Adaptive Neuron Selective Aggregator (ANSA): An Experimental Comparison of Federated Learning Robustness Under Data Poisoning

This code implements a unified experimental framework to compare Centralized Machine Learning, Standard Federated Learning (FedAvg), LFighter, and the proposed ANSA defense under controlled label-flipping attack scenarios. The framework is designed to ensure fairness, reproducibility, and consistency across all methods by enforcing identical data partitions, malicious client selections, and attack configurations. The MNIST dataset is used as the benchmark. From the original training set, 50,000 samples are selected and partitioned equally among N clients, where the number of clients is specified by the user. Each client holds a disjoint local dataset, reflecting a standard federated learning setting. The MNIST test set is split into per-client validation sets, while the full test set is used to evaluate the global model. All data splits are deterministic under a fixed random seed. Seven attack scenarios are evaluated. Scenario S1 contains no attack. Scenarios S2–S4 involve fewer than 50% malicious clients, while Scenarios S5–S7 involve more than 50% malicious clients. For each scenario, malicious clients are selected randomly but deterministically, and the same malicious client set is reused across all methods to ensure a fair comparison. The attack model is label-flipping poisoning, where specific source classes are flipped to a target class (class 2). Attack strength increases across scenarios by flipping additional classes: scenarios S2 and S5 flip class 7; S3 and S6 flip classes 7 and 3; and S4 and S7 flip classes 7, 3, and 9. These operations are applied only to the malicious clients’ local training data. Four learning paradigms are compared. In Centralized Learning, a single model is trained on the union of all client data, including poisoned samples. FedAvg performs standard federated aggregation without defenses. LFighter detects and excludes suspicious client updates based on clustering of model updates. ANSA selectively filters suspicious neurons in client updates, mitigating poisoning while preserving benign information. All federated methods operate in communication rounds with multiple local epochs per round. Centralized learning is trained for an equivalent total number of epochs. For each scenario and method, the framework records per-client validation accuracy, global accuracy per round, and final global test accuracy. For each scenario, a comparison plot is generated showing global model accuracy per round for all methods, with centralized results aligned to the federated rounds. All global accuracy curves are plotted in black for visual consistency. The framework is fully reproducible and controlled through the number of clients and a single random seed.