Federated learning in adversarial environments

The paper proposes a new federated learning scheme that resists state-of-the-art backdoor attacks and model degradation attacks even when a large proportion of participating nodes are malicious. The scheme applies biased quantization to model updates, offering different trade-offs among robustness, privacy, bandwidth efficiency, and model accuracy. Its differential privacy extension protects the participants' entire datasets; under strict privacy requirements its efficiency is comparable to the non-private robust scheme, but its robustness against these two types of attacks is weaker, suggesting a possible fundamental trade-off between differential privacy and robustness.