Research map / Federated learning and privacy / Privacy attacks and secure learning
Byzantine-robust Decentralized Federated Learning via Dual-domain Clustering and Trust Bootstrapping
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DFL-Dual, a Byzantine-robust decentralized federated learning method that combines model-domain (Euclidean, cosine) and data-domain (Wasserstein over inverted dummy data) distances with two-stage clustering and trust bootstrapping to exclude malicious neighbors, even when they exceed half.
Problem
Byzantine attacks in decentralized federated learning, where malicious clients may outnumber benign clients in a benign client's neighborhood and data is highly non-IID, make existing robust aggregation defenses fail.
Approach
Benign clients compute dual-domain distances (Euclidean distance between pre-aggregation models plus Wasserstein distance between dummy datasets obtained by a DLG-style model inversion with scaled equivalent gradients), then run two rounds of 2-median clustering, with a cosine-similarity-based trust score choosing which cluster to keep at each stage.
Key results
- Under targeted scaling attack with 60% Byzantine clients on MNIST, DFL-Dual keeps ASR at 0.50% with 96.21% accuracy, while baselines such as DFLTrust and Multi-Krum are far worse on attack success (e.g., DFLTrust 100% ASR).
- Under untargeted label-flipping attack, DFL-Dual reaches 96.64% accuracy on MNIST CNN versus 36.45% for Multi-Krum and 26.05% for DFL.
- DFL-Dual stays at low ASR (about 4-5%) on CIFAR-10 for scaling, DBA and A Little is Enough attacks, where baselines reach roughly 53-100% ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use dual-domain client clustering and trust bootstrapping rather than the evaluated robust aggregation baselines | DFL-Dual · Untargeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | accuracy (%) | Helped |
| Use DFL-Dual for targeted Scaling attacks | DFL-Dual · MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 0.50; 1.70; 4.44 | Helped |
| Use DFL-Dual for targeted A Little is Enough attacks | DFL-Dual · MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 0.55; 2.16; 4.78 | Helped |
| Use DFL-Dual for targeted DBA attacks | DFL-Dual · MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 0.48; 2.53; 4.35 | Helped |
| Add model-domain Euclidean distance to first-stage clustering (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | accuracy (%): 96.82 vs 96.21; 85.16 vs 84.83; 36.85 vs 49.01 (Scaling) | Mixed |
| Add model-domain Euclidean distance to first-stage clustering (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 31.61 vs 4.44 (CIFAR10 Scaling); 9.01 vs 4.35 (CIFAR10 DBA) | Mixed |
| Add data-domain Wasserstein distance to first-stage clustering (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | accuracy (%): 14.73 vs 84.83 (Fashion Scaling); 12.38 vs 96.54 (MNIST DBA) | Helped |
| Add data-domain Wasserstein distance to first-stage clustering (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 21.02 vs 1.70 (Fashion Scaling); 3.76 vs 4.35 (CIFAR10 DBA) | Mixed |
| Add trust bootstrapping for cluster selection (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | accuracy (%): 75.60 vs 96.21 (MNIST Scaling); 30.99 vs 84.83 (Fashion Scaling) | Helped |
| Add trust bootstrapping for cluster selection (ablation) | DFL-Dual · Targeted attacks across MNIST, Fashion-MNIST, and CIFAR-10 | ASR (%): 95.23 vs 0.50 (MNIST Scaling); 46.31 vs 1.70 (Fashion Scaling) | Helped |
Surprising findings
- Baseline ASR rises with non-IID degree, while DFL-Dual's ASR stays low even at p=0.8.
Limitations
- Full-knowledge adaptive attack scenario has limited practical applicability, as noted by the authors.
- Experiments use small models and datasets (MNIST, Fashion-MNIST, CIFAR-10) with 10 clients in the main topology.
- Several hyperparameters (alpha, C1, C2) are empirically tuned.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR-10
Benchmarks: MNIST Fashion-MNIST CIFAR-10
Metrics: accuracy attack success rate
Baselines: DFL DFLTrust DFLDetector Multi-Krum BridgeM IOS
Builds on: DLG FLTrust Krum FLDetector IOS
Closest papers by meaning
- Byzantine-Robust Federated Learning: Impact of Client Subsampling and Local Updates (ICML 2024 · similarity 0.88)
- Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.88)
- TRAIL: Trust-Aware Client Scheduling for Semi-Decentralized Federated Learning (AAAI 2025 · similarity 0.88)
- Competitive Advantage Attacks to Decentralized Federated Learning (NeurIPS 2025 · similarity 0.88)
- SemiDFL: A Semi-Supervised Paradigm for Decentralized Federated Learning (AAAI 2025 · similarity 0.87)
- Decentralized Sporadic Federated Learning: A Unified Algorithmic Framework with Convergence Guarantees (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.