标题： FedGuard：具有主要恶意客户端的联邦学习多样拜占庭鲁棒机制 显示英文标题

标题： FedGuard: A Diverse-Byzantine-Robust Mechanism for Federated Learning with Major Malicious Clients

摘要： 联邦学习是一种容易受到拜占庭攻击的分布式训练框架，尤其是在超过50%的客户端是恶意的情况下，或者数据集高度非独立同分布（non-IID）时。此外，大多数现有的防御机制都是为特定类型的攻击设计的（例如，基于梯度相似性的方案只能防御异常模型中毒），这限制了它们的有效性。针对这一问题，我们提出了FedGuard，一种新颖的联邦学习机制。FedGuard巧妙地通过利用成员推断对模型偏差的高度敏感性来解决上述问题。通过要求客户端在其训练中包含服务器指定数据的一个额外小批量，FedGuard可以识别并排除被污染的模型，因为它们在小批量上的置信度会显著下降。我们的全面评估明确表明，在三个高度非IID的数据集上，当90%的客户端是拜占庭攻击者，并且每轮发生七种不同类型的拜占庭攻击时，FedGuard在缓解各种类型的拜占庭攻击方面明显优于现有的鲁棒联邦学习方案。 显示英文摘要

摘要： Federated learning is a distributed training framework vulnerable to Byzantine attacks, particularly when over 50% of clients are malicious or when datasets are highly non-independent and identically distributed (non-IID). Additionally, most existing defense mechanisms are designed for specific attack types (e.g., gradient similarity-based schemes can only defend against outlier model poisoning), limiting their effectiveness. In response, we propose FedGuard, a novel federated learning mechanism. FedGuard cleverly addresses the aforementioned issues by leveraging the high sensitivity of membership inference to model bias. By requiring clients to include an additional mini-batch of server-specified data in their training, FedGuard can identify and exclude poisoned models, as their confidence in the mini-batch will drop significantly. Our comprehensive evaluation unequivocally shows that, under three highly non-IID datasets, with 90% of clients being Byzantine and seven different types of Byzantine attacks occurring in each round, FedGuard significantly outperforms existing robust federated learning schemes in mitigating various types of Byzantine attacks.