Federated learning (FL) allows multiple devices to train a model collaboratively without sharing their data. Despite its benefits, FL is vulnerable to privacy leakage and poisoning attacks. To address the privacy concern, secure aggregation (SecAgg) is often used to obtain the aggregation of gradients on sever without inspecting individual user updates. Unfortunately, existing defense strategies against poisoning attacks rely on the analysis of local updates in plaintext, making them incompatible with SecAgg. To reconcile the conflicts, we propose a robust federated learning framework against poisoning attacks (RFLPA) based on SecAgg protocol. Our framework computes the cosine similarity between local updates and server updates to conduct robust aggregation. Furthermore, we leverage verifiable packed Shamir secret sharing to achieve reduced communication cost of $O(M+N)$ per user, and design a novel dot-product aggregation algorithm to resolve the issue of increased information leakage. Our experimental results show that RFLPA significantly reduces communication and computation overhead by over $75\%$ compared to the state-of-the-art method, BREA, while maintaining competitive accuracy.

翻译：联邦学习（FL）允许多个设备在不共享数据的情况下协作训练模型。尽管具有优势，FL 仍易受隐私泄露和投毒攻击的影响。为解决隐私问题，通常采用安全聚合（SecAgg）来获取服务器端梯度的聚合结果，而无需检查单个用户的更新。然而，现有的针对投毒攻击的防御策略依赖于对明文本地更新的分析，这使得它们与 SecAgg 不兼容。为调和这一矛盾，我们提出了一种基于 SecAgg 协议的鲁棒联邦学习框架以抵御投毒攻击（RFLPA）。该框架通过计算本地更新与服务器更新之间的余弦相似度来执行鲁棒聚合。此外，我们利用可验证打包 Shamir 秘密共享技术，将每个用户的通信成本降低至 $O(M+N)$，并设计了一种新颖的点积聚合算法以解决信息泄露增加的问题。实验结果表明，与现有最优方法 BREA 相比，RFLPA 在保持竞争力的准确率的同时，显著降低了超过 $75\%$ 的通信和计算开销。