A robust aggregation method for blockchain federated learning based on multi-dimensional features and dynamic defense

doi:10.3969/j.issn.1671-1122.2026.09.006

Abstract

Abstract:

In recent years, the security of robust aggregation in blockchain-based federated learning become an important research topic. Existing defense methods mainly rely on detection in a single parameter space, prior trusted data, or fixed filtering strategies, and still suffer from limited detection dimensions and insufficient adaptability when facing stealthy attacks such as collusive poisoning and backdoor injection. To address these issues, this paper proposed MFDD, a robust aggregation method for blockchain-based federated learning based on multi-dimensional features and dynamic defense. MFDD identified potential collusive attacks through similarities among client updates and evaluated client anomalies using a probe dataset in terms of prediction deviation, task loss, parameter deviation, and directional consistency. To address directional anomalies in collusive reverse updates, a directional-risk conditional trust mechanism based on a robust center was further constructed. A coordinate-wise median was used to form a robust reference center, and an unsupervised median absolute deviation (MAD) criterion was employed to identify significant reverse updates. When valid directional-risk evidence was formed, anomalous clients were excluded and the weights of the remaining clients were renormalized. On this basis, client filtering and weighted aggregation were performed through adaptive fusion and dynamic defense, while key detection and aggregation information was recorded on the blockchain ledger to enable trusted recording and traceable auditing. Experimental results show that under the MNIST IID setting with 35% collusive reverse updates, MFDD achieves an accuracy of 0.9704± 0.0025, whereas the ablated variant without the directional-risk conditional trust mechanism achieves an accuracy of only 0.1763. On-chain auditing experiments based on Hyperledger Fabric 2.5.14 achieve 318 matches between on-chain and off-chain records and validated the auditing mechanism through duplicate submissions, overwrite attempts, and tampering with core audit fields. The results demonstrated that MFDD can improve robust aggregation under complex attack scenarios while providing a trusted and auditable recording mechanism for key detection and aggregation information.

Key words: Federated learning, blockchain, robust aggregation, multi-dimensional feature detection, dynamic defense

CLC Number:

TP309

Zhu Xiaoqiang, Lin Yanzi, Zhang Haowen, Yao Yingying. A robust aggregation method for blockchain federated learning based on multi-dimensional features and dynamic defense[J]. Netinfo Security, 2026, 26(9): 1391-1407.

Figures/Tables 11

符号	定义
${{\theta }^{t}}$	第t轮迭代的全局模型参数
$\Delta _{i}^{t}$	在第t轮训练结束后客户端$i$上传的模型更新向量
${{D}_{probe}}$	用于客户端行为审计的固定探测数据集
$S_{ij}^{t}$	客户端i，j更新的余弦相似度
$S_{i}^{sim}$	刻画客户端i更新群体一致性的相似性分量；参与融合前进行归一化，归一化后仍沿用该符号
$S_{i}^{behav}$	客户端i多维行为异常评分，取值越大表示异常程度越高
$\hat{S}_{i}^{behav}$	经Min-Max归一化后的行为异常评分
$\tilde{S}_{i}^{behav}$	由归一化行为异常评分反向转换并归一化得到的行为信任分量，取值越大表示行为可信度越高
${{\sigma }_{b}}$	归一化行为异常评分$\tilde{S}_{i}^{behav}$的标准差
$\alpha $	相似性分量与行为信任分量融合的自适应调节因子
$\omega _{i}^{t}$	客户端i的连续信任权重
$\varepsilon $	避免除零及数值不稳定的小正数
${{m}^{t}}$	第t轮客户端更新的坐标中位数鲁棒中心
$\rho _{i}^{t}$	客户端i更新与鲁棒中心之间的余弦方向相似度
$r_{i}^{t}$	客户端i的方向风险评分
$me{{d}_{r}}$	当前轮次所有客户端方向风险评分的中位数
$MA{{D}_{r}}$	当前轮次方向风险评分的中位数绝对偏差
${{\tau }^{t}}$	第t轮基于MAD确定的方向风险判别阈值
${{F}^{t}}$	第t轮被方向风险机制标记的客户端集合
${{S}^{t}}$	当前聚合路径下最终保留的客户端集合；方向风险条件成立时为排除${{F}^{t}}$后的客户端集合
$a_{i}^{t}$	客户端i条件筛选后的最终归一化聚合权重
$\delta $	连续信任权重退化判别阈值，本文设置为 0.01
$f$	Multi-Krum及安全保留约束使用的拜占庭客户端数量上界
${{\Delta }_{k}}$	升序排列后的相邻连续信任权重之间的第k个间隙
${{k}^{*}}$	最大权重间隙对应的候选分界位置
${{n}_{rm}}$	基础MFDD间隙筛选路径最终确定的客户端筛除数量

References 28

[1]	McMahan B, Moore E, Ramage D, et al. Communication-efficient learning of deep networks from decentralized data[C]// The 20th International Conference on Artificial Intelligence and Statistics. New York: PMLR, 2017: 1273-1282.
[2]	顾育豪, 白跃彬. 联邦学习模型安全与隐私研究进展[J]. 软件学报, 2023, 34(6): 2833-2864.
[3]	穆旭彤, 程珂, 宋安霄, 等. 抗拜占庭攻击的隐私保护联邦学习[J]. 计算机学报, 2024, 47(4): 842-861.
[4]	郑诚波, 闫皓楠, 傅彩利, 等. 面向智能物联网的双层级联邦安全学习架构[J]. 信息网络安全, 2024, 10(6):71-80.
[5]	Wen Jie, Zhang Zhixia, Lan Yang, et al. A survey on federated learning: challenges and applications[J]. International Journal of Machine Learning and Cybernetics, 2023, 14(2): 513-535. doi: 10.1007/s13042-022-01647-y
[6]	Qu Youyang, Uddin M P, Gan Chenquan, et al. Blockchain-enabled federated learning: a survey[J]. ACM Computing Surveys, 2022, 55(4): 1-35.
[7]	Issa W, Moustafa N, Turnbull B, et al. Blockchain-based federated learning for securing internet of things: a comprehensive survey[J]. ACM Computing Surveys, 2023, 55(9): 1-43.
[8]	Zheng Zibin, Xie Shaoan, Dai H-N, et al. Blockchain challenges and opportunities: a survey[J]. International Journal of Web and Grid Services, 2018, 14(4): 352-375. doi: 10.1504/IJWGS.2018.095647 URL
[9]	Zhang Haoran, Jiang Shan, Xuan Shichang. Decentralized federated learning based on blockchain: concepts, framework, and challenges[J]. Computer Communications, 2024, 216: 140-150. doi: 10.1016/j.comcom.2023.12.042 URL
[10]	Shejwalkar V, Houmansadr A, Kairouz P, et al. Back to the drawing board: a critical evaluation of poisoning attacks on production federated learning[C]// 2022 IEEE Symposium on Security and Privacy. New York: IEEE, 2022: 1354-1371.
[11]	Zhang Zaixi, Cao Xiaoyu, Jia Jinyuan, et al. FLDetector: defending federated learning against model poisoning attacks via detecting malicious clients[C]// The 28th ACM SIGKDD Conference. New York: ACM, 2022: 2545-2555.
[12]	Yin Dong, Chen Yudong, Kannan R, et al. Byzantine-robust distributed learning: towards optimal statistical rates[C]// International Conference on Machine Learning. New York: PMLR, 2018: 5650-5659.
[13]	Blanchard P, El Mhamdi E M, Guerraoui R, et al. Machine learning with adversaries: byzantine tolerant gradient descent[C]// Advances in Neural Information Processing Systems 30. Long Beach: Curran Associates Inc, 2017: 118-128.
[14]	Xiao Xiong, Tang Zhuo, Li Chuanying, et al. SCA: sybil-based collusion attacks of IIoT data poisoning in federated learning[J]. IEEE Transactions on Industrial Informatics, 2022, 19(3): 2608-2618. doi: 10.1109/TII.2022.3172310 URL
[15]	Fung C, Yoon C J M, Beschastnikh I. The limitations of federated learning in sybil settings[C]// The 23rd International Symposium on Research in Attacks, Intrusions and Defenses. Berkeley: USENIX, 2020: 301-316.
[16]	Zhu Tengteng, Guo Zehua, Yao Chao, et al. Byzantine-robust federated learning via cosine similarity aggregation[J]. Computer Networks, 2024, 254: 110730. doi: 10.1016/j.comnet.2024.110730 URL
[17]	Hu Hongsheng, Salcic Z, Sun Lichao, et al. Membership inference attacks on machine learning: a survey[J]. ACM Computing Surveys, 2022, 54(11): 1-37.
[18]	Fredrikson M, Jha S, Ristenpart T. Model inversion attacks that exploit confidence information and basic countermeasures[C]// The ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2015: 1322-1333.
[19]	Li Xiang, Huang Kaixuan, Yang Wenhao, et al. On the convergence of FedAvg on non-IID data[C]// The 8th International Conference on Learning Representations (ICLR 2020).OpenReview.net, 2020.
[20]	Nguyen T D, Nguyen T, Tran T A, et al. Towards irreversible backdoor attacks in federated learning[C]// Advances in Neural Information Processing Systems 36. New York: Curran Associates, 2023: 66364-66376.
[21]	刘嘉朗, 郭延明, 劳明睿, 等. 联邦学习后门攻击与防御算法综述[J]. 计算机研究与发展, 2024, 61(10): 2607-2626.
[22]	Cao Xiaoyu, Fang Minghong, Liu Jia, et al. FLTrust: byzantine-robust federated learning via trust bootstrapping[C]// Network and Distributed System Security Symposium. Reston: Internet Society, 2021: 1-18.
[23]	Nguyen T D, Rieger P, Chen H, et al. FLAME: Taming Backdoors in Federated Learning[C]// The 31st USENIX Security Symposium. Berkeley: USENIX, 2022: 1415-1432.
[24]	Rieger P, Nguyen T D, Miettinen M, et al. DeepSight: mitigating backdoor attacks in federated learning through deep model inspection[C]// Network and Distributed System Security Symposium. Reston: Internet Society, 2022: 1-18.
[25]	Baruch M, Baruch G, Goldberg Y. A little is enough: circumventing defenses for distributed learning[C]// Advances in Neural Information Processing Systems 32. New York: Curran Associates, 2019: 8635-8645.
[26]	Fang Minghong, Cao Xiaoyu, Jia Jinyuan, et al. Local model poisoning attacks to byzantine-robust federated learning[C]// The 29th USENIX Security Symposium. Berkeley: USENIX, 2020: 1605-1622.
[27]	Kim H, Park J, Bennis M, et al. Blockchained on-device federated learning[J]. IEEE Communications Letters, 2020, 24(6): 1279-1283. doi: 10.1109/COML.4234 URL
[28]	Li Yuzheng, Chen Chuan, Liu Nan, et al. A blockchain-based decentralized federated learning framework with committee consensus[J]. IEEE Network, 2021, 35(1): 234-241. doi: 10.1109/MNET.011.2000263

方法	主要检测依据	使用可信数据	客户端群体关系建模	独立方向异常门控	聚合方式
FoolsGold	客户端更新相似性	否	是	否	基于相似性降低权重
FLTrust	客户端与服务器参考更新的方向关系	是	否	否	信任评分与范数归一化
FLDetector	跨轮次更新预测偏差	否	否	否	异常客户端检测
FLAME	模型更新聚类、裁剪及噪声	否	是	否	聚类筛选与裁剪
Multi-Krum	客户端更新间的欧氏距离	否	是	否	选择距离较小的多个更新聚合
MFDD （本文方法）	群体一致性、多维行为、鲁棒中心方向风险	是	是	是	连续信任与条件筛选

项目	设置
客户端数量/个	20
通信轮数/轮	50
本地训练轮数/轮	2
学习率	0.01
Batch size	32
随机种子	42、123、2026
数据划分	IID、Shard Non-IID
探测数据集	训练集预留100个样本，每类10个，与客户端训练集及最终测试集不重叠
MNIST模型	Conv(1→16, 3?3) + ReLU + FC(16?26?26→128) + ReLU + FC(128→10)
CIFAR-10模型	3层卷积网络：32、64、128通道，每层ReLU与2?2最大池化；FC(2048→512) + ReLU + Dropout(0.5) + FC(512→10)
恶意客户端选择	每次实验开始时随机无放回抽样，不同seed重新抽样，同一run内固定
图案后门	左上角2?2触发器，像素值置为1.0，目标类别7；恶意客户端每batch中80%的样本注入触发器
标签翻转	all-to-one标签投毒，恶意客户端本地样本标签全部修改为目标类别7
CIFAR-10后门通道	仅修改第1个图像通道
协同反向更新	对客户端本地更新${{\Delta }_{i}}$执行${{\Delta }_{i}}\leftarrow ~-0.8{{\Delta }_{i}}$
ASR测试	使用与训练阶段相同规格的触发器，对测试样本全部注入触发器
主要攻击场景	协同反向更新、标签翻转、图案后门

实验场景	评价指标	MFDD-base	MFDD
Clean	ACC	0.9790±0.0017	0.9790±0.0017
图案后门攻击，35%	ASR	0.8189±0.2061	0.8189±0.2061
协同反向更新，35%	ACC	0.1763	0.9704±0.0025
协同反向更新，35%	TPR	0	0.4286±0

验证项目	验证对象	结果
代表轮次审计	第1、25、50轮	均完成链上查询
客户端记录查询	每轮20个客户端	20/20可查询
链上链下一致性	客户端级与轮次级字段	MATCH=318，mismatch=0
重复提交验证	相同正式记录重复提交	拒绝
同键覆盖验证	相同键提交不同内容	拒绝，无静默覆盖
核心字段篡改验证	Schema v1核心审计字段	8/8通过

性能指标	测试条件	平均值/ms	P95/吞吐量
Payload/outbox生成	本地Schema v1审计记录	1.791	—
Fabric提交	Payload生成并提交	2095.909	—
轮次记录查询	Round record	11.070	30.707 ms
客户端记录查询	Client record	11.653	27.810 ms
并发提交	并发度1	—	0.4787 TPS
并发提交	并发度2	—	0.9452 TPS
并发提交	并发度4	—	1.8924 TPS
并发提交	并发度8	—	2.8012 TPS