Do We Really Need to Design New Byzantine-robust Aggregation Rules?

2025-01-29

AI Summary

In federated learning, Byzantine clients launching poisoning attacks can severely degrade the robustness of existing aggregation rules. To address this, we propose FoundationFL—a framework that preserves standard robust aggregators (e.g., Trimmed-mean, Median) without modifying their logic; instead, the server generates synthetic model updates, which are jointly aggregated with clients’ local updates. We provide the first theoretical proof that enhancing input quality alone—without designing new aggregation rules—significantly improves Byzantine resilience of classical robust aggregators. FoundationFL guarantees convergence under Byzantine threats and empirically demonstrates substantial improvements in poisoning resistance across multiple real-world datasets, while maintaining high model accuracy and low communication overhead. The framework thus achieves strong effectiveness, generalizability, and practicality.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Other Foundations of Multi Agent Systems
• Natural Language Processing: Safety and Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization

Abstract

Federated learning (FL) allows multiple clients to collaboratively train a global machine learning model through a server, without exchanging their private training data. However, the decentralized aspect of FL makes it susceptible to poisoning attacks, where malicious clients can manipulate the global model by sending altered local model updates. To counter these attacks, a variety of aggregation rules designed to be resilient to Byzantine failures have been introduced. Nonetheless, these methods can still be vulnerable to sophisticated attacks or depend on unrealistic assumptions about the server. In this paper, we demonstrate that there is no need to design new Byzantine-robust aggregation rules; instead, FL can be secured by enhancing the robustness of well-established aggregation rules. To this end, we present FoundationFL, a novel defense mechanism against poisoning attacks. FoundationFL involves the server generating synthetic updates after receiving local model updates from clients. It then applies existing Byzantine-robust foundational aggregation rules, such as Trimmed-mean or Median, to combine clients' model updates with the synthetic ones. We theoretically establish the convergence performance of FoundationFL under Byzantine settings. Comprehensive experiments across several real-world datasets validate the efficiency of our FoundationFL method.

Problem

• Federated Learning
• Malicious Participants
• Model Integrity

Innovation

• FoundationFL
• Robustness Enhancement
• Federated Learning Security