Abstract: Federated learning improves the ability to protect data security by locally training models on distributed devices and sharing parameter updates, but still faces challenges such as privacy leakage and malicious client attacks. Traditional secure aggregation protocols suffer from client privacy leakage caused by server inference attacks. On the other hand, poisoning attacks by malicious clients can lead to performance degradation, reduced convergence, and even targeted misclassification of the global model. To address this issue, a bidirectional defense federated learning framework is proposed: clients upload the fully connected layers from their local models and the ciphertext of local model parameters obtained after adding noise. The fully connected layer parameters are used by the server to detect poisoning attacks, while the encrypted model parameters prevent server inference attacks. The noise added by clients automatically cancels out during the server's aggregation operation, ensuring the correctness of the aggregation result without affecting its accuracy. Under this unified framework, both client privacy protection and defense against malicious client poisoning attacks are achieved. Analysis shows that using an optimized elliptic curve key generation algorithm achieves privacy protection with reduced overhead. Meanwhile, experiments demonstrate that this method achieves high detection accuracy for four types of poisoning attacks on the MNIST and CIFAR-10 datasets, with a false positive rate below 6%. This provides an efficient and robust bidirectional privacy and security defense solution for federated learning.

摘要： :联邦学习通过在分布式设备上本地训练模型并共享参数更新，提高了保护数据安全的能力，但仍面临隐私泄露与恶意客户端攻击的挑战。传统安全聚合协议存在服务器的推理攻击导致的客户端隐私泄露，另一方面，恶意客户端的投毒攻击会导致影响全局模型的性能恶化、收敛性降低，甚至是针对性误分类。针对这个问题，提出一种双向防御联邦学习框架：客户端上传本地模型中的全连接层和通过添加噪声后得到的本地模型参数密文。全连接层参数用于服务器检测投毒攻击，加密后的模型参数用于防止服务器的推理攻击，客户端所添加的噪声在服务器聚合运算中自动抵消，不影响聚合结果的正确性。在统一的框架下，既保护了客户端隐私，也防范了恶意客户端的投毒攻击。分析表明，使用优化的椭圆曲线密钥生成算法，在减少了开销的前提下实现了隐私保护，与此同时，实验发现，该方法在MNIST和CIFAR-10数据集上对四类投毒攻击的检测准确率都达到了较高的水平，误报率低于6%。为联邦学习提供了高效、鲁棒的双向隐私与安全防御方案。