Logit Calibration and Feature Contrast for Robust Federated Learning on Non-IID Data

Federated learning (FL) is a privacy-preserving distributed framework for collaborative model training in edge networks. However, challenges such as vulnerability to adversarial examples and non-independent and identically distributed (non-IID) data across devices hinder the deployment of adversarially robust and accurate models at the edge. While adversarial training (AT) is widely recognized as an effective defense strategy against adversarial attacks in centralized training, we shed light on the adverse effects of directly applying AT in FL, which can severely compromise accuracy under non-IID scenarios. To address this limitation, this paper proposes <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FatCC</u>, which incorporates local logit <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</u>alibration and global feature <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</u>ontrast into the vanilla federated adversarial training (<underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fat</u>) process from both logit and feature perspectives. This approach effectively enhances the robust accuracy (RA) and clean accuracy (CA) of the federated system. First, we introduce logit calibration, where the logits are calibrated during local adversarial updates, thereby improving adversarial robustness. Second, FatCC incorporates feature contrast, which involves a global alignment term that aligns each local representation with corresponding unbiased global features, thus enhancing robustness and accuracy. Extensive experiments across multiple datasets demonstrate that FatCC achieves comparable or superior performance gains in both CA and RA compared to other baselines.