BARFED: Byzantine Attack-Resistant Federated Averaging Based on Outlier
  Elimination
  In federated learning, each participant trains its local model with its own
data and a global model is formed at a trusted server by aggregating model
updates coming from these participants. Since the server has no effect and
visibility on the training procedure of the participants to ensure privacy, the
global model becomes vulnerable to attacks such as data poisoning and model
poisoning. Although many defense algorithms have recently been proposed to
address these attacks, they often make strong assumptions that do not agree
with the nature of federated learning, such as Non-IID datasets. Moreover, they
mostly lack comprehensive experimental analyses. In this work, we propose a
defense algorithm called BARFED that does not make any assumptions about data
distribution, update similarity of participants, or the ratio of the malicious
participants. BARFED mainly considers the outlier status of participant updates
for each layer of the model architecture based on the distance to the global
model. Hence, the participants that do not have any outlier layer are involved
in model aggregation. We perform extensive experiments on many grounds and show
that the proposed approach provides a robust defense against different attacks.
