arXiv:2509.24330cs.LG2025-09被引 1

H+通过分段相似性检测,在无干净数据时仍能有效防御拜占庭攻击。

H+: An Efficient Similarity-Aware Aggregation for Byzantine Resilient Federated Learning

  • 从参数向量中随机抽取片段,多次比对参考向量识别可信客户端
  • 在无干净数据场景下仍保持高鲁棒性,攻击率高达50%时准确率超90%
  • 计算复杂度低,适合大规模联邦学习系统部署

联邦学习(FL)允许在不共享原始数据的情况下进行分布式模型训练,但易受拜占庭攻击影响,即恶意客户端上传异常参数破坏聚合结果。现有相似性感知聚合方法依赖干净数据作为参考,无法适用于无干净数据的场景。本文提出H+,一种新型相似性感知聚合方法:从每轮上传的p维参数向量中随机选取r维片段,通过相似性函数H与参考向量比对,保留最相似的客户端参数参与聚合。参考向量可来自已有鲁棒算法(无干净数据时)或直接来自干净数据。重复K次该过程,可高效识别诚实客户端。理论分析显示其时间复杂度为𝒪(KMr),且Kr ≪ p,计算开销低。大量实验表明,无论有无干净数据,H+在多种典型拜占庭攻击下均优于现有方法,攻击比例达50%时仍保持超过90%的准确率,在所有基准数据集上表现SOTA。

原文摘要 · Abstract (English)

Federated Learning (FL) enables decentralized model training without sharing raw data. However, it remains vulnerable to Byzantine attacks, which can compromise the aggregation of locally updated parameters at the central server. Similarity-aware aggregation has emerged as an effective strategy to mitigate such attacks by identifying and filtering out malicious clients based on similarity between client model parameters and those derived from clean data, i.e., data that is uncorrupted and trustworthy. However, existing methods adopt this strategy only in FL systems with clean data, making them inapplicable to settings where such data is unavailable. In this paper, we propose H+, a novel similarity-aware aggregation approach that not only outperforms existing methods in scenarios with clean data, but also extends applicability to FL systems without any clean data. Specifically, H+ randomly selects $r$-dimensional segments from the $p$-dimensional parameter vectors uploaded to the server and applies a similarity check function $H$ to compare each segment against a reference vector, preserving the most similar client vectors for aggregation. The reference vector is derived either from existing robust algorithms when clean data is unavailable or directly from clean data. Repeating this process $K$ times enables effective identification of honest clients. Moreover, H+ maintains low computational complexity, with an analytical time complexity of $\mathcal{O}(KMr)$, where $M$ is the number of clients and $Kr \ll p$. Comprehensive experiments validate H+ as a state-of-the-art (SOTA) method, demonstrating substantial robustness improvements over existing approaches under varying Byzantine attack ratios and multiple types of traditional Byzantine attacks, across all evaluated scenarios and benchmark datasets.

联邦学习拜占庭攻击鲁棒聚合安全训练

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。