ML Security PapersByzantine-Robust and Differentially Private Federated Optimization under Weaker Assumptions
Rustem Islamov 1, Grigory Malinovsky 2, Alexander Gaponov 2, Aurelien Lucchi 1, Peter Richtárik 2, Eduard Gorbunov 3
Published on arXiv
2603.23472
Data Poisoning Attack
OWASP ML Top 10 — ML02
Key Finding
Achieves state-of-the-art convergence rates under Byzantine attacks and DP constraints without requiring bounded gradients or auxiliary server datasets
Byz-Clip21-SGD2M
Novel technique introduced
Federated Learning (FL) enables heterogeneous clients to collaboratively train a shared model without centralizing their raw data, offering an inherent level of privacy. However, gradients and model updates can still leak sensitive information, while malicious servers may mount adversarial attacks such as Byzantine manipulation. These vulnerabilities highlight the need to address differential privacy (DP) and Byzantine robustness within a unified framework. Existing approaches, however, often rely on unrealistic assumptions such as bounded gradients, require auxiliary server-side datasets, or fail to provide convergence guarantees. We address these limitations by proposing Byz-Clip21-SGD2M, a new algorithm that integrates robust aggregation with double momentum and carefully designed clipping. We prove high-probability convergence guarantees under standard $L$-smoothness and $σ$-sub-Gaussian gradient noise assumptions, thereby relaxing conditions that dominate prior work. Our analysis recovers state-of-the-art convergence rates in the absence of adversaries and improves utility guarantees under Byzantine and DP settings. Empirical evaluations on CNN and MLP models trained on MNIST further validate the effectiveness of our approach.
Key Contributions
- Byz-Clip21-SGD2M algorithm combining robust aggregation with double momentum and clipping for Byzantine+DP settings
- Convergence guarantees under L-smoothness and sub-Gaussian noise without bounded gradient assumptions
- Unified framework handling both Byzantine robustness and differential privacy with improved utility
🛡️ Threat Analysis
Defends against Byzantine attacks in federated learning where malicious clients send arbitrary model updates to degrade global model performance — this is data poisoning via malicious gradient updates.