Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification
On the map: LLM safety and security → Federated unlearning and poisoning
Abstract (arXiv)
Federated Learning (FL) systems are susceptible to adversarial attacks, such as model poisoning attacks and backdoor attacks. Existing defense mechanisms face critical limitations in deployments, such as relying on impractical assumptions (e.g., adversaries acknowledging the presence of attacks before attacking) or undermining accuracy in model training, even in benign scenarios. To address these challenges, we propose CustodianFL, a two-staged anomaly detection method specifically designed for FL deployments. In the first stage, it flags suspicious client activities. In the second stage that is activated only when needed, it further examines these candidates using Three-Sigma Rule to identify and exclude truly malicious local models from FL training. To ensure integrity and transparency within the FL system, CustodianFL integrates zero-knowledge proofs, enabling clients to cryptographically verify the server's detection process without relying on the server's goodwill. CustodianFL operates without unrealistic assumptions and avoids interfering with FL training in attack-free scenarios. It bridges the gap between theoretical advances in FL security and the practical demands of real FL systems. Experimental results demonstrate that CustodianFL consistently delivers performance comparable to benign cases, highlighting its effectiveness in identifying and eliminating malicious models with high accuracy.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 39 of its 77 references that are in the map. First posted on arXiv 6 Oct 2023.
Builds on
39 of 77 references.
References · 39
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
- 2018LEAF: A Benchmark for Federated Settingscited by 780
- 2018How To Backdoor Federated Learningcited by 745
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
- 2018Federated Learning for Mobile Keyboard Predictioncited by 565
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
- 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
- 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
- 2019Robust Aggregation for Federated Learningcited by 314
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
27 more
- 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
- 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
- 2019Can You Really Backdoor Federated Learning?cited by 250
- 2020Byzantine-Robust Learning on Heterogeneous Datasets via Bucketingcited by 125
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
- 2019Federated Learning for Emoji Prediction in a Mobile Keyboardcited by 115
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
- 2018Federated Learning for Keyword Spottingcited by 95
- 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 86
- 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
- 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
- 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
- 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 65
- 2020Differentially Private Secure Multi-Party Computation for Federated Learning in Financial Applicationscited by 58
- 2019Federated Learning Of Out-Of-Vocabulary Wordscited by 51
- 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
- 2019Attack-Resistant Federated Learning with Residual-based Reweightingcited by 40
- 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
- 2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 35
- 2022Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learningcited by 30
- 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
- 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 29
- 2023BayBFed: Bayesian Backdoor Defense for Federated Learningcited by 23
- 2019Byzantine-Resilient Stochastic Gradient Descent for Distributed Learning: A Lipschitz-Inspired Coordinate-wise Median Approachcited by 13
- 2023G2uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clusteringcited by 9
- 2023Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspectivecited by 6
- 2017An Iterative Scheme for Leverage-based Approximate Aggregationcited by 2
Built on by
Citing papers per year: 2023: 1; 2024: 1.
2 papers.