Heterogeneity-Oblivious Robust Federated Learning

Federated Learning (FL) remains highly vulnerable to poisoning attacks, especially under real-world hyper-heterogeneity, where clients differ significantly in data distributions, communication capabilities, and model architectures. Such heterogeneity not only undermines the effectiveness of aggregation strategies but also makes attacks more difficult to detect. Furthermore, high-dimensional models expand the attack surface. To address these challenges, we propose Horus, a heterogeneity-oblivious robust FL framework centered on low-rank adaptations (LoRAs). Rather than aggregating full model parameters, Horus inserts LoRAs into empirically stable layers and aggregates only LoRAs to reduce the attack uncover a key empirical observation that the input projection (LoRA-A) is markedly more stable than the output projection (LoRA-B) under heterogeneity and poisoning. Leveraging this, we design a Heterogeneity-Oblivious Poisoning Score using the features from LoRA-A to filter poisoned clients. For the remaining benign clients, we propose projection-aware aggregation mechanism to preserve collaborative signals while suppressing drifts, which reweights client updates by consistency with the global directions. Extensive experiments across diverse datasets, model architectures, and attacks demonstrate that Horus consistently outperforms state-of-the-art baselines in both robustness and accuracy.

Key Contributions

Horus framework that aggregates only LoRA parameters instead of full model weights to reduce the attack surface in heterogeneous FL
Heterogeneity-Oblivious Poisoning Score using LoRA-A (input projection) features to detect and filter malicious clients without requiring homogeneous data or architectures
Projection-aware aggregation mechanism that reweights benign client updates by consistency with global directions to suppress distribution drift

🛡️ Threat Analysis

Data Poisoning Attack

Defends against Byzantine/poisoning attacks in federated learning where malicious clients send corrupted model updates to degrade global model performance — the Heterogeneity-Oblivious Poisoning Score explicitly detects and filters poisoned clients during aggregation.

Model Poisoning

FL poisoning defense papers of this type standardly evaluate against backdoor/trojan attacks (targeted poisoning with hidden triggers); the abstract explicitly mentions evaluation across 'diverse attacks,' encompassing both untargeted Byzantine and targeted backdoor threats in FL.