Dual Gradient Evaluation-Based Defense Method Against Poisoning Attacks in Federated Learning

Federated learning (FL), as an emerging distributed machine learning paradigm, aims to achieve collaborative training of a global model without sharing clients’ local data, thereby addressing user privacy and data silo issues. However, due to the distributed architecture of FL and the invisibility of local training, it is highly susceptible to poisoning attacks. While numerous poisoning defense methods have been proposed, they often suffer from limited defense effectiveness and overly strong security assumptions. To address this problem, we propose FedTPD, a dual gradient evaluation-based defense method against poisoning attacks in FL. Specifically, we first design an adaptive representative gradient selection mechanism, which involves adaptively clustering local gradients and selecting representative gradients from different clusters. Secondly, we propose a client-assisted model evaluation mechanism, wherein a reliable client is selected as an evaluator to assess the representative gradients from various clusters. Finally, we develop a bias-corrected model aggregation mechanism that aggregates the local gradients of each cluster based on the trust scores of their representative gradients, thereby reducing the impact of poisoning attacks on the global model. Experimental results on three typical datasets demonstrate that the proposed FedTPD can effectively resist various poisoning attacks. In particular, compared with state-of-the-art methods, the global model’s maximum and average accuracies on the CIFAR-10 and CIFAR-100 datasets are improved by 2.79%–28.15% and 0.79%–31.34%, and 3.48%–22.18% and 2.56%–22.06%, respectively.