WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning
Authors: Alessandro Licciardi
Organizations: Department of Mathematical Sciences, Politecnico di Torino, Turin, IT · National Institute of Nuclear Physics (INFN), Sezione di Torino, Turin, IT
Federated Learning (FL) enables collaborative model training without exposing raw data, yet remains vulnerable to malicious clients injecting poisoned datasets. Existing defenses are typically reactive (operating during training) or supervised (requiring prior knowledge of attack types) - assumptions that rarely hold in open-ended IoT deployments. We propose WaSA, a fully unsupervised, offline framework for malicious client detection. Before training, each client transmits a single, privacy-preserving spectral summary of its data to the server. A denoising autoencoder, trained solely on clean auxiliary data, scores clients based on their deviation from the learned benign manifold, identifying corruptions regardless of the attack type. WaSA requires no attack labels, generalizes to unseen anomalies, and introduces a Boltzmann sampling strategy for client selection that smoothly interpolates between hard exclusion and standard aggregation. Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios (up to 90 % malicious clients) demonstrate consistent improvements over supervised baselines and robust aggregation methods, with negligible communication overhead. Code is available at https://github.com/alelicciardi99/wavelet_autoencoders_malicious.
Figures & tables
Fig. 1 : Normalized anomaly scores Ek for all 100 clients on CIFAR-10 under the 60% corruption scenario. Left: WaSA with WST backbone. Right: WaSA with FT backbone, instead of WST. The orange band marks the detection threshold τ=1 . The WST representation yields a clear spectral separation between benign clients and all four corruption types, including structurally subtle attacks such as Gaussian blur and random pixel masking. The FT backbone fails to produce a consistent anomaly signal, with corruption scores overlapping significantly with the benign distribution, confirming the theoretical instability of the Fourier representation to local deformations [ 10 ] .
Fig. 2 : Boltzmann sampling probabilities πk derived from normalized anomaly scores on CIFAR-10 under the 60% corruption scenario, with temperature T=1 . Left: per-client probabilities grouped by type. Right: πk as a function of Ek , illustrating the Gibbs mapping from anomaly score to selection probability. The mean probability assigned to benign clients approaches 1/40 , which corresponds to the uniform selection probability in the oracle setting restricted to clean participants, indicating that WaSA -Boltzmann recovers near-oracle sampling behaviour without ground-truth labels. Corrupted clients exhibiting milder spectral distortions, such as Gaussian blur, receive non-negligible residual probabilities below 0.5% .