[Paper Review] FL-Defender: Combating Targeted Attacks in Federated Learning

Najeeb Jebreel, Josep Domingo‐Ferrer|arXiv (Cornell University)|Jul 2, 2022

Privacy-Preserving Technologies in Data4 citations

TL;DR

FL-Defender is a novel defense for federated learning that detects and mitigates targeted poisoning attacks—such as label-flipping and backdoor attacks—by analyzing the angular similarity of last-layer gradients across workers. It uses PCA-compressed gradient similarity features to re-weight updates based on deviation from the centroid, achieving state-of-the-art attack success rate reduction while preserving model accuracy and incurring minimal computational overhead.

ABSTRACT

Federated learning (FL) enables learning a global machine learning model from local data distributed among a set of participating workers. This makes it possible i) to train more accurate models due to learning from rich joint training data, and ii) to improve privacy by not sharing the workers' local private data with others. However, the distributed nature of FL makes it vulnerable to targeted poisoning attacks that negatively impact the integrity of the learned model while, unfortunately, being difficult to detect. Existing defenses against those attacks are limited by assumptions on the workers' data distribution, may degrade the global model performance on the main task and/or are ill-suited to high-dimensional models. In this paper, we analyze targeted attacks against FL and find that the neurons in the last layer of a deep learning (DL) model that are related to the attacks exhibit a different behavior from the unrelated neurons, making the last-layer gradients valuable features for attack detection. Accordingly, we propose extit{FL-Defender} as a method to combat FL targeted attacks. It consists of i) engineering more robust discriminative features by calculating the worker-wise angle similarity for the workers' last-layer gradients, ii) compressing the resulting similarity vectors using PCA to reduce redundant information, and iii) re-weighting the workers' updates based on their deviation from the centroid of the compressed similarity vectors. Experiments on three data sets with different DL model sizes and data distributions show the effectiveness of our method at defending against label-flipping and backdoor attacks. Compared to several state-of-the-art defenses, FL-Defender achieves the lowest attack success rates, maintains the performance of the global model on the main task and causes minimal computational overhead on the server.

Motivation & Objective

• To address the challenge of detecting stealthy targeted poisoning attacks in federated learning, especially in non-iid data and high-dimensional models.
• To overcome limitations of existing defenses that rely on unrealistic assumptions about data distribution or worker behavior.
• To develop a robust, scalable defense that maintains global model performance on the main task while minimizing computational cost on the server.
• To identify discriminative features in deep learning model gradients that reliably indicate malicious behavior during aggregation.

Proposed method

• Compute worker-wise angle similarity between the last-layer gradients of each client to capture directional patterns indicative of attack behavior.
• Apply principal component analysis (PCA) to compress the similarity vectors and remove redundant information, enhancing feature robustness.
• Calculate the centroid of the compressed similarity vectors to define a reference for normal behavior.
• Re-weight each worker’s model update based on its angular deviation from the centroid, penalizing outliers.
• Integrate the re-weighted updates into the FedAvg aggregation process to mitigate malicious contributions.
• Use historical gradient patterns to dynamically adjust trust scores, enabling adaptive defense against evolving attack strategies.

Experimental results

Research questions

• RQ1 Can last-layer gradient directions in deep learning models reveal distinguishing patterns between attack-related and benign neurons during federated training?
• RQ2 How can gradient-based features be engineered to detect targeted poisoning attacks without relying on assumptions about data distribution or model size?
• RQ3 To what extent can PCA-compressed gradient similarity vectors improve detection robustness in high-dimensional and non-i.i.d. FL settings?
• RQ4 Can a re-weighting mechanism based on angular deviation from a centroid effectively suppress malicious updates while preserving benign model performance?
• RQ5 How does FL-Defender compare in efficiency and effectiveness to state-of-the-art defenses under diverse attack scenarios?

Key findings

• FL-Defender achieved the lowest attack success rates across all evaluated datasets and attack types, outperforming state-of-the-art defenses.
• On MNIST-non-IID with 4 attackers, FL-Defender reduced the attack success rate to 20.6% (vs. 100% for other methods), maintaining a benign accuracy of 75.76%.
• On CIFAR10-IID, FL-Defender achieved an attack success rate of 12.00% and a benign accuracy of 76.10%, significantly outperforming baselines.
• On CIFAR10-non-IID, FL-Defender reduced the attack success rate to 38.35%—a notable improvement over other methods—while preserving 75.97% benign accuracy.
• The method incurred minimal computational overhead, with server-side runtime per iteration comparable to FoolsGold and significantly lower than other defenses.
• FL-Defender maintained high global model performance on non-attacked examples, demonstrating robustness without degrading main-task accuracy.