FedGDD: Defending Federated Learning Against Targeted Model Poisoning Sybil Attacks Based on Gradient Drift Detection

Sybil attacks pose a significant threat to federated learning, as malicious nodes can collaborate to form a majority and overwhelm the system. Therefore, developing effective countermeasures is essential to ensure the security of federated learning systems. To address this challenge, we introduce a novel targeted model poisoning defence method for federated learning, named Gradient Drift Detection (FedGDD). Unlike existing approaches, such as clustering, statistical analysis, and re-training, which struggle in scenarios where malicious nodes constitute the majority, FedGDD reframes malicious detection as a gradient drift detection problem. This approach identifies potential attacks by detecting deviations in gradients, operating on the premise that the loss functions for benign and malicious nodes are inherently different. Extensive experimental evaluations demonstrate the efficacy of FedGDD compared to six well-established methods: Flame, FLTrust, FedCPA, Median, Krum, and FL-WBC. Using tasks from both image classification and natural language processing, the experiments confirm that FedGDD is robust and independent of specific application settings. Results show that FedGDD effectively safeguards federated learning systems across a wide range of malicious node ratios. Specifically, FedGDD maintains a low attack success rate for malicious nodes when their ratio ranges from 0.2 to 0.8. Additionally, it preserves high model accuracy when the malicious node ratio is between 0.2 and 0.5. These findings highlight FedGDD's potential to enhance the reliability and performance of Federated Learning systems.