprints before trust assignment.

A. Robust Round-Wise Update Normalization

  • Robust round-wise normalization puts decompressed updates in a common coordinate system so recompression reflects relative structure rather than raw coordinate scale.Without normalization, the second compression pass can be dominated by raw scale.Source: A. Robust Round-Wise Update… · pp. 5–6

B. Server-Side Compression-Footprint Extraction

  • The five footprint components are relative distortion, cosine similarity, mean squared error, sparsity change, and compression ratio.Together they measure reconstruction loss, directional preservation, near-zero structure changes, and encoding efficiency under the fixed EBLC operator.Source: B. Server-Side Compression-Footprint… · p. 6

C. Robust Round-Wise Footprint Scaling

  • CRAFT robustly median/MAD-scales each footprint component across clients so all five contribute on a comparable scale.Direct distances in raw footprint space could otherwise be dominated by a component's numerical range.Source: C. Robust Round-Wise Footprint Scaling · pp. 6–7

D. Majority-Supported Footprint Trust Assignment

CRAFT anchors trust to a majority-supported region in footprint space, under a strict honest-majority assumption, and softens influence as footprints depart from that region.

D. Majority-Supported Footprint Trust Assignment

  • Trust decreases with normalized distance from the core, with λ controlling decay scale and p controlling its curvature.CRAFT assigns continuous weights rather than making a binary decision.Source: D. Majority-Supported Footprint Trust… · p. 7
  • CRAFT assumes fewer than half of participating clients are Byzantine; its selected majority-supported core must be anchored by the dominant region containing honest participation.An attacker-only cluster cannot define the core unless Byzantine clients control more than half of participants.Source: D. Majority-Supported Footprint Trust… · p. 7
  • The selected core is the client-centered footprint ball with the smallest radius that contains a strict majority of clients.A malicious client can be selected as the center if it lies within the same dominant region as the honest majority.Source: D. Majority-Supported Footprint Trust… · p. 7
  • When honest footprints are dispersed or attack-induced shifts are small, distributions may overlap; CRAFT is best aligned with IID or mildly heterogeneous data.Overlapping footprints can leave malicious clients inside or near the majority-region boundary, where their influence is reduced rather than eliminated.Source: D. Majority-Supported Footprint Trust… · p. 7

E. Trust-Weighted Robust Aggregation

CRAFT uses footprint trust to reduce inconsistent updates' influence and applies a weighted coordinate-wise median to decompressed updates; the stated evaluation setup targets IID client partitions.

E. Trust-Weighted Robust Aggregation

  • Footprint weights reduce influence inconsistent with the dominant pattern, while a weighted coordinate-wise median limits remaining high-magnitude or strategically placed coordinate values.Final aggregation uses decompressed client updates; the normalized updates and recompression outputs are diagnostic only.Source: E. Trust-Weighted Robust Aggregation · pp. 7–8

VI. EXPERIMENT SETUP

  • Unless otherwise stated, experiments use IID partitions with 25 clients, including 9 malicious clients (36%), and evaluate compressor signals, end-to-end robustness, non-IID data, a defense-aware attack, and server-side cost.Main experiments use λ = 2 and p = 4 for trust weighting.Source: §VI · p. 8

A. Datasets

Across three datasets, six attacks, and six aggregation baselines, the footprint analyses find broader honest–malicious separation with EBLC/SZ2 than with Top-K, and the largest amplification from SZ2 among tested EBLCs.

A. Datasets

  • The evaluation covers CIFAR-10, Fashion-MNIST, and Purchase, using CNNs for the image datasets and an MLP for Purchase.CIFAR-10 and Fashion-MNIST are image-classification datasets; Purchase is a tabular classification dataset derived from shopping records.Source: A. Datasets · p. 8

B. Compressors

  • CRAFT uses SZ2 by default in relative error-bound mode with tolerance τ = 0.01, and also evaluates ZFP, TThresh, and Top-K.The stated rationale for τ = 0.01 is that FedSZ reports it provides the best accuracy–compression tradeoff for federated learning.Source: B. Compressors · p. 8

C. Poisoning attacks

  • Six evaluated attacks are ALIE, IPM, Min-Max, Min-Sum, Sine, and PoisonedFL; ALIE uses z = 1 and IPM uses ϵ = 10.Min-Max and Min-Sum are constructed to evade distance-based filters, while Sine and PoisonedFL introduce structured model-poisoning behavior.Source: C. Poisoning attacks · pp. 8–9

D. Defense Baselines

  • CRAFT is compared with Mean, Median, Trimmed Mean, Krum, Bulyan, and DnC under the same compressed-update pipeline.CRAFT uses the decompressed updates for aggregation and performs server-side footprint extraction to assign trust weights.Source: D. Defense Baselines · p. 9

A. Footprint Separation Analysis

  • The footprint-separation analysis examines compressor choice, EBLC-pass tolerance, and majority-core trust assignment.Its experiments test whether compression-induced information loss provides separation between honest and malicious clients.Source: A. Footprint Separation Analysis · p. 9

1) EBLC versus Top-K Footprint Structure:

  • SZ2 separates honest and malicious updates across five metrics, with the strongest gap in sparsity change (21.54); Top-K's positive gaps concentrate in relative distortion (3.32) and MSE (3.73).SZ2 also shifts cosine similarity (7.17), relative distortion (−9.64), MSE (−4.38), and compression ratio (−4.71), while Top-K compression ratio is essentially uninformative. The comparison used CIFAR-10 under ALIE with 9 malicious clients out of 25; SZ2 used τ = 0.01 and Top-K retained the largest 1% of coordinates.Source: Figure 3 · p. 9, 1) EBLC versus Top-K Footprint Structure · p. 9

2) Choice of EBLC:

  • SZ2 gives the largest footprint-amplification ratio for all tested attacks, including the Min-Max weakest case, where it still leads the tested compressors.SZ2 uses prediction and error-bounded quantization, making its output sensitive to update predictability, local variation, near-zero structure, and compressibility.Source: 2) Choice of EBLC · p. 9

3) Tolerance and Footprint Signal:

SZ2 tolerance affects both footprint separation and compression strength, while the dominant footprint metric varies by attack. CRAFT remains competitive across poisoning settings, with results also showing how its footprint signal responds to client heterogeneity.

3) Tolerance and Footprint Signal:

  • SZ2 gives the strongest EBLC-dependent footprint amplification in this setting.Source: Figure 4 · p. 10
  • SZ2 tolerance has a non-monotonic effect: weak compression and overly aggressive compression both weaken footprint separation, while the region around τ = 0.01 balances compression and signal quality.The accompanying figure concerns SZ2 tolerance, footprint separation, and compression strength.Source: 3) Tolerance and Footprint Signal · pp. 9–10, Figure 5 · p. 10

4) Footprint signal as a function of attack:

  • Across dataset–attack settings, MSE is the largest average contributor at 46.1%, followed by Sparsity Change at 24.1% and Compression Ratio at 13.5%, so no single statistic explains all attacks.On CIFAR-10, Sparsity Change dominates ALIE, Min-Max, and Min-Sum, while MSE dominates IPM, Sine, and PoisonedFL.Source: 4) Footprint signal as a function of… · p. 10

B. Accuracy Under Model-Poisoning Attacks

  • CRAFT achieves the best final accuracy in 7 of 18 dataset–attack settings and is within 1.7 percentage points of the best in the others.Table II reports final test accuracy across datasets, attacks, and aggregation rules.Source: B. Accuracy Under Model-Poisoning… · p. 11
  • CRAFT remains competitive with DnC across the evaluation without requiring the attacker-count input that DnC requires.DnC requires the server to specify the number of malicious clients or a reliable upper bound.Source: B. Accuracy Under Model-Poisoning… · p. 11
  • Under benign IID training, CRAFT closely tracks Mean across all three datasets, indicating no material cost to clean accuracy.Source: B. Accuracy Under Model-Poisoning… · p. 11

C. Effect of Client Data Heterogeneity

  • For Min-Max, as α decreases from 1.0 to 0.3, footprint separation falls from about 7.0 to 4.0 while attacker aggregation weight rises from 0.28% to 1.21%.CRAFT is designed for IID or mildly heterogeneous data, where honest clients form a compact majority in footprint space.Source: C. Effect of Client Data Heterogeneity · p. 11
  • Across tested α values, CRAFT keeps attacker weight below 1.3% for Min-Max and below 1.9% for Min-Sum; Min-Sum separation is non-monotonic, falling to 2.89 at α = 0.5 before rising to 5.12 at α = 0.3.Source: C. Effect of Client Data Heterogeneity · p. 11

D. Robustness to a Defense-Aware Attack

The paper tests CRAFT against a restricted defense-aware IPM attack, measures its server-side overhead, and discusses the footprint conditions and scope that shape its robustness. Its conclusion presents compression-induced information loss as a security signal while identifying more heterogeneous client populations as future work.

D. Robustness to a Defense-Aware Attack

  • On CIFAR-10, adaptive IPM closely tracks standard IPM while malicious aggregation weight stays mostly near zero; Fashion-MNIST shows a larger accuracy gap and occasional weight spikes, still below the raw attacker share.On Purchase, adaptive and standard IPM are nearly indistinguishable, with attacker weight close to zero throughout.Source: D. Robustness to a Defense-Aware Attack · p. 11, Figure 11 · p. 13

E. Server-Side Overhead

  • CRAFT takes about 1.35 seconds per CIFAR-10 round, 3.11 seconds on Fashion-MNIST, and 3.30 seconds on Purchase; footprint extraction dominates the added overhead.Majority-core search and trust assignment take less than 0.3 ms per round on all three datasets.Source: E. Server-Side Overhead · pp. 11–12

VIII. DISCUSSION AND LIMITATIONS

  • CRAFT’s effectiveness depends on honest clients forming a compact footprint majority; strong non-IID partitions can disperse honest footprints and weaken distance from that region as a reliability signal.The non-IID and defense-aware experiments are stress tests, not guarantees outside the intended IID or mildly heterogeneous regime.Source: §VIII · p. 12

IX. CONCLUSION

  • The conclusion frames EBLC-induced information loss as a security signal and identifies more heterogeneous populations, where honest clients may form multiple footprint regions, as future work.CRAFT converts footprint statistics into trust weights and is reported as competitive with established Byzantine-robust aggregators without prior knowledge of the malicious-client count.Source: §IX · p. 13

APPENDIX A FOOTPRINT TRUST AND MALICIOUS-CLIENT FRACTION

The appendices examine how CRAFT’s malicious influence changes with attacker share, compare EBLC/SZ and Top-K footprints, test a defense-aware attack on Purchase, and report benign accuracy and trust-parameter behavior. Suppression weakens when attackers enter the majority-supported footprint region.

APPENDIX A FOOTPRINT TRUST AND MALICIOUS-CLIENT FRACTION

  • 7.6 × 10−9% malicious influence remains with 8% malicious clients, and 0.029% remains at 32%; influence rises to 0.62% at 40% and 1.36% at 44%.At 40% and 44%, 5% of attackers enter the majority radius, where their distance to the core decreases.Source: Figure 12 · p. 15, Appendix A · p. 15

APPENDIX C DEFENSE-AWARE ATTACK ON PURCHASE

  • On Purchase, adaptive and standard IPM are nearly indistinguishable, and CRAFT assigns malicious clients almost no aggregation weight across the run.Source: Figure 14 · p. 15, Appendix C · p. 15

APPENDIX B EBLC AND TOP-K FOOTPRINT DISTRIBUTIONS.

  • EBLC/SZ footprints separate honest and malicious updates across several metrics, while Top-K’s signal is concentrated in fewer coordinates.Source: Appendix B · p. 15, Figure 13 · p. 16

APPENDIX D BENIGN ACCURACY WITHOUT POISONING

  • Across CIFAR-10, Fashion-MNIST, and Purchase, CRAFT closely follows Mean aggregation in the benign IID setting.The passage states that these results do not sacrifice clean accuracy for the reported robustness gains.Source: Appendix D · p. 16, Figure 15 · p. 17

APPENDIX E TRUST-PARAMETER ABLATION

  • On CIFAR-10 under IPM, tested trust-parameter settings yield last-50-round mean accuracy from 45.4% to 47.2%; the main experiments use λ = 2 and p = 4.Source: Appendix E · p. 16, Figure 16 · p. 17
Loading 2609.40312v1…