Defending Federated Learning Against Model Poisoning Attacks via Eliminating Malicious Features

Federated learning (FL) is susceptible to model poisoning attacks, in which malicious clients compromise the global model by sending manipulated model updates to the server. While numerous studies have proposed defenses against such attacks, these defenses often struggle to handle complex attack patterns or heterogeneous data distributions in practical scenarios. Moreover, existing defenses face significant limitations in efficiency and applicability, particularly when dealing with large-scale or highly sophisticated attacks. This article studies model poisoning attacks in FL, showing the effectiveness of such attacks and the difficulties of defending against them via a theoretical foundation. To address the above challenges, we introduce a novel defense method designed to mitigate model poisoning attacks more effectively by eliminating malicious features, and design differential privacy-based defense (DPD) and selective aggregation-based defense (SAD), respectively. Empirical evidence from experiments with public datasets verifies their effectiveness. In particular, SAD outperforms all baseline defense methods in defending against Min-Max attacks. Additionally, SAD effectively defends against other attack types, achieving optimal or near-optimal defense performance in our experiments.