FedSPA Uses Shapley Values to Shield Federated Learning From Poisoning Attacks

Federated learning lets many devices train a shared machine-learning model without ever sending their raw data to a central server, a design that has made the paradigm popular for privacy-sensitive applications. The trade-off, researchers report in Cluster Computing, is that the server cannot directly inspect the training data on each client, leaving the whole system exposed to data poisoning attacks in which compromised participants submit corrupted model updates. A new method called FedSPA, short for Federated Learning with Shapley Value and Model Parameter Joint Analysis, is designed to tolerate such attacks by identifying malicious clients before their updates are aggregated.

The problem is sharpened by a statistical reality of distributed data. In most real federated systems, the data held by different clients is non-independent and non-identically distributed, or Non-IID, meaning each participant sees a different slice of the world. That heterogeneity increases the variability of client updates on its own, which in turn amplifies the damage a poisoning attacker can do, because genuinely unusual benign updates become harder to tell apart from deliberately corrupted ones. According to the authors, Yiming Zhong, Gang Xue, Zhicheng Wang and Jing Liu, existing defense methods tend to be biased when distinguishing benign from malicious updates under Non-IID conditions, which degrades their defensive performance.

FedSPA takes a different route by combining explainable artificial intelligence with direct parameter analysis. The method defines a local similarity measure based on the model parameters that each client submits, and a global similarity measure based on Shapley values computed with SHAP, or SHapley Additive exPlanations, a technique borrowed from explainable AI that quantifies how much each feature contributes to a model’s output.

A notable departure from earlier work, the authors state, is that FedSPA does not need to evaluate or rely on client contribution scores to reach its verdicts. Instead, the combined similarity analysis is claimed to accurately identify malicious clients within the federated system.

The evaluation covers two representative data poisoning scenarios: attacks that inject Gaussian noise and attacks that flip data labels, tested across multiple image datasets. The reported results indicate that FedSPA surpasses previous strategies in mitigating data poisoning attacks and provides an effective protective mechanism for federated learning systems. The study is published in Cluster Computing, volume 29, article number 912, with the article appearing on 28 October 2026.

Subject of Research: A robust federated learning aggregation method that detects data poisoning attacks using Shapley values and model parameter analysis.

Article Title: FedSPA: an attack-tolerant robust federated aggregation via shapley value and parameter analysis

Article References: Zhong, Y., Xue, G., Wang, Z., & Liu, J. (2026). FedSPA: an attack-tolerant robust federated aggregation via shapley value and parameter analysis. Cluster Computing, 29(16), Article 912. https://doi.org/10.1007/s10586-026-06703-8

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06703-8

Keywords: federated learning, data poisoning, Shapley value, SHAP, explainable AI, robust aggregation, Non-IID data, model security, label-flipping attack, Gaussian noise attack, distributed learning, Cluster Computing