Research map / Federated learning and privacy / Privacy attacks and secure learning
RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RFLPA, a secure-aggregation federated learning framework that defends against poisoning using FLTrust-style cosine-similarity trust scores computed over verifiable packed Shamir secret sharing with a dot-product re-sharing protocol, reducing per-user communication to O(M+N).
Problem
Existing poisoning defenses inspect plaintext local updates and are incompatible with secure aggregation, while prior secret-sharing-based robust FL (BREA) has high communication and computation costs for high-dimensional models.
Approach
Compute FLTrust cosine-similarity trust scores under secret sharing using verifiable packed Shamir sharing and a dot-product aggregation protocol (secret re-sharing plus Reed-Solomon decoding) so the server learns only the final dot products, norms and the global gradient.
Key results
- Under 30% gradient manipulation attackers on MNIST, RFLPA keeps accuracy at 0.95 versus 0.32 for FedAvg and 0.93 for BREA.
- Per-client communication for RFLPA stays around 82.5MB regardless of user count, a reduction of over 75% versus BREA, and 99.3% lower at 2,000 clients across model dimensions.
- RFLPA reduces user and server computation by over 80% relative to BREA, with an average accuracy drop of 2.84%, 4.38% and 3.46% without attackers on MNIST, F-MNIST and CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RFLPA instead of FedAvg under gradient manipulation | Federated learning · MNIST, 30% attackers | accuracy | Helped |
| Use RFLPA instead of FedAvg under gradient manipulation | Federated learning · F-MNIST, 30% attackers | accuracy | Helped |
| Use RFLPA instead of FedAvg under gradient manipulation | Federated learning · CIFAR-10, 30% attackers | accuracy | Helped |
| Use RFLPA instead of FedAvg with no attackers | Federated learning · MNIST | accuracy: 0.98 ± 0.0 -> 0.96 ± 0.0 | Hurt |
| Use packed secret sharing in RFLPA instead of BREA | RFLPA · Per-client communication, 2,000 clients and varying model dimensions | communication cost reduction: 99.3% | Helped |
| Use RFLPA instead of BREA | Federated learning · Per-client communication, varying participating client size | communication cost reduction: over 75% | Helped |
| Use RFLPA instead of BREA | Federated learning · User and server computation, varying client size | computation cost reduction: over 80% | Helped |
Surprising findings
- Under no attack, RFLPA is slightly less accurate than FedAvg (average drops of 2.84%, 4.38%, 3.46%).
Limitations
- Requires the server to hold a small clean root dataset (e.g., 200 samples).
- Rank-based robust aggregation not supported efficiently; differential privacy not incorporated.
- Accuracy slightly lower than FedAvg without attackers and reported for only three image datasets with small models.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR-10
Benchmarks: MNIST Fashion-MNIST CIFAR-10
Metrics: test accuracy per-iteration communication cost per-iteration computation cost
Baselines: FedAvg Bulyan Trim-mean LDP CDP BREA
Builds on: FLTrust BREA Shamir secret sharing verifiable secret sharing secure aggregation
Closest papers by meaning
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.91)
- Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.90)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.88)
- FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.88)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.87)
- Janus: Dual-Server Multi-Round Secure Aggregation with Verifiability for Federated Learning (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.