Research map / Federated learning and privacy / Personalized and heterogeneous FL
FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FedAA, which uses a DDPG agent at the server to continuously set aggregation weights over the top-M% of clients (selected by parameter distance), with server-side validation accuracy as reward, to improve robustness to Byzantine attacks and performance fairness in non-IID federated learning.
Problem
Federated learning under statistical heterogeneity and Byzantine/malicious clients suffers from poor robustness and fairness, and existing personalized FL methods do not address server-side aggregation vulnerabilities.
Approach
Treat each communication round as an MDP in which a DDPG actor outputs continuous aggregation weights for the M% clients closest in parameter space (a FABA-inspired distance-based selection), with reward given by the aggregated model's accuracy on a small class-balanced server validation set.
Key results
- Under same-value attack on CIFAR10 with 20% malicious clients, FedAA with M=80% reaches 90.3% mean accuracy with variance 0.013, versus Ditto at about 0.82-0.86 under attack.
- Under sign-flipping, Ditto and lp-proj-2 collapse beyond 20% malicious clients, while FedAA keeps around 0.97 on MNIST at 30-40% attack fraction (ablation table lists 0.974 at 30%).
- On CIFAR-100, Tiny-ImageNet and AG News, FedAA reports 0.524, 0.260 and 0.955 accuracy, about 30%, 6% and 0.5% above Ditto.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use validation-set reward with 100 images per class instead of 10 per class (ablation) | FedAA server validation set · CIFAR10 | mean test accuracy: 0.842 -> 0.875 | Helped |
| Class-balanced held-out validation set vs unfair class-imbalanced set (ablation) | FedAA server validation set · CIFAR10 | mean test accuracy: 0.855 -> 0.875; variance 0.043 -> 0.024 | Helped |
| Replace DDPG with PPO or TD3 as the aggregation-weight RL agent (ablation) | FedAA · CIFAR10 | mean test accuracy: PPO 0.881 vs DDPG 0.880; TD3 0.812 | No clear effect |
| Upload only last hidden layer parameters instead of all layers (ablation) | FedAA · CIFAR10 / FASHIONMNIST | mean test accuracy: CIFAR10 AL 0.875 vs LHL 0.879; FashionMNIST 0.975 vs 0.974 | No clear effect |
| Shrink DDPG hidden layers from 256 to 128 or 64 neurons (ablation) | FedAA · MNIST / CIFAR10 / FashionMNIST / EMNIST | mean test accuracy: impact on test accuracy is limited (e.g., MNIST 0.978 / 0.979 / 0.978) | No clear effect |
| Adding FedAA adaptive aggregation with validation reward vs Ditto under same-value attack | FedAA · CIFAR10 same-value attack (10% malicious) | mean test accuracy: 0.880 vs Ditto 0.817 | Helped |
| Adding FedAA adaptive aggregation vs Ditto on challenging datasets | FedAA · CIFAR-100 / Tiny-ImageNet / AG-News-100 | mean test accuracy: 0.524 vs 0.239; 0.260 vs 0.203; 0.955 vs 0.950 | Helped |
| Adaptive aggregation (FedAA) on clean (no attack) CIFAR10 and FashionMNIST | FedAA · no malicious clients (clear) | mean test accuracy: CIFAR10 0.873 vs Ditto 0.867; FashionMNIST 0.972 vs Ditto 0.973 | No clear effect |
| Reduce participating clients to C=50% under IPM attack (ablation) | FedAA (M=30%) · CIFAR10 / MNIST IPM attack | mean test accuracy: CIFAR10 10%: 0.870 (C=100%) vs 0.869 (C=50%); MNIST 20%: 0.975 vs 0.977 | No clear effect |
| Increase M (fraction of clients aggregated) from 10% to 100% under same-value attack (ablation) | FedAA · CIFAR10 same-value attack | mean test accuracy: peaks near M=80% (0.903 at 20% malicious) then sharp drop at M=90-100% | Mixed |
| Use FedAA's distance-based client selection/DDPG aggregation under sign-flipping attack | FedAA · MNIST sign-flipping (40% malicious) | mean test accuracy: 0.981 vs Ditto collapse | Helped |
| Uniform sign-flip robustness limitation: FedAA tolerates up to 50% malicious clients vs lp-proj up to 80% | FedAA · sign-flipping attack | max tolerable malicious fraction: 50% vs 80% for lp-proj | Hurt |
Surprising findings
- Tuning the DDPG learning rate or discount factor changed accuracy only marginally, and PPO and TD3 were not clearly better than DDPG in the authors' tests.
- Using only the last hidden layer parameters for the state and reducing DDPG hidden width barely changed accuracy.
Limitations
- Non-convex DRL training is sensitive to initialization and hyperparameters.
- Under sign-flipping attacks FedAA tolerates at most 50% malicious clients, while lp-proj tolerates up to 80%.
- Reward design can induce unfairness if the server validation set is class-imbalanced; some classes (5 and 9 on MNIST) converge lower.
Experimental setup
Datasets: MNIST CIFAR10 FashionMNIST EMNIST SYNTHETIC CIFAR-100 Tiny-ImageNet AG News
Benchmarks: MNIST CIFAR10 FashionMNIST EMNIST SYNTHETIC(0,0) SYNTHETIC(1,1) CIFAR-100 Tiny-ImageNet AG News
Metrics: mean test accuracy across benign clients variance of accuracy across clients standard deviation of client test loss (fairness)
Baselines: FedAvg Ditto lp-proj-1 lp-proj-2 Global local
Builds on: DDPG Ditto lp-proj FAVOR FABA
Closest papers by meaning
- FedAWA: Adaptive Optimization of Aggregation Weights in Federated Learning Using Client Vectors (CVPR 2025 · similarity 0.90)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.89)
- Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · similarity 0.88)
- Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.88)
- Pursuing Overall Welfare in Federated Learning through Sequential Decision Making (ICML 2024 · similarity 0.88)
- Fair Federated Learning under Domain Skew with Local Consistency and Domain Diversity (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.