A Byzantine-Robust Secure Federated Learning Scheme in Heterogeneous Data

Abstract

Secure Federated Learning protects user privacy by keeping local gradients within the ciphertext space, thereby preventing direct exposure of raw gradients during aggregation. Paradoxically, this very protection introduces a fundamental vulnerability: the opacity of encrypted gradients blinds the server, rendering honest and malicious gradients indistinguishable. An attacker can exploit this opacity to inject manipulated gradients directly into the secure aggregation process, compromising the integrity of the global model. To address this issue, we propose SFLBR, a novel Byzantine-robust Secure Federated Learning framework. Specifically, we adopt the gradient median as a robust benchmark and introduce a layer-wise cosine similarity metric to differentiate malicious gradients. Furthermore, considering the complexity of non-independent and identically distributed (Non-IID) scenarios, we further design a proactive defense strategy that constrains the divergence among honest gradients, and augment it with a trust score function to improve robustness against potential misjudgments. Finally, we construct a series of secure communication protocols based on a lightweight dual-masking encryption mechanism, which enable efficient robust aggregation directly within the ciphertext space. Extensive experiments validate the effectiveness of SFLBR, demonstrating state-of-the-art (SOTA) defense performance across diverse attack scenarios.