cs.CRAug 14, 2026

STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregation

Authors: Nawrin Tabassum, Yanzhao Wu

Organizations: Department of Computer Science and Engineering Ahsanullah University of Science and Technology Dhaka, Bangladesh · Knight Foundation School of Computing and Information Sciences Florida International University Miami, FL, USA

Abstract

Data poisoning attacks pose serious security threats to Federated Learning (FL) systems in Computer Vision. Despite growing research attention, two key challenges remain for existing defense techniques: (1) accurately distinguishing between benign and malicious model updates and (2) effectively mitigating the influence of poisoned model updates during model aggregation. To address these challenges, we propose a novel defense framework against targeted poisoning attacks with Spatial-Temporal Analysis and Robust aggregation for FL (STAR-FL). First, we employ spatial-temporal clustering to identify and remove potentially malicious updates from the FL training process. Second, we adjust the learning rate during aggregation to mitigate the impact of any malicious updates that evade detection. Third, we conduct extensive experiments across multiple benchmark datasets to evaluate the spatial-temporal analysis and robust aggregation in STAR-FL. Experimental results demonstrate their synergistic effect in enabling STAR-FL to effectively protect FL and consistently outperform state-of-the-art defenses against targeted poisoning attacks, significantly reducing Attack Success Rates (ASRs). The source code is available at https://github.com/mlsysx/STAR-FL.

Figures & tables

Panel of Figure 1 — Fig. 1 : Poisoned image examples from FMNIST (top) and CIFAR-10 (bottom) datasets. A plus pattern is inserted as a trigger in the top left of the images.

Panel of Figure 1 — Fig. 1 : Poisoned image examples from FMNIST (top) and CIFAR-10 (bottom) datasets. A plus pattern is inserted as a trigger in the top left of the images.

M_{t_{k}}=\sum_{i\in h_{t}}sign\;(\Delta W^{i}_{t_{k}})

Algorithm 1 STAR-FL Framework

S_{C_{p}}=avg\;{\frac{V_{i}\cdot V_{j}}{\|V_{i}\|\,\|V_{j}\|};}\hskip 17.00024pt\forall\;{i,j\in C_{p},i\neq j}

Algorithm 2 DetectMaliciousClients

Panel of Figure 4 — Fig. 2 : PCA visualization of benign (green) and malicious (red) updates over all communication rounds with $m$ =10%.

Panel of Figure 4 — Fig. 2 : PCA visualization of benign (green) and malicious (red) updates over all communication rounds with $m$ =10%.

Panel of Figure 5 — Fig. 3 : Kernel Density Estimation plots at round 30 and 15 for the FMNIST dataset (top), and at round 90 and 45 for the CIFAR-10 dataset (bottom).

Panel of Figure 5 — Fig. 3 : Kernel Density Estimation plots at round 30 and 15 for the FMNIST dataset (top), and at round 90 and 45 for the CIFAR-10 dataset (bottom).

Dataset	% of Malicious Clients	MA (%)( $\uparrow$ )	BA (%)( $\uparrow$ )	ASR (%)( $\downarrow$ )
FMNIST	10	91.49	97.50	2.30
	20	90.94	97.10	2.90
	30	89.96	96.80	3.60
CIFAR-10	10	74.63	57.70	3.20
	20	74.61	59.40	3.90
	30	72.58	52.60	4.10

TABLE I : Main task accuracy, base class accuracy, and attack success rate with different percentages of malicious clients.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

	FMNIST		CIFAR-10		CIFAR-100
Defense	Main Task Accuracy (%)( $\uparrow$ )	Attack Success Rate (%)( $\downarrow$ )	Main Task Accuracy (%)( $\uparrow$ )	Attack Success Rate (%)( $\downarrow$ )	Main Task Accuracy (%)( $\uparrow$ )	Attack Success Rate (%)( $\downarrow$ )
No Attack	92.52	N/A	78.63	N/A	59.31	N/A
FedAvg [ 1 ]	92.33	100.0	78.11	77.50	59.25	52.00
RFA [ 17 ]	92.41	100.0	78.40	78.80	55.68	47.00
Trimmed Mean [ 19 ]	92.29	99.50	77.02	68.90	57.90	44.00
Median [ 19 ]	91.31	77.40	72.38	66.00	42.81	34.00

TABLE II : Effectiveness of our proposed defense compared to existing defenses.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

Dataset	Defense	MA (%)( $\uparrow$ )	BA (%)( $\uparrow$ )	ASR (%)( $\downarrow$ )
FMNIST	Spatial	92.10	98.29	2.00
	Temporal	92.18	98.79	1.90
	Spat.+Temp.	92.19	98.19	2.60
CIFAR-10	Spatial	78.22	69.20	4.60
	Temporal	78.26	67.69	6.50
	Spat.+Temp.	78.01	63.80	4.20

TABLE III : Main task accuracy, base class accuracy, and attack success rate under different combinations of spatial and temporal filtering.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

Dataset	Defense	MA (%)( $\uparrow$ )	BA (%)( $\uparrow$ )	ASR (%)( $\downarrow$ )
FMNIST	Spat.+Robust	91.34	97.60	2.80
	Temp.+Robust	91.29	97.89	2.70
	Robust	91.32	96.79	1.30
CIFAR-10	Spat.+Robust	73.95	53.10	4.60
	Temp.+Robust	73.97	58.99	6.10
	Robust	75.32	57.40	4.70

TABLE IV : Main task accuracy, base class accuracy, and attack success rate under different combinations of spatial-temporal filtering and robust aggregation.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

$\alpha$	% of malicious clients	FMNIST		CIFAR-10
$\alpha$	% of malicious clients	Main Task Accuracy (%)( $\uparrow$ )	Attack Success Rate (%)( $\downarrow$ )	Main Task Accuracy (%)( $\uparrow$ )	Attack Success Rate (%)( $\downarrow$ )
0.5	10	79.32	2.50	46.15	3.20
	20	78.16	6.10	42.19	7.80
	30	79.24	20.10	42.68	13.00
1.0	10	88.91	2.10	58.05	8.40
	20	86.56	4.10	52.43	11.60

TABLE V : Main task accuracy and attack success rate under various data heterogeneity.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

Attack	Dataset	MA (%)( $\uparrow$ )	BA (%)( $\uparrow$ )	ASR (%)( $\downarrow$ )
MRA	FMNIST	89.32	96.10	3.60
MRA	CIFAR-10	74.40	58.89	3.30
DBA	FMNIST	89.62	96.70	3.20
DBA	CIFAR-10	73.43	55.10	5.10
MRA+DBA	FMNIST	89.39	95.49	3.63
MRA+DBA	CIFAR-10	75.54	58.79	4.30

TABLE VI : Main task accuracy, base class accuracy, and attack success rate under different attacks.

\uparrow

denotes better performance with higher values, and

\downarrow

denotes better performance with lower values.

Fig. 4 : Training time and GPU usage overhead of STAR-FL compared to baseline methods on CIFAR-10.

More in this topic

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 943 papers

TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning
Aug 7, 2026Yuhan Xie, Jingrong Huang, Chen LyuAdversarial Robustness Split Federated Learning
Shanghai University of Finance and Economics MoE Key Laboratory of Interdisciplinary Research of Computation and Economics Shanghai, China
PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning
Mar 24, 2026Tao Liu, Jiguang Lv, Dapeng Man +7Data Poisoning Attacks Adversarial Attacks
College of Computer Science and Technology, Harbin Engineering University, Harbin, 150001, China
FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning
Feb 23, 2025Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad SaifData Poisoning Attacks Federated Learning
Department of Electrical and Computer Engineering, University of Windsor, Windsor ON, Canada · Faculty of Computer Science, University of New Brunswick, Fredericton NB, Canada

Aug 7, 2026J/K move · Enter open · S save

TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

Yuhan Xie, Jingrong Huang, Chen Lyu

Shanghai University of Finance and Economics MoE Key Laboratory of Interdisciplinary Research of Computation and Economics Shanghai, China

Adversarial Robustness Split Federated Learning Data Poisoning Attacks Federated Learning

Open paper AskPDF arXiv

Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min-max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.