New Federated Learning Framework Resists Coordinated Poisoning Attacks

The study, published in Discover Computing, introduces the Trimmed-Mean Federated Chain, or TFC, which aims to address vulnerabilities in distributed machine learning where malicious clients manipulate model updates to compromise the global model. Federated learning allows devices to train models collaboratively without sharing raw data, preserving privacy but exposing the process to adversarial interference. The new framework integrates global norm stabilisation, directional filtering, and trimmed-mean aggregation to improve robustness under diverse attack scenarios.

The research team, led by Chang Zhi Soh, Chee-Onn Chow, Joon Huang Chuah, and David Chieng, identified that existing robust aggregation methods often degrade under increasingly complex datasets and coordinated adversarial settings. While previous approaches like the Krum Federated Chain, or KFC, provide protection against traditional Byzantine and backdoor attacks, they may struggle when malicious clients collaborate to align their updates with benign directions. This coordination allows attackers to evade conventional filtering strategies that rely on detecting outliers or distance-based anomalies. The TFC framework is specifically designed to mitigate these sophisticated threats by adding stabilisation and filtering components before aggregation.

The proposed TFC architecture operates within a federated chain, a blockchain-based structure that decentralises the aggregation process to enhance transparency and trust. In each communication round, participating clients perform local training and transmit their model updates to the server. The server then applies a multi-stage defence strategy. First, a stabilisation module suppresses abnormal client updates with excessively large magnitudes using a median-based norm reference. This step prevents extreme updates from destabilising the aggregation process or disproportionately influencing the overall update distribution.

Following stabilisation, the filtering module evaluates the directional consistency of the remaining updates. It constructs a robust reference update by computing the element-wise median of the client updates. Layerwise cosine similarity is then calculated to measure how closely each client update aligns with this reference direction. The filtering process occurs in two stages: a coarse stage removes updates with low similarity scores, and a refined stage applies stricter criteria to further identify inconsistent updates. Adaptive survivor selection retains only the most consistent updates for the final aggregation step.

The final step involves aggregating the surviving updates using the trimmed-mean method. This statistical approach removes extreme coordinate values before averaging the remaining values, utilising more client information than median aggregation while maintaining robustness against outliers. By combining stabilisation, directional filtering, and trimmed-mean aggregation, the TFC framework aims to preserve benign client contributions while reducing the influence of coordinated malicious updates that attempt to maintain directional consistency with legitimate updates.

To evaluate the effectiveness of TFC, the researchers conducted extensive experiments on three benchmark image classification datasets: EMNIST, Fashion-MNIST, and CIFAR-10. The experiments simulated three types of adversarial attacks: Byzantine attacks, backdoor attacks, and Coordinated Model Poisoning, or CMP, attacks. Byzantine attacks involve malicious clients sending arbitrary or corrupted updates to disrupt training. Backdoor attacks implant hidden behaviours into the model by associating specific trigger patterns with target labels. CMP attacks involve multiple colluding clients generating coordinated malicious updates to amplify their influence on the global model.

The experimental setup used the Flexible Federated Learning Framework, or FLEX, to implement the TFC architecture and ensure fair comparison with the KFC baseline. For EMNIST and Fashion-MNIST, 200 clients were used, while 100 clients were used for the more complex CIFAR-10 dataset. The training process consisted of 100 communication rounds for each setting. The proportion of malicious clients varied by attack type and dataset, ranging from 3.33% to 40% of participating clients per round. Each experimental configuration was evaluated using multiple independent repetitions to improve reliability, with results averaged over the final ten communication rounds.

The results demonstrated that TFC generally achieves stronger robustness performance than KFC under Byzantine and backdoor attacks. Under Byzantine attacks, TFC achieved higher classification accuracy across all evaluated datasets. On EMNIST and Fashion-MNIST, even the TFC Baseline, which used only trimmed-mean aggregation, outperformed KFC. However, on the more complex CIFAR-10 dataset, the full TFC framework with stabilisation and filtering modules achieved substantially higher accuracy, highlighting the importance of these additional components under heterogeneous data conditions.

For backdoor attacks, TFC achieved lower attack success rates than KFC across all datasets, indicating stronger resistance to targeted poisoning. The improvements were particularly noticeable on Fashion-MNIST and CIFAR-10, where the integration of stabilisation and directional filtering proved more effective. On EMNIST, both methods achieved similarly low attack success rates, suggesting that simpler datasets are less sensitive to differences between robust aggregation strategies. These findings suggest that TFC provides improved empirical robustness against backdoor attacks, especially under more complex data distributions.

Under Coordinated Model Poisoning attacks, the performance of TFC was more nuanced. TFC achieved lower attack success rates than KFC on EMNIST and Fashion-MNIST, indicating improved robustness against coordinated adversarial behaviour in relatively simpler settings. However, on CIFAR-10, both methods exhibited comparable performance, with noticeable fluctuations in attack success rates throughout the training process. These fluctuations reflect unstable learning dynamics caused by coordinated adversarial updates under high-complexity data distributions. The results indicate that coordinated poisoning attacks remain a significant challenge for robust aggregation mechanisms, particularly under heterogeneous conditions.

The study also examined the computational cost of the TFC framework. The multi-stage design introduces additional aggregation-stage computation compared to KFC, including global-norm computation, median-based reference construction, and layer-wise cosine-similarity evaluation. In the CIFAR-10 CMP experiments, TFC required approximately 59 minutes and 39 seconds for 100 communication rounds, compared to 53 minutes and 30 seconds for KFC. This represents an increase of approximately 11.5% in training time. The additional overhead reflects the stabilisation and directional-filtering operations performed before aggregation. Memory requirements are also increased due to the storage of intermediate information such as layer norms and similarity measurements, but these operations do not introduce additional client-side communication rounds.

The researchers acknowledge several limitations of the present study. The evaluated attacks were not specifically designed to circumvent the TFC defence mechanisms, meaning the threat model does not represent adaptive white-box or grey-box attacks where adversaries have explicit knowledge of the defence criteria. Future work will investigate norm-constrained and direction-aware adaptive attacks to evaluate robustness against adversaries specifically designed to exploit the stabilisation and filtering mechanisms. Additionally, the evaluation did not constitute a systematic stress test under severe non-IID conditions, and further analysis is needed to understand the impact of strong data heterogeneity on the false-positive rate of the filtering modules.

The proposed TFC framework represents a significant step towards securing federated learning systems against sophisticated poisoning attacks. By integrating stabilisation, directional filtering, and trimmed-mean aggregation, the framework improves empirical robustness under the evaluated adversarial settings. The study highlights the importance of combining statistical aggregation methods with pre-aggregation defence mechanisms to address the evolving landscape of adversarial threats in distributed machine learning. Future research will focus on formal theoretical guarantees, adaptive attack simulations, and scalability assessments to further validate the framework’s applicability in real-world federated learning environments.

The study positions TFC within the broader context of blockchain-based federated learning, which aims to eliminate the single point of failure inherent in centralised server architectures. By recording model updates on a tamper-resistant ledger, such systems enhance transparency and accountability among participating clients. However, the authors note that blockchain technology does not inherently verify the semantic correctness of uploaded updates. Consequently, poisoning attacks can still compromise the global model, making robust aggregation a critical component for ensuring model integrity within these decentralised frameworks. The proposed TFC architecture builds upon the Flexible Federated Learning Framework, or FLEX, which provides a configurable environment for designing and evaluating federated learning systems, including data distribution and privacy settings.

The experimental design incorporated specific attack configurations to test the framework’s resilience. For backdoor attacks, malicious clients poisoned 20% of their local training samples by inserting a fixed trigger pattern and changing the corresponding label to the target class, which was set to class 0. In the case of Coordinated Model Poisoning, a fixed group of colluding clients generated coordinated malicious updates using a train-and-scale strategy. These clients trained on targeted poisoned data and subsequently scaled the resulting malicious model update using a scaling factor of 4.0 before submission. The malicious clients were distributed across the miners to ensure that adversarial updates could affect the entire federated chain rather than remaining isolated within a single miner.

The evaluation metrics were tailored to the specific nature of the attacks. For untargeted Byzantine attacks, the primary metric was classification accuracy on clean test data, where higher values indicate stronger robustness. For targeted attacks, including backdoor and CMP scenarios, the researchers measured both classification accuracy and the attack success rate, or ASR. The ASR measures the proportion of poisoned samples that are successfully misclassified into the attacker’s target class, with lower values indicating stronger resistance. To ensure reliability, each experimental configuration was evaluated using multiple independent repetitions, with the reported results representing the mean of round-wise averaged metric values over the final ten communication rounds.

The ablation study provided quantitative evidence for the necessity of the multi-stage defence strategy. The initial TFC Baseline, which relied solely on trimmed-mean aggregation, achieved classification accuracies of 0.98827 on EMNIST and 0.89507 on Fashion-MNIST under Byzantine attacks. However, this aggregation-only configuration became insufficient under more challenging settings. During backdoor evaluations, the introduction of directional filtering with adaptive survivor selection was necessary to suppress directionally inconsistent updates. The subsequent addition of the stabilisation module addressed unstable ASR behaviour observed in developmental experiments, leading to the complete TFC framework that combines all three defence components.

Subject of Research: Trimmed-mean federated chain for robust aggregation against poisoning attacks in federated learning

Article Title: Trimmed-mean federated chain for robust aggregation against poisoning attacks in federated learning

Article References: Soh, C. Z., Chow, C.-O., Chuah, J. H., & Chieng, D. (2026). Trimmed-mean federated chain for robust aggregation against poisoning attacks in federated learning. Discover Computing, 29(1), Article 832. https://doi.org/10.1007/s10791-026-10769-8

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10769-8

Keywords: Trimmed-mean, federated, chain, robust, aggregation, against, poisoning, attacks, learning, scientific research