FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning
Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, Ahmad-Reza Sadeghi
TL;DR
FreqFed introduces a frequency-domain aggregation for federated learning that mitigates both targeted backdoors and untargeted poisoning by transforming client updates with a Discrete Cosine Transform, retaining low-frequency components, clustering with HDBSCAN to identify representative benign updates, and aggregating via FedAVG on the accepted set. The approach is attack- and data-distribution-agnostic, validated across image, NLP, IoT intrusion detection, speech, and graph domains with extensive experiments showing robust defense and negligible impact on the main task accuracy. Key contributions include a novel weight-domain frequency analysis, an automated clustering-based filtering mechanism, and comprehensive cross-domain evaluation against adaptive and state-of-the-art attacks. The work advances robust FL by providing a generic, scalable defense against sophisticated poisoning strategies without requiring data access or strong distributional assumptions.
Abstract
Federated learning (FL) is a collaborative learning paradigm allowing multiple clients to jointly train a model without sharing their training data. However, FL is susceptible to poisoning attacks, in which the adversary injects manipulated model updates into the federated model aggregation process to corrupt or destroy predictions (untargeted poisoning) or implant hidden functionalities (targeted poisoning or backdoors). Existing defenses against poisoning attacks in FL have several limitations, such as relying on specific assumptions about attack types and strategies or data distributions or not sufficiently robust against advanced injection techniques and strategies and simultaneously maintaining the utility of the aggregated model. To address the deficiencies of existing defenses, we take a generic and completely different approach to detect poisoning (targeted and untargeted) attacks. We present FreqFed, a novel aggregation mechanism that transforms the model updates (i.e., weights) into the frequency domain, where we can identify the core frequency components that inherit sufficient information about weights. This allows us to effectively filter out malicious updates during local training on the clients, regardless of attack types, strategies, and clients' data distributions. We extensively evaluate the efficiency and effectiveness of FreqFed in different application domains, including image classification, word prediction, IoT intrusion detection, and speech recognition. We demonstrate that FreqFed can mitigate poisoning attacks effectively with a negligible impact on the utility of the aggregated model.