Research map / Federated learning and privacy / Privacy attacks and secure learning
Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DDFed, an FHE-based secure aggregation framework that detects poisoning attacks on encrypted updates via a two-phase (perturbed secure cosine similarity + client-side feedback selection) mechanism without adding server roles.
Problem
Federated learning needs both privacy (secure aggregation) and robustness to poisoning, but similarity-based anomaly detection requires plaintext updates that secure aggregation hides; prior joint solutions rely on DP noise, extra non-colluding servers, or 3PC.
Approach
Use CKKS fully homomorphic encryption for aggregation; compute cosine similarity on encrypted last-layer updates (normalized client-side and perturbed with Gaussian DP noise), let clients decrypt scores and vote on a mean-threshold selection, then aggregate benign updates with FedAvg weights and apply clipping, all within the single-server FL topology.
Key results
- Under 0.3 attacker ratio, DDFed stays near no-attack accuracy under IPM and ALIE and, with Clipping Median, is one of only two methods that withstand SCALING attacks on MNIST/FMNIST.
- DDFed adds about 2 seconds to a roughly 10-second training round (about 20% overhead) on an Apple M2 Max.
- On CIFAR10 with full-layer protection, DDFed reaches about 69-70% accuracy under IPM, ALIE and SCALING attacks, comparable to the no-attack FedAvg accuracy of 70.16%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add encrypted similarity detection and FHE secure aggregation | DDFed · FMNIST cold-start IPM attack | accuracy: 81.87 -> 83.32 | Helped |
| add encrypted similarity detection and FHE secure aggregation | DDFed · FMNIST cold-start ALIE attack | accuracy: 82.97 -> 80.97 | Hurt |
| add encrypted similarity detection and FHE secure aggregation | DDFed · FMNIST cold-start SCALINE attack | accuracy: 81.11 -> 83.05 | Helped |
| use full layers instead of the last layer for similarity computation (ablation) | DDFed · CIFAR10 under IPM, ALIE, and SCALINE attacks | accuracy: 70.3 -> 69.84; 64.62 -> 69.73; 69.61 -> 68.89 | Mixed |
| add DP noise to non-encrypted parameters instead of encrypted parameters (ablation) | DDFed · CIFAR10 under IPM, ALIE, and SCALINE attacks | accuracy: 70.21 -> 70.31; 64.3 -> 64.62; 69.82 -> 69.6 | No clear effect |
| use FHE-based encrypted similarity computation and secure aggregation instead of unencrypted aggregation | DDFed · MNIST and FMNIST under IPM, SCALING, and ALE attacks | avg time per round (s): 12.43; 12.14; 12.15; 12.25; 12.23; 11.95 | Hurt |
| vary the DP perturbation epsilon from 0.01 to 0.1 (ablation) | DDFed · MNIST under IPM attack | accuracy | No clear effect |
| vary the DP perturbation epsilon from 0.01 to 0.1 (ablation) | DDFed · FMNIST under IPM attack | accuracy | Mixed |
Surprising findings
- Krum, Median, and Cos Defense are not the only robust baselines; FedAvg, Trimmed Mean and Clipping Median fail under IPM attack, and only DDFed and Clipping Median withstand SCALING attacks.
Limitations
- Assumes fewer than 50% malicious clients (r_attack < 0.5).
- Only enhances existing similarity-based defenses; does not propose new poisoning defenses or handle dropouts/dynamic participants.
- Optimal epsilon for the DP perturbation is task-dependent and left open.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR10
Benchmarks: MNIST Fashion-MNIST CIFAR10
Metrics: test accuracy time per training round
Baselines: FedAvg Krum Cos Defense Median Clipping Median Trimmed Mean
Builds on: FedAvg Cosine defense CKKS TenSEAL
Closest papers by meaning
- RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation (NeurIPS 2024 · similarity 0.91)
- Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.89)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.89)
- Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.89)
- Revamping Federated Learning Security from a Defender's Perspective: A Unified Defense with Homomorphic Encrypted Data Space (CVPR 2024 · similarity 0.88)
- FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.