CoChat
Sign Up
Cited by 999Privacy-Preserving Technologies in DataAdversarial Robustness in Machine LearningCryptography and Data Security

The DOI matches its Crossref record; 54 of the 54 references it cites were found in a registry or an index; none of the 27 sources its claims cite is checked for support yet.

FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

Open access
Cao, Xiaoyu, Fang, Minghong, Liu, Jia, Gong, Neil Zhenqiang·2021·Proceedings 2021 Network and Distributed System Security Symposium
DOI 10.14722/ndss.2021.24434
Open this paper in CoChat — free account

Abstract

Byzantine-robust federated learning aims to enable a service provider to learn an accurate global model when a bounded number of clients are malicious. The key idea of existing Byzantine-robust federated learning methods is that the service provider performs statistical analysis among the clients' local model updates and removes suspicious ones, before aggregating them to update the global model. However, malicious clients can still corrupt the global models in these methods via sending carefully crafted local model updates to the service provider. The fundamental reason is that there is no root of trust in existing federated learning methods. In this work, we bridge the gap via proposing FLTrust, a new federated learning method in which the service provider itself bootstraps trust. In particular, the service provider itself collects a clean small training dataset (called root dataset) for the learning task and the service provider maintains a model (called server model) based on it to bootstrap trust. In each iteration, the service provider first assigns a trust score to each local model update from the clients, where a local model update has a lower trust score if its direction deviates more from the direction of the server model update. Then, the service provider normalizes the magnitudes of the local model updates such that they lie in the same hyper-sphere as the server model update in the vector space. Our normalization limits the impact of malicious local model updates with large magnitudes. Finally, the service provider computes the average of the normalized local model updates weighted by their trust scores as a global model update, which is used to update the global model. Our extensive evaluations on six datasets from different domains show that our FLTrust is secure against both existing attacks and strong adaptive attacks.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

FLTrust is a Byzantine-robust federated learning method in which the server bootstraps trust using a small clean root dataset and a server model, then weights and normalizes client updates before aggregation. Across six datasets, it defends against existing and adaptive poisoning attacks while matching FedAvg accuracy under no attacks.

Key findings

  • On MNIST-0.1, a CNN global model trained with FLTrust had a testing error rate of 0.04 under all evaluated attacks, while the Krum attack increased Krum’s testing error rate from 0.10 to 0.90.
  • Using a root dataset with less than 100 examples, FLTrust under adaptive attacks with 40%–60% malicious clients still trained global models as accurate as FedAvg under no attacks; for MNIST-0.1 with 60% malicious clients, FLTrust’s testing error rate was 0.04, the same as FedAvg under no attacks.
  • FLTrust substantially reduced Scaling attack success rates: at most 0.03 across the six datasets, whereas FedAvg’s attack success rates were always high.
  • FLTrust tolerated up to 90% malicious clients under existing and adaptive attacks while achieving testing error rates similar to FedAvg without attacks; Scaling attack success rates remained close to 0 when up to 95% of clients were malicious.

Methods

  • FLTrust has the server collect a clean small root dataset and maintain a server model; in each iteration it computes a server model update, assigns each client update a trust score equal to the ReLU-clipped cosine similarity with the server update, normalizes each client update to the server update’s magnitude, and aggregates the normalized updates weighted by trust scores.
  • Evaluation used six datasets: MNIST-0.1, MNIST-0.5, Fashion-MNIST, CIFAR-10, CH-MNIST, and Human Activity Recognition; models included CNN, logistic regression, and ResNet20; attacks included label flipping, Krum attack, Trim attack, Scaling attack, and an adaptive attack optimized for FLTrust.
  • Comparisons were against FedAvg, Krum, Trim-mean, and Median; default settings included 100 clients except HAR (30) and CH-MNIST (40), 20% malicious clients, and a root dataset of 100 examples; analysis used testing error rate and attack success rate, plus a formal security analysis under stated assumptions.

Limitations

  • The paper states FLTrust requires a clean root dataset and may not be robust against a poisoned root dataset, though it argues a service provider can collect a small clean one at low cost.
  • The paper states that stronger local model poisoning attacks to FLTrust may exist and leaves them for future work; it also notes FLTrust works well only when the root dataset distribution does not diverge too much from the overall training data distribution.
  • Evident from the text: the formal guarantee relies on assumptions including strong convexity, Lipschitz continuity, and sub-exponential gradient bounds, and uses settings such as \(R_l=1\) and \(\beta=1\); the empirical evaluation is limited to the six datasets and specified attack/model configurations.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.14722/ndss.2021.24434

Cites

54 of 54 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 27 cited sources checked · 0 supported · 0 flagged

Show all 57 claims

  • It may state two separate claims as one. 19
  • The quote only partly states this claim. 2
  • Probably not a substantial claim. 15
34 of 34

  • The authors state this as an assumption.

    The root dataset is clean from poisoning.

    “We require the root dataset to be clean from poisoning.”

  • The authors state this as an assumption.

    The attacker does not compromise the server.

    “However, the attacker does not compromise the server.”

  • The authors state this as an assumption.

    The server does not have access to the raw local training data on the clients and does not know the number of malicious clients.

    “The server does not have access to the raw local training data on the clients, and the server does not know the number of malicious clients.”

  • The authors state this as an assumption.

    The server has full access to the global model as well as the local model updates from all clients in each iteration.

    “However, the server has full access to the global model as well as the local model updates from all clients in each iteration.”

  • The authors state this as an assumption.

    The attacker controls some malicious clients, which can be fake clients injected by the attacker or genuine ones compromised by the attacker.

    “Specifically, an attacker controls some malicious clients, which can be fake clients injected by the attacker or genuine ones compromised by the attacker.”

  • The authors state this as an assumption.

    The malicious clients can send arbitrary local model updates to the server in each iteration of the FL training process.

    “The malicious clients can send arbitrary local model updates to the server in each iteration of the FL training process.”

  • The authors state this as an assumption.

    The attacker has partial knowledge about an FL system: local training data and local model updates on the malicious clients, loss function, and learning rate.

    “Typically, an attacker has the following partial knowledge about an FL system: local training data and local model updates on the malicious clients, loss function, and learning rate.”

  • The authors state this as an assumption.

    The attacker can perform adaptive attacks to FLTrust.

    “Moreover, the attacker can perform adaptive attacks to FLTrust, which we discuss in Section V.”

  • The authors state this as an assumption.

    The expected loss function F(w) is µ-strongly convex and differentiable over the space Θ with L-Lipschitz continuous gradient.

    “Assumption 1.The expected loss function F (w) is µ-strongly convex and differentiable over the space Θ with L-Lipschitz continuous gradient.”

  • The authors state this as an assumption.

    The empirical loss function f(D,w) is L1-Lipschitz probabilistically.

    “Moreover, the empirical loss function f (D, w) is L 1 -Lipschitz probabilistically.”

  • The authors state this as an assumption.

    The gradient of the empirical loss function ∇f(D,w*) at the optimal global model w* is sub-exponential with parameters σ1 and γ1.

    “Assumption 2. The gradient of the empirical loss function ∇f (D, w * ) at the optimal global model w * is bounded.Moreover, the gradient difference h(D, w) = ∇f (D, w) -∇f (D, w * ) for any w ∈ Θ is bounded.Specifically, there exist positive constants σ 1 and γ 1 such that for any unit vector v, ∇f (D, w * ), v is sub-exponential with σ 1 and γ 1”

  • The authors state this as an assumption.

    The first m clients are malicious.

    “Assuming the first m clients are malicious.”

  • The authors state this as an assumption.

    The service provider can collect a representative root dataset that has the same distribution as the overall training data distribution of the learning task (Case I).

    “Case I. We assume the service provider can collect a representative root dataset for the learning task, i.e., the root dataset has the same distribution as the overall training data distribution of the learning task.”

  • The authors state this as an assumption.

    The root dataset has a distribution different from the overall training data distribution, biased towards a certain class (Case II).

    “Case II.We assume the root dataset has a distribution different from the overall training data distribution of the learning task.In particular, we assume the root dataset is biased towards a certain class.”

  • The authors state this as an assumption.

    The parameter space Θ is constrained such that ||w - w*|| ≤ r√d for any w ∈ Θ.

    “r is some positive number such that ww * ≤ r √ d for any w ∈ Θ (i.e., the parameter space Θ is constrained).”

  • The authors state this as an assumption.

    The attacker knows that FLTrust is used to learn the global model.

    “When an attacker knows our FLTrust is used to learn the global model, the attacker can adapt its attacks to FLTrust.”

  • The authors state this as an assumption.

    Each client's local training dataset D_i and the root dataset D0 are sampled independently from the distribution X.

    “Assumption 3 . Each client's local training dataset D i (i = 1, 2, • • • , n) and the root dataset D 0 are sampled independently from the distribution X .”

  • The authors state this as an assumption.

    Assumption 1 holds.

    “Assume Assumption 1 holds.”

  • The authors state this as an assumption.

    Assumption 2 holds.

    “Suppose Assumption 2 holds.”

  • The authors state this as an assumption.

    The adaptive attacker has full knowledge about the FL system when solving the optimization problem.

    “We consider a strong adaptive attacker who has full knowledge about the FL system when solving the optimization problem.”
20 of 20

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • HAR client training counts exceed the stated training split

    Minor

    With 10,299 examples across 30 clients, using 75% for training yields about 7,724 training examples in total. The stated minimum of 281 training examples per client would require at least 8,430; the reported mean of 343 would require about 10,290.

  • Local model updates have the opposite sign from the gradients

    Minor

    The paper defines a local model update as the new model minus the current model. Under its stated SGD step, setting β = 1 makes that update the negative of the gradient, not the gradient as claimed in the appendix. This also reverses the direction of the stated global update.

2 of 2

Citations

Cites

Flagged first, then by citations

Show all 47 references

Research works printed but not linked: 2

  1. B. I. Rubinstein, B. Nelson, L. Huang, A. D. Joseph, S.-h. Lau, S. Rao, N. Taft, and J. Tygar, "Antidote: understanding and defending against poisoning of anomaly detectors," in ACM IMC, 2009.
  2. C. Xie, S. Koyejo, and I. Gupta, "Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance," in ICML, 2019, pp. 6893- 6901.

Cited by

Sorted by citations

Items 101–200 of 989

Related

See all

Metadata

Authors
Cao, X., Fang, M., Liu, J., & Gong, N. Z.
Affiliations
  • Duke University (US)
  • The Ohio State University (US)
ORCID
Venue
Proceedings 2021 Network and Distributed System Security Symposium
Publisher
Internet Society
Published
2021
DOI
10.14722/ndss.2021.24434
OpenAlex
W3138597937
Cited by
999
References
47
Citations by year
2026: 238 · 2025: 314 · 2024: 240 · 2023: 134 · 2022: 52 · 2021: 19
FWCI
50.96
Type
conference paper
Language
en
Open access
Licence
public-domain
Locations
  • Network and Distributed System Security Symposium (publishedVersion, public-domain)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
National Science Foundation (1943226, 1937786, 2110252)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
Keywords
malicious clients, trust score, adaptive attacks, global model aggregation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review