Federated learning is highly susceptible to model poisoning attacks,
especially those meticulously crafted for servers. Traditional defense methods
mainly focus on updating assessments or robust aggregation against manually
crafted myopic attacks. When facing advanced attacks, their defense stability
is notably insufficient. Therefore, it is imperative to develop adaptive
defenses against such advanced poisoning attacks. We find that benign clients
exhibit significantly higher data distribution stability than malicious clients
in federated learning in both CV and NLP tasks. Therefore, the malicious
clients can be recognized by observing the stability of their data
distribution. In this paper, we propose AdaAggRL, an RL-based Adaptive
Aggregation method, to defend against sophisticated poisoning attacks.
Specifically, we first utilize distribution learning to simulate the clients'
data distributions. Then, we use the maximum mean discrepancy (MMD) to
calculate the pairwise similarity of the current local model data distribution,
its historical data distribution, and global model data distribution. Finally,
we use policy learning to adaptively determine the aggregation weights based on
the above similarities. Experiments on four real-world datasets demonstrate
that the proposed defense model significantly outperforms widely adopted
defense models for sophisticated attacks.

通过观察数据分布的稳定性，我们提出了 AdaAggRL，一种基于强化学习的自适应聚合方法，用于防御复杂的恶意攻击。实验证明，该防御模型在四个真实数据集上显著优于广泛采用的防护模型。

利用基于强化学习的聚合，在联邦学习中防御复杂的中毒攻击

Defending Against Sophisticated Poisoning Attacks with RL-based  Aggregation in Federated Learning

Adaptive defenses, which optimize at test time, promise to improve
adversarial robustness. We categorize such adaptive test-time defenses, explain
their potential benefits and drawbacks, and evaluate a representative variety
of the latest adaptive defenses for image classification. Unfortunately, none
significantly improve upon static defenses when subjected to our careful case
study evaluation. Some even weaken the underlying static model while
simultaneously increasing inference computation. While these results are
disappointing, we still believe that adaptive test-time defenses are a
promising avenue of research and, as such, we provide recommendations for their
thorough evaluation. We extend the checklist of Carlini et al. (2019) by
providing concrete steps specific to adaptive defenses.

我们对自适应防御策略进行了分类并评估了最新的代表性方法，结果表明在图像分类中这些自适应防御策略没有明显的提高静态防御的水平，同时增加了推理计算。然而，我们仍相信自适应的防御策略是一个有前途的研究方向，并提出了具体的研究建议和评估步骤扩展了 Carlini 等人的清单。