Research map / Federated learning and privacy / Privacy attacks and secure learning
Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdaAggRL, an RL-based (TD3) adaptive aggregation defense that uses gradient-inversion distribution learning and MMD-based distribution-stability similarities to weight client updates against sophisticated poisoning attacks in federated learning.
Problem
Federated learning is vulnerable to advanced, learnable untargeted model poisoning attacks (e.g., RL-based attacks tailored to the server) that evade traditional update-assessment and robust aggregation defenses.
Approach
Benign clients show more stable simulated data distributions over rounds than malicious clients; the server reconstructs client data via gradient inversion, measures MMD-based similarities between current, historical and global feature distributions, and uses TD3 policy learning to set aggregation weights and an exclusion threshold.
Key results
- On MNIST-0.1 with CNN, AdaAggRL reaches 0.9655 accuracy under RL-attack versus 0.7300 for the best baseline (FLtrust).
- On CIFAR-10 with ResNet18, AdaAggRL achieves 0.7531 under RL-attack, while Feddefender and FedVal reach 0.4150 and 0.1392 respectively.
- AdaAggRL tolerates up to 90% malicious clients under LMP and EB, while other baselines tolerate only below 30% under LMP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · MNIST-0.1, EB attack | accuracy: 0.9598 -> 0.9659 | Helped |
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · MNIST-0.1, RL-attack | accuracy: 0.7300 -> 0.9655 | Helped |
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · MNIST-0.5, RL-attack | accuracy: 0.4250 -> 0.9559 | Helped |
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · F-MNIST, RL-attack | accuracy: 0.6150 -> 0.8337 | Helped |
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · EMNIST, IPM attack | accuracy: 0.8834 -> 0.8805 | Hurt |
| Use AdaAggRL instead of the strongest listed baseline | Federated aggregation · CIFAR-10, RL-attack | accuracy: 0.6450 -> 0.7531 | Helped |
| Add current-history similarity S_cl (ablation) | AdaAggRL · MNIST-0.5, LMP attack | testing accuracy convergence speed and oscillation amplitude | Helped |
| Add current-global and historical-global similarities S_cg and S_lg (ablation) | AdaAggRL · MNIST-0.5, EB attack | defense effectiveness | Helped |
| Add reconstruction similarity S_R (ablation) | AdaAggRL · MNIST, LMP attack | testing accuracy convergence speed and oscillation amplitude | Helped |
| Increase gradient inversion iterations from 10 to 30 (ablation) | AdaAggRL · MNIST, LMP attack | accuracy: 0.9554 -> 0.9636 | Helped |
| Increase gradient inversion iterations from 30 to 50 (ablation) | AdaAggRL · MNIST, LMP attack | accuracy: 0.9636 -> 0.9664 | Helped |
| Increase reconstructed images from 16 to 32 (ablation) | AdaAggRL · MNIST, LMP attack | accuracy: 0.9636 -> 0.9628 | No clear effect |
Surprising findings
- Median-based aggregation collapses to around 0.10 accuracy under EB attack on several datasets, showing that some standard robust aggregators can be worse than no defense.
Limitations
- Adds computational overhead from gradient inversion and feature extraction per client each round.
- Evaluation attacker is assumed to have full server knowledge but the defense is not tested against attacks specifically designed to keep distribution stability; authors note this as future work.
- Experiments are limited to image classification and a single NLP setting in the appendix.
Experimental setup
Datasets: MNIST F-MNIST EMNIST CIFAR-10 IMDB
Benchmarks: MNIST F-MNIST EMNIST CIFAR-10
Metrics: testing accuracy of global model after 500 FL epochs
Baselines: Krum Median C-Median Clipping FLtrust Feddefender FedVal FedAvg
Builds on: TD3 inverting gradients maximum mean discrepancy FLtrust Krum
Closest papers by meaning
- RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation (NeurIPS 2024 · similarity 0.90)
- Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.89)
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.89)
- Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning (NeurIPS 2025 · similarity 0.89)
- FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.88)
- FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.