[Paper Review] FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

Xiaoyu Cao, Minghong Fang+2 more|arXiv (Cornell University)|Dec 27, 2020

Privacy-Preserving Technologies in DataComputer Science44 references35 citations

TL;DR

FLTrust bootstraps trust in federated learning by using a small, clean root dataset and a server model to defend against Byzantine-local model poisoning attacks, achieving robustness with minimal client-side changes.

ABSTRACT

Byzantine-robust federated learning aims to enable a service provider to learn an accurate global model when a bounded number of clients are malicious. The key idea of existing Byzantine-robust federated learning methods is that the service provider performs statistical analysis among the clients' local model updates and removes suspicious ones, before aggregating them to update the global model. However, malicious clients can still corrupt the global models in these methods via sending carefully crafted local model updates to the service provider. The fundamental reason is that there is no root of trust in existing federated learning methods. In this work, we bridge the gap via proposing FLTrust, a new federated learning method in which the service provider itself bootstraps trust. In particular, the service provider itself collects a clean small training dataset (called root dataset) for the learning task and the service provider maintains a model (called server model) based on it to bootstrap trust. In each iteration, the service provider first assigns a trust score to each local model update from the clients, where a local model update has a lower trust score if its direction deviates more from the direction of the server model update. Then, the service provider normalizes the magnitudes of the local model updates such that they lie in the same hyper-sphere as the server model update in the vector space. Our normalization limits the impact of malicious local model updates with large magnitudes. Finally, the service provider computes the average of the normalized local model updates weighted by their trust scores as a global model update, which is used to update the global model. Our extensive evaluations on six datasets from different domains show that our FLTrust is secure against both existing attacks and strong adaptive attacks.

Motivation & Objective

• Motivate Byzantine-robust federated learning when some clients may be malicious.
• Introduce a trust-bootstrapping mechanism leveraging a clean root dataset managed by the server.
• Design a robust aggregation rule that accounts for both direction and magnitude of model updates.
• Evaluate FLTrust against standard and adaptive poisoning attacks across multiple datasets.
• Assess fidelity, robustness, and efficiency relative to FedAvg and existing Byzantine-robust methods.

Proposed method

• Server maintains a small clean root dataset and a server model trained on it.
• Clients compute local model updates as in standard FL but are evaluated against a server-driven trust signal.
• Trust scores are based on ReLU-clipped cosine similarity between local updates and the server update.
• Local updates are magnitude-normalized to the same norm as the server update to limit poisoning impact.
• Global update is the weighted average of normalized local updates, weighted by trust scores, plus the server model update considerations.
• The approach integrates both direction and magnitude of updates in aggregation to defend against attacks.

Experimental results

Research questions

• RQ1 How can a server-anchored root dataset improve robustness against Byzantine clients in federated learning?
• RQ2 Does FLTrust maintain accuracy (fidelity) comparable to FedAvg under no attack while providing robustness under attack?
• RQ3 Can FLTrust defend against adaptive local model poisoning attacks designed for its aggregation rule?
• RQ4 What is the impact of root dataset size and distribution on FLTrust performance?
• RQ5 How do FLTrust’s defenses compare to existing Byzantine-robust methods (e.g., Krum, Trimmed Mean, Median) across diverse tasks?

Key findings

• FLTrust remains secure against existing poisoning attacks across six datasets, even with root datasets under 100 examples.
• Under adaptive attacks with 40-60% malicious clients, FLTrust achieves CNN global model accuracy on MNIST-0.1 comparable to FedAvg under no attacks.
• Compared to Krum, Trimmed Mean, and Median, FLTrust shows improved robustness in the reported experiments.
• A CNN global model trained with FLTrust on MNIST-0.1 achieves a testing error rate of 0.04 under all evaluated attacks.
• Krum can raise testing error rate from 0.10 to 0.90 under its attack variant, illustrating FLTrust’s relative resilience.
• FLTrust can maintain performance close to FedAvg under no attacks even when facing adversarial clients.