FedOPCS: An Optimized Poisoning Countermeasure for Non-IID Federated Learning with Privacy-Preserving Stability

Federated learning (FL), as a distributed machine learning framework, enables multiple participants to jointly train models without sharing data, thereby ensuring data privacy and security. However, FL systems still struggle to escape the typical poisoning threat launched by Byzantine nodes. The current defence measures almost all rely on the anomaly detection of local gradients in a plaintext state, which not only weakens privacy protection but also allows malicious clients to upload malicious ciphertext gradients once they are encrypted, which thus easily evade existing screenings. At the same time, mainstream aggregation algorithms are generally based on the premise that “each client’s data satisfy an independent and identically distributed (IID)”, which is obviously difficult to achieve in real scenarios where large-scale terminal devices hold their own data. Symmetry in data distribution and model updates across clients is crucial for achieving robust and fair aggregation, yet non-IID data and adversarial attacks disrupt this balance. To address these challenges, we propose FedOPCS, an optimized poisoning countermeasure for non-IID FL algorithms with privacy-preserving stability by introducing three key innovations: Conditional Generative Adversarial Network (CGAN)-based data augmentation with conditional variables to simulate global distribution, a dynamic weight adjustment mechanism with homomorphic encryption, and two-stage anomaly detection combining gradient analysis and model performance evaluation. Extensive experiments on MNIST and CIFAR-10 show that, in the model poisoning and mixed poisoning environments, FedOPCS outperforms the baseline methods by 11.4% and 4.7%, respectively, while maintaining the same efficiency as FedAvg. FedOPCS therefore offers a privacy-preserving, Byzantine-robust, and communication-efficient solution for future heterogeneous FL deployments.