Source-linked AI summary
WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning
Alessandro Licciardi
TL;DR
Federated learning remains vulnerable to poisoned client data, while existing defenses often operate during training or depend on known attack signatures. WaSA screens clients offline with a clean-data-trained autoencoder and reports strong detection and classification outcomes across corruption settings.
Problem
Many defenses are reactive or require supervised attack labels, limiting offline detection when attack signatures are unknown.
Source: §I · p. 1Method
WaSA sends a single spectral summary per client and uses a clean-data-trained denoising autoencoder to score deviations from the benign WST manifold, with Boltzmann sampling for participation.
Source: §I · p. 1, C. Offline Manifold Learning via… · p. 2, D. Online Client Evaluation & Filtering · p. 3Results
WaSA outperforms both supervised WAFFLE variants on every detection metric and achieves best classification results in most settings, including 24.10% on CIFAR-100 at 90% corruption.
Source: B. Results and Discussion · p. 6Takeaways & Limitations
WaSA generalizes to unseen and composite corruptions without retraining, while soft sampling can sustain convergence when the clean client pool is critically small.
Source: §IV · p. 6
Abstract
from arXiv · showhide
Federated Learning (FL) enables collaborative model training without exposing raw data, yet remains vulnerable to malicious clients injecting poisoned datasets. Existing defenses are typically reactive (operating during training) or supervised (requiring prior knowledge of attack types) - assumptions that rarely hold in open-ended IoT deployments. We propose WaSA, a fully unsupervised, offline framework for malicious client detection. Before training, each client transmits a single, privacy-preserving spectral summary of its data to the server. A denoising autoencoder, trained solely on clean auxiliary data, scores clients based on their deviation from the learned benign manifold, identifying corruptions regardless of the attack type. WaSA requires no attack labels, generalizes to unseen anomalies, and introduces a Boltzmann sampling strategy for client selection that smoothly interpolates between hard exclusion and standard aggregation. Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios (up to 90 % malicious clients) demonstrate consistent improvements over supervised baselines and robust aggregation methods, with negligible communication overhead. Code is available at https://github.com/alelicciardi99/wavelet_autoencoders_malicious.
I. INTRODUCTION
WaSA addresses malicious-client detection before FL training without requiring known attack labels. It combines clean-data-trained anomaly detection with compact spectral summaries and probabilistic client selection.
I. INTRODUCTION
- Most defenses detect anomalies during training, while supervised offline detection such as WAFFLE requires attack labels.The paper motivates offline screening as a way to separate defense from training and avoid dependence on known attack signatures.Source: §I · p. 1
- Robust aggregation methods can fail theoretically when attackers exceed 50%.WaSA is presented as an offline, unsupervised alternative to threat-specific detection.Source: §I · p. 1
- WaSA detects anomalous clients offline using a denoising autoencoder trained on clean WST embeddings and normalized reconstruction error, without prior attack knowledge.Clients with embeddings deviating from the learned benign manifold receive high scores and are flagged at round zero.Source: §I · p. 1
- A GPU-accelerated, SVD-based spectral prototype compresses each client’s data distribution into one privacy-preserving image.The prototype is transmitted as a single summary.Source: §I · pp. 1–2
- WaSA adds a Boltzmann client-selection strategy that interpolates between hard exclusion and uniform sampling through temperature T.This complements deterministic filtering with probabilistic participation.Source: §I · pp. 1–2
II. METHODOLOGY
The methodology frames FL as server-coordinated optimization over clients’ local empirical risks. WaSA then screens clients offline and uses their reconstruction-error scores to govern participation.
II. METHODOLOGY
- In standard FL, the server minimizes a weighted global objective formed from each client’s local empirical risk.The client weight is its relative data size, p_k = n_k/n.Source: §II · p. 2
- Under FedAvg, selected clients optimize locally and the server aggregates their updated weights each communication round.The global model is updated from the participating clients’ contributions.Source: §II · p. 2
- WaSA first learns a benign manifold offline, then computes client reconstruction errors before training and uses the scores for threshold-based or Boltzmann participation.This separates client screening from federated optimization.Source: §II · p. 2
A. Client-Side Optimal Rank-Reduced Representation
Each client represents its local data with a compact spectral prototype derived from a rank-reduced approximation. The construction uses principal directions weighted by their captured variance.
A. Client-Side Optimal Rank-Reduced Representation
- The spectral prototype is a variance-weighted superposition of the empirical principal directions.Each direction is weighted by the fraction of total variance captured by its principal component.Source: A. Client-Side Optimal Rank-Reduced… · p. 2
- Each client flattens its local samples into a matrix and centers the matrix by subtracting the sample mean.The data matrix has n_k rows and D = C · H · W columns.Source: A. Client-Side Optimal Rank-Reduced… · p. 2
- The truncated SVD gives the rank-r matrix that optimally approximates the centered data in Frobenius norm, according to the Eckart-Young-Mirsky theorem [14].The resulting rank-reduced representation is used to construct the spectral prototype.Source: A. Client-Side Optimal Rank-Reduced… · p. 2
B. Wavelet Scattering Transform
WaSA applies the Wavelet Scattering Transform to the client prototype to obtain a representation stable to local geometric deformations. It retains first-order scattering coefficients and notes that the combined representation protects raw data from inversion.
B. Wavelet Scattering Transform
- Because the spectral prototype can be distorted by small translations or rotations in pixel space, WaSA projects it through the Wavelet Scattering Transform.The projection is intended to produce a representation stable to these deformations.Source: B. Wavelet Scattering Transform · p. 2
- WaSA retains only first-order scattering coefficients and vectorizes them to form each client embedding.The scattering operator separates structurally distinct signals while maintaining Lipschitz stability to C2 diffeomorphisms, as established in and applied to FL anomaly detection in WAFFLE.Source: B. Wavelet Scattering Transform · p. 2
- The non-invertibility of the scattering operator, combined with SVD truncation, inherently protects raw local data from inversion attacks.Source: B. Wavelet Scattering Transform · p. 2
C. Offline Manifold Learning via Denoising Autoencoder
WaSA trains a denoising autoencoder exclusively on clean data to learn the low-dimensional manifold of benign WST representations. An embedding that departs from this manifold is difficult to reconstruct and can be detected without prior attack knowledge.
C. Offline Manifold Learning via Denoising Autoencoder
- A strict encoder bottleneck trained only on clean data makes the autoencoder learn the benign representation manifold, exposing anomalous embeddings through poor reconstruction.The encoder compresses WST embeddings and the decoder reconstructs them; deviations from the learned manifold cannot be accurately reconstructed from the latent space.Source: C. Offline Manifold Learning via… · p. 2
- Training occurs offline on synthetic embeddings generated from an auxiliary dataset, before federated training begins.The parameters are optimized against reconstruction error over noise-corrupted batches.Source: C. Offline Manifold Learning via… · p. 2
- At convergence, Lfinal is the empirical loss used as the baseline reconstruction error on clean data.The offline-training algorithm returns the learned parameters and baseline loss.Source: C. Offline Manifold Learning via… · pp. 2–3
D. Online Client Evaluation & Filtering
Before the first FL round, clients send embeddings and the server scores their deviation from the learned benign distribution. WaSA then either excludes clients above a threshold or samples clients with probabilities controlled by their anomaly scores and temperature.
D. Online Client Evaluation & Filtering
- Before the first communication round, each client sends its embedding to the server, which computes a scale-free normalized anomaly score Ek.Scores near or below 1 indicate embeddings near the learned benign manifold, while anomalous spectral structures yield scores much greater than 1.Source: D. Online Client Evaluation & Filtering · p. 3
- With deterministic thresholding, clients with Ek ≤ τ form the participating set, and aggregation uses only that set in subsequent rounds.A natural hard threshold is τ = 1.Source: D. Online Client Evaluation & Filtering · p. 3
- Boltzmann sampling maps anomaly scores to client-selection probabilities, with temperature interpolating between hard exclusion and uniform random sampling.The server computes probabilities before the first round and draws a subset without replacement each round; smaller Ek corresponds to better reconstruction.Source: D. Online Client Evaluation & Filtering · p. 3
- For detection evaluation, a client is classified as malicious when its expected participation over the training horizon is negligible.The criterion uses P, the number selected per round, Ttotal, the total rounds, and Tmax, the maximum rounds deemed harmless for a corrupted client.Source: D. Online Client Evaluation & Filtering · p. 3
A. Experimental Setup
Experiments use MNIST, CIFAR-10, and CIFAR-100 with an auxiliary server dataset and federations of 100 clients exposed to four corruption types at 60% or 90% prevalence. The reported CIFAR-10 figures compare WST and Fourier representations and show near-oracle benign sampling probabilities under Boltzmann sampling.
A. Experimental Setup
- The benchmarks are MNIST, CIFAR-10, and CIFAR-100, with 20% of each training set reserved as server-side auxiliary data and the remaining 80% used for client data.CIFAR-100 is described as the more difficult, fine-grained recognition task.Source: A. Experimental Setup · p. 3
- Each federation has 100 clients, with corruption scenarios of 60% and 90% and four corruption types distributed equally among corrupted clients.The corruptions are Gaussian noise, Gaussian blur, random pixel masking, and black images.Source: A. Experimental Setup · pp. 3–4
- On CIFAR-10 with 60% corruption, WST separates benign clients from all four corruption types, while Fourier scores overlap the benign distribution.The comparison includes subtle Gaussian-blur and random-pixel-masking attacks; the figure marks threshold τ = 1.Source: Figure 1 · p. 4
- At T = 1 on CIFAR-10 with 60% corruption, benign clients’ mean selection probability approaches 1/40, while mildly distorted clients retain probabilities below 0.5%.The mean approaches the oracle uniform probability over the clean participants, without ground-truth labels.Source: Figure 2 · p. 4
- Training runs for 500 communication rounds with 10 clients participating per round, using FedAvg and three fixed random seeds.The setup uses dataset-matched model architectures and an autoencoder trained for 100 epochs.Source: A. Experimental Setup · p. 4
B. Results and Discussion
WaSA’s WST-based screening separates clean clients from subtle corruptions, while Boltzmann sampling retains limited participation from mildly distorted clients. Across reported classification and detection settings, WaSA performs strongly against aggregation and supervised-detection baselines, including under severe corruption.
Global Model Classification Performance
- WaSA-Boltzmann (T = 1.0) achieves 97.41% MNIST and 56.44% CIFAR-10 at 60% corruption, and 24.10% CIFAR-100 at 90%, surpassing Oracle and FedAvg in the latter setting.Table I reports test accuracy at communication round 500.Source: Table I · p. 5, B. Results and Discussion · p. 6
Client Detection: WaSA vs. WAFFLE
- At 40% corruption, WaSA-Boltzmann (T ∗= 0.5) reaches 98.8% F1 and 100% recall on both CIFAR-10 and CIFAR-100, versus 95.2% F1 and 83.0% recall for WAFFLE-WST.At 90% corruption, WaSA-Deterministic reaches 100% F1 on CIFAR-10 and 99.6% on CIFAR-100, while WAFFLE-WST recall falls to 68.3% on CIFAR-100.Source: Table II · p. 5, B. Results and Discussion · p. 6
Spectral Representation: WaSA-WST vs. FT
- On CIFAR-10 with 60% corruption, WST places all 40 clean clients below τ = 1 and all four corruption profiles above it, while Fourier scores overlap for blur and random masking.The Fourier overlap is attributed to instability of its modulus under local spatial deformations.Source: B. Results and Discussion · p. 5
Boltzmann Sampling Behaviour
- At T = 1, benign clients have mean selection probability approximately 1/40, while mildly distorted clients retain probabilities below 0.5% when the benign pool is small.High-anomaly clients are exponentially suppressed by πk ∝ exp(−Ek/T).Source: B. Results and Discussion · pp. 5–6
IV. CONCLUSION
WaSA screens clients using the geometry of a learned benign WST manifold rather than labeled attack profiles. Its unsupervised detection and Boltzmann sampling are presented as supporting generalization to unfamiliar corruptions and convergence when clean clients are scarce.
IV. CONCLUSION
- WaSA grounds offline client screening in a learned benign WST manifold rather than labeled attack profiles.This design removes the supervised assumption and supports generalization to unseen and composite corruptions without retraining, even when benign clients are a minority.Source: §IV · p. 6
- Boltzmann sampling decouples defensive filtering from hard exclusion, sustaining convergence when the clean client pool is critically small..Source: §IV · p. 6
- Together, the contributions advance offline FL defense from a supervised, threat-specific paradigm to a fully unsupervised, attack-agnostic one..Source: §IV · p. 6