Exploiting Feature Non-IIDness for Untargeted Data Poisoning Attacks in Byzantine-Robust Federated Learning

Defending Poisoning Attacks in Federated Learning Under System and Data Heterogeneity

Federated learning (FL) is susceptible to poisoning attacks, where malicious clients manipulate local data or models to disrupt training. The system and data heterogeneity inherent in practical FL systems exacerbates these vulnerabilities, rendering existing defense mechanisms ineffective or infeasible. Specifically, distinguishing benign local models, trained on heterogeneous client data, from poisoned ones presents a significant challenge. Moreover, semi-asynchronous FL (SAFL) paradigms, commonly employed to address system heterogeneity, further complicate this issue by preventing fair evaluation of local models originating from different global models (i.e., with varying staleness). In this work, we propose a novel defensive framework (namely Fed-Beta) for robust and accurate FL model training under system and data heterogeneity. First, we introduce a staleness-aware SAFL paradigm, where the server accepts only a fixed number of local models per round and groups them based on their staleness. Then, we implement a two-stage aggregation mechanism. Specifically, we develop a robust intra-group aggregation method using model inversion to evaluate data-domain discrepancies among clients. This method accurately identifies and excludes malicious local models from aggregation, producing a reliable representative model for each group. Moreover, we design a model-consistency-aware inter-group aggregation method, which selectively aggregates group representative models with consistent update directions to update the global model. Theoretically, we conduct rigorous convergence analysis of Fed-Beta, offering insights into how system and data heterogeneity affect the defensive performance. Empirically, extensive experiments corroborate its superiority over existing schemes.

A Byzantine-Resilient Federated Learning Framework with Cryptographic Gradient Attestation Against Coordinated Model Poisoning Attacks

FedSentinel is presented, a novel Byzantine-resilient federated learning framework that combines cryptographic gradient attestation with adaptive trust-weighted aggregation to protect against coordinated model-poisoning attacks, which are among the most serious challenges.

Graph-aware Byzantine-resilient aggregation for adaptive poisoning detection in federated learning

SiftFL: Scheduling-Based Robust Backdoor Detection in Federated Learning

Backdoor attacks pose a serious threat to federated learning, particularly when client data are non-IID and the attacker ratio is high. FilterFL is a recent server-side defense that employs two Conditional Generative Adversarial Networks (CGANs) to generate synthetic samples and identify malicious client models without requiring clean server data. However, executing both CGAN stages in every communication round makes the defense robust but computationally expensive. In this paper, we propose SiftFL, a scheduling-based robust backdoor detection method that sifts out malicious client models at a fraction of the original cost. SiftFL decouples the cost of the CGAN stages from the number of communication rounds by executing them periodically rather than every round and complements this schedule with a trust history score that stabilizes client filtering across rounds. This design preserves and, in several settings, improves the robustness of CGAN-based detection while sharply lowering its server-side cost. Experiments using MNIST, CIFAR-10, and GTSRB benchmark dataset show that SiftFL reduces server defense computation by up to 99% while keeping the drop in main accuracy within about 4% in the most challenging non-IID cases compared to the original baseline. At the same time, the attack success rate is reduced by roughly 97–99%, and robustness accuracy improves significantly to 85%, in settings where the original FilterFL becomes unstable. The results indicate that scheduling and trust history make SiftFL a more practical and reliable backdoor detection method under non-IID data distribution and high attacker presence.

MAD-Based Update Filtering for Non-IID Federated Learning: Robustness Analysis Under Poisoning Attacks

A ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping.

URP-FL: Robust and Personalized Federated Learning under Heterogeneous and Adversarial Conditions

Federated learning is appealing for privacy-sensitive network systems, yet its practical deployment remains hindered by the following three recurring challenges: (1) client drift under non-IID data, (2) vulnerability to corrupted updates, and (3) the communication cost of repeated model exchange. Most existing approaches address these issues in isolation. While analytically convenient, this separation often fails to reflect real-world conditions. For instance, defenses against poisoning may suppress useful updates, while personalization and compression can alter the aggregation geometry itself. In this paper, we study these effects jointly and propose URP-FL, a compact training framework that integrates reliability-aware aggregation, local regularization for drift control, and sparse client uploads. We provide theoretical analysis establishing a convergence bound with distinct terms capturing optimization error, data heterogeneity, and adversarial impact. Experiments on a non-IID image classification benchmark with sign-flip and label-flip attacks demonstrate the benefits of the unified design. Compared to FedAvg and FedProx, this URP-FL maintains accuracy under attack while reducing transmitted parameters by approximately 75%. Rather than presenting a production ready system, it offers a reproducible and technically coherent step toward federated learning that is more robust under realistic conditions.