# AdRo-FL: Informed and Secure Client Selection for Federated Learning in the Presence of Adversarial Aggregator

arXiv: https://arxiv.org/abs/2506.17805 · HTML: https://mlsanity.com/paper/2506.17805/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 40 references that are in the map.
- First posted on arXiv 21 Jun 2025.

## Builds on (most cited first, 18 of 18)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated learning with hierarchical clustering of local updates to improve training on non-IID data](https://mlsanity.com/paper/2004.11791/) (2020)
- [Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity](https://mlsanity.com/paper/1811.12469/) (2018)
- [LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learning](https://mlsanity.com/paper/2109.14236/) (2021)
- [Federated Learning for Breast Density Classification: A Real-World Implementation](https://mlsanity.com/paper/2009.01871/) (2020)
- [8-Bit Approximations for Parallelism in Deep Learning](https://mlsanity.com/paper/1511.04561/) (2015)
- [Node Selection Toward Faster Convergence for Federated Learning on Non-IID Data](https://mlsanity.com/paper/2105.07066/) (2021)
- [Federated Learning and Differential Privacy: Software tools analysis, the Sherpa.ai FL framework and methodological guidelines for preserving data privacy](https://mlsanity.com/paper/2007.00914/) (2020)
- [Fed-GraB: Federated Long-tailed Learning with Self-Adjusting Gradient Balancer](https://mlsanity.com/paper/2310.07587/) (2023)
- [FLrce: Resource-Efficient Federated Learning with Early-Stopping Strategy](https://mlsanity.com/paper/2310.09789/) (2023)
- [Client Selection in Federated Learning based on Gradients Importance](https://mlsanity.com/paper/2111.11204/) (2021)
- [FedGradNorm: Personalized Federated Gradient-Normalized Multi-Task Learning](https://mlsanity.com/paper/2203.13663/) (2022)
- [Auxo: Efficient Federated Learning via Scalable Client Clustering](https://mlsanity.com/paper/2210.16656/) (2022)
- [Dordis: Efficient Federated Learning with Dropout-Resilient Differential Privacy](https://mlsanity.com/paper/2209.12528/) (2022)
- [Blockchain-based Secure Client Selection in Federated Learning](https://mlsanity.com/paper/2205.05611/) (2022)
- [FedMint: Intelligent Bilateral Client Selection in Federated Learning with Newcomer IoT Devices](https://mlsanity.com/paper/2211.01805/) (2022)
- [Lotto: Secure Participant Selection against Adversarial Servers in Federated Learning](https://mlsanity.com/paper/2401.02880/) (2024)
- [Clustered Scheduling and Communication Pipelining For Efficient Resource Management Of Wireless Federated Learning](https://mlsanity.com/paper/2206.07631/) (2022)

## Built on by (most cited first, 1 of 1)

- [SettleFL: Trustless and Scalable Reward Settlement Protocol for Federated Learning on Permissionless Blockchains (Extended version)](https://mlsanity.com/paper/2602.23167/) (2026)

## Abstract (arXiv)

Federated Learning (FL) enables collaborative learning without exposing clients' data. While clients only share model updates with the aggregator, studies reveal that aggregators can infer sensitive information from these updates. Secure Aggregation (SA) protects individual updates during transmission; however, recent work demonstrates a critical vulnerability where adversarial aggregators manipulate client selection to bypass SA protections, constituting a Biased Selection Attack (BSA). Although verifiable random selection prevents BSA, it precludes informed client selection essential for FL performance. We propose Adversarial Robust Federated Learning (AdRo-FL), which simultaneously enables: informed client selection based on client utility, and robust defense against BSA maintaining privacy-preserving aggregation. AdRo-FL implements two client selection frameworks tailored for distinct settings. The first framework assumes clients are grouped into clusters based on mutual trust, such as different branches of an organization. The second framework handles distributed clients where no trust relationships exist between them. For the cluster-oriented setting, we propose a novel defense against BSA by (1) enforcing a minimum client selection quota from each cluster, supervised by a cluster-head in every round, and (2) introducing a client utility function to prioritize efficient clients. For the distributed setting, we design a two-phase selection protocol: first, the aggregator selects the top clients based on our utility-driven ranking; then, a verifiable random function (VRF) ensures a BSA-resistant final selection. AdRo-FL also applies quantization to reduce communication overhead and sets strict transmission deadlines to improve energy efficiency. AdRo-FL achieves up to 1.85× faster time-to-accuracy and up to 1.06× higher final accuracy compared to insecure baselines.