Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Do We Really Need to Design New Byzantine-robust Aggregation Rules?

Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sundararaja Sitharama Iyengar, Haibo Yang

TL;DR

This paper addresses poisoning attacks in federated learning by arguing that there is no need for new Byzantine-robust aggregation rules. It introduces FoundationFL, where the server generates synthetic updates based on client updates and combines them with real updates using established robust aggregators such as Trimmed-mean or Median, thereby reducing update variance and improving robustness under attack. The authors provide convergence guarantees under standard FL assumptions and validate the approach across six datasets and twelve poisoning attacks, showing robust performance and scalability, including under non-IID data and high fractions of malicious clients. The work suggests a practical, provably effective defense that leverages existing aggregation principles with synthetic augmentations, offering a less brittle and more adaptable defense against poisoning in FL with broad theoretical and empirical support.

Abstract

Federated learning (FL) allows multiple clients to collaboratively train a global machine learning model through a server, without exchanging their private training data. However, the decentralized aspect of FL makes it susceptible to poisoning attacks, where malicious clients can manipulate the global model by sending altered local model updates. To counter these attacks, a variety of aggregation rules designed to be resilient to Byzantine failures have been introduced. Nonetheless, these methods can still be vulnerable to sophisticated attacks or depend on unrealistic assumptions about the server. In this paper, we demonstrate that there is no need to design new Byzantine-robust aggregation rules; instead, FL can be secured by enhancing the robustness of well-established aggregation rules. To this end, we present FoundationFL, a novel defense mechanism against poisoning attacks. FoundationFL involves the server generating synthetic updates after receiving local model updates from clients. It then applies existing Byzantine-robust foundational aggregation rules, such as Trimmed-mean or Median, to combine clients' model updates with the synthetic ones. We theoretically establish the convergence performance of FoundationFL under Byzantine settings. Comprehensive experiments across several real-world datasets validate the efficiency of our FoundationFL method.

Do We Really Need to Design New Byzantine-robust Aggregation Rules?

TL;DR

This paper addresses poisoning attacks in federated learning by arguing that there is no need for new Byzantine-robust aggregation rules. It introduces FoundationFL, where the server generates synthetic updates based on client updates and combines them with real updates using established robust aggregators such as Trimmed-mean or Median, thereby reducing update variance and improving robustness under attack. The authors provide convergence guarantees under standard FL assumptions and validate the approach across six datasets and twelve poisoning attacks, showing robust performance and scalability, including under non-IID data and high fractions of malicious clients. The work suggests a practical, provably effective defense that leverages existing aggregation principles with synthetic augmentations, offering a less brittle and more adaptable defense against poisoning in FL with broad theoretical and empirical support.

Abstract

Federated learning (FL) allows multiple clients to collaboratively train a global machine learning model through a server, without exchanging their private training data. However, the decentralized aspect of FL makes it susceptible to poisoning attacks, where malicious clients can manipulate the global model by sending altered local model updates. To counter these attacks, a variety of aggregation rules designed to be resilient to Byzantine failures have been introduced. Nonetheless, these methods can still be vulnerable to sophisticated attacks or depend on unrealistic assumptions about the server. In this paper, we demonstrate that there is no need to design new Byzantine-robust aggregation rules; instead, FL can be secured by enhancing the robustness of well-established aggregation rules. To this end, we present FoundationFL, a novel defense mechanism against poisoning attacks. FoundationFL involves the server generating synthetic updates after receiving local model updates from clients. It then applies existing Byzantine-robust foundational aggregation rules, such as Trimmed-mean or Median, to combine clients' model updates with the synthetic ones. We theoretically establish the convergence performance of FoundationFL under Byzantine settings. Comprehensive experiments across several real-world datasets validate the efficiency of our FoundationFL method.

Paper Structure

This paper contains 23 sections, 5 theorems, 25 equations, 5 figures, 13 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Federated Learning
  4. Poisoning Attacks to FL
  5. Byzantine-robust Aggregation Rules
  6. Threat Model
  7. Our Method
  8. Overview
  9. FoundationFL
  10. Theoretical Analysis
  11. Evaluation
  12. Experimental Setup
  13. Datasets
  14. Poisoning Attacks
  15. Compared Aggregation Rules
  16. ...and 8 more sections

Key Result

Theorem 1

Assuming that Assumptions assumption_1-assumption_3 and Assumption assumption_5 are valid and the client's learning rate is $\alpha=\frac{1}{\lambda}$, our proposed FoundationFL framework uses the Trimmed-mean aggregation rule to combine both generated synthetic model updates and model updates from where $\bm{\theta}^T$ is the global model at training round $T$, $\bm{\theta}^0$ is the initial glo

Figures (5)

  • Figure 1: Impact of fraction of malicious clients.
  • Figure 2: Impact of degree of Non-IID.
  • Figure 3: Impact of fraction of synthetic updates.
  • Figure 4: Impact of total number of clients.
  • Figure 5: Computation cost of different FL methods.

Theorems & Definitions (11)

  • Theorem 1
  • proof
  • Theorem 2
  • proof
  • Remark
  • Lemma 1
  • proof
  • Lemma 2
  • proof
  • Lemma 3
  • ...and 1 more