Recent attacks on federated learning (FL) can introduce malicious model
updates that circumvent widely adopted Euclidean distance-based detection
methods. This paper proposes a novel defense strategy, referred to as
LayerCAM-AE, designed to counteract model poisoning in federated learning. The
LayerCAM-AE puts forth a new Layer Class Activation Mapping (LayerCAM)
integrated with an autoencoder (AE), significantly enhancing detection
capabilities. Specifically, LayerCAM-AE generates a heat map for each local
model update, which is then transformed into a more compact visual format. The
autoencoder is designed to process the LayerCAM heat maps from the local model
updates, improving their distinctiveness and thereby increasing the accuracy in
spotting anomalous maps and malicious local models. To address the risk of
misclassifications with LayerCAM-AE, a voting algorithm is developed, where a
local model update is flagged as malicious if its heat maps are consistently
suspicious over several rounds of communication. Extensive tests of LayerCAM-AE
on the SVHN and CIFAR-100 datasets are performed under both Independent and
Identically Distributed (IID) and non-IID settings in comparison with existing
ResNet-50 and REGNETY-800MF defense models. Experimental results show that
LayerCAM-AE increases detection rates (Recall: 1.0, Precision: 1.0, FPR: 0.0,
Accuracy: 1.0, F1 score: 1.0, AUC: 1.0) and test accuracy in FL, surpassing the
performance of both the ResNet-50 and REGNETY-800MF. Our code is available at:
this https URL

本文提出了一种新颖的防御策略 LayerCAM-AE 来对抗联邦学习中的模型污染攻击，通过整合 Layer Class Activation Mapping（LayerCAM）和自编码器（AE），显著增强了检测能力，实验结果表明 LayerCAM-AE 在联邦学习中提高了模型的检测率和准确性，超越了现有的防御模型 ResNet-50 和 REGNETY-800MF。