WGMwgm QEqe EPep PMSpms BECbec DEde

# FedRDF: A Robust and Dynamic Aggregation Function against Poisoning Attacks
in Federated Learning

Enrique Mármol Campos, Aurora Gonzalez-Vidal José L. Hernández-Ramos and
Antonio Skarmeta Enrique Marmol, Aurora Gonzalez-Vidal José L. Hernández-Ramos
and Antonio Skarmeta are with the University of Murcia, Spain. E-mail:
{enrique.marmol, aurora.gonzalez2, jluis.hernandez<EMAIL_ADDRESS>
###### Abstract

Federated Learning (FL) represents a promising approach to typical privacy
concerns associated with centralized Machine Learning (ML) deployments.
Despite its well-known advantages, FL is vulnerable to security attacks such
as Byzantine behaviors and poisoning attacks, which can significantly degrade
model performance and hinder convergence. The effectiveness of existing
approaches to mitigate complex attacks, such as median, trimmed mean, or Krum
aggregation functions, has been only partially demonstrated in the case of
specific attacks. Our study introduces a novel robust aggregation mechanism
utilizing the Fourier Transform (FT), which is able to effectively handling
sophisticated attacks without prior knowledge of the number of attackers.
Employing this data technique, weights generated by FL clients are projected
into the frequency domain to ascertain their density function, selecting the
one exhibiting the highest frequency. Consequently, malicious clients’ weights
are excluded. Our proposed approach was tested against various model poisoning
attacks, demonstrating superior performance over state-of-the-art aggregation
methods.

###### Index Terms:

Federated Learning , Fourier Transform, Robust aggregation function

##  I Introduction

Federated Learning (FL) McMahan et al. (2017) is a decentralized paradigm of
Machine Learning (ML) where data is not shared through typical datacenters for
further analysis. FL involves multiple clients (or parties) and an aggregator
or set of aggregators. Such clients collaboratively train an ML model using
their respective datasets without sharing the raw data; indeed, solely the
parameters generated during local training are shared with the aggregator.
This decentralized ML approach addresses some of the main privacy challenges
associated with conventional centralized ML deployments in terms of privacy
and its impact on the enforcement of General Data Protection Regulation (GDPR)
principles Goddard (2017). In this context, FL emerges as a promising solution
for privacy-related concerns and also for mitigating the issues associated
with the delay required to share and process the data on servers or
centralized platforms during model training Rasha et al. (2023). Consequently,
FL has found widespread utility across multiple domains Rodríguez-Barroso et
al. (2023), including finance, healthcare, smart cities Matheu et al. (2022)
and cybersecurity Campos et al. (2021).

The training process in a FL scenario encompasses each client transmitting
their individual model updates or weights to the aggregator, which
subsequently aggregates these contributions by using a certain aggregation
function.Typically, the aggregation function entails averaging the clients’
weights and sending the outcome back to the clients in each training round.
However, like in centralized ML deployments, FL is subject to various types of
security attacks, including Byzantine clients, which do not behave as
expected. Specifically, poisoning attacks are intended to modify the data or
directly the weights shared by clients with the aggregator to degrade the
model’s performance and hinder its convergence Xia et al. (2023). Indeed,
previous works confirm FL’s susceptibility to poisoning attacks Baruch et al.
(2019), particularly highlighting the vulnerability of the average function or
FedAvg McMahan et al. (2017) as an aggregation approach. In the context of FL,
model poisoning attacks involve maliciously modifying the weights/gradients in
each training round. As we discussed in Hernandez-Ramos et al. (2023), these
attacks are especially relevant in FL. In fact, since the data is not shared,
model poisoning also includes the effect produced by data poisoning attacks,
such as dirty-label Bhagoji et al. (2019). To address these attacks, various
robust aggregation functions were proposed, such as the use of median, trimmed
mean Yin et al. (2018) or Krum Blanchard et al. (2017). However, most of these
approaches, as well as the works based on these techniques, only address
simple poisoning attacks, where attackers lack the ability to collude with
each other. Additionally, some of these proposals assume that the number of
attackers is known, which may not be feasible in real-world scenarios or
against sophisticated attacks where the compromised nodes can change in each
training round.

Unlike the previous approaches, our robust aggregation mechanism does not
require knowledge of the number of attackers in a certain scenario, and it is
not based on distance or statistical approaches. Instead, we employ a
technique based on the well-known Fourier Transform (FT) Gray and Goodman
(2012), which is used to convert the weights sent in each round into the
frequency domain to calculate their density function. Thus, only the weights
with higher frequencies are selected. Our approach has been thoroughly
evaluated against two types of model poisoning attacks: in the first case,
compromised clients generate random weights to be shared with the aggregator;
in the second case, we use the min-max attack where the compromised nodes
collude to achieve a greater impact on the performance of the resulting model
Shejwalkar and Houmansadr (2021). The evaluation results demonstrate that our
approach offers better results against both attacks compared to well-known
aggregation functions, without adding further complexity. Additionally, our
proposed FT-based approach is complemented with a simple mechanism to
determine the existence of Byzantine attackers in each training round. The
main reason is that in the absence of attackers, the use of FedAvg as an
aggregation mechanism provides better results compared to robust aggregation
functions. Thus, the resulting approach FedRDF is designed to maximize the
effectiveness of the system by choosing between FedAvg and FT depending on the
presence of malicious clients in each training round. In summary, the
contributions of our work are:

  * •

Design and implementation of a novel Fourier Transform-based robust
aggregation function for model poisoning attacks

  * •

Definition of a threat model and implementation of different attacks for the
evaluation and analysis of the proposed approach

  * •

Dynamic aggregation strategy to alternate between FedAvg and the proposed FT-
based method based on the detection of malicious clients

  * •

Extensive performance evaluation demonstrating enhanced resistance against
certain attacks compared with state-of-the-art approaches

The paper’s organization is as follows: it starts with foundational concepts
in Section II, then explores related works in Section III focusing on robust
aggregation against attacks. Section IV outlines the threat model and
considered attacks. Following this, Section V details the robust aggregation
steps and dynamic client selection. The evaluation results are presented in
Section VI, and finally, Section VII summarizes the study’s findings and
conclusions.

##  II Preliminaries

In this section, we describe the main notions related to our work, including
the FL components and process, as well as the role of aggregation functions
and the typical structure of poisoning attacks.

###  II-A Federated learning

Federated learning (FL) McMahan et al. (2017) introduced a decentralized
collaborative approach in ML, enabling model training without sharing
underlying data. FL settings typically comprise distinct entities: the clients
and an aggregator. Each client possesses unique, private datasets undisclosed
to others during the collaborative training process. Clients collectively
train a shared ML model, solely exchanging the resultant weights while the
aggregator, or server, aggregates these weights and redistributes them for
subsequent training. This FL process unfolds through distinct steps:

  1. 1.

The aggregator initializes the model and dispatches it to the clients.

  2. 2.

Clients individually train the model through local iterations (epochs).

  3. 3.

Clients transmit their obtained weights to the aggregator.

  4. 4.

The aggregator aggregates these weights to generate new weights, subsequently
relayed to the clients.

Steps 2), 3), and 4) are iterated multiple times (rounds) until weight
convergence is achieved.

The pivotal element within the server is the aggregation function, commonly
exemplified by FedAvg, initially proposed by McMahan et al. (2017), in which
weights are aggregated trough the mean. FedAvg involves clients calculating
local weights and transmitting them to the server. The server aggregates these
weights by computing their average based on the respective data lengths.
Specifically, the FedAvg objective function is derived using Equation 1,
wherein $W=(w_{i})_{i=1}^{n}$ denotes the server’s model weights,
$W^{k}=(w_{i}^{k})_{i=1}^{n}$ represents client $k$’s weights, $D_{k}$ is the
length of the client $k$ dataset, and $D$ total sum of all dataset lengths.

$W=\sum_{k=1}^{K}\frac{D_{k}}{D}W^{k},$ (1)

###  II-B Poisoning attacks

Poisoning attacks in FL are intended to harm the training phase by introducing
maliciously modified data or weights to undermine the model performance
Barreno et al. (2006). These attacks are usually represented in two forms:
data poisoning attacks and local model poisoning attacks. Data poisoning
involves manipulating a client’s local data to induce misclassification.
Conversely, local model poisoning targets altering the weights generated
through the local training process, so that clients transmit corrupted weights
to the aggregator. Recent works Bhagoji et al. (2019); Fang et al. (2018)
argue that data poisoning attacks can essentially be perceived as local model
poisoning by computing their corresponding weight modifications. Moreover,
empirical evidence suggests that local model poisoning attacks yield more
significant impact than dataset alterations. Consequently, this study focuses
on attacks intended to manipulate clients’ weights.

Local model poisoning attacks encompass two classes: untargeted and targeted
poisoning attacks Tian et al. (2022). Untargeted attacks constitute the basic
form, seeking to minimally modify the global model to yield incorrect
predictions for different samples. In contrast, targeted attacks are
intricate, introducing a multi-task problem to manipulate the victim’s
predictions on specific samples while maintaining functionality on benign
samples—distinct from random alterations in untargeted attacks. This study
prioritizes untargeted attacks to safeguard the system against any form of
assault, unlike targeting specific misclassifications. Additionally, research
in Kiourti et al. (2020) underscores the challenge in detecting untargeted
poisoning attacks compared to their targeted counterparts. Section V provides
comprehensive insight into the attack types considered within this study.

###  II-C Robust aggregations functions

Robust aggregation functions are meant to resist corrupted weights by looking
for alternatives to the mean, aggregation functions that can filter the
correct weights from the false ones. We show a summary of the robust
aggregation functions considered in this work in table I. In this table, the
main characteristics of these functions are displayed, including the
underlying technique, the requirement of known number of attackers, and the
computational cost.

| Underlying technique | Requirement of known number of attackers | Computational cost
---|---|---|---
Median | Median statistic | No | Medium
Krumm | Euclidean distance | Yes | High
Trimmed mean | Validation data | Yes | Medium
FFT | Frequency statistics | No | Medium
Table I: Summary of the main state-of-the-art aggregation functions and our
FFT-based approach

####  II-C1 FedMedian

FedMedian, proposed by Yin et al. (2018), represents a different approach
compared with FedAvg by employing a median computation rather than averaging
weights. This variant computes the median in a coordinate-wise manner,
evaluating weight values individually.

$W=Median(W^{1},\dots,W^{K})$ (2)

####  II-C2 Trimmed Mean

The trimmed mean, as proposed by Yin et al. (2018), constitutes a distinct
approach to mean computation. This method involves selecting a value
$n<\frac{K}{2}$, where $K$ represents the number of clients. Subsequently, in
a coordinate-wise manner, the server eliminates the lowest $n$ values and the
highest $n$ values, computing the mean from the remaining $K-2n$ values. The
selection of $n$ aims to eliminate outlayers and enhance the system’s
capability against potential adversarial behavior from $n$ malicious clients,
thereby fortifying the system against up to 50% of malicious entities.
Denoting this resulting set as $I$:

$W=\sum_{n}^{K-n}\frac{|I_{i}|}{|I|}W^{i},$ (3)

####  II-C3 Krumm

The Krumm aggregation function, introduced by Blanchard et al. (2017), derives
from the Krumm function (Equation 4). This function operates on the clients’
weights $W^{k}$, selecting the weight with the lowest sum among their $K-f-2$
nearest neighbors. Here, $K$ denotes the total number of clients, $f$
represents a server-determined constant indicative of the count of malicious
clients, and $\Gamma_{K-f-2}^{i}$ denotes the set of nearest neighbors for
client $k$. Subsequently, the server transmits this selected value to the
remaining clients.

$Krum(W^{1},W^{2},\dots,W^{K})=Min\\{(\sum_{j\in\Gamma_{K-f-2}^{i}}||W^{i}-W^{j}||)_{i=1}^{K}\\}$
(4)

###  II-D Data representation

There are several approaches to representing a numeric variable, as the set of
weights in a FL environment are. The most basic one is to compute the mean and
standard deviation among other statistical measures (e.g. variance, mode) and
that is how FedAvg, FedMean and other basic functions are composed. However,
using those statistics it is not possible to represent and grasp all the
information that the variable contains Gonzalez-Vidal et al. (2018).

Representation methods are techniques used to transform input data into a more
meaningful and informative representation by means of symbols Lin et al.
(2007), aggregate by intervals Zhang and Glass (2011), domain transformations
Gonzalez-Vidal et al. (2018), and other kinds of operations.

If we interpret aggregation functions as a way to represent the set of
weights, it is possible to use more elaborated representation methods in order
to perform aggregation in FL scenarios. The only restriction is that those
methods need to be invertible, meaning that they should allow for the
reconstruction or decoding of the original input data from the learned
representation so that the final aggregated result is in the domain of the
original weights. This restriction needs to be fulfilled so that the
aggregation can be used again in the different clients as weight without
compromising the clients’ models. Some examples of invertible transformation
are the Discrete Cosine Transform (DCT), Autoencoders, Principal Component
Analysis (PCA) and the Fourier Transform.

####  II-D1 Fourier Transform

The Fourier transform emerges as a specialized case within the realm of
Fourier series Tolstov (2012). Fourier series find application in analyzing
periodic functions over $\mathbb{R}$, specifically those conforming to
$f(x)=f(z+L)$, defined by Equation 5.

$f(x)=\sum_{n=-\infty}^{\infty}\hat{f}(n)\exp^{\frac{2\pi inx}{L}},$ (5)

Here, $\hat{f}(n)=\frac{1}{L}\int_{a}^{b}f(x)\exp^{\frac{-2\pi inx}{L}}dx$ ,
$n\in\mathbb{Z}$ , and $L=b-a$.

The Fourier transform extends this theory to encompass non-periodic functions
on $\mathbb{R}$, aiming to associate a function $f$ defined on $\mathbb{R}$
with another function $\hat{f}$ on $\mathbb{R}$. This $\hat{f}$ is referred to
as the Fourier transform Gray and Goodman (2012); Kammler (2007); Stein and
Shakarchi (2011) of $f$ and is defined by:

$\hat{f}(\omega)=\int_{-\infty}^{\infty}f(x)e^{-2\pi ix\omega}dx$ (6)

Thus, extending a periodic function infinitely allows designating this
transform $\hat{f}$ as the representation of $f$ in the frequency domain. One
of the advantages of the Fourier transform is that is easily invertible, being
in this case the equation 7

$f(x)=\int_{-\infty}^{\infty}\hat{f}(\omega)e^{2\pi in\omega}d\omega,$ (7)

In our context, we utilize the discrete version of the Fourier transform
denoted by the equation:

$X(n)=\sum_{m=0}^{N-1}x(m)e^{-\frac{2\pi in}{N}},$ (8)

where $N$ represents the total number of points. Given the objective of
minimizing computational costs while building a robust aggregation function,
the Fast Fourier transform (FFT) is employed. Instead of conducting a total of
$N^{2}$ operations, this technique recursively divides the sum into even and
odd points, effectively reducing the total operations to $N\log N$. From the
comparison in Shi et al. (2022) illustrated in Table II, it’s evident that the
FFT, our selected function, doesn’t incur additional computation compared to
others, highlighting the notably high computational cost associated with the
Krumm function.

| Computation time
---|---
Mean | $\mathcal{O}(KN\log{N})$
Median | $\mathcal{O}(KN\log{N})$
Trimmed mean | $\mathcal{O}(KN\log{N})$
Krumm | $\mathcal{O}(KN^{2})$
FFT | $\mathcal{O}(KN\log{N})$
Table II: Computation cost of the different aggregation functions

##  III Related work

In recent years, the resilience of FL systems against poisoning attacks has
garnered significant interest. Some recent works applied some of the functions
described in the previous section to specific attacks using certain datasets.
For example, Rey et al. (2022) employs median and trimmed mean to protect
their federated process using an intrusion detection dataset for IoT, although
authors do not consider sophisticated colluding attacks, like the min-max. The
description of median and trimmed mean is provided by Yin et al. (2018), but
the authors do not offer experimental results on the resilience of these
functions to Byzantine attacks. Additionally, So et al. (2020) implements a
variant of Krum called multi-Krum, in which the update generated by the
aggregator in each round is based on averaging several updates provided by the
clients. While collusion attacks are considered, these are related to privacy
aspects Ruzafa-Alcázar et al. (2021).

Moreover, other studies consider variations of existing aggregation functions
or define new approaches to address different poisoning attacks. In this
direction, Pillutla et al. (2022) uses the geometric median instead of the
median as employed in FedMedian. Specifically, the authors define RFA, a
robust aggregation algorithm based on the weighted geometric median to defend
the system against clients’ corrupted weights considering aspects of privacy
and efficiency. Moreover, the authors of Li et al. (2021a) extend this
technique of the geometric median by incorporating additional weights for
those that are close to each other based on their formula for measuring
skewness. In both works, they adapted their method to fit non-IID scenarios by
adding personalization techniques Kulkarni et al. (2020). Looking at other
works that use different aggregation functions, in Cao et al. (2020), the
authors present FLTrust, a method to prevent the global model from being
infected by malicious clients. In their method, after each client iteration,
the server checks for maliciousness by calculating their trust score based on
similarity with the global model using cosine similarity, then they apply the
ReLu function to take those greater than 0. Next, the weights are normalized
and aggregated using the mean. Finally, the work Li et al. (2021b) presents
LoMar, an algorithm created to defend the FL process against poisoning
attacks. Their algorithm is divided into two parts, first they divide the
model weights using the $k$ nearest neighbors and then use their density using
kernel density estimation (KDE) to calculate what they call the client’s
malicious factor. And in the second part, they set a threshold to assess which
clients are malicious.

Unlike previous approaches, our proposed robust aggregation function utilizes
the Fourier Transform to project the weights sent by clients in each training
round into the frequency domain. Using the density function, values with the
highest density are selected for aggregation. It is noteworthy that only
recently a study by Zhao et al. (2022) considered a transform-domain based
approach to enhance efficiency and precision, though security aspects are not
addressed. In our case, we use the fast Fourier Transform to convert the
weights sent by the clients into the frequency domain. Our approach is tested
against simple poisoning attacks in which a set of attackers generate random
weights Pillutla et al. (2022), as well as in scenarios with sophisticated
attacks where several compromised nodes collude using the min-max attack,
which has been proven to be a highly effective attack approach in FL scenarios
Shejwalkar and Houmansadr (2021).

##  IV Threat model and considered attacks

In this section, we describe the attacks considered in this work, and then, we
will describe the complete FL system involving benign and malign clients.

###  IV-A Threat model

Based on the description provided in Section II, we provide a detailed
explanation of the considered FL scenarios, as well as the attacks implemented
to assess our robust aggregation approach. Specifically, we consider an FL
scenario composed of K clients and one aggregator. It is important to note
that, although the proposed scenario only considers a single aggregator, our
approach can be used in a decentralized or hierarchical setting where multiple
aggregators are deployed Lalitha et al. (2018). Our threat model assumes the
existence of a number M of compromised clients or byzantine attackers, where
$M<K/2$, and we assume that the aggregator is not compromised. In each
evaluation scenario, all malicious clients $m\in M$ will execute one of the
two considered attacks, which are described in the following subsection.

To describe our threat model, we consider the systematization of threat models
for poisoning attacks in FL proposed by Shejwalkar et al. (2022). This system
describes different aspects related to the characteristics of the attackers,
including their objectives, knowledge, and capabilities:

  * •

Objective of the adversary: for both attacks, the goal is to reduce the
model’s accuracy by manipulating the weights generated from local training in
each FL round. Therefore, our considered attacks are indiscriminate (or
untargeted Baruch et al. (2019)) and generic, as their aim is to cause a
general misclassification of the data used, without targeting a specific class
or set of samples.

  * •

Knowledge of the adversary: in both attacks, the attackers only have access to
the model updates produced by the client they control, but not to the other
clients. Nevertheless, in the case of the min-max attack (see Section IV-B),
the compromised nodes have access to the updates produced by other malicious
nodes to collude with them. Therefore, following the categorization described
by Shejwalkar et al. (2022), we assume whitebox knowledge regarding the models
produced by the clients in each training round. Moreover, although it could be
considered in future work, we assume that the attackers do not have
information related to the aggregation function used.

  * •

Capabilities of the adversary: our considered attacks are based on poisoning
the models produced by the clients in each training round. Access can be
triggered by direct access to the device itself, or through attacks such as
Man-in-the-middle where the attacker receives the updates and modifies them
before they are sent to the aggregator in each training round. Furthermore,
both attacks follow an online mode, since, unlike typical attacks like label-
flipping which are carried out at the beginning of training, our attacks are
launched in every training round. In addition, in the case of the min-max
attack, the attackers have the ability to collude with each other by
exchanging their local updates to achieve a greater impact.

Additionally, we assume a scenario with no dropouts or stragglers Park et al.
(2021), meaning the nodes remain active throughout all the rounds of the
training process.

###  IV-B Attacks considered

Before describing our robust aggregation approach for FL, we first outline the
considered attacks. It is important to note that we consider that in each
training round, a node may be compromised with the intention of degrading the
performance of the global model. The first attack is based on sending random
weights in each training round. Specifically, instead of sending updated
weights based on local training on their data, a compromised node will send a
set of weights generated randomly through a random Gaussian initialization
(provided by the Keras library) to the aggregator. As demonstrated in previous
works Pillutla et al. (2022), despite their low complexity, the implementation
of these attacks leads to a significant degradation of performance if
appropriate measures are not deployed.

The second type of attack is introduced in Shejwalkar and Houmansadr (2021),
where the authors test some of the robust aggregation functions described in
Section II, and exploit their weaknesses to reduce their overall performance.
The authors catalog various attack strategies, among which we adopt a
particularly challenges variant: the agnostic min-max attack. This strategy is
designed to be effective even without knowledge of the aggregation function or
the benign clients’ weights. The choice to focus on the min-max attack is that
according to Shejwalkar and Houmansadr (2021), its impact is more significant
compared with other attacks, such as LIE Baruch et al. (2019) and Fang Fang et
al. (2020) attacks.

The methodology of min-max attack is based on an initial step in which
malicious clients conduct model training with a standard dataset, like a
benign client. Subsequently, these malign entities circulate their computed
weights among themselves. The next step involves the calculation of new
weights, which are crafted to maximize divergence from both the aggregated
benign weights and from each other’s weights, while maintaining a level of
subtlety to eschew detection. These optimized weights are then sent to the
aggregator. The equation to derive such final malign weights is described in
Equation (9):

$\Theta=A((W^{m})_{m\in M})+\gamma\Theta^{p},$ (9)

where $M$ denotes the set of malicious clients, $A(\cdot)$ is the aggregation
function, $\Theta^{p}$ symbolizes the perturbation vector, and $\gamma$ is a
scaling coefficient. Here, $\Theta^{p}$ and $\gamma$ represent the direction
and the distance of the perturbation added to the average weights of malicious
clients. $\gamma$ is calculated by 10. $\Theta^{p}$ can be calculated by three
different ways Shejwalkar and Houmansadr (2021): through the inverse unit
vector, i.e., dividing the weights through their norm,
$=-\frac{\Theta}{||\Theta||_{2}}$; the inverse standard deviation,
$\Theta^{p}=-std((W^{m})_{m\in M})$; and the inverse sign,
$\Theta^{p}=-sign(\Theta)$, where $sign$ in equal to 1, 0, or -1 depending on
the sign of the value. In this work, we use the inverse unit vector method, as
it induced the most substantial decline in the global model’s accuracy. A
graphical representation of the min-max attack is provided in Figure 1. Within
this figure, individual points denote the weights: the malicious weights are
in red, benign weights in solid green, weights of the malignant client post-
training are green with a red dot, and light green points depict the
hypothetical benign weights in the absence of any malign influence. These
malign weights, as previously described, are strategically positioned as
distant as feasible from the benign weights, incrementally causing divergence
to reduce the global model’s accuracy. To do so, after the training, the
malign clients share their weights in order to calculate the mean, and then by
equation 9 calculate the final malign weights to be sent to the server.

$argmax_{\gamma}\max_{m\in M}||\Theta-W^{m}||\leq\max_{m,l\in
M}||W^{m}-W^{l}||$ (10)

Figure 1: Visual description of how min-max attack works. The malicious
weights (red points) separate from legitimate weights (green points), with the
intention of degrading the overall system performance. The attack forces the
legitimate weights to deviate from their true positions (indicated by light
green), which they would naturally converge to in the absence of malicious
entities.

The resulting FL scheme considered in this work is shown in Figure 2 with $K$
clients where there are $M<K$ compromised clients. These clients will send
fake weights with the intention of harming the model performance, deviating
the benign weights from their original direction. In some cases, malicious
clients may operate independently (e.g., sending random weights) or
collaborate to maximize their impact (e.g., through the min-max attack).
Particularly in scenarios where several clients collude, as illustrated in
Fig. 2, certain clients join forces to generate certain weights aimed at
significantly disrupting the overall process. This collaboration involves
employing a specific function, denoted as $F_{M}$, which in our context refers
to the min-max attack (see Equation 9).

Figure 2: Scheme of our federated environment. Benign weights are presented as
green packages. Malign clients cooperate to send malicious weights (red
packages) to the server using a certain function $F_{M}$ (9 in our case). The
server aggregates the weights using a certain aggregation function $F$

##  V Methodology

In this section, we describe our Byzantine-resilient secure aggregation
function based on the FFT. An inherent property of the FFT is the capability
of obtaining the density function through its frequency domain Nanbu (1995).
From this density function, we select the maximum value, i.e., the point with
highest frequency. For aggregating the clients’ weights using the FFT, once
the server receives the weights $(W^{k})_{1}^{K}$ of the $K$ clients, it
calculates the FFT in a coordinate-wise way and selects the point whose FFT is
the highest. Specifically, as shown in Fig. 3 we calculate the vectors
$V_{i,l}=\\{w^{1}_{i,l},\dots,w^{K}_{i,l}\\}$, where $w^{k}_{i,l}$ is the
$i$-th element of the weights $W^{k}$ at layer $l$ of client $k$. Then, these
vectors $V_{i,l}$ are sorted, and for each $i$ and $l$, we compute the FFT of
this vector to transform it into a frequency vector, since as said in section
II-D1, we can project any function to the frequency domain, and hence,
calculate the density function in this case. Then, we take the index of the
point of $V_{i,l}$ that achieves the maximum value in the frequency vector.

Specifically, we take:

$\bar{w}_{i,l}=arg\,max_{w^{k}_{i,l}}\\{FFT(V_{i,l})\\}\forall i,l$ (11)

Figure 3: Visual description of our aggregation method

Then, the aggregated model is calculated by joining all these $\bar{w}_{i,l}$
into $\bar{W}$. Such model $\bar{W}$ is sent to the clients. This method
operates on the principle that the weights from benign clients are likely to
be grouped closely in the vector space. By applying the FFT to compute the
density function of the vector $V_{i,l}$, we can identify such groups. The
density function is expected to peak in regions where benign weights
congregate, while malicious weights, which must deviate to impact performance
adversely, will be isolated from these high-density zones. Consequently, such
outlier weights exert minimal influence on the result of Equation 11,
regardless of their magnitudes.

This approach effectively shields the system against malicious clients.
However, as discussed in Section III and further in our work, in scenarios
devoid of malicious activity, a simple mean of the weights proves to be the
most efficient. Traditional methods prioritize defense against spurious
weights at the expense of some accuracy, an unnecessary trade-off in the
absence of malicious clients. To address this, our method incorporates a
dynamic selection mechanism between the mean and Equation 11. This
adaptability ensures minimal accuracy loss in any situation, whether malicious
clients are present or not. Specifically, our approach uses the FedAvg
function in environments without presence of malicious activity, shifting
towards FFT-based aggregation as the presence of malicious clients increases.

To optimize the final accuracy of the model and judiciously select between the
two aggregation methods, we employ the Kolmogorov–Smirnov (K-S) test Berger
and Zhou (2014), as outlined in 1. The K-S test is a robust, non-parametric
method for assessing the goodness-of-fit. This test contrasts two sample
distributions to determine if they significantly diverge from one another. The
essence of the K-S test is captured by the following equation:

$KS(F_{1},F_{2})=sup{F_{1}(x)-F_{2}(x)}$ (12)

where $F1$ and $F2$ are the cumulative distribution functions of the two
samples under comparison, and $sup$ denotes the maximum difference between
these distributions. By applying this test, we can effectively discern between
benign and potentially malicious weight distributions, thereby guiding the
decision to use either of the aggregation methods to improve the model’s
performance.

We operate under the assumption that benign weights, which are derived from
using the same model and dataset (but different samples), will exhibit a
consistent distribution pattern. To test this assumption, we select a subset
of points of size $S$ from the vectors $V_{i,l}$ and use the remaining points
to calculate the $p$-value from the K–S test. A $p$-value exceeding 0.05
indicates that the sampled subset adheres to the general distribution of the
remaining points, suggesting the absence of malign influences. Conversely, a
lower $p$-value implies a deviation from the expected distribution, signaling
the presence of potentially malicious clients.

This testing procedure is replicated $C$ times for each vector $V_{i,l}$, with
each iteration considering a different subset. We then compute the frequency
with which the test results indicate a deviation from the expected
distribution. The mean of these frequencies is calculated for every $i$ and
$l$ of $V_{i,l}$. If this average $p$ surpasses a predetermined threshold
$\alpha$, it implies the presence of malicious weights, prompting the server
to implement the FFT for aggregation. If the average $p$ remains below
$\alpha$, the server defaults to using FedAvg. A concise overview of this
process is depicted in 13, where $F$ represents the server’s aggregation
function.

$F(W^{1},\dots,W^{K})=\left\\{\begin{array}[]{lcc}FedAvg(W^{1},\dots,W^{K})&if&p\leq\alpha\\\
\\\ FFT(W^{1},\dots,W^{K})&if&p>\alpha\end{array}\right.$ (13)

This methodology is designed not only to optimize performance irrespective of
the number of malicious clients but also to safeguard the system against
sudden attacks. For instance, consider a scenario where the system is secure
at round $r$, but at round $r+1$, several clients become compromised and begin
transmitting malicious weights. In such a situation, our approach would
utilize FedAvg as aggregation method for all rounds up to and including round
$r$. However, upon the onset of the attack at round $r+1$, it would switch to
using the FFT for aggregation. This adaptive strategy ensures that our method
aligns with the most effective function for each specific circumstance,
thereby avoiding any unnecessary loss in accuracy.

Algorithm 1 Algorithm of our robust dynamic federated learning framework

0: $N$ set of clients, $R$ number of rounds, $E$ number of epochs, $C$ number
of repetitions of malicious test, $S$ size of the subset part of malicious
test, and $t$ threshold.

0: Global model $W$

1: for $r$ in 1 to $R$ do

2: $W_{r}^{k}=\text{localUpdate}(W_{r-1},E)$

3: Send $W_{r}^{k}$ to the server

4: for client $\in N$ do

5: $W_{r}^{k}=\text{localUpdate}(W_{r-1},E)$

6: Send $W_{r}^{k}$ to the server

7: end for

8: for Server do

9: $t_{r}=\text{mean}(Mal\\_test(\\{W_{r}^{1},\dots,W_{r}^{|N|}\\}),C,S)$

10: if $t_{r}<t$ then

11: $W_{r}=\text{mean}(\\{W_{r}^{1},\dots,W_{r}^{|N|}\\})$

12: else

13: $W_{r}=\text{FFT}(\\{W_{r}^{1},\dots,W_{r}^{|N|}\\})$

14: end if

15: Send $W_{r}$ to clients

16: end for

17: end for $Mal\\_test(\\{W_{r}^{1},\dots,W_{r}^{|N|}\\}),C,S):$

18: Calculate $V_{i,l}=\\{w^{1}_{i,l},\dots,w^{K}_{i,l}\\}\forall i,l$

19: for all $V_{i,l}$ do

20: for 1, 2, …, C do

21: Take sample $\hat{V}_{i,l}$ of $V_{i,l}$ of size S

22: Calculate $p$-value of $KS(\hat{V}_{i,l},V_{i,l}\setminus\hat{V}_{i,l})$

23: end for

24: Calculate average of the previous $p$-values

25: end for

26: Return vector of $p$-values

##  VI Evaluation

In this section, we describe the evaluation conducted to demonstrate the
feasibility of our approach and its ability to fights against the described
attacks. Thus, we provide a comprehensive evaluation comparing the performance
of our previously described mechanism in section V with well-known techniques
such as Krum and Trimmed mean, in scenarios where the described attacks are
implemented.

###  VI-A Settings and dataset

For the evaluation of our robust dynamic aggregation function, we consider
several federated scenarios running in a virtual machine with processor
Intel(R) Xeon(R) Silver 4214R CPU @ 2.40GHz with 32 cores and 96 GB of RAM.
Furthermore, our scenarios are deployed using the Flower implementation Beutel
et al. (2020).

Moreover, we use the FEMNIST dataset, which represents a federated version of
EMNIST Cohen et al. (2017) created by LEAF Caldas et al. (2018) that is
publicly available111https://github.com/TalwalkarLab/leaf. FEMNIST is a
dataset of handwritten characters used for image classification. It is the
result of dividing the EMNIST dataset into 3550 non-iid clients. The data
contains 62 classes (the numbers from 0 to 9, and 52 letters either in upper
and lower case).

We employ a Convolutional Neural Network (CNN) architecture composed by four
hidden layers: three convolutional layers with kernel sizes of 8x8 with 8, 16,
and 24 channels, followed by a fully connected layer consisting of 128
neurons. Each of these layers utilizes the ReLU activation function. The
network culminates in an output layer of 62 neurons, employing a softmax
activation function for multi-class classification.

For the experimental setup, we initially selected a cohort of 100 clients
through a random sampling process. These clients were then fixed to ensure
consistency across all experiments and procedural steps. Each client dataset
encompasses 1315 samples across 47 classes, with an average entropy of 0.93.
This entropy value, computed using the Shannon entropy formula Bonachela et
al. (2008), serves as an indicator of class distribution balance within each
client’s dataset. Additionally, we divided the dataset of each node into
training data (80%) and testing data (20%).

To simulate adversarial scenarios, malicious clients were randomly chosen from
within the pool of 100 clients. Importantly, the selection of these malicious
clients varied with each experimental run to ensure robustness in the
evaluation. This variation in the selection of malicious clients across runs
allows for a comprehensive assessment of the model’s resilience to different
adversarial configurations.

###  VI-B Comparison of robust aggregation functions

In this section, our method is evaluated in comparison with the other
aggregation functions discussed in Section II. We focus on their performance
against the two types of attacks outlined in Section IV, varying the
proportion of malicious clients from 0% to 50%. We use 50 training rounds for
training the FL model. Our analysis extends to additional aspects, including
the evolution of model accuracy over more rounds, and the impact of the
dynamic method introduced in the preceding section, particularly in relation
to threshold selection.

To facilitate a more direct comparison with other methods, we initially
present results excluding our dynamic client detection method, that is, we
focused solely on the FFT approach. With aggregation functions like Krumm and
Trimmed Mean, which require specification of the number of malicious nodes, we
adjust their settings to match the resistance level to the proportion of
malicious clients present. Therefore, this could be considered as the best
case for those methods as we assume there is a previous step to calculate such
number of malicious clientes. For instance, with 20% malicious clients, we
configure Krumm and Trimmed Mean to resist and exclude 20 clients,
respectively. Furthermore, to enhance the reliability of our findings, each
result in this section represents the average of five separate runs.

####  VI-B1 Random weights attack

In evaluating the resilience of aggregation functions against an adversarial
presence sending random weights, our work compares the accuracy of the
different aggregation functions of section II with the FFT. Table III and Fig.
4 show the performance obtained by the different aggregation functions.

Under a scenario without malicious clients, FedAvg outperforms others with an
accuracy of 0.8697. However, its efficacy declines rapidly with the
introduction of adversarial actors. In the case of trimmed mean, it exhibits
robustness up to a moderate level of malicious activity (around 40%), post
which it too succumbs to a substantial reduction in accuracy. Krum, while not
suffering steep declines, consistently underperforms relative to the median
and FFT across the spectrum of adversarial presence. This is particularly
noteworthy as it suggests that Krum’s mechanism for outlier detection does not
translate into higher accuracy in the context of this specific type of attack.

Remarkably, both the median and FFT aggregation functions demonstrate
comparable resistance against this attach, with FFT exhibiting slightly
superior performance. This improvement is more pronounced beyond the 45%
threshold of malicious clients, where FFT sustains its accuracy more
effectively than its counterparts. Therefore, our proposed FFT-based
aggregation function manifests as the most robust across our tests. It
maintains its accuracy above 0.80 even when malicious clients constitute up to
50% of the network. These results underscore the potential of FFT as a robust
aggregation strategy in FL environments with byzantine attackers.

% of malicious clients | FedAvg | Median | Trimmed mean | Krumm | TFF
---|---|---|---|---|---
0% | 0,8697 | 0,8489 | 0,8688 | 0,8169 | 0,8529
5% | 0,8437 | 0,852 | 0,8554 | 0,8046 | 0,8577
10% | 0,8174 | 0,8526 | 0,8511 | 0,7951 | 0,8553
15% | 0,7726 | 0,8452 | 0,8518 | 0,8098 | 0,858
20% | 0,7239 | 0,8562 | 0,8472 | 0,8019 | 0,8575
25% | 0,7182 | 0,8403 | 0,8434 | 0,8024 | 0,8498
30% | 0,616 | 0,8433 | 0,8385 | 0,7939 | 0,8457
35% | 0,621 | 0,8414 | 0,8458 | 0,8004 | 0,8396
40% | 0,5291 | 0,8303 | 0,8438 | 0,8044 | 0,8403
45% | 0,4663 | 0,8256 | 0,7958 | 0,8075 | 0,8346
50% | 0,4095 | 0,7854 | 0,7761 | 0,8065 | 0,8195
Table III: Accuracy of different aggregation functions against a random
weights attack Figure 4: Comparison of accuracy different aggregation
functions for random weights attack

####  VI-B2 Min-max attack

In the case of the more sophisticated min-max attack, the evaluation results
are provided in Table IV and Fig. 5. According to the results, FedAvg’s
performance deteriorates precipitously, even with a minimal 5% incursion of
malicious nodes, thereby highlighting its lack of robustness against this
attack. Furthermore, the obtained results reveal that Krum’s methodology of
selecting weights based on minimizing the distance to its neighbors fails
under this attack vector. Malicious clients exploiting this aspect can
broadcast identical weights, resulting in a zero distance and consequently
causing Krum to erroneously select these compromised weights. This flaw
exposes a significant susceptibility of Krum to manipulation by colluding
attacks

Regarding the median, trimmed mean, and our proposed FFT-based aggregation
function, we observe a convergence in performance under moderate levels of
malicious activity. However, the FFT approach provides better results by
consistently achieving higher accuracy than the median and trimmed mean up to
a threshold of 50% of malicious clients. The resilience of FFT is noteworthy,
declining from an accuracy of 0.8529 in a environment without malicious nodes
to 0.8083 when nearly half of the clients are compromised. Furthermore, it
should be noted that trimmed mean’s parameters were specifically tuned for
each level of malicious activity, that is, the function assumes the exact
number of malicious clients is known. This situation may not be feasible in
real-world scenarios. This aspect accentuates the robustness of our FFT-based
method, which does not rely on such tailoring to maintain superior performance
against adversarial attacks.

Figure 5: Comparison of different aggregation functions for min-max attack % of malicious clients | FedAvg | Median | Trimmed mean | Krumm | TFF
---|---|---|---|---|---
0% | 0,8697 | 0,8489 | 0,8688 | 0,8169 | 0,8529
5% | 0,0569 | 0,8437 | 0,8495 | 0,0504 | 0,8564
10% | 0,0557 | 0,8428 | 0,8493 | 0,0550 | 0,8531
15% | 0,0553 | 0,8411 | 0,8417 | 0,0518 | 0,8535
20% | 0,0587 | 0,8209 | 0,8234 | 0,0591 | 0,8334
25% | 0,0536 | 0,8230 | 0,8229 | 0,0570 | 0,8379
30% | 0,0589 | 0,8241 | 0,8289 | 0,0592 | 0,8333
35% | 0,0538 | 0,8140 | 0,8170 | 0,0562 | 0,8233
40% | 0,0566 | 0,8070 | 0,8145 | 0,0584 | 0,8181
45% | 0,0572 | 0,0558 | 0,7884 | 0,0580 | 0,8083
50% | 0,0592 | 0,0551 | 0,0637 | 0,0611 | 0,0601
Table IV: Accuracy of different aggregation functions against min-max attack

####  VI-B3 Evolution throughout training rounds

Fig. 6 and 7 show the evolution of the performance of the different robust
aggregation functions throughout the rounds against the two types of attack.
The main goal is to show the convergence behavior of the different approaches
under diverse attack scenarios. It should be noted that FedAvg is excluded
from this analysis due to its rapid degradation in performance.

For clarity and to avoid overburdening the visual presentations, we modify the
increments of malicious client representation to steps of 10%, instead the
previous 5% increments. A total of 90 training rounds are considered to
demonstrate the evolution of the different aggregation functions considering
varying rates of malicious clients. For the random weights attack, the
accuracy values of median, trimmed mean, Krumm, and FFT decrease from 0.8677,
0.8777, 0.8214, 0.8768 at 0% of malicious clients to 0.7973, 0.7867, 0.7889,
and 0.8358 at 50% of malicious clients respectively. According to the results,
for low rates of malicious clients, the different functions provide similar
results except in the case of trimmed mean. The robustness of FFT becomes more
pronounced as this rate increases. Indeed, with 50% of malicious clients, the
FFT-based approach truly stands out, maintaining higher accuracy than the
other methods throughout the training rounds. This indicates that FFT is
particularly effective in scenarios with a high level of adversarial presence.
The median and Krum also perform well, significantly better than the trimmed
mean, but not quite as effectively as FFT. This trend is also similar for the
min-max attack when comparing FFT with median and trimmed mean. In particular,
the accuracy values of median, trimmed mean, and FFT decrease from 0,8658,
0,8794, 0.8691 at 0% of malicious clients to 0,8020, 0.8071, and 0.8185 at 50%
of malicious clients respectively. It should be noted that in this case, the
Krumm approach is not shown due to the lack of resistance against this attack,
as already mentioned.

Figure 6: Analysis of evolution of the aggregation functions throughout the
rounds for random weights attack Figure 7: Analysis of evolution of the
aggregation functions through the rounds for min-max attack

####  VI-B4 Complete version of our algorithm

As shown in Fig. 4 and Fig. 5, when the proportion of malicious clients is at
0%, FedAvg provides the highest value. However, its performance declines
significantly as the presence of malicious clients increases. As already
described in Section V, to maximize model accuracy regardless of the
percentage of malicious clients, our approach involves dynamically toggling
between FedAvg and FFT based on a threshold that estimates the level of
malicious activity. This strategy is corroborated by the results presented in
Tables V and VI, which were derived using cross-validation with 5 folds across
4 threshold levels, as described by Hastie et al. (2009). This process ensures
each sample is part of the test set at some point by systematically rotating
the training and testing datasets.

Our findings indicate that a threshold value of $0.02$ yields the most
favorable average outcome for both attack scenarios. Thus, in situations where
the average skewness is less than or equal to $0.02$, we opt for FedAvg, and
for higher skewness, the FFT-based approach is employed. In Figures 8 and 9,
we benchmark our dynamic threshold-based method, set at $0.02$, against the
standalone performances of FFT and FedAvg from Figures 4 and 5. These figures
reveal that our method initially registers above FFT and slightly below to
FedAvg at 0% malicious clients, and subsequently falls below FFT as malicious
clients emerge. Despite maintaining a minimal divergence from the optimal
function, there is a noticeable gap at the last data point in both figures.
This discrepancy arises because the K–S test, being probabilistic, may
occasionally select an incorrect function, adversely affecting accuracy.
Nevertheless, the overall efficacy of our dynamic method aligns with its
intended purpose. It reliably discerns the presence of malicious clients in
most instances, selecting the most suitable aggregation function for the given
context. While the use of the K-S test can be seen as an initial approach for
the identification of malicious clients, our future work is intended to come
up with more sophisticated and precise approaches that could be further
integrated with our proposed FFT-based aggregation function for a more robust
overall FL framework.

| 0,02 | 0,025 | 0,03 | 0,035
---|---|---|---|---
0% | 0,8621 | 0,8649 | 0,865 | 0,8678
10% | 0,8589 | 0,8598 | 0,8355 | 0,8374
20% | 0,8494 | 0,8289 | 0,7978 | 0,8058
30% | 0,84 | 0,8088 | 0,7762 | 0,727
40% | 0,8373 | 0,7837 | 0,7441 | 0,6579
50% | 0,8004 | 0,7432 | 0,6112 | 0,5419
Mean | 0,8413 | 0,8148 | 0,7716 | 0,7396
Table V: cross validation for random attack Figure 8: Comparison of our complete dynamic method with the static mean and FFT using the random attack | 0,02 | 0,025 | 0,03 | 0,035
---|---|---|---|---
0% | 0,8621 | 0,8649 | 0,865 | 0,8678
10% | 0,8535 | 0,8476 | 0,8335 | 0,8108
20% | 0,8308 | 0,8066 | 0,7510 | 0,7077
30% | 0,8260 | 0,4933 | 0,6537 | 0,4005
40% | 0,8014 | 0,4580 | 0,2673 | 0,2696
Mean | 0,8347 | 0,6940 | 0,6741 | 0,6112
Table VI: cross validation min-max attack Figure 9: Comparison of our complete
dynamic method with the static mean and FFT using the min-max attack

##  VII Conclusions and future work

This paper presented a novel approach to robust aggregation in FL, addressing
the challenges associated with the capability to resist against model
poisoning attacks. Unlike well-known techniques, such as median, trimmed mean,
or Krum functions, our mechanism leverages the Fourier Transform to
effectively filter and aggregate model updates in a FL scenario. Our method
stands out by not requiring prior knowledge of the number of attackers and by
being adaptable to dynamic and sophisticated attack scenarios. Through
extensive evaluation against different types of model poisoning attacks, our
approach has shown to outperform existing aggregation functions. The use of
FedRDF not only enhances robustness against attacks but also maintains model
accuracy in the absence of attackers, where FedAvg remains a preferable
choice. Nevertheless, as part of our future work, we aim to explore more
sophisticated approach beyond the K-S test to determine the existence of
attackers and which specific clients are compromised to come up with a robust
FL framework against different poisoning attacks.

## Acknowledgements

This study forms part of the ThinkInAzul program and was partially supported
by MCIN with funding from European Union NextGenerationEU (PRTR-C17.I1) and by
Comunidad Autónoma de la Región de Murcia - Fundación Séneca. It was partially
funded by the HORIZON-MSCA-2021-SE-01-01 project Cloudstars (g.a. 101086248),
the HORIZON-MSCA-2021-PF-01-01 project INCENTIVE (g.a. 101065524) and by the
ONOFRE Project PID2020-112675RB-C44 funded by MCIN/AEI/10.13039/501100011033 .

## References

  * McMahan et al. (2017) B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * Goddard (2017) M. Goddard, “The eu general data protection regulation (gdpr): European regulation that has a global impact,” _International Journal of Market Research_ , vol. 59, no. 6, pp. 703–705, 2017.
  * Rasha et al. (2023) A.-H. Rasha, T. Li, W. Huang, J. Gu, and C. Li, “Federated learning in smart cities: Privacy and security survey,” _Information Sciences_ , 2023.
  * Rodríguez-Barroso et al. (2023) N. Rodríguez-Barroso, D. Jiménez-López, M. V. Luzón, F. Herrera, and E. Martínez-Cámara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” _Information Fusion_ , vol. 90, pp. 148–173, 2023.
  * Matheu et al. (2022) S. N. Matheu, E. Mármol, J. L. Hernández-Ramos, A. Skarmeta, and G. Baldini, “Federated cyberattack detection for internet of things-enabled smart cities,” _Computer_ , vol. 55, no. 12, pp. 65–73, 2022.
  * Campos et al. (2021) E. M. Campos, P. F. Saura, A. González-Vidal, J. L. Hernández-Ramos, J. B. Bernabe, G. Baldini, and A. Skarmeta, “Evaluating federated learning for intrusion detection in internet of things: Review and challenges,” _Computer Networks_ , p. 108661, 2021.
  * Xia et al. (2023) G. Xia, J. Chen, C. Yu, and J. Ma, “Poisoning attacks in federated learning: A survey,” _IEEE Access_ , vol. 11, pp. 10 708–10 722, 2023.
  * Baruch et al. (2019) G. Baruch, M. Baruch, and Y. Goldberg, “A little is enough: Circumventing defenses for distributed learning,” _Advances in Neural Information Processing Systems_ , vol. 32, 2019.
  * Hernandez-Ramos et al. (2023) J. L. Hernandez-Ramos, G. Karopoulos, E. Chatzoglou, V. Kouliaridis, E. Marmol, A. Gonzalez-Vidal, and G. Kambourakis, “Intrusion detection based on federated learning: a systematic review,” _arXiv preprint arXiv:2308.09522_ , 2023.
  * Bhagoji et al. (2019) A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 634–643.
  * Yin et al. (2018) D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 5650–5659.
  * Blanchard et al. (2017) P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” _Advances in neural information processing systems_ , vol. 30, 2017.
  * Gray and Goodman (2012) R. M. Gray and J. W. Goodman, _Fourier transforms: an introduction for engineers_. Springer Science & Business Media, 2012, vol. 322.
  * Shejwalkar and Houmansadr (2021) V. Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in _NDSS_ , 2021.
  * Barreno et al. (2006) M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?” in _Proceedings of the 2006 ACM Symposium on Information, computer and communications security_ , 2006, pp. 16–25.
  * Fang et al. (2018) M. Fang, G. Yang, N. Z. Gong, and J. Liu, “Poisoning attacks to graph-based recommender systems,” in _Proceedings of the 34th annual computer security applications conference_ , 2018, pp. 381–392.
  * Tian et al. (2022) Z. Tian, L. Cui, J. Liang, and S. Yu, “A comprehensive survey on poisoning attacks and countermeasures in machine learning,” _ACM Computing Surveys_ , vol. 55, no. 8, pp. 1–35, 2022.
  * Kiourti et al. (2020) P. Kiourti, K. Wardega, S. Jha, and W. Li, “Trojdrl: evaluation of backdoor attacks on deep reinforcement learning,” in _2020 57th ACM/IEEE Design Automation Conference (DAC)_. IEEE, 2020, pp. 1–6.
  * Gonzalez-Vidal et al. (2018) A. Gonzalez-Vidal, P. Barnaghi, and A. F. Skarmeta, “Beats: Blocks of eigenvalues algorithm for time series segmentation,” _IEEE Transactions on Knowledge and Data Engineering_ , vol. 30, no. 11, pp. 2051–2064, 2018.
  * Lin et al. (2007) J. Lin, E. Keogh, L. Wei, and S. Lonardi, “Experiencing sax: a novel symbolic representation of time series,” _Data Mining and knowledge discovery_ , vol. 15, pp. 107–144, 2007.
  * Zhang and Glass (2011) Y. Zhang and J. Glass, “A piecewise aggregate approximation lower-bound estimate for posteriorgram-based dynamic time warping,” in _Twelfth Annual Conference of the International Speech Communication Association_ , 2011.
  * Tolstov (2012) G. P. Tolstov, _Fourier series_. Courier Corporation, 2012.
  * Kammler (2007) D. W. Kammler, _A first course in Fourier analysis_. Cambridge University Press, 2007.
  * Stein and Shakarchi (2011) E. M. Stein and R. Shakarchi, _Fourier analysis: an introduction_. Princeton University Press, 2011, vol. 1.
  * Shi et al. (2022) J. Shi, W. Wan, S. Hu, J. Lu, and L. Y. Zhang, “Challenges and approaches for mitigating byzantine attacks in federated learning,” in _2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)_. IEEE, 2022, pp. 139–146.
  * Rey et al. (2022) V. Rey, P. M. S. Sánchez, A. H. Celdrán, and G. Bovet, “Federated learning for malware detection in iot devices,” _Computer Networks_ , vol. 204, p. 108693, 2022.
  * So et al. (2020) J. So, B. Güler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,” _IEEE Journal on Selected Areas in Communications_ , vol. 39, no. 7, pp. 2168–2181, 2020.
  * Ruzafa-Alcázar et al. (2021) P. Ruzafa-Alcázar, P. Fernández-Saura, E. Mármol-Campos, A. González-Vidal, J. L. Hernández-Ramos, J. Bernal-Bernabe, and A. F. Skarmeta, “Intrusion detection based on privacy-preserving federated learning for the industrial iot,” _IEEE Transactions on Industrial Informatics_ , vol. 19, no. 2, pp. 1145–1154, 2021.
  * Pillutla et al. (2022) K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” _IEEE Transactions on Signal Processing_ , vol. 70, pp. 1142–1154, 2022.
  * Li et al. (2021a) S. Li, E. Ngai, and T. Voigt, “Byzantine-robust aggregation in federated learning empowered industrial iot,” _IEEE Transactions on Industrial Informatics_ , vol. 19, no. 2, pp. 1165–1175, 2021.
  * Kulkarni et al. (2020) V. Kulkarni, M. Kulkarni, and A. Pant, “Survey of personalization techniques for federated learning,” in _2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4)_. IEEE, 2020, pp. 794–797.
  * Cao et al. (2020) X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” _arXiv preprint arXiv:2012.13995_ , 2020.
  * Li et al. (2021b) X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, and Y. Liu, “Lomar: A local defense against poisoning attack on federated learning,” _IEEE Transactions on Dependable and Secure Computing_ , 2021.
  * Zhao et al. (2022) L. Zhao, L. Cai, and W.-S. Lu, “Transform-domain federated learning for edge-enabled iot intelligence,” _IEEE Internet of Things Journal_ , vol. 10, no. 7, pp. 6205–6220, 2022.
  * Lalitha et al. (2018) A. Lalitha, S. Shekhar, T. Javidi, and F. Koushanfar, “Fully decentralized federated learning,” in _Third workshop on bayesian deep learning (NeurIPS)_ , vol. 2, 2018.
  * Shejwalkar et al. (2022) V. Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2022, pp. 1354–1371.
  * Park et al. (2021) J. Park, D.-J. Han, M. Choi, and J. Moon, “Sageflow: Robust federated learning against both stragglers and adversaries,” _Advances in neural information processing systems_ , vol. 34, pp. 840–851, 2021.
  * Fang et al. (2020) M. Fang, X. Cao, J. Jia, and N. Z. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” in _Proceedings of the 29th USENIX Conference on Security Symposium_ , 2020, pp. 1623–1640.
  * Nanbu (1995) K. Nanbu, “Fourier transform method to determine the probability density function from a given set of random samples,” _Physical Review E_ , vol. 52, no. 6, p. 5832, 1995.
  * Berger and Zhou (2014) V. W. Berger and Y. Zhou, “Kolmogorov–smirnov test: Overview,” _Wiley statsref: Statistics reference online_ , 2014.
  * Beutel et al. (2020) D. J. Beutel, T. Topal, A. Mathur, X. Qiu, T. Parcollet, and N. D. Lane, “Flower: A friendly federated learning research framework,” _arXiv preprint arXiv:2007.14390_ , 2020.
  * Cohen et al. (2017) G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik, “Emnist: Extending mnist to handwritten letters,” in _2017 international joint conference on neural networks (IJCNN)_. IEEE, 2017, pp. 2921–2926.
  * Caldas et al. (2018) S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Konečnỳ, H. B. McMahan, V. Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” _arXiv preprint arXiv:1812.01097_ , 2018.
  * Bonachela et al. (2008) J. A. Bonachela, H. Hinrichsen, and M. A. Munoz, “Entropy estimates of small data sets,” _Journal of Physics A: Mathematical and Theoretical_ , vol. 41, no. 20, p. 202001, 2008.
  * Hastie et al. (2009) T. Hastie, R. Tibshirani, J. H. Friedman, and J. H. Friedman, _The elements of statistical learning: data mining, inference, and prediction_. Springer, 2009, vol. 2.

|  Enrique Mármol Campos is a Ph.D. Student at the university of Murcia. He
graduated in Mathematics in 2018. Then, in 2019, he finished the M.S. in
advanced math, in the specialty of operative research and statistic, at the
university of Murcia. He is currently researching on federated learning
applied to cybersecurity in IoT devices.
---|---
|  Aurora Gonzalez Vidal graduated in Mathematics from the University of
Murcia in 2014. In 2015 she got a fellowship to work in the Statistical
Division of the Research Support Service, where she specialized in Statistics
and Data Analysis. Afterward, she studied a Big Data Master. In 2019, she got
a Ph.D. in Computer Science. Currently, she is a postdoctoral researcher at
the University of Murcia. She has collaborated in several national and
European projects such as ENTROPY, IoTCrawler, and DEMETER. Her research
covers machine learning in IoT-based environments, missing values imputation,
and time-series segmentation. She is the president of the R Users Association
UMUR.
---|---
|  José Luis Hernández Ramos received the Ph.D. degree in computer science
from the University of Murcia, Spain. He is a Marie Sklodowska-Curie
Postdoctoral Fellow at the same university. Before that, he worked as a
Scientific Project Officer at the European Commission. He has participated in
different European research projects, such as SocIoTal, SMARTIE, and SerIoT,
and published more than 60 peer-reviewed papers. His research interests
include application of security and privacy mechanisms in the Internet of
Things and transport systems scenarios, including blockchain and machine
learning. He has served as a technical program committee and chair member for
several international conferences, and editor in different journals.
---|---
|  Antonio Skarmeta is a full professor at the University of Murcia, the
Department of Information and Communications Engineering. His research
interests are the integration of security services, identity, the Internet of
Things, and smart cities. Skarmeta received a Ph.D. in computer science from
the University of Murcia. He has published more than 200 international papers
and been a member of several program committees.
---|---