MAD-Based Update Filtering for Non-IID Federated Learning: Robustness Analysis Under Poisoning Attacks

Abstract

Federated Learning enables collaborative model training without sharing raw client data, making it attractive for privacy-sensitive domains. However, its performance degrades when local data are non-independent and identically distributed (non-IID) and when malicious clients inject adversarial updates; robust aggregation alone can be insufficient, especially for imbalanced medical datasets where minority-class degradation is masked by overall accuracy. This paper proposes a Median Absolute Deviation (MAD)-based malicious-update filtering framework for non-IID federated learning. The server flags and excludes abnormal client updates before aggregation, using a coordinate-wise median reference and a modified Z-score over cosine distances. Unlike trust-based defenses, it requires no clean server-side dataset and provides an interpretable, per-round diagnostic. We evaluate it on CIFAR-10 and HAM10000 under noise injection and sign flipping against eight robust aggregation baselines, under a unified protocol that reports Accuracy and Macro-F1 at the same validation-selected checkpoint, averaged over three seeds. On CIFAR-10, the proposed method attains a mean Macro-F1 comparable to or better than the strongest baselines under both attacks (75.9% and 67.6%). On HAM10000 under noise injection it achieves the highest mean accuracy (74.0%) with a competitive Macro-F1, whereas under sign flipping it is only mid-ranked. An ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping. These results characterize both the robustness potential and the boundary conditions of update-level median filtering in non-IID federated learning.