Federated Adversarial Defense with Adversarial Training and Personalized Evaluation

Federated learning(FL) mitigates privacy leakage issues that may arise from data transmission in multi-site methods in the medical field by utilizing local training and global aggregation. Although FL offers a degree of data privacy, local training at individual sites remains susceptible to adversarial attacks, potentially undermining the overall robustness of the aggregated global model. We propose a federated adversarial training approach that enhances the robustness through both local training and global aggregation. In the local training, we incorporate adversarial training by adding adversarial samples to each site's training set, thereby improving the robustness of the local models during the federated learning. Furthermore, to enhance the fairness of the global aggregation, we introduce a personalized evaluation method. After anonymizing the source information, the models are redistributed to the participating sites, where their performance is evaluated in terms of accuracy and robustness across different sites, enabling a fairer and more comprehensive assessment of each model' s contribution to the global aggregation. We conducted experiments on two multi-site brain disease datasets and compared our approach with other adversarial training methods under both white-box and black-box attacks, demonstrating the reliability of our method.