标题： 通过远程证明实现可信联邦学习以缓解拜占庭威胁 显示英文标题

标题： Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threats

摘要： 联邦学习（FL）因其隐私保护能力而受到广泛关注，使分布式设备能够在不共享原始数据的情况下协作训练全局模型。 然而，其分布式特性迫使中央服务器盲目信任本地训练过程并聚合不确定的模型更新，使其容易受到恶意参与者的拜占庭攻击，尤其是在关键任务场景中。 由于客户端之间的知识多样，检测此类攻击具有挑战性，因为模型更新的变化可能来自良性因素，如非独立同分布数据，而不是对抗行为。 现有的数据驱动防御难以区分恶意更新和自然变化，导致高误报率和较差的过滤性能。 为解决这一挑战，我们提出了Sentinel，一种基于远程认证（RA）的FL系统方案，从系统安全角度恢复客户端透明度并缓解拜占庭攻击。 我们的系统使用代码插装来跟踪控制流并在本地训练过程中监控关键变量。 此外，我们在可信执行环境（TEE）内使用可信训练记录器生成认证报告，该报告经过密码学签名并安全传输到服务器。 在验证后，服务器确保合法客户端的训练过程不受程序行为违规或数据篡改的影响，仅允许受信任的模型更新被聚合到全局模型中。 在物联网设备上的实验结果表明，Sentinel以较低的运行时间和内存开销确保了本地训练完整性的可信性。 显示英文摘要

摘要： Federated Learning (FL) has gained significant attention for its privacy-preserving capabilities, enabling distributed devices to collaboratively train a global model without sharing raw data. However, its distributed nature forces the central server to blindly trust the local training process and aggregate uncertain model updates, making it susceptible to Byzantine attacks from malicious participants, especially in mission-critical scenarios. Detecting such attacks is challenging due to the diverse knowledge across clients, where variations in model updates may stem from benign factors, such as non-IID data, rather than adversarial behavior. Existing data-driven defenses struggle to distinguish malicious updates from natural variations, leading to high false positive rates and poor filtering performance. To address this challenge, we propose Sentinel, a remote attestation (RA)-based scheme for FL systems that regains client-side transparency and mitigates Byzantine attacks from a system security perspective. Our system employs code instrumentation to track control-flow and monitor critical variables in the local training process. Additionally, we utilize a trusted training recorder within a Trusted Execution Environment (TEE) to generate an attestation report, which is cryptographically signed and securely transmitted to the server. Upon verification, the server ensures that legitimate client training processes remain free from program behavior violation or data manipulation, allowing only trusted model updates to be aggregated into the global model. Experimental results on IoT devices demonstrate that Sentinel ensures the trustworthiness of the local training integrity with low runtime and memory overhead.