ML Security PapersProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning
Sena Ergisi , Luis Maßny , Rawad Bitar
Published on arXiv
2509.09534
Data Poisoning Attack
OWASP ML Top 10 — ML02
Key Finding
ProDiGy maintains model accuracy under non-IID data heterogeneity and state-of-the-art Byzantine attacks in scenarios where existing defenses (Krum, Bulyan, FLTrust, etc.) fail to converge
ProDiGy
Novel technique introduced
Federated Learning (FL) emerged as a widely studied paradigm for distributed learning. Despite its many advantages, FL remains vulnerable to adversarial attacks, especially under data heterogeneity. We propose a new Byzantine-robust FL algorithm called ProDiGy. The key novelty lies in evaluating the client gradients using a joint dual scoring system based on the gradients' proximity and dissimilarity. We demonstrate through extensive numerical experiments that ProDiGy outperforms existing defenses in various scenarios. In particular, when the clients' data do not follow an IID distribution, while other defense mechanisms fail, ProDiGy maintains strong defense capabilities and model accuracy. These findings highlight the effectiveness of a dual perspective approach that promotes natural similarity among honest clients while detecting suspicious uniformity as a potential indicator of an attack.
Key Contributions
- Dual scoring system that jointly evaluates client gradients by proximity (honest updates cluster together) and dissimilarity (suspicious uniformity among adversarial updates is penalized)
- Byzantine-robust aggregation algorithm ProDiGy that maintains model accuracy under non-IID data heterogeneity where state-of-the-art defenses fail
- Extensive empirical evaluation across diverse FL settings (IID and non-IID) against prominent attacks (ALIE, FOE, mimic), outperforming existing robust aggregation rules in worst-case utility
🛡️ Threat Analysis
ProDiGy defends against Byzantine attacks in federated learning, where malicious clients send adversarial gradient updates to degrade the global model's performance — this is the canonical FL poisoning / Byzantine-fault-tolerant aggregation threat covered by ML02.