Abstract:

Federated Learning （FL）， an emerging distributed machine learning method， enables multiple participants to train models collaboratively while protecting data privacy. However， the existing studies have shown that FL systems face the threat of Byzantine attacks， which may lead to significant degradation of model performance or hinder model convergence. Aiming at Byzantine attacks， an active defense framework for detecting malicious updates and weakening the impact of malicious updates was proposed. The framework consists of two core modules： malicious update detection module and malicious update weakening module. The malicious update detection module identifies malicious updates by constructing a malicious sample library and combining a scoring mechanism and a clustering algorithm； while the malicious update weakening module reduces the negative impact of malicious updates on the global model effectively by distributing a specific “test model” to clients， and adjusting aggregation weights according to model updates from clients using the scoring and weight allocation mechanisms. Experimental results show that the proposed framework has the accuracy of malicious update detection close to 100% for some attack types， while ensures that aggregation weights of benign updates account for more than 90% through malicious update weakening in most attack scenarios.

Key words: Federated Learning (FL), Byzantine attack, active defense framework, anomaly detection, scoring mechanism, weight allocation mechanism

摘要：

联邦学习作为一种新兴的分布式机器学习方法，能够在保护数据隐私的前提下，使多个参与方协同训练模型。然而，现有的研究表明，联邦学习系统容易受到拜占庭攻击，此类攻击可能导致模型性能显著下降或阻碍模型收敛。针对此类攻击，提出一种主动防御框架，以检测恶意更新并减轻恶意更新的影响。该框架包括恶意更新检测与恶意更新削弱2个核心模块。其中，恶意更新检测模块主要通过构建恶意样本库，结合评分机制与聚类算法识别恶意更新；而恶意更新削弱模块则通过向客户端分发特定的“测试模型”，根据客户端响应的模型更新，利用评分及权重分配机制调整聚合权重，从而有效降低恶意更新对全局模型的负面影响。实验结果表明，针对部分攻击类型，本文框架的恶意更新检测准确率接近100%，且通过恶意更新削弱在大部分攻击场景下均保证良性更新的聚合权重占比超过90%。

关键词: 联邦学习, 拜占庭攻击, 主动防御框架, 异常检测, 评分机制, 权重分配机制