Abstract
Federated learning (FL) is an emerging distributed machine learning paradigm that enables participants to cooperatively train learning tasks without revealing the raw data. However, the distributed nature of FL makes it susceptible to poisoning attacks, especially when the local data of participants are non-independent and identically diatributed (non-IID). Although several defense methods have been proposed to mitigate poisoning attacks, their effectiveness is limited by the specific assumptions about the data distribution. In this work, we propose a new defense strategy, FedAPA (Federated Prototype Learning Against Poisoning Attacks). Specifically, we use abstract class prototypes to communicate between the clients and server, thus effectively alleviating the impact of non-IID data. Moreover, we propose a new abnormal client detection method that aims to mitigate the impact of malicious clients while distinguishing between malicious and benign clients, thereby effectively defending against poisoning attacks. Extensive experiments on different datasets show that FedAPA can effectively resist the poisoning attacks under various data distributions.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial Intelligence and Statistics, pp. 1273–1282. PMLR (2017)
Tao, Y., et al.: Byzantine-resilient federated learning at edge. IEEE Trans. Comput. (2023)
Zou, Y., Yu, D., Yu, J., Zhang, Y., Dressler, F., Cheng, X.: Distributed byzantine-resilient multiple-message dissemination in wireless networks. IEEE/ACM Trans. Netw. 29(4), 1662–1675 (2021)
Jing, G., Zou, Y., Yu, D., Luo, C., Cheng, X.: Efficient fault-tolerant consensus for collaborative services in edge computing. IEEE Trans. Comput. (2023)
Yin, C., Zeng, Q.: Defending against data poisoning attack in federated learning with non-iid data. IEEE Trans. Comput. Soc. Syst. (2023)
Xiao, X., Tang, Z., Li, C., Xiao, B., Li, K.: Sca: sybil-based collusion attacks of iiot data poisoning in federated learning. IEEE Trans. Industr. Inf. 19(3), 2608–2618 (2022)
Ma, Z., Ma, J., Miao, Y., Li, Y., Deng, R.H.: Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Trans. Inf. Forensics Secur. 17, 1639–1654 (2022)
Chen, X., Yu, H., Jia, X., Yu, X.: Apfed: Anti-poisoning attacks in privacy-preserving heterogeneous federated learning. IEEE Trans. Inf. Forensics Secur. (2023)
Chen, Y., Su, L., Xu, J.: Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proc. ACM Measure. Anal. Comput. Syst. 1(2), 1–25 (2017)
Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Adv. Neural Inform. Process. Syst. 30 (2017)
Yin, D., Chen, Y., Kannan, R., Bartlett, P.: Byzantine-robust distributed learning: Towards optimal statistical rates. In: International Conference on Machine Learning, pp. 5650–5659. PMLR (2018)
Fung, C., Yoon, C.J., Beschastnikh, I.: The limitations of federated learning in sybil settings. In: 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020), pp. 301–316 (2020)
Cao, X., Fang, M., Liu, J., Gong, N.Z.: Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995 (2020)
Jebreel, N.M., Domingo-Ferrer, J.: Fl-defender: combating targeted attacks in federated learning. Knowl.-Based Syst. 260, 110178 (2023)
Feng, X., Cheng, W., Cao, C., Wang, L., Sheng, V.S.: Dpfla: defending private federated learning against poisoning attacks. IEEE Trans. Serv. Comput. (2024)
Shen, X., Liu, Y., Li, F., Li, C.: Privacy-preserving federated learning against label-flipping attacks on non-iid data. IEEE Internet of Things J. (2023)
Miao, Y., Liu, Z., Li, H., Choo, K.K.R., Deng, R.H.: Privacy-preserving byzantine-robust federated learning via blockchain systems. IEEE Trans. Inf. Forensics Secur. 17, 2848–2861 (2022)
Tan, Y., Long, G., Liu, L., Zhou, T., Lu, Q., Jiang, J., Zhang, C.: Fedproto: federated prototype learning across heterogeneous clients. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, pp. 8432–8440 (2022)
Huang, W., Ye, M., Shi, Z., Li, H., Du, B.: Rethinking federated learning with domain shift: a prototype view. In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 16312–16322. IEEE (2023)
Yan, B., Zhang, H., Xu, M., Yu, D., Cheng, X.: Fedrfq: prototype-based federated learning with reduced redundancy, minimal failure, and enhanced quality. IEEE Trans. Comput. (2024)
Li, Y., Jiang, Y., Li, Z., Xia, S.T.: Backdoor learning: a survey. IEEE Trans. Neural Netw. Learn. Syst. (2022)
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., Lu, R.: Privacy-enhanced federated learning against poisoning adversaries. IEEE Trans. Inf. Forensics Secur. 16, 4574–4588 (2021)
Han, S., Park, S., Wu, F., Kim, S., Zhu, B., Xie, X., Cha, M.: Towards attack-tolerant federated learning via critical parameter analysis. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4999–5008 (2023)
Acknowledgments
This work was supported in part by the NSF of China under Grants 62202250, 62272256, 62172291, 62302235 and 62072065, the NSF of Shandong Province under Grants ZR2021QF079 and ZR2022QF094, the Major Program of Shandong Provincial Natural Science Foundation for the Fundamental Research (ZR2022ZD03), and in part by the Talent Cultivation Promotion Program of Computer Science and Technology in Qilu University of Technology (Shandong Academy of Sciences) under Grant 2023PY059, the Talent Research Projects of Qilu University of Technology under Grant 2023RCKY137, the Colleges and Universities 20 Terms Foundation of Jinan City under Grant 202228093, Sichuan Science and Technology Program(2023YFQ0029).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2025 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Zhang, J., Zhang, H., Wang, G., Dong, A. (2025). Defending Against Poisoning Attacks in Federated Prototype Learning on Non-IID Data. In: Cai, Z., Takabi, D., Guo, S., Zou, Y. (eds) Wireless Artificial Intelligent Computing Systems and Applications. WASA 2024. Lecture Notes in Computer Science, vol 14998. Springer, Cham. https://doi.org/10.1007/978-3-031-71467-2_6
Download citation
DOI: https://doi.org/10.1007/978-3-031-71467-2_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-71466-5
Online ISBN: 978-3-031-71467-2
eBook Packages: Computer ScienceComputer Science (R0)