PRISM‑FCP is a federated conformal prediction framework that achieves Byzantine robustness while reducing communication costs. It does so by partially sharing model updates—transmitting only a subset of parameters per round—to dampen the influence of poisoned clients during training, and by filtering out suspected Byzantine clients during calibration using histogram‑based techniques. Experiments on synthetic data and UCI datasets show that PRISM‑FCP maintains near‑nominal coverage and offers favorable trade‑offs between communication overhead and predictive performance.
By Ehsan Lari, Reza Arablouei, Stefan Werner
The paper investigates how adversarial examples transfer between client models in federated learning and explores the relationship between these examples and client data distributions. It proposes a defense strategy based on adversarial training that leverages the transferability of model robustness. Experiments on real-life datasets demonstrate that the new attack and defense methods outperform existing state‑of‑the‑art approaches.
By Zuobin Xiong, Deval Mukherjee, Homook Cho, Wei Li
The paper introduces a robust decentralized federated distillation approach that allows heterogeneous client models to collaborate using predictions on shared unlabeled public data. Each client evaluates received predictions across three modalities—class prediction, boundary decision, and prediction correlation—filters unreliable clients, assigns reliability-based weights, and constructs modality-specific teachers. The method validates distillation gradients against supervised gradients from private data, removes conflicting gradients, and proves convergence under Byzantine attacks, achieving improved accuracy on CIFAR-10 and CIFAR-100 under non‑IID data and malicious conditions.
By Xiao Ma, Hong Shen, Hui Tian, Wei Ke, Wenqi Lyu
The paper introduces DP‑BR‑FedAvg, a federated learning framework that combines Gaussian‑mechanism differential privacy with a coordinate‑wise trimmed‑mean Byzantine‑robust aggregation rule. It is evaluated on a simulated cross‑institutional classification task involving fraud and clinical‑risk scoring, where it improves the F1‑score for a minority class from 0.030 (plain FedAvg) to 0.119 while bounding privacy loss. The study demonstrates that privacy and robustness mechanisms interact, and that system design for regulated, adversarial, cross‑institutional settings must account for this interaction.
By Srikumar Nayak
The paper introduces Fed-ADR, a coordinated attack framework where a malicious orchestrator server directs heterogeneous adversarial clients to adapt their gradient updates in real time, thereby evading existing federated learning defenses and drastically reducing global model accuracy. It also presents a lightweight detection mechanism that estimates true client gradients from historical data to spot coordinated attacks, and an in-situ recovery method that restores model performance without restarting training. Experiments on MNIST, Fashion‑MNIST, and CIFAR‑10 show the attack can drop accuracy from over 90% to below 10%, while the defense can recover accuracy to above 90% within a few rounds at a computational cost at least 20× lower than retraining from scratch.
By Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy
The development of federated learning (FL) techniques has helped improve the privacy preservation of users' data and extended the applications of machine learning models. However, the involvement of a...
FedLNS is a server‑side framework that screens federated learning updates by representing each client’s contribution through changes in trainable normalization‑layer parameters, creating lightweight signatures that can be compared against a history‑aware cross‑client reference. The method requires no extra client‑to‑server communication, raw data, or labeled attack examples, and after screening, the remaining full‑model updates are aggregated with standard federated learning rules. Experiments on GPT‑style, BERT‑style, and LLaMA‑style models with 200 clients demonstrate that FedLNS achieves lower test perplexity than six baselines even when 40% of the population performs target manipulation under both IID and non‑IID data partitions.
By Kai Li, Jong-Ik Park, Carlee Joe-Wong, Wei Ni, Falko Dressler
arXiv:2608. 06637v1 Announce Type: cross Abstract: Robust aggregation methods are widely used in federated learning to mitigate the impact of adversarial client behavior.
By Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul Islam
arXiv:2609.36660v1 Announce Type: new
Abstract: We study federated learning (FL) with adversarial clients, where the goal is to minimize the average loss of the honest (non-adversarial) clients witho...
By Leonardo F. Toso, James Anderson, Rafael Pinot, Nirupam Gupta
arXiv:2608. 01095v1 Announce Type: new Abstract: Federated learning (FL) enables multiple intelligent devices to collaboratively train a high-accuracy model without sharing raw data.
By Hongliang Zhang, Zhongyuan Yu, Fenghua Xu, Teng Hu, Jian Meng, Jiguo Yu
The paper investigates the effects of label‑flipping poisoning attacks in a three‑client federated intrusion detection system (IDS) trained on CICIDS2017 with non‑IID attack subtype distributions. Flipping 60% of training labels from a single Byzantine client reduces the attacker’s own detection accuracy from 99.96% to 84.33%, while the federated global ensemble remains stable across all tested poison rates. The study shows that the self‑compromise signal can be detected as an anomaly, enabling Byzantine client identification without target data exfiltration, and notes that the current aggregation uses a Federated Forest rather than FedAvg, with future work planned to extend to parametric classifiers.
By Asmah Muallem, Firdous Kausar, Sajid Hussain, Lei Qian
The paper introduces DP‑BR‑FedAvg, a federated learning framework that combines Gaussian‑mechanism differential privacy with a coordinate‑wise trimmed‑mean Byzantine‑robust aggregation rule. It is evaluated on a simulated cross‑institutional classification task for fraud and clinical‑risk scoring, showing that plain FedAvg fails when a quarter of twenty clients are Byzantine, while DP‑BR‑FedAvg recovers more signal and bounds privacy loss. The study demonstrates that privacy and robustness interact, and system design for regulated, adversarial, cross‑institutional settings must account for this interaction.