用统计指纹检测恶意客户端，轻量高效且适配资源受限的联邦学习。
TinyGuard:A lightweight Byzantine Defense for Resource-Constrained Federated Learning via Statistical Update Fingerprints
- 提取更新的统计指纹，低维空间检测异常行为。
- 在多种攻击下保持95%准确率，对抗自适应攻击也有效。
- 无需修改优化流程，适合大模型微调场景。
现有拜占庭鲁棒聚合方法通常依赖全维度梯度比较或成对距离计算，导致计算开销大，难以应用于大规模和资源受限的联邦学习系统。本文提出TinyGuard，一种通过统计更新指纹增强标准FedAvg算法的轻量级拜占庭防御机制。不直接处理高维梯度，而是提取包含范数统计、层间比率、稀疏性度量和低阶矩等关键行为特征的紧凑统计指纹。通过在低维指纹空间中测量鲁棒统计偏差来识别拜占庭客户端，复杂度为O(nd)，且不改变底层优化过程。在MNIST、Fashion-MNIST、ViT-Lite和ViT-Small（带LoRA适配器）上的大量实验表明，TinyGuard在良性环境下保持了FedAvg的收敛性，在多种拜占庭攻击（如符号翻转、缩放、噪声注入、标签投毒）下可达95%准确率。面对自适应白盒攻击，帕累托前沿分析显示，攻击者无法同时规避检测并实现有效污染，这一特性称为统计束缚。消融研究验证了在客户端数量（50–150）、阈值参数及极端数据异构性下，检测精度稳定在0.8。该框架与架构无关，特别适用于传统拜占庭防御难以实施的基础模型联邦微调场景。
原文摘要 · Abstract (English)
Existing Byzantine robust aggregation mechanisms typically rely on fulldimensional gradi ent comparisons or pairwise distance computations, resulting in computational overhead that limits applicability in large scale and resource constrained federated systems. This paper proposes TinyGuard, a lightweight Byzantine defense that augments the standard FedAvg algorithm via statistical update f ingerprinting. Instead of operating directly on high-dimensional gradients, TinyGuard extracts compact statistical fingerprints cap turing key behavioral properties of client updates, including norm statistics, layer-wise ratios, sparsity measures, and low-order mo ments. Byzantine clients are identified by measuring robust sta tistical deviations in this low-dimensional fingerprint space with nd complexity, without modifying the underlying optimization procedure. Extensive experiments on MNIST, Fashion-MNIST, ViT-Lite, and ViT-Small with LoRA adapters demonstrate that TinyGuard pre serves FedAvg convergence in benign settings and achieves up to 95 percent accuracy under multiple Byzantine attack scenarios, including sign-flipping, scaling, noise injection, and label poisoning. Against adaptive white-box adversaries, Pareto frontier analysis across four orders of magnitude confirms that attackers cannot simultaneously evade detection and achieve effective poisoning, features we term statistical handcuffs. Ablation studies validate stable detection precision 0.8 across varying client counts (50-150), threshold parameters and extreme data heterogeneity . The proposed framework is architecture-agnostic and well-suited for federated fine-tuning of foundation models where traditional Byzantine defenses become impractical
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。