通过损失聚类提升联邦学习抗攻击能力，仅需两个可信节点即可防御多种恶意攻击。
Robust Federated Learning under Adversarial Attacks via Loss-Based Client Clustering
- 基于客户端损失值进行聚类，识别并过滤恶意更新。
- 在MNIST、FMNIST、CIFAR-10上均显著优于均值、裁剪均值等基准方法。
- 无需预知恶意客户端数量，理论保证在强攻击下仍具最优性边界。
联邦学习（FL）允许多个客户端在不共享私有数据的前提下协同训练模型。本文研究客户端遭受对抗性（拜占庭）攻击的联邦学习场景，假设服务器可信且拥有一个可靠的辅助数据集。这可能对应于服务器在联邦前已掌握可信数据，或存在一个临时承担服务器角色的可信客户端。本方法仅需两个可信参与者——服务器和一个客户端——即可有效运行，且无需事先知道恶意客户端的数量。理论分析表明，在强拜占庭攻击下仍能保持有界的最优性差距。实验结果表明，该算法在多种攻击策略（如标签翻转、符号翻转、高斯噪声添加）下，于MNIST、FMNIST、CIFAR-10基准测试中显著优于标准及鲁棒联邦学习基线方法，包括均值、裁剪均值、中位数、Krum和Multi-Krum，所有实验均基于Flower框架完成。
原文摘要 · Abstract (English)
Federated Learning (FL) enables collaborative model training across multiple clients without sharing private data. We consider FL scenarios wherein FL clients are subject to adversarial (Byzantine) attacks, while the FL server is trusted (honest) and has a trustworthy side dataset. This may correspond to, e.g., cases where the server possesses trusted data prior to federation, or to the presence of a trusted client that temporarily assumes the server role. Our approach requires only two honest participants, i.e., the server and one client, to function effectively, without prior knowledge of the number of malicious clients. Theoretical analysis demonstrates bounded optimality gaps even under strong Byzantine attacks. Experimental results show that our algorithm significantly outperforms standard and robust FL baselines such as Mean, Trimmed Mean, Median, Krum, and Multi-Krum under various attack strategies including label flipping, sign flipping, and Gaussian noise addition across MNIST, FMNIST, and CIFAR-10 benchmarks using the Flower framework.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。