Dual watermark authentication defense for federated learning: lossless integrity verification against model poisoning

Abstract Federated learning (FL) is a distributed machine learning framework that coordinates clients to train models on their private datasets via a centralized server, thereby mitigating data privacy risks. However, the communication channels involved in this process are untrusted, leaving FL vulnerable to model poisoning attacks launched by adversaries through man-in-the-middle techniques. Such attacks can degrade the accuracy of the global model and ultimately cause the entire FL training process to fail. In this paper, we propose a defense mechanism that integrates secure verification with watermarking, with the primary goal of ensuring the integrity of models transmitted over communication channels and enabling highly reliable FL deployment. Our mechanism leverages a dual watermarking method: first, models are marked using specially generated samples, and then these samples are further watermarked based on a class histogram-inspired approach. This dual strategy enhances both model detection and watermark stealthiness. The key innovation of our method lies in its sensitivity to subtle tampering while imposing no loss in model accuracy. Experimental results demonstrate that our defense mechanism significantly strengthens the resilience of FL models against sophisticated model poisoning attacks, while maintaining high accuracy and reliability.