# A Four-Pronged Defense Against Byzantine Attacks in Federated Learning

arXiv: https://arxiv.org/abs/2308.03331 · HTML: https://mlsanity.com/paper/2308.03331/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Aug 2023.

## Built on by (most cited first, 9 of 9)

- [ZooPFL: Exploring Black-box Foundation Models for Personalized Federated Learning](https://mlsanity.com/paper/2310.05143/) (2023)
- [MARS: A Malignity-Aware Backdoor Defense in Federated Learning](https://mlsanity.com/paper/2509.20383/) (2025)
- [AGRAMPLIFIER: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification](https://mlsanity.com/paper/2311.06996/) (2023)
- [MISA: Unveiling the Vulnerabilities in Split Federated Learning](https://mlsanity.com/paper/2312.11026/) (2023)
- [Can We Trust the Similarity Measurement in Federated Learning?](https://mlsanity.com/paper/2311.03369/) (2023)
- [PFAttack: Stealthy Attack Bypassing Group Fairness in Federated Learning](https://mlsanity.com/paper/2410.06509/) (2024)
- [FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning](https://mlsanity.com/paper/2507.21177/) (2025)
- [FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching](https://mlsanity.com/paper/2604.15115/) (2026)
- [Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities](https://mlsanity.com/paper/2609.28722/) (2026)

## Abstract (arXiv)

textitFederated learning (FL) is a nascent distributed learning paradigm to train a shared global model without violating users' privacy. FL has been shown to be vulnerable to various Byzantine attacks, where malicious participants could independently or collusively upload well-crafted updates to deteriorate the performance of the global model. However, existing defenses could only mitigate part of Byzantine attacks, without providing an all-sided shield for FL. It is difficult to simply combine them as they rely on totally contradictory assumptions. In this paper, we propose FPD, a underlinefour-underlinepronged underlinedefense against both non-colluding and colluding Byzantine attacks. Our main idea is to utilize absolute similarity to filter updates rather than relative similarity used in existingI works. To this end, we first propose a reliable client selection strategy to prevent the majority of threats in the bud. Then we design a simple but effective score-based detection method to mitigate colluding attacks. Third, we construct an enhanced spectral-based outlier detector to accurately discard abnormal updates when the training data is textitnot independent and identically distributed (non-IID). Finally, we design update denoising to rectify the direction of the slightly noisy but harmful updates. The four sequentially combined modules can effectively reconcile the contradiction in addressing non-colluding and colluding Byzantine attacks. Extensive experiments over three benchmark image classification datasets against four state-of-the-art Byzantine attacks demonstrate that FPD drastically outperforms existing defenses in IID and non-IID scenarios (with 30% improvement on model accuracy).