Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning
Not on the map. Why?
Abstract (arXiv)
Lossy compression is widely used in Federated Learning (FL) but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior induced by lossy compression can expose differences between honest and attack-generated updates. We introduce the concept of a compression footprint: the low-dimensional collection of reconstruction, directional, sparsity, and payload statistics induced by a lossy compressor. We characterize sufficient conditions under which compression footprints separate honest and malicious updates, and operationalize our findings in the CRAFT (Compression-guided Robust Aggregation via Footprint Trust) server-side robust aggregation method. Crucially, under a strict honest-majority assumption, CRAFT uses server-verifiable footprints, requires no client-side metadata nor knowledge of the number of malicious clients, and adds no communication beyond the compressed FL pipeline. Moreover, while CRAFT assumes a strict honest majority, it does not require the number of malicious clients to be known in advance. We observe that error-bounded lossy compressor (EBLC) footprints provide stronger separation than Top-K footprints and that footprint trust suppresses malicious influence. We evaluate CRAFT under IID client data with 36% malicious participation across six standard model-poisoning attacks, three datasets, and six robust aggregation baselines, finding that CRAFT consistently achieves the best accuracy in 7 out of 18 settings and within 1.7 percentage points of the best in the others. Our results show that lossy compression can serve as both a communication mechanism and a security signal for robust aggregation in FL.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 20 of its 29 references that are in the map. First posted on arXiv 30 Sep 2026.
Builds on
20 of 29 references.
References · 20
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2018How To Backdoor Federated Learningcited by 765
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
- 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
- 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
- 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
- 2019Can You Really Backdoor Federated Learning?cited by 255
- 2019Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulationcited by 141
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
8 more
- 2019Byzantine-Robust Federated Machine Learning through Adaptive Model Averagingcited by 70
- 2019Understanding Top-k Sparsification in Distributed Deep Learningcited by 56
- 2018TTHRESH: Tensor Compression for Multidimensional Visual Datacited by 42
- 2024Model Poisoning Attacks to Federated Learning via Multi-Round Consistencycited by 18
- 2024Achieving Byzantine-Resilient Federated Learning via Layer-Adaptive Sparsified Model Aggregationcited by 15
- 2021BROADCAST: Reducing Both Stochastic and Compression Noise to Robustify Communication-Efficient Federated Learningcited by 13
- 2023Communication Compression for Byzantine Robust Learning: New Efficient Algorithms and Improved Ratescited by 12
- 2023FedSZ: Leveraging Error-Bounded Lossy Compression for Federated Learning Communicationscited by 4
Built on by
Not cited yet.