Two Heads Are Better than One: Model-Weight and Latent-Space Analysis for Federated Learning on Non-iid Data against Poisoning Attacks
Not on the map. Why?
Abstract (arXiv)
Federated Learning is a popular paradigm that enables remote clients to jointly train a global model without sharing their raw data. However, FL has been shown to be vulnerable towards model poisoning attacks due to its distributed nature. Particularly, attackers acting as participants can upload arbitrary model updates that effectively compromise the global model of FL. While extensive research has been focusing on fighting against these attacks, we find that most of them assume data at remote clients are under iid while in practice they are inevitably non-iid. Our benchmark evaluations reveal that existing defenses generally fail to live up to their reputation when applied to various non-iid scenarios. In this paper, we propose a novel approach, GeminiGuard, that aims to address such a significant gap. We design GeminiGuard to be lightweight, versatile, and unsupervised so that it aligns well with the practical requirements of deploying such defenses. The key challenge from non-iids is that they make benign model updates look more similar to malicious ones. GeminiGuard is mainly built on two fundamental observations: (1) existing defenses based on either model-weight analysis or latent-space analysis face limitations in covering different MPAs and non-iid scenarios, and (2) model-weight and latent-space analysis are sufficiently different yet potentially complementary methods as MPA defenses. We hence incorporate a novel model-weight analysis component as well as a custom latent-space analysis component in GeminiGuard, aiming to further enhance its defense performance. We conduct extensive experiments to evaluate our defense across various settings, demonstrating its effectiveness in countering multiple types of untargeted and targeted MPAs, including adaptive ones. Our comprehensive evaluations show that GeminiGuard consistently outperforms SOTA defenses under various settings.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 20 of its 31 references that are in the map. First posted on arXiv 30 Mar 2025.
Builds on
20 of 31 references.
References · 20
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
- 2021Federated Learning on Non-IID Data Silos: An Experimental Studycited by 568
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
- 2018Deep Learning for Classical Japanese Literaturecited by 422
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
- 2021Federated Learning on Non-IID Data: A Surveycited by 346
- 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
- 2021No Fear of Heterogeneity: Classifier Calibration for Federated Learning with Non-IID Datacited by 241
- 2017EMNIST: an extension of MNIST to handwritten letterscited by 213
8 more
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
- 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
- 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 27
- 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 27
- 2023FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attackscited by 15
- 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
- 2024FLGuard: Byzantine-Robust Federated Learning via Ensemble of Contrastive Modelscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.