Research map / Federated learning and privacy / Privacy attacks and secure learning

Rethinking Byzantine Robustness in Federated Recommendation from Sparse Aggregation Perspective

AAAI 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Studies Byzantine robustness of federated recommendation under sparse per-item aggregation and proposes Spattack, a family of four attacks (omniscient/non-omniscient × all-items/limited-items) that breaks Mean, Median, Norm and other defenses on FedMF and FedGNN.

Problem

Byzantine robustness of federated recommender systems is unexplored because item embeddings are updated sparsely by only the clients that interact with them, so dense-aggregation defenses and attacks do not transfer, leaving tail items vulnerable.

Approach

Treat aggregation per single item as the smallest unit, show tail items have low effective breakdown points under power-law degree distributions, and design attacks that send gradients opposite to benign ones (or Gaussian noise) across all or a sampled subset of items per malicious client.

Key results

• Under 3% malicious clients, Spattack reduces HR@5 by 47%-98% across datasets, outperforming baselines such as LIE, Cluster and Fang.
• With 5% malicious clients, Spattack-O-S/D under Median and Norm defenses degrades ML100K HR@5 by roughly 53%-85%, showing defenses break on tail items.
• On FedGNN with 10% malicious clients, the attack dramatically lowers performance, with Median-based defense showing particularly strong degradation.

Measured effects reported in the paper

Surprising findings

• Random Gaussian noise (Spattack-L-D) alone can break Median-based defenses on tail items, so hiding benign gradients does not protect FR.
• Median defense can perform worse than the no-defense Mean aggregator for some attacks, with Median and Norm frequently failing under Spattack.

Limitations

• Attacks assume collusion and identical malicious gradients across clients in several variants.
• Experiments limited to MF-based FedMF and a 2-layer FedGNN on three datasets with 32-dimensional embeddings.

Experimental setup

Datasets: ML100K ML1M Steam

Benchmarks: ML100K ML1M Steam

Metrics: HR@5 nDCG@5 HR@10 nDCG@10

Baselines: LabelFlip FedAttack Gaussian LIE Cluster Fang Mean Median Trimmed-mean Krum Norm

Builds on: FedMF FedGNN Byzantine-robust aggregation (Median, Krum, Trimmed-mean) BPR

Closest papers by meaning

• Self-Driven Entropy Aggregation for Byzantine-Robust Heterogeneous Federated Learning (ICML 2024 · similarity 0.89)
• A Huber Loss Minimization Approach to Byzantine Robust Federated Learning (AAAI 2024 · similarity 0.87)
• Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.87)
• SecEmb: Sparsity-Aware Secure Federated Learning of On-Device Recommender System with Large Embedding (ICML 2025 · similarity 0.87)
• Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.86)
• FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.86)