FedQV: Leveraging Quadratic Voting in Federated Learning

TL;DR

This work introduces FedQV, a quadratic voting–based aggregation rule for Federated Learning designed to mitigate poisoning attacks that exploit the 1p1v paradigm. FedQV replaces linear, data-size–driven voting with a budgeted quadratic voting mechanism, using client-model similarity to price votes and a masked voting rule to deter manipulation, while allowing adaptive budgets via reputation. The authors prove convergence at a rate of $O\left(\frac{1}{T}\right)$ and establish truthfulness, and demonstrate through extensive experiments across four datasets that FedQV substantially outperforms FedAvg under various poisoning attacks. Additionally, FedQV proves compatible with Byzantine-robust defenses and privacy-preserving techniques, and its performance further improves when coupled with reputation-based budgets, making it a practical, reusable augmentation for robust FL systems.

Abstract

Federated Learning (FL) permits different parties to collaboratively train a global model without disclosing their respective local labels. A crucial step of FL, that of aggregating local models to produce the global one, shares many similarities with public decision-making, and elections in particular. In that context, a major weakness of FL, namely its vulnerability to poisoning attacks, can be interpreted as a consequence of the one person one vote (henceforth 1p1v) principle underpinning most contemporary aggregation rules. In this paper, we propose FedQV, a novel aggregation algorithm built upon the quadratic voting scheme, recently proposed as a better alternative to 1p1v-based elections. Our theoretical analysis establishes that FedQV is a truthful mechanism in which bidding according to one's true valuation is a dominant strategy that achieves a convergence rate that matches those of state-of-the-art methods. Furthermore, our empirical analysis using multiple real-world datasets validates the superior performance of FedQV against poisoning attacks. It also shows that combining FedQV with unequal voting ``budgets'' according to a reputation score increases its performance benefits even further. Finally, we show that FedQV can be easily combined with Byzantine-robust privacy-preserving mechanisms to enhance its robustness against both poisoning and privacy attacks.

Figures (5)

• Figure 1: Global model weights (position within the triangle) and corresponding test accuracy (color-coded) with three parties (two benign and one malicious). FedAvg is located at the bottom left corner ; QV is positioned around the centre ; FedQV is situated along the right triangle side . Details of the experimental setup are provided in Appendix \ref{['ap:preliminary']}.
• Figure 2: Overview of FedQV algorithm.
• Figure 3: FedQV aggregation weights of each party(left), ACC and ASR for global model(right), for 10 communication rounds in MNIST dataset under Backdoor attack
• Figure 4: ACC and ASR as we vary the hyperparameters similarity threshold $\theta$ and budget $B$.
• Figure :

Theorems & Definitions (22)

• Theorem 4.1
• Remark 4.2
• Remark 4.3
• Definition 4.4
• Theorem 4.5
• Remark 4.6
• Lemma A.5
• Lemma A.6
• Lemma A.7
• Lemma A.8