TLDR: DSFL is a new Federated Learning framework that uses a dual-server architecture and group-based secure aggregation to protect privacy and resist Byzantine attacks. It avoids heavy encryption, filters out malicious participants using a credit-based system, and maintains high model accuracy and efficiency, making it practical for edge computing environments.
Federated Learning (FL) has emerged as a powerful approach for training machine learning models collaboratively across many devices without centralizing sensitive raw data. This decentralized method offers significant privacy advantages, making it ideal for applications in healthcare, finance, and IoT where data protection is paramount. However, the promise of FL is often undermined by critical challenges, including the threat of malicious participants (known as Byzantine attacks), the difficulty of maintaining model accuracy with diverse data (non-IID settings), and the high computational demands of existing privacy-preserving techniques.
Traditional FL protocols often struggle to defend against participants who intentionally submit corrupted or misleading model updates. These ‘Byzantine’ participants can severely degrade the global model’s accuracy and reliability. Existing solutions frequently rely on heavy cryptographic tools, assume the presence of trusted hardware, or introduce significant computational and communication overheads, making them impractical for resource-constrained edge devices. Furthermore, some approaches, while aiming for privacy, can still be vulnerable to information leakage if clients and servers collude.
Introducing DSFL: A Robust and Private Federated Learning Framework
A new framework, DSFL (Dual-Server Byzantine-Resilient FL Framework via Group-Based Secure Aggregation), has been proposed to address these limitations. DSFL offers a novel, non-cryptographic design that enhances both privacy and robustness while remaining computationally efficient. Unlike previous dual-server approaches, DSFL specifically tackles the vulnerability of privacy leakage through collusion between clients and servers, a critical flaw in earlier designs like LSFL.
DSFL introduces three key innovations:
- A dual-server secure aggregation protocol that protects the confidentiality of model updates without needing complex encryption or pairwise key exchanges.
- A group-wise, credit-based filtering mechanism that identifies and suppresses malicious participants by scoring deviations in their contributions.
- A dynamic reward-penalty strategy that promotes fair and adaptive participation throughout the training process.
How DSFL Works
The DSFL system involves three main entities: a Third-Party Service Provider (TP), a Service Provider (SP), and numerous Local Participants (Ps). The TP is responsible for selecting eligible participants and initiating a ‘Participant Combination Matrix’ (PCM), which helps group participants. The SP maintains the global model and coordinates the training. Local participants, such as mobile phones or IoT devices, train models on their private data.
To ensure privacy, each participant splits their local model update into two random ‘shares’ and sends one share to the TP and the other to the SP. This additive secret sharing means that neither the TP nor the SP can reconstruct an individual participant’s full model update on their own. They must collaborate to aggregate the global model, but even then, individual contributions remain private.
For Byzantine robustness, DSFL uses a clever filtering mechanism. The TP and SP work together using the PCM and a ‘Contributed Participant Group matrix’ (CPG) to assess how consistent each participant’s contribution is with the majority. Participants whose updates deviate significantly from the median behavior are identified as potentially malicious. A ‘k-nearest weight selection’ approach then filters out these unreliable updates, ensuring that only the most trustworthy contributions are used for global model aggregation.
To further encourage honest behavior, DSFL implements a reward-penalty system. Participants who contribute positively to the global model receive rewards, while those whose updates are deemed unreliable or uninformative incur penalties. If a participant’s credits deplete, they are disqualified from further participation, effectively mitigating the influence of persistent adversaries.
Also Read:
- FediLoRA: Enhancing Federated Multimodal Fine-tuning with Adaptive LoRA Ranks and Missing Modality Handling
- Collaborative AI for Education: Addressing Privacy and Personalization with Federated Foundation Models
Performance and Efficiency
DSFL has been rigorously evaluated on standard datasets like MNIST, CIFAR-10, and CIFAR-100, even under challenging conditions with up to 30% Byzantine participants and non-independent and identically distributed (non-IID) data. The results show that DSFL consistently outperforms state-of-the-art baselines, including LSFL, homomorphic encryption (HE)-based protocols, and differential privacy (DP)-enhanced schemes.
For instance, DSFL achieved 97.15% accuracy on CIFAR-10 and 68.60% on CIFAR-100, while a standard approach like FedAvg degraded significantly to 9.39% under similar adversarial conditions. Despite its strong resilience, DSFL remains remarkably lightweight, introducing only 55.9 milliseconds of runtime and 1088 KB of communication overhead per round. This makes it highly suitable for secure and scalable deployment in edge computing environments, where resources are often limited.
The framework’s security analysis confirms that it preserves model privacy against both curious servers and malicious participants, as long as the servers do not collude and the majority of participants are honest. Furthermore, DSFL maintains an optimal convergence rate, ensuring that the model learns effectively despite the privacy and robustness mechanisms.
In conclusion, DSFL represents a significant advancement in federated learning, bridging the gap between secure, robust, and efficient model training. Its innovative dual-server architecture, group-based filtering, and reward-penalty system make it a strong candidate for real-world deployment in critical domains where both privacy and resilience to attacks are paramount. For more technical details, you can refer to the full research paper here.
