Multi-GAFL: Multi-Group Aggregation for Protecting Privacy and Mitigating Poisoning Attack in Federated Learning

Privacy-preserving federated learning (PPFL) securely aggregates local gradients of clients into a global model, but it is vulnerable to poisoning attacks by Byzantine clients who upload malicious gradients to prevent convergence and compromise accuracy. Traditional defense methods, relying on observable characteristics in plaintext, are incompatible with PPFL, where client gradients are encrypted and indistinguishable to the central server. To detect malicious clients who upload poisoning updates in ciphertext, we design a privacy-preserving federated learning framework, namely Multi-GAFL. The framework initially employs a verifiable secret sharing (VSS) scheme combined with a masking technique to protect the privacy of uploading gradients. Subsequently, to accurately identify Byzantine clients and to remove the gradients of the detected clients, we propose a multi-group aggregation strategy and norm & sign detection algorithm. These approaches ultimately mitigate the impact of poisoning attacks. In addition, by setting a threshold in VSS, our Multi-GAFL achieves robustness against client dropout during training. Experiments demonstrate the effectiveness of Multi-GAFL in resisting poisoning attacks. Even when the proportion of Byzantine clients reaches 40%, MultiGAFL still effectively defends against multiple poisoning attacks and outperforms existing defense methods.