Research map / Federated learning and privacy / Privacy attacks and secure learning
Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FAVD, a privacy-preserving, server-independent federated learning method that values client data before local training by comparing noisy local and global density functions (K-means clusters with Mahalanobis distance) to filter poisoned samples.
Problem
Federated learning lacks auditable data valuation and verifiable client contributions under black-box data poisoning, especially when reliance on a central server creates single points of failure and privacy risks.
Approach
Each client clusters low-dimensional output-layer representations with K-means, shares Gaussian-noised mean and covariance density parameters, and discards samples whose Mahalanobis distance to the global density exceeds a threshold before training, so only benign-valued data contributes to verifiable updates.
Key results
- Under no threat, FAVD improves global test accuracy over no-valuation FL by about 2-3% on uniform splits and 3-4% on non-IID splits (e.g., CIFAR10 uniform 88.42 vs 85.59).
- Under 50% malicious clients with M-SimBA poisoning, FAVD reduces accuracy drop on Camelyon17, HAM10000 and CIFAR100 to roughly 3-7% in uniform settings, while No Val drops 15-66%.
- On CIFAR10 (50% maliciousness), FAVD achieves MSDR 0.86 and BMR 0.24 versus FedBary's 0.82 and 0.27.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add FAVD data valuation before training (ablation) | Federated learning · Covid-chestxray, uniform and non-IID, no threat | test accuracy (%): 91.37±1.54 -> 93.75±1.20; 88.62±1.27 -> 91.36±1.31 | Helped |
| add FAVD data valuation before training (ablation) | Federated learning · Camelyon17, uniform and non-IID, no threat | test accuracy (%): 91.82±1.21 -> 94.62±1.15; 87.81±1.79 -> 91.38±1.86 | Helped |
| add FAVD data valuation before training (ablation) | Federated learning · HAM10000, uniform and non-IID, no threat | test accuracy (%): 73.61±1.59 -> 75.48±0.42; 68.79±0.83 -> 71.36±0.86 | Helped |
| add FAVD data valuation before training (ablation) | Federated learning · CIFAR10, uniform and non-IID, no threat | test accuracy (%): 85.59±0.76 -> 88.42±0.21; 82.93±1.18 -> 86.24±1.22 | Helped |
| add FAVD data valuation before training (ablation) | Federated learning · CIFAR100, uniform and non-IID, no threat | test accuracy (%): 78.45±0.81 -> 81.19±0.45; 73.56±1.74 -> 76.38±1.83 | Helped |
| use FAVD rather than the strongest listed baseline | Federated learning · Covid-chestxray, uniform and non-IID, 50% maliciousness | impact of poisoned data (U): 81.01±0.53 -> 18.44±0.81; 81.62±0.53 -> 20.78±1.98 | Helped |
| use FAVD rather than the strongest listed baseline | Federated learning · Camelyon17, uniform and non-IID, 50% maliciousness | impact of poisoned data (U): 82.76±0.83 -> 3.05±1.32; 83.52±1.14 -> 4.01±0.46 | Helped |
| use FAVD rather than the strongest listed baseline | Federated learning · HAM10000, uniform and non-IID, 50% maliciousness | impact of poisoned data (U): 65.24±1.63 -> 4.28±0.78; 66.12±1.63 -> 6.41±1.39 | Helped |
| use FAVD rather than the strongest listed baseline | Federated learning · CIFAR10, uniform and non-IID, 50% maliciousness | impact of poisoned data (U): 81.46±1.89 -> 4.08±1.73; 82.28±1.89 -> 6.87±1.89 | Helped |
| use FAVD rather than the strongest listed baseline | Federated learning · CIFAR100, uniform and non-IID, 50% maliciousness | impact of poisoned data (U): 6.04±0.43 -> 5.93±0.87; 8.61±1.52 -> 7.09±1.21 | Helped |
| use FAVD instead of FedBary | CIFAR10 federated learning · CIFAR10, 30% and 50% maliciousness | MSDR: 0.88 -> 0.90; 0.82 -> 0.86 | Helped |
| use FAVD instead of FedBary | CIFAR10 federated learning · CIFAR10, 30% and 50% maliciousness | BMR: 0.19 -> 0.17; 0.27 -> 0.24 | Helped |
Surprising findings
- FLTrust, which relies on a clean validation dataset, performs poorly on diverse datasets.
Limitations
- Malicious clients exploiting benign-looking data can evade distribution-based valuation.
- Adaptive attackers mimicking legitimate behaviour can bypass the anomaly detection.
- Evaluation covers only a gradient-noise-based M-SimBA poisoning attack in the main text; label-flip attacks are discussed only as potential extension.
Experimental setup
Datasets: Covid-chestxray Camelyon17 HAM10000 CIFAR10 CIFAR100
Benchmarks: Covid-chestxray Camelyon17 HAM10000 CIFAR10 CIFAR100
Metrics: global test accuracy impact of poisoned data (U) MSDR BMR CCC
Baselines: Krum trimmed mean Median FLTrust DOS zPROBE FedVal FedCE FedBary MOON MoE SplitNN
Builds on: FedAvg FedBary FLTrust Krum
Closest papers by meaning
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.89)
- Data Valuation and Detections in Federated Learning (CVPR 2024 · similarity 0.89)
- Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · similarity 0.87)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.87)
- Mitigating the Privacy–Utility Trade-off in Decentralized Federated Learning via f-Differential Privacy (NeurIPS 2025 · similarity 0.87)
- A Bayesian Approach for Personalized Federated Learning in Heterogeneous Settings (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.