1. Abstract

Poisoning Attack Detection in Federated Learning is a cybersecurity project designed to identify and mitigate malicious client updates that can compromise collaborative machine learning models. Federated Learning allows multiple clients to train a shared model without directly sharing their raw datasets. However, malicious participants may submit manipulated model updates or use poisoned training data to reduce model accuracy, introduce incorrect predictions, or influence model behavior. The proposed system monitors client model updates and applies anomaly detection and robust aggregation techniques to identify suspicious contributions. The server evaluates update characteristics, detects potential outliers, and aggregates trusted or filtered updates to improve global model reliability. The system aims to strengthen federated learning security, reduce the impact of poisoning attacks, and support more trustworthy collaborative AI applications.

2. Objectives

1. To develop a poisoning attack detection framework for federated learning.
2. To simulate malicious and honest clients in a distributed training environment.
3. To identify suspicious model updates using anomaly detection techniques.
4. To implement robust aggregation methods to reduce the influence of malicious clients.
5. To compare model performance before and after poisoning attacks.
6. To evaluate detection precision, recall, F1-score, and false positive rate.
7. To improve the reliability of the global model during collaborative training.
8. To visualize suspicious clients, attack detection results, and model performance.

3. Existing System

Traditional Federated Learning allows clients to train local models and send their updates to a central server for aggregation. Standard aggregation algorithms, such as Federated Averaging (FedAvg), may be vulnerable when malicious clients submit manipulated updates or poison their local training data. These contributions can degrade global model performance or influence predictions without directly accessing other clients' datasets.

Disadvantages

1. Vulnerability to malicious client updates.
2. Reduced global model accuracy during poisoning attacks.
3. Difficulty distinguishing malicious updates from legitimate variations.
4. Potential model manipulation by compromised clients.
5. Limited protection in basic aggregation methods.
6. Risk of false alarms when honest clients have different data distributions.

4. Proposed System

The proposed system integrates poisoning attack simulation, anomaly detection, and robust aggregation into a federated learning framework. Honest clients train local models using legitimate datasets, while simulated malicious clients submit manipulated updates or train on poisoned data. The server analyzes client updates using techniques such as update norm analysis, cosine similarity, clustering, or statistical anomaly detection.

Suspicious updates are flagged or down-weighted, and a robust aggregation strategy is used to reduce their influence on the global model. The system compares the resulting model with a standard FedAvg baseline under different attack scenarios.

Key Features

1. Simulation of honest and malicious clients.
2. Detection of suspicious model updates.
3. Model update anomaly analysis.
4. Robust aggregation techniques.
5. Global model accuracy monitoring.
6. Attack detection performance evaluation.
7. Dashboard for visualizing malicious client alerts and training results.

5. Implementation Procedure

1. Dataset Collection: Select a public dataset for a classification task, such as MNIST, Fashion-MNIST, or a suitable network intrusion dataset.

2. Data Preprocessing: Clean the dataset, handle missing values where applicable, normalize features, and divide the data into training and testing sets.

3. Client Simulation: Partition the dataset among multiple simulated clients representing independent participants.

4. Local Model Development: Build a machine learning model or neural network for the selected classification task.

5. Federated Learning Setup: Use Flower to coordinate local training and communication between clients and the aggregation server.

6. Baseline Training: Train the model using honest clients and standard FedAvg to establish baseline accuracy.

7. Poisoning Attack Simulation: Introduce controlled attacks, such as label-flipping data poisoning or manipulated model updates, from selected simulated clients.

8. Update Monitoring: Collect permitted model update statistics, such as update norms, similarity scores, and changes in model performance.

9. Anomaly Detection: Apply statistical thresholds, clustering, or other anomaly detection methods to flag potentially malicious updates.

10. Robust Aggregation: Apply an aggregation method such as coordinate-wise median, trimmed mean, or another suitable robust strategy to limit the influence of suspicious contributions.

11. Performance Evaluation: Compare the baseline and defended models using accuracy, precision, recall, F1-score, attack detection rate, and false positive rate.

12. Dashboard Development: Create a Streamlit or Flask application to display model accuracy, detected suspicious clients, attack types, and training metrics.

13. Testing: Evaluate the system under different poisoning strengths, malicious client proportions, and non-IID data distributions.

6. Software Requirements

7. Hardware Requirements

Recommended: Intel Core i5 or equivalent, 16 GB RAM, and SSD storage for running multiple simulated clients and attack experiments.

8. Advantages of the Project

1. Improved Security: Helps identify suspicious client updates during federated training.
2. Attack Impact Reduction: Robust aggregation can limit the influence of some poisoning attacks.
3. Global Model Protection: Helps preserve model performance when malicious clients participate.
4. Collaborative Learning: Maintains distributed training without directly sharing raw datasets.
5. Attack Evaluation: Enables testing against different poisoning scenarios.
6. Performance Monitoring: Measures detection effectiveness and false positive rates.
7. Scalability: Supports experiments with varying client counts and attacker proportions.
8. Security Research Support: Helps evaluate defenses for trustworthy federated learning.