SecureAFL: Secure Asynchronous Federated Learning

Anjun Gao; Feng Wang; Zhenglin Wan; Yueyang Quan; Zhuqing Liu; Minghong Fang

cs.CRApr 4, 2026

SecureAFL: Secure Asynchronous Federated Learning

Authors: Anjun Gao, Feng Wang, Zhenglin Wan, Yueyang Quan, Zhuqing Liu, Minghong Fang

Organizations: University of Louisville, Louisville, USA · Northeastern University, Shenyang, China · National University of Singapore, Singapore, Singapore · University of North Texas, Denton, USA

Abstract

Federated learning (FL) enables multiple clients to collaboratively train a global machine learning model via a server without sharing their private training data. In traditional FL, the system follows a synchronous approach, where the server waits for model updates from numerous clients before aggregating them to update the global model. However, synchronous FL is hindered by the straggler problem. To address this, the asynchronous FL architecture allows the server to update the global model immediately upon receiving any client's local model update. Despite its advantages, the decentralized nature of asynchronous FL makes it vulnerable to poisoning attacks. Several defenses tailored for asynchronous FL have been proposed, but these mechanisms remain susceptible to advanced attacks or rely on unrealistic server assumptions. In this paper, we introduce SecureAFL, an innovative framework designed to secure asynchronous FL against poisoning attacks. SecureAFL improves the robustness of asynchronous FL by detecting and discarding anomalous updates while estimating the contributions of missing clients. Additionally, it utilizes Byzantine-robust aggregation techniques, such as coordinate-wise median, to integrate the received and estimated updates. Extensive experiments on various real-world datasets demonstrate the effectiveness of SecureAFL.

Figures & tables

Notation	Definition
$n$	Number of clients
$\bm{w}^{t}$	Global model at the $t$ th training round
$\bm{g}_{i}^{t}$	Local model update from client $i$ at round $t$
$\hat{\bm{g}}_{i}^{t}$	Estimated local model update from client $i$ at round $t$
$\tau_{i}$	Delay of client $i$ ’s local model update
$\lambda_{i}^{t}$	Lipschitz factor for client $i$ at round $t$

Table 1. Summary of key notation.

	Representative methods	Batch update or single update	Delay or no delay
Synchronous FL	Median ( Yin et al., 2018 ) , Trimmed-mean ( Yin et al., 2018 ) , Krum ( Blanchard et al., 2017 ) , FLAME ( Nguyen et al., 2022b ) , Baybfed ( Kumari et al., 2023 ) , Bucketing ( Karimireddy et al., 2022 ) , Foolsgold ( Fung et al., 2020 ) , DnC ( Shejwalkar and Houmansadr, 2021 ) , RFLBAT ( Wang et al., 2022b ) , SignGuard ( Xu et al., 2022 ) , FLShield ( Kabir et al., 2024 ) , FreqFed ( Fereidooni et al., 2024 ) , BackdoorIndicator ( Li and Dai, 2024 ) , FLTrust ( Cao et al., 2021a ) , GAA ( Pan et al., 2020 ) , FLARE ( Wang et al., 2022a ) , FoundationFL ( Fang et al., 2025b )	Batch update	No delay
Semi-asynchronous FL	Catalyst ( Cox et al., 2024 ) , PoiSAFL ( Pang et al., 2025 )	Batch update	Delay
Asynchronous FL	Kardam ( Damaskinos et al., 2018 ) , BASGD ( Yang and Li, 2021 ) , Sageflow ( Park et al., 2021 ) , Zeno++ ( Xie et al., 2020 ) , AFLGuard ( Fang et al., 2022 ) , AsyncDefender ( Bai et al., 2025 ) , SecureAFL (Ours)	Single update	Delay

Table 2. Comparison of Synchronous FL, Semi-asynchronous FL, and Asynchronous FL.

Layer	Size
Input	$28\times 28\times 1$
Convolution + ReLU	$3\times 3\times 30$
Max Pooling	$2\times 2$
Convolution + ReLU	$3\times 3\times 50$
Max Pooling	$2\times 2$
Fully Connected + ReLU	100

Table 3. CNN architecture.

Table 4. Performance of different methods on the Fashion-MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet datasets. For untargeted attacks, results are reported as TER, while for targeted attacks (e.g., backdoor attacks), results are reported as TER/ASR. Lower values indicate better defense performance. Results on the Udacity dataset are reported in Table 5 .

Method	No attack	Signflip	Gaussian	Min-Max	Adaptive
AsyncSGD	0.17	0.29	1.10	0.36	0.33
Kardam	0.18	0.28	0.19	0.55	0.24
BASGD	0.17	0.19	0.19	inf	0.20
Zeno++	0.17	inf	0.24	inf	inf
AFLGuard	0.18	0.43	0.25	0.19	0.26
SecureAFL	0.17	0.17	0.18	0.17	0.17

Table 5. RMSE of different methods on Udacity dataset.

Figure 1. Impact of fraction of malicious clients on Fashion-MNIST dataset.

Figure 2. Impact of client delay on Fashion-MNIST dataset.

Figure 3. Impact of degree of Non-IID on Fashion-MNIST dataset.

$\alpha$	No attack	Labelflip	Signflip	Gaussian	Scaling	DBA	PGD	Neurotoxin	3DFed	Min-Max	Adaptive
0.4	0.13	0.15	0.14	0.14	0.19/0.02	0.16/0.02	0.17/0.07	0.19/0.08	0.19/0.10	0.22	0.23
0.6	0.15	0.16	0.15	0.14	0.18/0.08	0.17/0.03	0.19/0.10	0.20/0.01	0.17/0.06	0.20	0.23
0.8	0.12	0.12	0.13	0.14	0.18/0.07	0.17/0.05	0.16/0.07	0.15/0.06	0.17/0.03	0.15	0.18

Table 6. Impact of

\alpha

on Fashion-MNIST dataset.

Variant	No attack	Labelflip	Signflip	Gaussian	Scaling	DBA	PGD	Neurotoxin	3DFed	Min-Max	Adaptive
Variant I	0.12	0.14	0.15	0.14	0.40/0.36	0.34/0.33	0.40/0.19	0.30/0.22	0.38/0.34	0.35	0.35
Variant II	0.17	0.17	0.20	0.18	0.72/0.90	0.44/0.58	0.34/0.38	0.37/0.34	0.35/0.40	0.87	0.90
Variant III	0.16	0.16	0.19	0.20	0.34/0.41	0.68/0.53	0.30/0.25	0.29/0.25	0.46/0.47	0.90	0.90
Variant IV	0.41	0.56	0.66	0.47	0.57/0.49	0.53/0.53	0.59/0.49	0.48/0.42	0.58/0.46	0.45	0.63
SecureAFL	0.12	0.12	0.13	0.14	0.18/0.07	0.17/0.05	0.16/0.07	0.15/0.06	0.17/0.03	0.15	0.18

Table 7. Different variants of SecureAFL on Fashion-MNIST dataset.

Round	Relative estimation error
200–300	0.81
300–400	0.72
400–500	0.68
500–600	0.65
600–700	0.61
700–Convergence	0.59

Table 8. Relative estimation error across training rounds on the Fashion-MNIST dataset.

Method	50 clients	100 clients	300 clients
AsyncSGD	0.02	0.02	0.04
Zeno++	0.02	0.03	0.05
AFLGuard	0.04	0.06	0.08
SecureAFL	0.03	0.04	0.06

Table 9. Running time (in seconds) under varying numbers of clients, where the CNN has 140,000 parameters.

Method	140,000 parameters	500,000 parameters	1,000,000 parameters
AsyncSGD	0.02	0.03	0.04
Zeno++	0.02	0.04	0.06
AFLGuard	0.04	0.05	0.08
SecureAFL	0.03	0.04	0.06

Table 10. Running time (in seconds) under varying CNN model sizes, where the number of clients is set to 50.

Figure 4. Impact of total number of clients on Fashion-MNIST dataset.

Dataset	No attack	Labelflip	Signflip	Gaussian	Scaling	DBA	PGD	Neurotoxin	3DFed	Min-Max	Adaptive
Fashion-MNIST	0.24	0.25	0.33	0.31	0.38/0.44	0.34/0.43	0.33/0.29	0.32/0.27	0.34/0.31	0.39	0.43
CIFAR-10	0.26	0.40	0.42	0.49	0.58/0.37	0.53/0.42	0.55/0.44	0.52/0.40	0.57/0.43	0.55	0.66
CIFAR-100	0.50	0.58	0.57	0.66	0.73/0.53	0.74/0.55	0.71/0.67	0.73/0.44	0.72/0.57	0.93	0.89
Tiny-ImageNet	0.63	0.71	0.75	0.71	0.70/0.15	0.72/0.18	0.69/0.12	0.70/0.15	0.71/0.15	0.73	0.72
Udacity	0.18	–	0.41	0.32	–	–	–	–	–	0.29	0.33

Table 11. Performance of AsyncDefender across different datasets and attack types.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

Reviving Stale Updates: Data-Free Knowledge Distillation for Asynchronous Federated Learning
Nov 1, 2025Baris Askin, Holger R. Roth, Zhenyu Sun +3Asynchronous Federated Learning Federated Learning Aggregation
Carnegie Mellon University · NVIDIA · Northwestern University
Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification
Oct 6, 2023Shanshan Han, Wenxuan Wu, Baturalp Buyukates +4Byzantine-Robust Federated Learning Adversarial Attacks
University of California, Irvine · Texas A&M University · University of Birmingham +3
FedPSA: Modeling Behavioral Staleness in Asynchronous Federated Learning
Feb 17, 2026Chaoyi Lu, Yiding Sun, Zhichuan Yang +3Asynchronous Federated Learning Federated Learning Aggregation

Nov 1, 2025J/K move · Enter open · S save

Reviving Stale Updates: Data-Free Knowledge Distillation for Asynchronous Federated Learning

Baris Askin, Holger R. Roth, Zhenyu Sun, Carlee Joe-Wong+2

Carnegie Mellon University · NVIDIA · Northwestern University

Asynchronous Federated Learning Federated Learning Aggregation

Open paper AskPDF arXiv

Federated learning (FL) enables collaborative model training across distributed clients without sharing raw data, yet its scalability is limited by synchronization overhead. Asynchronous federated learning (AFL) alleviates this issue by allowing clients to communicate independently, thereby improving wall-clock efficiency in large-scale, hardware-heterogeneous environments. However, asynchrony introduces updates computed on outdated global models (staleness) that can destabilize optimization and hinder convergence. We propose FedRevive, an AFL framework that revives stale updates through data-free knowledge distillation (DFKD). FedRevive integrates parameter-space aggregation with a server-side DFKD process that transfers knowledge from stale client updates to the current global model without access to data. A meta-learned generator synthesizes pseudo-samples for multi-teacher distillation. A hybrid aggregation scheme combining raw with DFKD updates effectively mitigates staleness while retaining AFL scalability. Experiments on vision and text benchmarks show that FedRevive achieves faster training by up to 29.7% and higher final accuracy by up to 11.4 percentage points than baselines.

Abstract

Federated Learning

Explore similar work

Reviving Stale Updates: Data-Free Knowledge Distillation for Asynchronous Federated Learning

Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification

FedPSA: Modeling Behavioral Staleness in Asynchronous Federated Learning