WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning
Authors: Alessandro Licciardi
Organizations: Department of Mathematical Sciences, Politecnico di Torino, Turin, IT · National Institute of Nuclear Physics (INFN), Sezione di Torino, Turin, IT
Federated Learning (FL) enables collaborative model training without exposing raw data, yet remains vulnerable to malicious clients injecting poisoned datasets. Existing defenses are typically reactive (operating during training) or supervised (requiring prior knowledge of attack types) - assumptions that rarely hold in open-ended IoT deployments. We propose WaSA, a fully unsupervised, offline framework for malicious client detection. Before training, each client transmits a single, privacy-preserving spectral summary of its data to the server. A denoising autoencoder, trained solely on clean auxiliary data, scores clients based on their deviation from the learned benign manifold, identifying corruptions regardless of the attack type. WaSA requires no attack labels, generalizes to unseen anomalies, and introduces a Boltzmann sampling strategy for client selection that smoothly interpolates between hard exclusion and standard aggregation. Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios (up to 90 % malicious clients) demonstrate consistent improvements over supervised baselines and robust aggregation methods, with negligible communication overhead. Code is available at https://github.com/alelicciardi99/wavelet_autoencoders_malicious.
Figures & tables
Fig. 1 : Normalized anomaly scores Ek for all 100 clients on CIFAR-10 under the 60% corruption scenario. Left: WaSA with WST backbone. Right: WaSA with FT backbone, instead of WST. The orange band marks the detection threshold τ=1 . The WST representation yields a clear spectral separation between benign clients and all four corruption types, including structurally subtle attacks such as Gaussian blur and random pixel masking. The FT backbone fails to produce a consistent anomaly signal, with corruption scores overlapping significantly with the benign distribution, confirming the theoretical instability of the Fourier representation to local deformations [ 10 ] .
Fig. 2 : Boltzmann sampling probabilities πk derived from normalized anomaly scores on CIFAR-10 under the 60% corruption scenario, with temperature T=1 . Left: per-client probabilities grouped by type. Right: πk as a function of Ek , illustrating the Gibbs mapping from anomaly score to selection probability. The mean probability assigned to benign clients approaches 1/40 , which corresponds to the uniform selection probability in the oracle setting restricted to clean participants, indicating that WaSA -Boltzmann recovers near-oracle sampling behaviour without ground-truth labels. Corrupted clients exhibiting milder spectral distortions, such as Gaussian blur, receive non-negligible residual probabilities below 0.5% .
Federated Learning (FL) systems are susceptible to adversarial attacks, such as model poisoning attacks and backdoor attacks. Existing defense mechanisms face critical limitations in deployments, such as relying on impractical assumptions (e.g., adversaries acknowledging the presence of attacks before attacking) or undermining accuracy in model training, even in benign scenarios. To address these challenges, we propose CustodianFL, a two-staged anomaly detection method specifically designed for FL deployments. In the first stage, it flags suspicious client activities. In the second stage that is activated only when needed, it further examines these candidates using Three-Sigma Rule to identify and exclude truly malicious local models from FL training. To ensure integrity and transparency within the FL system, CustodianFL integrates zero-knowledge proofs, enabling clients to cryptographically verify the server's detection process without relying on the server's goodwill. CustodianFL operates without unrealistic assumptions and avoids interfering with FL training in attack-free scenarios. It bridges the gap between theoretical advances in FL security and the practical demands of real FL systems. Experimental results demonstrate that CustodianFL consistently delivers performance comparable to benign cases, highlighting its effectiveness in identifying and eliminating malicious models with high accuracy.
Shanshan Han, Wenxuan Wu, Baturalp Buyukates +4
University of California, Irvine · Texas A&M University · University of Birmingham +3
Federated learning (FL) is vulnerable to poisoning attacks, where malicious clients upload manipulated updates to degrade the performance of the global model. Although detection methods can identify and remove malicious clients, the model remains affected. Retraining from scratch is effective but costly, and existing unlearning methods remain unsatisfactory in both effectiveness and efficiency. We propose Federated Adversarial Unlearning (FAUN), a lightweight framework that retains only a short window of malicious clients' updates and employs adversarial optimization on a proxy dataset to derive updates that eliminate malicious directions. Applying these updates for a few unlearning rounds, followed by benign fine-tuning, enables fast removal of malicious effects and stable recovery. Experiments on three canonical datasets show that FAUN achieves recovery comparable to retraining while requiring far fewer rounds and reduces attack success rates to near zero, confirming FAUN successfully eliminates the contributions of unlearned clients.
Wenwei Zhao, Xiaowen Li, Yao Liu +1
Department of Electrical Engineering, University of South Florida,Tampa, FL, USA · Bellini College, University of South Florida, Tampa, FL, USA
Federated Learning enables decentralized model training by exchanging model updates--rather than raw data--with a central parameter server (PS). While most of the existing defenses primarily assume static or independently acting adversaries, we reveal a new class of dynamically adaptive attacks that systematically bypass such protections. We propose Fed-ADR, a holistic attack framework in which a malicious orchestrator server (OS) dynamically coordinates a heterogeneous set of adversarial clients, including both targeted and untargeted attackers. Through real-time coordination by the OS, malicious clients strategically adapt their gradient updates to evade defenses deployed by the PS, while either severely degrading global model performance or steering training toward adversarial objectives.To mitigate this threat, we offer a detection mechanism that estimates each client's true gradient from historical updates, enabling real-time detection of coordinated malicious behavior without additional overhead. We further introduce an in-situ recovery mechanism that restores global model performance without restarting training, preserving convergence and minimizing recovery time. Comprehensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 benchmark datasets demonstrate that Fed-ADR's attack scheme can reduce global accuracy from over 90% to below 10%, bypassing several state-of-the-art defenses. When our detection and recovery modules are employed, they identify malicious clients and restore accuracy to over 90% within a few rounds, at a substantially lower cost than retraining from scratch--achieving a reduction of at least 20x in computational overhead.
Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy
School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA