FLARE通过动态多维信誉评估提升联邦学习抗恶意客户端攻击能力。
FLARE: Adaptive Multi-Dimensional Reputation for Robust Client Reliability in Federated Learning
- 构建多维度信誉分数，持续评估客户端表现与行为变化。
- 自适应阈值使防御强度随攻击频率和模型收敛情况动态调整。
- 软排除机制和本地差分隐私保护提升检测精度与隐私安全。
联邦学习（FL）可在保护数据隐私的同时实现协同模型训练，但易受恶意客户端的拜占庭攻击、数据投毒或自适应对抗行为影响。现有防御方法依赖静态阈值与二元判断，难以适应真实场景中客户端行为的动态演变。本文提出FLARE，一种基于自适应信誉的框架，将客户端可靠性评估从二元决策转变为连续的多维信任度量。FLARE包含：(i) 融合性能一致性、统计异常指标与时间行为的多维信誉评分；(ii) 根据模型收敛状态与近期攻击强度自校准的动态阈值机制；(iii) 基于信誉加权的聚合策略，对可疑贡献进行比例抑制而非直接剔除；(iv) 支持在差分隐私保护下的客户端更新进行信誉评分。我们还引入一种高度隐蔽的统计模仿（SM）攻击，其通过融合真实梯度与合成扰动及持续漂移，逃避传统过滤器检测。在100个客户端的MNIST、CIFAR-10和SVHN数据集上实验表明，FLARE在多种攻击类型下（包括标签翻转、梯度缩放、自适应攻击、ALIE和SM）均保持高准确率并加速收敛，相比现有最优方法鲁棒性提升最高达16%，模型收敛损失控制在非攻击基线的30%以内，且计算开销极低。
原文摘要 · Abstract (English)
Federated learning (FL) enables collaborative model training while preserving data privacy. However, it remains vulnerable to malicious clients who compromise model integrity through Byzantine attacks, data poisoning, or adaptive adversarial behaviors. Existing defense mechanisms rely on static thresholds and binary classification, failing to adapt to evolving client behaviors in real-world deployments. We propose FLARE, an adaptive reputation-based framework that transforms client reliability assessment from binary decisions to a continuous, multi-dimensional trust evaluation. FLARE integrates: (i) a multi-dimensional reputation score capturing performance consistency, statistical anomaly indicators, and temporal behavior, (ii) a self-calibrating adaptive threshold mechanism that adjusts security strictness based on model convergence and recent attack intensity, (iii) reputation-weighted aggregation with soft exclusion to proportionally limit suspicious contributions rather than eliminating clients outright, and (iv) a Local Differential Privacy (LDP) mechanism enabling reputation scoring on privatized client updates. We further introduce a highly evasive Statistical Mimicry (SM) attack, a benchmark adversary that blends honest gradients with synthetic perturbations and persistent drift to remain undetected by traditional filters. Extensive experiments with 100 clients on MNIST, CIFAR-10, and SVHN demonstrate that FLARE maintains high model accuracy and converges faster than state-of-the-art Byzantine-robust methods under diverse attack types, including label flipping, gradient scaling, adaptive attacks, ALIE, and SM. FLARE improves robustness by up to 16% and preserves model convergence within 30% of the non-attacked baseline, while achieving strong malicious-client detection performance with minimal computational overhead. https://github.com/Anonymous0-0paper/FLARE
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。