Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning
CRAFT defends federated learning against model poisoning by scoring lossy-compression footprints of client updates.
The paper treats lossy compression distortion and payload behavior as a security signal, defining compression footprints that can separate honest and malicious federated-learning updates. CRAFT is a server-side robust aggregator that uses those footprints under a strict honest-majority assumption, without client metadata, a known attacker count, or extra communication. With 36% malicious participation, six model-poisoning attacks, three datasets, and six baselines, CRAFT was best in 7 of 18 settings and within 1.7 percentage points otherwise; error-bounded compressors separated attacks better than Top-K.
- Footprints capture reconstruction, direction, sparsity, and payload statistics
- CRAFT needs an honest majority but not a known attacker count
- No extra client metadata or communication beyond compressed updates
- Best accuracy in 7 of 18 settings at 36% malicious clients
From the original article
1 min read at arxiv.orgLossy compression is widely used in Federated Learning (FL) but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior induced by lossy compression can expose differences between honest and attack-generated updates.
By Sachi Shome · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.