Defending Against Poisoning Attacks in Federated Learning with Strong Privacy Protection

Federated learning can support multiple clients to train a global model with the assistance of the central server without sharing raw clients' data. However, the gradients uploaded by clients still compromise privacy and federated learning is vulnerable to poisoning attacks by malicious clients. Previous studies have focused on privacy preservation or defense against poisoning attacks, respectively. In practice, privacy preservation further increases the difficulty of defending against poisoning attacks, leading to the problem of severe degradation of model accuracy under strong privacy preservation. In this paper, we propose a lightweight, robust, and privacy-preserving federated learning scheme that can effectively resist poisoning attacks under strong privacy protection and prevent model accuracy degradation. We employ a differential privacy technique that adds noise to the upload gradient to protect data privacy. To address the problem that it is difficult to detect malicious clients under strong privacy preservation, we design a probabilistic grouping mechanism based on trust scores to support the detection of malicious clients. We conduct extensive experiments to evaluate our scheme, and the results show that our scheme can resist different types of poisoning attacks under strong privacy preservation, thus improving the accuracy of the model.