Privacy-preserving and anti-poisoning method for hierarchical federated learning

doi:10.3969/j.issn.1671-1122.2026.10.007

Abstract

Abstract:

Federated learning (FL) as a privacy-preserving distributed machine learning paradigm has been widely applied across various fields. However, traditional single-server architectures face issues of excessive server communication overhead as user devices increase. Although multi-edge-server architectures alleviate the single-point load pressure, their limited coverage cannot meet the demands of large-scale FL for data diversity and model generalization capability. In recent years, the hierarchical federated learning (HFL) architecture has been introduced, which incorporates edge servers in different regions to perform intermediate aggregation while a cloud server handles global aggregation. This approach effectively reduces the cloud server’s load and is better suited for large-scale FL training across multiple regions. Nevertheless, HFL still faces challenges such as privacy leakage and poisoning attacks, especially in non-independent and identically distributed (non-IID) data scenarios. Moreover, the unreliability of edge servers in the intermediate layer is often overlooked, which can easily lead to collusion and crash risks, thereby threatening privacy security and affecting model training. To address these issues, this paper proposed a secure and reliable aggregation scheme based on the HFL architecture. Firstly, by using Shamir’s secret sharing and a masking mechanism, the scheme not only enhanced privacy protection during the training phase but also significantly improves the system’s tolerance to collusion and crash at edge servers. Secondly, the paper integrated Gaussian mixture model clustering and a scaled dot-product attention mechanism to design an anti-poisoning protocol under privacy protection. Theoretical analysis proves that the proposed scheme offers strong reliability in terms of privacy protection and resilience against edge server collusion and crash risks. Extensive experiments show that the scheme effectively resists poisoning attacks on various datasets and under non-IID settings, improving model accuracy by 5% to 20% compared to state-of-the-art methods.

Key words: hierarchical federated learning, privacy-preserving, anti-poisoning, collusion attack, crash risk

CLC Number:

TP309

Liu Yuanxin, Liang Yihuai, Zhou Zhengchun. Privacy-preserving and anti-poisoning method for hierarchical federated learning[J]. Netinfo Security, 2026, 26(10): 1595-1615.

Figures/Tables 17

References 34

[1]	Le Junqing, Zhang Di, Lei Xinyu, et al. Privacy-preserving federated learning with malicious clients and honest-but-curious servers[J]. IEEE Transactions on Information Forensics and Security, 2023, 18: 4329-4344.
[2]	Zhang Zhuangzhuang, Wu Libing, Ma Chuanguo, et al. LSFL: a lightweight and secure federated learning scheme for edge computing[J]. IEEE Transactions on Information Forensics and Security, 2022, 18: 365-379.
[3]	Li Yiran, Li Hongwei, Xu Guowen, et al. Practical privacy-preserving federated learning in vehicular fog computing[J]. IEEE Transactions on Vehicular Technology, 2022, 71(5): 4692-4705.
[4]	Hazra A, Rana P, Adhikari M, et al. Fog computing for next-generation internet of things: fundamental, state-of-the-art and research challenges[J]. Computer Science Review, 2023, 48: 100549.
[5]	Liu Yi, Nie Jiangtian, Li Xuandi, et al. Federated learning in the sky: aerial-ground air quality sensing framework with uav swarms[J]. IEEE Internet of Things Journal, 2020, 8(12): 9827-9837.
[6]	Liu Lumin, Zhang Jun, Song S H, et al. Client-Edge-Cloud hierarchical federated learning[C]// The 2020 IEEE International Conference on Communications (ICC 2020). New York: IEEE, 2020: 1-6.
[7]	Lim W Y B, Luong N C, Hoang D T, et al. Federated learning in mobile edge networks: a comprehensive survey[J]. IEEE Communications Surveys & Tutorials, 2020, 22(3): 2031-2063.
[8]	Siriwardhana Y, Pawani P, Liyanage M, et al. SHIELD-Secure aggregation against poisoning in hierarchical federated learning[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(2): 1845-1863.
[9]	Li Yanbin, Wang Xuemei, Sun Runkang, et al. Trustiness-Based hierarchical decentralized federated learning[J]. Knowledge-Based Systems, 2023, 276: 110763.
[10]	Zhou Hongliang, Zheng Yifeng, Jia Xiaohua. Towards robust and privacy-preserving federated learning in edge computing[J]. Computer Networks, 2024, 243: 110321.
[11]	Li Xiumin, Wen Mi, He Siying, et al. A privacy-preserving federated learning scheme against poisoning attacks in smart grid[J]. IEEE Internet of Things Journal, 2024, 11(9): 16805-16816.
[12]	Li Xueyang, Liang Yihuai, Zhou Zhengchun, et al. Efficient privacy-preserving federated learning with integrity in fog computing[J]. IEEE Transactions on Network Science and Engineering, 2026, 13: 391-407.
[13]	Xu Guowen, Li Hongwei, Ren Hao, et al. Data security issues in deep learning: attacks, countermeasures, and opportunities[J]. IEEE Communications Magazine, 2019, 57(11): 116-122.
[14]	Melis L, Song Congzheng, De C E, et al.Exploiting unintended feature leakage in collaborative learning[C]//2019 IEEE Symposium on Security and Privacy (SP). New York: IEEE, 2019: 691-706.
[15]	Miao Yinbin, Yan Xinru, Li Xinghua, et al. RFed: robustness-enhanced privacy-preserving federated learning against poisoning attack[J]. IEEE Transactions on Information Forensics and Security, 2024, 19: 5814-5827.
[16]	Bonawitz K, Ivanov V, Kreuter B, et al. Practical secure aggregation for privacy-preserving machine learning[C]// The 2017 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2017: 1175-1191.
[17]	Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need[C]// The 31st International Conference on Neural Information Processing Systems. New York: Curran Associates, 2017: 6000-6010.
[18]	Ma Zhuoran, Ma Jianfeng, Miao Yinbin, et al. ShieldFL: mitigating model poisoning attacks in privacy-preserving federated learning[J]. IEEE Transactions on Information Forensics and Security, 2022, 17: 1639-1654.
[19]	Zeng Honghong, Lou Jiong, Li Kailai, et al. ESFL: accelerating poisonous model detection in privacy-preserving federated learning[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(4): 3780-3794.
[20]	Wu Minzhe, Zhao Bowen, Xiao Yang, et al. MODEL: a model poisoning defense framework for federated learning via truth discovery[J]. IEEE Transactions on Information Forensics and Security, 2024, 19: 8747-8759.
[21]	Li Xueyang, Yang Xue, Zhou Zhengchun, et al. Efficiently achieving privacy preservation and poisoning attack resistance in federated learning[J]. IEEE Transactions on Information Forensics and Security, 2024, 19: 4358-4373.
[22]	Zhou Hongliang, Zheng Yifeng, Huang Hejiao, et al. Toward robust hierarchical federated learning in internet of vehicles[J]. IEEE Transactions on Intelligent Transportation Systems, 2023, 24(5): 5600-5614.
[23]	Liu Jingwei, Wu Yufeng, Du Wei, et al. Byzantine-Robust hierarchical aggregation for cross-device federated learning in consumer IoT[J]. IEEE Transactions on Consumer Electronics, 2024, 71(2): 6359-6370.
[24]	Zuo Shaojun, Xie Yong, Wu Libing, et al. ApaPRFL: robust privacy-preserving federated learning scheme against poisoning adversaries for intelligent devices using edge computing[J]. IEEE Transactions on Consumer Electronics, 2024, 70(1): 725-734.
[25]	Chen Xiao, Yu Haining, Jia Xiaohua, et al. APFed: anti-poisoning attacks in privacy-preserving heterogeneous federated learning[J]. IEEE Transactions on Information Forensics and Security, 2023, 18: 5749-5761.
[26]	Huang Zixuan, Bi Yuanguo, Zhang Kuan, et al. PDSA-FL: a poisoning-defense secure aggregation in federated learning[J]. IEEE Transactions on Information Forensics and Security, 2025, 20: 7617-7632.
[27]	Liang Yihuai, Li Yan, Shin B S. Privacy-Preserving and reliable truth discovery for heterogeneous fog-based crowdsensing[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(3): 2338-2351.
[28]	Shamir A. How to share a secret[J]. Communications of the ACM, 1979, 22(11): 612-613.
[29]	Fu Yinlin, Liu Xiaonan, Sarkar S, et al. Gaussian mixture model with feature selection: an embedded approach[J]. Computers & Industrial Engineering, 2021, 152: 107000.
[30]	Xu Lei, Jordan M I. On convergence properties of the EM algorithm for gaussian mixtures[J]. Neural Computation, 1996, 8(1): 129-151.
[31]	Zhu Ligeng, Liu Zhijian, Han Song. Deep leakage from gradients[C]// The 33rd International Conference on Neural Information Processing Systems. New York: NeurIPS, 2019, 1323: 14774-14784.
[32]	Pasquini D, Ateniese G, Bernaschi M. Unleashing the tiger: inference attacks on split learning[C]// The 2021 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2021: 2113-2129.
[33]	Li Guohao, Yang Li, Zhou Lu, et al. Practical and collusion-resistant privacy-preserving aggregation for edge intelligence[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(6): 7229-7243.
[34]	Liu Yuanxin, Liang Yihuai, Zhang Rui, et al. Secure federated learning with configurable reliability in heterogeneous edge computing[J]. Computer Networks, 2026, 274: 111808.

方案	分层联邦学习	考虑 non-IID	防范服务器合谋	隐私保护	防范服务器宕机	防御投毒
GALAXY^[3]	—	—	√	√	√	√
SHIELD^[8]	√	√	—	—	—	√
RoPPFL^[10]	√	√	—	√	—	√
PFLS^[11]	√	√	—	√	—	√
EPIFL^[12]	√	√	—	√	√	√
ShieldFL^[18]	—	√	—	√	—	√
ESFL^[19]	—	√	—	√	—	√
MODEL^[20]	—	√	—	—	—	√
RoHFL^[22]	√	√	—	—	—	√
BHFL^[23]	√	√	√	√	—	√
ApaPRFL^[24]	√	—	—	√	—	√
APFed^[25]	√	√	—	√	—	√
PDSA^[26]	√	√	√	√	—	√
本文方案	√	√	√	√	√	√

符号	描述
m	客户端总数
U	HFL中地理区域的集合
N	单个区域内边缘服务器的总数
T	SSS的门限值
K	GMM聚类中的簇总数
d	客户端梯度的维度
deg	精度值
$\mathbf{G}_{i}^{t}$	客户端i在t轮时的梯度向量
$\boldsymbol{G}_{i}^{t \prime}$	客户端i在t轮时整数化后的梯度向量
$[\mathbf{G}_{i}^{t}]$	客户端i在t轮时的梯度向量份额
$[{{\mathbf{\bar{G}}}_{t,a}}]$	区域a在第t轮的区域聚合梯度向量份额
${{\pi }_{k}}$	簇k的权重值
${{\mathbf{\mu }}_{k}}$	簇k的均值向量
$\mathbf{\sigma }_{k}^{2}$	簇k的对角协方差向量
$\varepsilon $	GMM迭代停止的收敛阈值
I_max	GMM的最大迭代次数
i	客户端索引
j	维度索引
k	簇索引

阶段	算法	计算复杂度	通信复杂度
单客户端本地训练	GALAXY	O(N·d)	O(N·d)
	EPIFL	O(d)	O(d)
	本文方案	O(N·d)	O(N·d)
边缘服务器聚合	GALAXY	O(N²·m·d)	O(N²·m·d)
	EPIFL	O(m·d)	O(m·d)
	本文方案	O(N²·m·d)	O(N²·m·d)
云服务器全局聚合	GALAXY	—	—
	EPIFL	O(U·d)	O(U·d)
	本文方案	O(U²·N·d)	O(U·N·d)

方案	收敛期准确率方差 (标签翻转攻击下)	收敛期准确率方差 (后门攻击下)
本文方案	0.154	0.131
MODEL	0.088	1.994
ShieldFL	1.409	0
PDSA	0.519	4.375
GALAXY	0.203	5.907
EPIFL	0.531	0.068
ESFL	0.912	0

投毒客户端比例	仅应用缩放点积注意力机制	仅应用GMM	本文方案
0	61.56%	65.85%	70.00%
10%	46.88%	48.22%	58.98%
20%	42.50%	47.64%	52.76%
30%	44.48%	44.89%	50.38%
40%	40.96%	40.47%	47.98%