Fast, Private, and Protected: Safeguarding Data Privacy and Defending Against Model Poisoning Attacks in Federated Learning

TL;DR

FPP addresses privacy-preserving FL under non-iid data and potential model-poisoning by integrating secure aggregation with reputation-guided client selection, real-data loss evaluation, and checkpoint-based recovery. The method updates the global model via $omega_{t+1}^n = omega_t - alpha * grad L(omega_t, D_c)$ and detects attacks with $e_t > e_{t-1} * gamma$, rolling back to the last approved checkpoint when triggered. Reputation values $r_c$ modulate participation through $r_c \leftarrow r_c * delta_p$ on attacks and $r_i \leftarrow \min(1, r_i * delta_r)$ after successful rounds, enabling robustness without exposing individual gradients. In dockerized experiments, FPP achieves faster convergence and resilience to poisoning compared to baselines, highlighting its practical potential for privacy-preserving, attack-resilient FL in non-iid settings.

Abstract

Federated Learning (FL) is a distributed training paradigm wherein participants collaborate to build a global model while ensuring the privacy of the involved data, which remains stored on participant devices. However, proposals aiming to ensure such privacy also make it challenging to protect against potential attackers seeking to compromise the training outcome. In this context, we present Fast, Private, and Protected (FPP), a novel approach that aims to safeguard federated training while enabling secure aggregation to preserve data privacy. This is accomplished by evaluating rounds using participants' assessments and enabling training recovery after an attack. FPP also employs a reputation-based mechanism to mitigate the participation of attackers. We created a dockerized environment to validate the performance of FPP compared to other approaches in the literature (FedAvg, Power-of-Choice, and aggregation via Trimmed Mean and Median). Our experiments demonstrate that FPP achieves a rapid convergence rate and can converge even in the presence of malicious participants performing model poisoning attacks.

Figures (5)

• Figure 1: Process of a training round in the FPP.
• Figure 2: Accuracy per round in the training with only honest clients.
• Figure 3: Accuracy per round in the training with one attacker sending noise.
• Figure 4: Accuracy per round in the training with one attacker maximizing the loss.
• Figure 5: Accuracy per round in the training with 345 honest clients.