SA-FL: Secure Aggregation Scheme in Federated Learning Against Poisoning Attacks

Federated learning (FL) enables collaborative training while keeping raw data on client devices, providing basic-level privacy protection. To further resist privacy breach incurred by inference attacks, secure aggregation techniques have been developed to prevent any party from accessing individual gradients. However, these techniques also hinder anomaly detection, leaving FL systems vulnerable to poisoning attacks under strong privacy constraints. In this paper, we propose SA-FL, a secure aggregation framework that enables effective poisoning detection while preserving privacy. SA-FL introduces an order-preserving blinding mechanism in which client updates are masked using a structured set of random factors that remain algebraically separable under modular arithmetic. The server assess similarity across blinded gradients without revealing their contents. To securely extract aggregated results, SA-FL employs a dual-server architecture in which two non-colluding entities jointly perform decryption, ensuring that no single party can access individual gradients. We provide a comprehensive theoretical analysis proving 1) the correctness of Pearson correlation coefficient computation under blinding, 2) convergence under dual-server aggregation, and 3) indistinguishability under hybrid arguments ensuring semantic privacy. Extensive experiments demonstrate that SA-FL enhances poisoning detection accuracy by up to 3% compared to existing defenses, with a negligible overhead of a few milliseconds per round.