AF-MCDC: Active Feedback-Based Malicious Client Dynamic Detection

Abstract

Federated Learning (FL) has long been known for separating the training and model construction processes, ensuring the privacy of participating clients. However, this separation also introduces a new attack surface. Due to the decentralization feature, Federal Learning is prone to Byzantine attacks. Attackers can deliberately corrupt or malfunction one or more participants in the federated network, disrupting the overall model training process. Researchers have proposed many defense mechanisms to mitigate Byzantine attacks. Their main ideas include eliminating malicious updates that deviate from the overall distribution through similarity detection and avoiding malicious parameters using statistical characteristics. Yet, these defense mechanisms are usually passive, detection only happens on the central server, neglecting the important role of clients. Thus we propose AF-MCDC: Active Feedback-Based Malicious Client Dynamic Detection, a byzantine-robust federated learning method taking advantage of valid clients. What sets AF-MCDC apart from existing robust federated learning methods is its three-pronged defense approach. First, a detection mechanism is deployed on each client to verify the integrity of the distributed global model. If the model fails the integrity check, it will not be used to initialize the local model. On the server side, a decision is made based on the detection results uploaded by the clients, followed by performance scoring using cosine similarity among federated clients. Finally, a dynamic weighting mechanism based on client score rankings is applied to weigh the local models uploaded by all clients, effectively filtering out malicious clients Evaluation of two datasets, MNIST and CIFAR-10, demonstrates that AF-MCDC is robust against a significant portion of malicious clients. Furthermore, even when over half of the clients are malicious, AF-MCDC can still train a global model with performance comparable to the global model learned by FedAvg under non-adversarial conditions.