Federated learning (FL) is a collaborative learning paradigm allowing
multiple clients to jointly train a model without sharing their training data.
However, FL is susceptible to poisoning attacks, in which the adversary injects
manipulated model updates into the federated model aggregation process to
corrupt or destroy predictions (untargeted poisoning) or implant hidden
functionalities (targeted poisoning or backdoors). Existing defenses against
poisoning attacks in FL have several limitations, such as relying on specific
assumptions about attack types and strategies or data distributions or not
sufficiently robust against advanced injection techniques and strategies and
simultaneously maintaining the utility of the aggregated model. To address the
deficiencies of existing defenses, we take a generic and completely different
approach to detect poisoning (targeted and untargeted) attacks. We present
FreqFed, a novel aggregation mechanism that transforms the model updates (i.e.,
weights) into the frequency domain, where we can identify the core frequency
components that inherit sufficient information about weights. This allows us to
effectively filter out malicious updates during local training on the clients,
regardless of attack types, strategies, and clients' data distributions. We
extensively evaluate the efficiency and effectiveness of FreqFed in different
application domains, including image classification, word prediction, IoT
intrusion detection, and speech recognition. We demonstrate that FreqFed can
mitigate poisoning attacks effectively with a negligible impact on the utility
of the aggregated model.

FreqFed 是一种新颖的聚合机制，通过将模型更新转换到频域，可以有效过滤掉恶意攻击，无论攻击类型、策略和客户端数据分布，从而在不影响聚合模型的实用性的前提下有效缓解毒化攻击。