Research map / Federated learning and privacy / Privacy attacks and secure learning
FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FedREDefense, which flags malicious federated-learning client updates by the reconstruction error of each update from distilled local data-label knowledge, without relying on cross-client or global information.
Problem
Defending federated learning against model poisoning attacks when data is highly non-IID and/or a large fraction of clients is malicious, where cross-client and global-information defenses degrade.
Approach
Genuine training updates can be approximately reconstructed from a small set of distilled local data-label pairs via bi-level optimization, while handcrafted poisoning updates cannot; each client's update is filtered by its normalized reconstruction error against a fixed threshold, using only that client's own update.
Key results
- FedREDefense achieves 100% detection accuracy (DACC) with 0% FPR and FNR across all seven attacks on FashionMNIST, CIFAR-10, and CINIC at default settings (100 clients, 28 malicious, beta=0.1).
- With 72% malicious clients, FedREDefense keeps DACC at 100%, while FLDetector's detection degrades and FLAME cannot operate beyond 50% malicious clients.
- On CIFAR-10 under Fang attack, FedREDefense reaches 61.06% TACC versus 58.56% for FLDetector and 54.44% for FLAME; under Min-Max, 61.06% TACC versus 5.57% for FLDetector.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FedREDefense to filter malicious model updates instead of the compared defenses | Federated learning · FashionMNIST, Fang attack | TACC (%): 84.06 -> 85.54 | Helped |
| Use FedREDefense to filter malicious model updates instead of the compared defenses | Federated learning · CIFAR-10, Fang attack | TACC (%): 58.56 -> 61.06 | Helped |
| Use FedREDefense to filter malicious model updates instead of the compared defenses | Federated learning · CINIC, Fang attack | TACC (%): 46.02 -> 50.81 | Helped |
| Use FedREDefense to filter malicious updates under model-poisoning attacks | Federated learning · FashionMNIST, all reported attack scenarios | DACC (%): 100.00 | Helped |
| Use FedREDefense to filter malicious updates under model-poisoning attacks | Federated learning · CIFAR-10, all reported attack scenarios | DACC (%): 100.00 | Helped |
| Use FedREDefense to filter malicious updates under model-poisoning attacks | Federated learning · CINIC, all reported attack scenarios | DACC (%): 100.00 | Helped |
Surprising findings
- FLDetector fails against LIE, Min-Sum, Min-Max and MPAF because some crafted attacks produce updates more consistent across rounds than benign clients.
- Adaptive scaling attacks that evade the reconstruction-error detector gain only small scaling factors (about 1 to 2) and do little damage, which the paper frames as a trade-off for attackers.
Limitations
- Data poisoning attacks that train on genuine but poisoned data produce genuine-looking updates and are not detected; adaptive label flip attacks reduce TACC but are not filtered.
- Threshold gamma (0.6) is set by empirical observation of error ranges (benign about 0-0.3, malicious about 0.7-1.0) rather than a derived criterion.
- Server must store distilled local knowledge for every client, with storage O(pK) and added server computation.
Experimental setup
Datasets: FashionMNIST CIFAR-10 CINIC
Benchmarks: FashionMNIST CIFAR-10 CINIC
Metrics: DACC FPR FNR AAR TACC ASR
Baselines: Krum Median Trimmed Mean Norm Bound FLAME FLTrust FLDetector FLCert
Builds on: dataset distillation FLTrust FLDetector FLAME
Closest papers by meaning
- Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.93)
- Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning (NeurIPS 2025 · similarity 0.91)
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.88)
- Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · similarity 0.88)
- Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.88)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.