Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning

Sachi Shome; William Eiers

cs.LGSep 30, 2026

Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning

Authors: Sachi Shome, William Eiers

Organizations: Stevens Institute of Technology

Abstract

Lossy compression is widely used in Federated Learning (FL) but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior induced by lossy compression can expose differences between honest and attack-generated updates. We introduce the concept of a \emph{compression footprint}: the low-dimensional collection of reconstruction, directional, sparsity, and payload statistics induced by a lossy compressor. We characterize sufficient conditions under which compression footprints separate honest and malicious updates, and operationalize our findings in the CRAFT (\emph{Compression-guided Robust Aggregation via Footprint Trust}) server-side robust aggregation method. Crucially, under a strict honest-majority assumption, CRAFT uses server-verifiable footprints, requires no client-side metadata nor knowledge of the number of malicious clients, and adds no communication beyond the compressed FL pipeline. Moreover, while CRAFT assumes a strict honest majority, it does not require the number of malicious clients to be known in advance. We observe that error-bounded lossy compressor (EBLC) footprints provide stronger separation than Top-K footprints and that footprint trust suppresses malicious influence. We evaluate CRAFT under IID client data with 36% malicious participation across six standard model-poisoning attacks, three datasets, and six robust aggregation baselines, finding that CRAFT consistently achieves the best accuracy in 7 out of 18 settings and within 1.7 percentage points of the best in the others. Our results show that lossy compression can serve as both a communication mechanism and a security signal for robust aggregation in FL.

Figures & tables

Symbol	Name	Definition
$r_{\tau,m}(u)$	Relative Distortion	$\frac{\\|u-\bar{u}\\|_{2}}{\\|u\\|_{2}}$
$c_{\tau,m}(u)$	Cosine Similarity	$\frac{\langle u,\bar{u}\rangle}{\\|u\\|_{2}\\|\bar{u}\\|_{2}}$
$q_{\tau,m}(u)$	Mean Squared Error	$\frac{1}{d}\\|u-\bar{u}\\|_{2}^{2}$
$s_{\tau,m}(u)$	Sparsity Change	$\frac{1}{d}\sum_{j=1}^{d}\!\left(\mathbf{1}\{\|\bar{u}_{j}\|\leq\kappa\}-\mathbf{1}\{\|u_{j}\|\leq\kappa\}\right)$
$\rho_{\tau,m}(u)$	Compression Ratio	$\frac{B_{\mathrm{raw}}(u)}{B_{\tau,m}(u)}$

TABLE I : The five coordinates of the EBLC compression footprint.

Fig. 1 : Overview of CRAFT. The server decompresses client updates, extracts server-side compression footprints, assigns footprint-based trust weights, and aggregates the decompressed updates with a weighted coordinate-wise median.

Panel of Figure 3 — Fig. 2 : Examples of CRAFT trust-weight assignment under the IPM attack on CIFAR-10.

Fig. 3 : Per-metric honest–malicious footprint separation for EBLC/SZ2 and Top- $K$ .

Fig. 4 : EBLC-dependent footprint amplification across attacks; SZ2 gives the strongest amplification in this setting.

Fig. 5 : Effect of SZ2 tolerance on footprint separation and compression strength.

Fig. 6 : Contribution of each compression-footprint metric to honest–malicious separation across attacks.

Fig. 7 : CIFAR-10 accuracy under model-poisoning attacks.

Fig. 8 : Fashion-MNIST accuracy under model-poisoning attacks.

Fig. 9 : Purchase accuracy under model-poisoning attacks.

Dataset	Defense	ALIE	IPM	Min-Max	Min-Sum	Sine	PoisonedFL
CIFAR-10	Mean	52.30	10.00	19.37	23.51	10.00	10.00
	Median	34.80	13.99	10.93	10.01	33.77	13.88
	Trimmed Mean	40.49	10.00	21.95	10.00	10.00	10.00
	Krum	23.68	48.00	17.74	10.00	48.83	57.43
	Bulyan	23.67	43.77	10.10	13.21	57.13	31.83
	DnC	57.31	51.33	58.81	59.85	53.92	54.26

TABLE II : Final test accuracy (%). The best result in each dataset–attack setting is bold.

Fig. 10 : Effect of Dirichlet label skew on CRAFT for CIFAR-10 under Min-Max and Min-Sum attacks. Lower $\alpha$ indicates stronger non-IIDness. The dashed line shows the $36\%$ attacker weight under mean aggregation.

Fig. 11 : Restricted adaptive IPM results.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 12 : Effect of malicious client fraction on CRAFT for CIFAR-10 under IPM. Malicious influence remains negligible until attackers begin to enter the majority-supported footprint core.

Fig. 13 : Per-metric footprint distributions for honest and malicious clients under EBLC/SZ (top row) and Top- $K$ (bottom row). EBLC/SZ exhibits separation across multiple footprint coordinates, whereas Top- $K$ is informative mainly in a narrower subset of metrics.

Fig. 15 : No-attack baseline accuracy for Mean aggregation and CRAFT on CIFAR-10, Fashion-MNIST, and Purchase. CRAFT closely tracks Mean when all clients are honest.

Fig. 16 : CRAFT trust-parameter ablation on CIFAR-10 under IPM.

Explore similar work

Sep 14, 2026cs.LG

End-to-End Verifiable and Robust Federated Learning

Federated learning enables multiple parties to train a shared model without centralizing raw data with the help of an aggregator, but introduces integrity risks once participants or infrastructure are not fully trustworthy. Two requirements are particularly important: robustness to poisoned or Byzantine client updates, and verifiability of the aggregator so that clients or third parties can audit the reported aggregation without learning individual updates. Existing work has largely treated these goals separately, and efficient public verifiability for robust, outlier-excluding aggregation remains limited. We present a verifiable federated learning protocol that makes a robust aggregation pipeline publicly auditable. Our design combines cryptographic commitments with non-interactive zero-knowledge proofs to certify both (i) cosine-similarity-based outlier exclusion and (ii) aggregation over the selected set, without revealing individual client updates to verifiers. In experiments under representative poisoning attacks, our method maintains high accuracy, with an average accuracy loss below 4% across the evaluated configurations, while keeping verification overhead practical: proof artifacts can be generated and verified within minutes at the scale studied. In summary, our results show that robust outlier exclusion and public verifiability can be jointly achieved in a federated learning setting.

Doryan Lesaignoux, Enrique Mármol Campos, Gabriele Spini +2

AIT Austrian Institute of Technology · Vienna, Austria · Department of Computer Engineering +2

Federated Learning Zero-Knowledge Proofs Log-Ratio-Based Gaussian Trust Weight Poisoning

Ask PDF

Jul 23, 2026cs.LG

Information-Theoretically Secure Aggregation for Lightweight Federated Learning: Resilient to Dropouts and Adversaries

On-device federated learning (FL) enables privacy-preserving and personalized model training on resource-constrained devices such as smartphones and IoT nodes. To reduce communication cost, sign-based methods (e.g., signSGD) transmit one-bit gradients. However, exposing gradient signs makes them vulnerable to inference attacks, while existing secure aggregation schemes are often incompatible with such methods or incur significant computational and communication overhead. We propose a lightweight and information-theoretically secure aggregation framework tailored for sign-based FL. The framework securely computes the majority vote (MV) polynomial through single-round secure multiplication, ensuring end-to-end information-theoretic security under the honest-majority assumption while revealing only the final aggregated sign to the server. To enhance efficiency and scalability, we introduce two key techniques. First, inverse-form exponent reduction halves the effective MV polynomial degree, reducing both communication and computation costs. Second, we propose single-round secure multiplication, achieving linear offline complexity and storage with only a single online communication. Together, these techniques reduce online communication by up to 99.5% and latency by up to 85.7% compared to conventional approaches. Also, by leveraging inherent MDS-code-based decoding, the framework achieves robustness against both dropouts and adversarial behaviors, yielding accuracy gains of up to 20.65% and 10.74%, respectively. Overall, the proposed framework establishes a practical foundation for large-scale, low-latency, and information-theoretically secure aggregation in sign-based FL.

Hyeong-Gun Joo, Songnam Hong, Dong-Joon Shin

Department of Electronic Engineering, Hanyang University, Seoul, South Korea

Secure Aggregation Federated Learning Dropout Lightweight Gradient Component Adversarial Robustness

Ask PDF

Sep 29, 2026cs.CR

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

Federated learning enables multiple clients to collaboratively train models without sharing their private data. However, the lack of visibility into local training makes it difficult to verify whether clients follow the prescribed training procedure or submit malicious updates, such as model poisoning. A natural approach is to replay client training for verification. However, privacy-preserving replay produces numerical results that cannot be directly matched with local client execution because the two run in different environments. We present OPFL, an optimistic verification framework for privacy-preserving federated learning. To protect data privacy, OPFL performs replay inside secure multi-party computation (MPC). Although gradients computed on MPC and local GPUs are not bitwise identical, we observe that their absolute differences are stable and bounded. OPFL therefore calibrates an empirical boundary offline and uses it to distinguish benign numerical deviations from malicious manipulation. To reduce the cost of expensive MPC replay, OPFL adopts optimistic verification by post auditing only sampled training steps. Experiments on LeNet, BERT, and Qwen show that the boundary generalizes across datasets, input lengths, and GPUs, while achieving

0

% ASR against model poisoning and PGD-based attacks. On a LeNet workload, at

p=0.01

, OPFL is approximately

98.6\times

faster than full MPC-based FL and

625.5\times

faster than ZK-based approach.

Hongxu Su, Jianzhu Yao, Xuechao Wang +1

Federated Learning Clover Boundaries

Ask PDF