Defending Against Data Poisoning Attacks: From Distributed Learning to Federated Learning.

This article focuses on the vulnerabilities of federated learning (FL)—a privacy-preserving variant of distributed learning (DL)—to data poisoning attacks and evaluates the effectiveness of existing defenses originally designed for DL in FL contexts. The study finds that while robust aggregation rules can somewhat defend against targeted label-flipping attacks under independent and identically distributed (IID) data, their effectiveness diminishes with non-IID data distributions typical in FL, and batch size influences defense stability. Addressing these challenges, the authors propose DSPO (Detect and Suppress the Potential Outliers), a defense strategy that assigns adaptive weights to client updates based on pairwise similarity to mitigate malicious influence without discarding updates outright. Experimental results on Fashion-MNIST and CIFAR-10 datasets demonstrate that DSPO outperforms existing defenses in maintaining model accuracy under poisoning attacks, particularly in non-IID settings, though further research is needed to generalize defenses across attack types and high-dimensional models.