Robust hierarchical federated learning with dual-layer filtering mechanism

Abstract

Hierarchical federated learning (HFL) is an effective “cloud-edge-device” distributed model training framework that protects data privacy. During HFL training, poisoning attacks on local data and transmitted models can affect the accuracy of the global model. Existing methods for defending against unauthorized attacks primarily rely on single-feature anomaly detection approaches, such as calculating distances or densities between data or model parameters. These methods fail to integrate multiple characteristics and metrics to capture anomalous model updates,thus exhibiting significant limitations in model robustness and accuracy. Therefore, we propose a robust hierarchical federated learning method with a dual-layer filtering mechanism (DF-HFL). This method first uses Kernel density estimation to infer the approximate data distribution of devices, ensuring minimal differences among devices within each cluster. It then calculates the density weight of each cluster and the local weight of each device, comparing the difference between local and global weights. Anomalous weights are filtered through a threshold during aggregation. DF-HFL amplifies the distance between malicious updates and normal updates using the dual-layer filtering mechanism, effectively identifying anomalous weights that do not significantly deviate from the normal weight distribution. This helps in accurately detecting anomalies. Additionally, mean filtering is employed to reduce the impact of anomalous data on the original normal gradients, enhancing system robustness. To demonstrate the effectiveness of the proposed method, experiments were conducted on MNIST, FMNIST, Heart Disease and Bank Market datasets. Compared to existing methods like FedAvg, Krum, Random, and Multi-Krum, the global model accuracy improved by 5.18%, 38.98%, 29.96%, and 6.44%.

Introduction

With the development of wireless communication technology and the increasing emphasis on data privacy and security, the hierarchical federated learning (HFL) framework based on “cloud-edge-end” collaboration has received more and more attention ¹ and is widely used in scenarios such as smart transportation, ² industrial internet of things monitoring, ³ and smart medical care. ⁴ Under this framework, the global model training requires uploading the local model trained on the local device (MD) to the edge server (ES), which is closer to the device, for partial aggregation, and then uploading the aggregated model to the cloud server (CS) for global aggregation, which is able to realize the model training and updating while protecting the privacy of data.^5,6

However, the multi-tier architecture of HFL inherently increases its vulnerability to attacks. Attackers can launch poisoning attacks during model updates or transmissions at different layers, which leads to the propagation of these malicious updates at different layers, gradually affecting the global performance and reliability of the model.^7,8

Therefore, the defence means of HFL is crucial for the accuracy and convergence of the global model. Traditional distance-based or density-based methods remove anomalous clients to enhance the robustness of the model by directly calculating the variability between the local gradients of different clients, but this single robustness method cannot cover all anomalies.^9,10 For example, the distance-based anomaly detection method makes it difficult to find a uniform distance metric when the data distribution varies greatly, resulting in some benign clients being misjudged as anomalous clients, which in turn cannot participate in the training of the global model. Density-based anomaly detection mechanisms may incorrectly misclassify local anomalies as global anomalies, resulting in benign clients not being able to participate in the training either.^11,12 In addition, the effectiveness of these methods may diminish when the attacked data or gradient is less different from the normal data. For example, gradient tampering attacks can affect the model without significantly deviating from the normal data distribution by creating small perturbations on the global model that gradually deviate from the correct optimization direction and are difficult to identify by a simple disparity metric.^13,14

We propose a robust hierarchical federated learning method with a two-layer filtering mechanism named DF-HFL. This method investigating from two dimensions of data distribution and gradient, we adopt the method of combining distance and density as the anomaly scoring mechanism for data security and construct a filter federated learning algorithm, which is able to amplify the difference between anomalous and normal participants and reduce the influence of anomalous data on the system, and enhance the system’s overall robustness. It mainly includes: in order to ensure the security of the real data of MDs, the kernel density estimation algorithm is utilized on the server side to approximate the data distribution of MDs by updating the gradient, and the K-means clustering algorithm is used to classify the MDs with similar data distributions into the same cluster in order to effectively identify potential malicious updates in the case of non-uniform distribution. Then the KL scatter metric is utilized to calculate the variability of different MDs with respect to the local cluster distribution, and this is used as the anomaly scoring criterion. To further enhance anomaly detection, we propose a two-layer filtering anomaly detection mechanism. The first layer uses a maximal filter to amplify the distance between anomalous and normal updates to ensure that the system can correctly reject malicious updates. The second layer then applies a mean filter to the model gradient to highlight the overall trend of the data and help separate malicious updates from the global update trend. This not only makes the model updates smoother and more continuous but also achieves privacy protection by enhancing the robustness of the gradient while safeguarding the model performance. The method implements a multi-dimensional security assessment to accurately detect and discard malicious updates by measuring data distribution and gradient differences.

In summary, in real-world scenarios, DF-HFL can be applied to various large-scale data collaborative training scenarios. For example, in smart transportation scenarios, DF-HFL monitors traffic flow, surveillance videos and other data collected by road test units and edge devices, and analyzes them to identify abnormal data. At the same time, during the collaborative training process, it ensures that the model is trained towards the optimal goal to avoid the impact of abnormal updates on the model.

The main contributions of this article are as follows:

This article proposes a robust hierarchical federated learning method with a dual-layer filtering mechanism. At the edge server (ES), Kernel density estimation (KDE) is used to approximate the original data distribution of mobile devices (MDs) and K-means clustering is applied to group MDs into clusters, ensuring that the differences between MDs within each cluster are minimized to accurately identify anomalies during training.

The article introduces a dual-layer scoring mechanism based on distance and density to detect anomalies. The cluster density weight for each cluster is obtained through clustering, and each MD’s local weight is derived based on KL divergence. Then, the anomaly score for each MD is calculated by multiplying the difference between the MD’s local gradient updates and the global gradient by the weight.

The dual-layer filtering mechanism is employed to filter out anomalous data. A gradient amplifier is used to enlarge the distance between normal updates and anomalous updates, enabling accurate differentiation between anomalous and normal data. Mean filtering is used to highlight the overall data trend, reducing the influence of outliers and identifying potential anomalous updates.

The effectiveness of DF-HFL was validated on the MNIST and FMNIST datasets. Experimental results show that the global model accuracy of DF-HFL increased by 23.71% and 47.58% compared to other methods.

Related work

Existing HFL anomaly detection methods typically calculate differences in data distribution or gradient updates using evaluation metrics such as distance or density, then use these differences for anomaly scoring, and finally select normal data distributions or gradient updates for the global model based on the scoring and filtering mechanism.^15–17

The basic idea of distance-based detection mechanisms is to use the distance or similarity between samples to determine whether there is an anomaly or malicious behavior. Common distance metrics include Euclidean distance, Manhattan distance, cosine similarity, and so on.^18,19 In literature Arias et al., ²⁰ researchers used a nearest-neighbor approach to calculate anomaly detection scores and proposed a nonparametric detection algorithm that combines distance and isolation metrics to represent the most relevant features of anomalies. Although this method can detect different types of anomalies, it is easy to cause misjudgments due to the lack of a unified distance metric in non-IID scenarios. Therefore, Velliangiri et al. ²¹ proposed a feature distance map-based measurement method to identify denial of service (DoS) attacks in networks, using min–max normalization to standardize identified features and mark correlations between features, which reduces computational complexity and system error rate. Meanwhile, many researchers have used triangular region map techniques to model real-world environments and segment them into different regional structures based on extracted features or content, using support vector machines (SVMs) based on the distance to associate data samples with cluster centers, enhancing detection accuracy. ²² In Li et al., ²³ researchers proposed a segmented detection method based on the local malicious factor, identifying malicious participants by estimating the distance between data distributions. Building on this, Gong et al. ²⁴ proposed amplifying the most active features in each local update to better distinguish between malicious and benign updates, improving overall system efficiency. Although these methods can identify potential malicious attacks by analyzing the characteristics of data and gradients, distance-based detection methods struggle to accurately calculate differences between participants’ data and gradients in high-dimensional data spaces. Additionally, if the training dataset is unevenly distributed or contains significant noise, the distance calculation will be affected, leading to a decline in detection performance.

Reputation-based detection mechanisms guide the identification of malicious participants through methods like setting reputation score thresholds and implementing reputation reward-punishment mechanisms.^25,26 The trust score-weighted mean update then incentivizes the training of the global model. However, these methods overlook the uncertainty of clients in the FL training environment, as they do not consider that reliable clients may randomly switch from trustworthy to malicious behavior during the training process. Thus, Al-Maslamani et al. ²⁷ proposed allowing the server to select devices for training based on the client’s reputation scores to update the global model, using a reinforcement learning algorithm to adaptively choose the optimal reputation threshold. Additionally, researchers addressed the real-time dynamic changes in vehicular networks, proposing a logarithmic normalization scheme based on reputation updates to accurately handle scaled gradients from malicious vehicles, thereby improving system robustness. ²⁸ Although these methods can filter out malicious participants through reputation scoring mechanisms to ensure correct model training, most current methods do not consider the personalized adaptive adjustment of reputation thresholds, which prevents the setting of personalized threshold parameters for specific client groups, affecting the model’s performance.

Model framework

In this section, we describe the proposed hierarchical collaborative federated learning (FL) model training framework, as shown in Figure 1. First, the central cloud server (CS) in hierarchical FL sends the initialized global model to each participating edge server (ES), and the ES then forwards the initialized global model to each mobile device (MD) participating in local training. Second, the MDs use their own datasets to begin training the model. After a certain number of training rounds, the local model updates are uploaded to the connected ES for aggregation. Finally, the partially aggregated models from the ES are uploaded to the CS for global aggregation. The notation used in this article is explained in Table 1.

Figure 1.

HFL modeling framework.

Table 1.

Symbol description.

Symbol	Description	Symbol	Description
$s_m$	Edge server	$k_p$	Kernel block size
$h_i$	Mobile device	$G_i$	Gradient height
$D_i$	Local dataset	$W_i$	Gradient width
${\omega }_i$	Model gradient	$a_k$	Filter threshold
${\omega }_{act}^{{}^{\prime }}$	Active gradient	${\lambda }_j^1$	Cluster density weight
$\varpi$	Model accuracy	${\lambda }_i^2$	Device local weight
$K(\cdot )$	Kernel density	${\lambda }_i^{{}^{\prime }}$	Scoring weight

This work considers a layered FL framework for cloud-edge-end collaboration that contains a central cloud server, M edge servers $E=\{s_1,\dots s_M\}$ and n mobile devices $H=\{h_1,\dots h_N\}$ . Each mobile device has a local dataset $D_i$ for model training, the size of which can be denoted as $|D_i|$ . The accuracy of the global model is affected by the accuracy of the partial global models it aggregates, and the partial global model accuracy is determined by the local model accuracy of the MDs involved in training. Therefore, the goal of hierarchical FL is to improve the accuracy of the global model by minimizing the local loss function of each participating training device, which can be expressed as follows: $minL({\omega }_i)=(\sum _{|D_i|}L({\omega }_i))/|D_i|$ . Where $L({\omega }_i)$ denotes the local loss function of the mobile device model on the local dataset $D_i$ , and the model gradient is ${\omega }_i$ . We use stochastic gradient descent (SGD) to estimate the gradient update using each small batch of samples in a randomly selected manner to minimize the loss function on the training data and update the model parameters through iterations, ${\omega }_j^{t+1}={\omega }_i^t-\alpha \mathrm{\nabla }L({\omega }_i^t)$ . Where $\alpha$ denotes the learning rate and $L({\omega }_i)$ denotes the current gradient update. When the local training is completed, the MD first uploads the updated model to the ES side and uses FedAvg for aggregation, and then the ES uploads the aggregated model to the CS side for global aggregation. This process is iterated until the global model reaches the desired model accuracy.

Robust hierarchical federated learning with dual-layer filtering mechanism

When applying HFL to practical distributed computing environments, the system faces issues of malicious tampering or illegal attacks on device data during training and communication. ²⁸ Attackers can inject new malicious clients or manipulate existing clean clients to generate poisoned local training updates, affecting the model’s training outcome. During local training, attackers may inject incorrect labels or misleading features into real local data, distorting the model’s understanding and learning process, which leads to inaccurate predictions. Additionally, attackers may modify or replace gradients during transmission or processing, altering the model’s update direction or causing the model to converge to incorrect local optima, resulting in a deviation from the correct parameter updates and reducing model performance and accuracy.^29,30

While HFL can mitigate the impact of illegal attacks by applying data filtering and gradient validation at different levels, there remain threats from multi-level, multi-node, and multi-type poisoning attacks, such as data poisoning on end devices or model poisoning at the edge server. To minimize poisoning attacks and the security risks of hierarchical propagation in HFL, ensuring the security and trustworthiness of the training process and the reliability of the final global model, we propose a robust HFL framework with a dual-filtering mechanism. This mechanism employs an anomaly detection approach based on distance and density, jointly evaluating the security level of training clients from both data distribution and gradient perspectives, as shown in Figure 2.

Figure 2.

Robust hierarchical federated learning method process for dual-layer filtering mechanisms.

The specific training process of this scheme includes: (a) uploading the local client training model to the base station and estimating the data distribution of all participating clients using kernel density estimation; (b) grouping the participating local MDs using K-means clustering based on the obtained data distribution to ensure that the data in each cluster has the maximum similarity; (c) assigning cluster weights based on the cluster density, and also computing the global distribution; (d) use the KL scatter of each MD distribution and the global distribution as the scoring value, which is assigned as the local weight of the MD; (e) add the local weight of the MD with the weight of the cluster in which it is located and normalize it to get the final scoring weight; (f) amplify the gradient features from the perspective of spatial features of the gradient based on the maximal filter (which makes the distance between abnormal data and normal data become larger), and solve for the MD parameters and the global model parameters, multiply the difference value with the MD scoring weights, and select the MD with the smallest distance to be aggregated; (g) filter the model parameters to be aggregated by mean value filtering to enhance the robustness of the gradient. This two-layer filtering mechanism based on filtering can make appropriate filtering decisions to defend against multiple types of poisoning attacks according to the poisoning of different training levels, ensuring the security and accuracy of the global model.

Grouping of MD under Kernel density estimation

Based on the privacy and security properties of federated learning, ES is unable to obtain the real dataset distribution of local clients. Therefore, in order to obtain the data distribution of local clients while avoiding exposing sensitive data directly to an insecure network environment, we analyze the uploaded gradient data at the edge server side to obtain the predicted data distribution. Although the defender does not have access to the true statistical distribution of the participants $h_i$ , an estimated data distribution can be approximated by analyzing each output label using kernel density estimation methods. Considering the relationship between participants $h_i$ and contributions $\mathbf{y}$ as a probabilistic graphical model, the expected probability distribution of each output label can be used to understand and characterize the overall probability distribution. However, distance-based techniques focus mainly on conventional anomaly detection, which becomes increasingly difficult to be effective as the number of malicious nodes increases, and can only be used as a rough security filtering detection.

Therefore, we design a density measurement component to complement the conventional distance-based mechanism. Taking advantage of the property that malicious gradients tend to be sparsely distributed while benign gradients are denser, the density of the neighborhood around each data (both data distribution and gradient) is evaluated, where the neighborhood is defined as the set of $k$ neighbors. The $k$ nearest neighbors updated by each participant were first selected using a distance metric, and scores for each metric were recorded. These neighbors are selected based on the degree of similarity and distance between data points, and the value of this score is correlated with factors such as the size of the distance metric and the density of the area in which the neighbor is located, with higher scores indicating that the neighbor has a higher density or importance in the surrounding area. Then, the scores of $k$ neighbors are aggregated into a density score. Finally, participants with high-density scores are whitelisted based on their density scores. Participants in the whitelist are considered benign or highly trusted and can be allowed to continue to participate in updates or other operations. This density measurement component is integrated into the distance-based mechanism as a top-down security policy. By considering the density profile of data points, we can identify potentially malicious gradients in a more granular manner and enhance the screening and security of participants, thereby improving the overall system security and stability.

We consider the case where the defender is unaware of the number of malicious participants present in the HFL system and define the neighbor domain of each participant as $H_i=\{h_{i,1},\dots ,h_{i,k}\}$ , where the value of $k$ is much smaller than the sum of the number of edge servers and the number of clients. The process of using kernel density estimation to predict the distribution of participating client data includes: (a) in the preprocessing stage, dividing the gradient features according to their dimensionality and effectively grouping the gradient data for subsequent processing and analysis; (b) clustering the parameters according to the output labels, and clustering the data with similar features or attributes together, so as to analyze and model the data more accurately; (c) for each gradient parameter category or label, the probability density function of its data is estimated using kernel density estimation, which takes into account the effect of the kernel function around the data point and uses it as a product of the numerical outputs to obtain an estimate of the data distribution.

In the process of kernel density estimation of the gradient parameters, we define the set of $k$ domains of the update parameters of the $t$ th iteration as being ${\theta }_i=\{{\theta }_{i,1},\dots ,{\theta }_{i,j},\dots {\theta }_{i,k}\}$ , respectively, each neighbor update distance from the location of the central parameter ${\theta }_i$ can be computed as:

$$\stackrel{-}{d_i}=\frac{1}{k}\sum _{j=1}^{k}diff({\theta }_i,{\theta }_{i,j}),$$

(1)

where the function $diff(\cdot )$ denotes the squared Euclidean distance between ${\theta }_i$ and its neighbors, and in order to further analyze the degree of variance between all the updating gradients in order to estimate the distribution of the data, we compute the average of the distances of all the gradients $\stackrel{-}{D_i}$ , which can be expressed as:

$$\stackrel{-}{D_i}=\frac{1}{k(k-1)}\sum _{i=1}^k\sum _{j=1}^{k}diff({\theta }_i,{\theta }_j),i\ne j,$$

(2)

For each participant $h_i$ , the update parameters from the participant contribute differently to the output, which can be notated as the contribution $\mathbf{y}=[\begin{array}{c}{y}_1,\dots ,y_r,\dots y_R\end{array}]$ , where $r\in [1,R]$ denotes the $r$ th output label. We can represent the relationship between the participant $h_i$ and the output contribution $\mathbf{y}$ as a specific probabilistic graphical model using the expected probability distribution of each output label. Therefore, in the case that ES does not have access to the client’s real dataset, we can preprocess the analysis of output labels that satisfy the condition $\sum _{r=1}^{R}P({\theta }_i|y_i)=1$ to predict the probability distribution of the data on the client side, and use the nonparametric kernel density estimation function to estimate the estimated local distribution of the client and its k-nearest neighbor user interface. We use $\stackrel{\sim }{d}(h_i)$ to denote the estimated data distribution of the ith client on the $r$ th label, which can be computed as:

$$\stackrel{\sim }{d}\left(h_i^r\right)=\frac{1}{k}\sum _{j=1}^{k}K\left(\frac{h_i^r-h_{i,j}^r}{h^r}\right),$$

(3)

In this context, $K(\cdot )$ is the kernel density function, $h_{i,j}^r$ represents the $r$ -th output label of the $j$ -th neighbor of $H_i$ , and $h^r$ is the bandwidth of the kernel density function $K(\cdot )$ . For different output labels, the bandwidth values are usually not the same and remain constant, depending on the classifier used. The choice of bandwidth is critical for estimating the data distribution. A large bandwidth may result in an overly smoothed probability distribution, masking the true structure of the data, while a small bandwidth can produce a sharp, multi-peaked density estimate, affecting the accuracy of judgment. The Gaussian kernel function has a higher density near the center, gradually decreasing as the distance from the center increases. We use the Gaussian kernel function as the kernel density function, which can be expressed as:

$$K\left(\frac{h_i^r-h_{i,j}^r}{h^r}\right)=\frac{1}{h^r\sqrt{2\pi }}{e}^{-((h_i^r-h_{i,j}^r)/2h^r)},$$

(4)

DF-HFL, in the first layer of filtering, approaches from the data dimension by obtaining the estimated client data distribution based on the uploaded gradient updates. It then calculates the KL divergence between different data distributions to identify malicious clients under attack, ensuring the security and reliability of the training process.

In data poisoning attacks, malicious attackers may intentionally tamper with their local data or inject false data to degrade the global model’s performance. When data is poisoned, originally similar distributions may become dissimilar, resulting in non-independent and identically distributed (non-IID) data. DF-HFL groups the participating MDs according to the heterogeneity of the data distributions, making it easier to identify when user data is subject to poisoning attacks.

At the initialization stage of the group training, we first consider all devices under each ES as a whole. Then, DF-HFL iteratively assigns data points to $K$ clusters, minimizing the sum of squared distances between each data point and its corresponding cluster center. This process includes two steps: calculating the distance between the data distribution of each MD and the center of each cluster and updating the cluster centers. We use Euclidean distance to calculate the distances:

$$d({\omega }_i,{\omega }_k)=\Vert {\omega }_i,{\omega }_k|{|}^2,$$

(5)

Then update the cluster center after every MD assignment: for the centroid of the $j$ th cluster ${\omega }_k$ , compute the average of all data points in the cluster as the new centroid, ${\omega }_k=1/|S_j|{\sum }_{{\omega }_i\in S_j}{\omega }_i$ . Where $|S_j|$ is the number of data points in the $j$ th cluster and $S_j$ is the set of data points in the $j$ th cluster.

For the divided clusters, calculate the weight of each cluster: ${\lambda }_j^1=|S_j|/\sum _{i=1}^K|S_i|$ . Cluster weights are important influences on global model aggregation, determining how much the gradient updates of different MDs contribute to the global model and directly affecting the model accuracy.

Distance and density-based filtering mechanism

In the training process, selecting benign participants and eliminating malicious ones requires a suitable scoring mechanism. Traditional distance-based scoring mechanisms require the data distributions of participating MDs to remain uniform, and the datasets affected by malicious attacks should exhibit significant differences from benign datasets. As noted in the literature, ³¹ under conditions of independent and identically distributed (IID) data, the data distribution learned by a local model subjected to data poisoning attacks no longer aligns with the original IID data, resulting in non-independent and identically distributed (non-IID) scenarios. However, this is not always the case; in current practical environments, most clients have non-IID data distributions. In such cases, distance-based detection mechanisms may struggle to effectively identify malicious updates. Meanwhile, density-based detection mechanisms are another mainstream approach for anomaly detection. This method can group participating training clients through clustering to identify abnormal updates. When handling data, regions with lower density are typically considered noise or local anomalies, but sometimes these noise points may be incorrectly classified as global anomalies.^32,33 Additionally, in cases where local density varies significantly within the dataset, this method might mistakenly label regions with lower local density—though not anomalous on a global scale—as anomalies, thus affecting the final training results. Therefore, how to jointly apply both distance-based and density-based anomaly detection mechanisms is crucial for accurately identifying malicious participants. ³⁴

We adopt a combined distance and density approach as the data security filtering method in the DF-HFL framework, relying on measuring pairwise distances and density differences between local updates to identify and discard malicious updates. Each ES discards updates that fall outside a specified range, thereby mitigating the impact of malicious data. The specific solution process is shown in Algorithm 1.

Algorithm 1: The Training Process of DF-HFL.

Input: MDs h_i, Number of groups k, Aggregation Threshold a_k

Intimidation: Global model ${\omega }_c^0$

1: for iteration do

2: Upload gradient updates to ES after device local training

3: Let ES approximate the original data distribution based on the gradient through Equation (2)

4: The K-means clustering algorithm was utilized to classify the MD into different clusters through Equation (4)

5: Calculate cluster weights for each cluster

6: Differences between different MDs in each cluster were calculated and anomaly scored using KL scatter through Equation (6)

7: Calculate the local weight of the MD

8: Filter Amplifier Amplifies Normal Update and Abnormal Update Distance

9: Select the top a_k MD aggregations of the anomaly score

10: Mean value filtering reduces the impact on normal data after removing anomalous data

11: end for

In general, if a participant is subjected to common data poisoning attacks, such as label flipping or malicious data injection, the participant’s data distribution may change, and its KL divergence could increase. KL divergence is a metric that measures the difference between two probability distributions, essentially quantifying the information loss or error introduced when one distribution is used to approximate another. When data distribution changes, the dependencies between variables may increase, causing the KL divergence to grow. The changes introduced by poisoning attacks are malicious and may cause the model to perform worse on affected participants. Therefore, we use KL divergence as a metric to evaluate the distance between participants in order to address attacks at the data poisoning level.

We consider two random variables: local data distribution $D_i$ and global data distribution $D_c$ , denoted by $P$ and $Q$ respectively, with probability distribution $p(x),q(x)$ . We define $D_{\mathrm{KL}}(P\Vert Q)$ as the KL divergence from $P$ to $Q$ , which can be calculated as:

$$D_{\mathrm{KL}}(P\Vert Q)=-\sum _{x}p\left(x\right)\log q\left(x\right)-\sum _x-p\left(x\right)\log p\left(x\right),$$

(6)

By calculating the KL divergence between data distributions, we can identify data points that may differ from others due to malicious attacks, data poisoning, or other abnormal situations. This allows us to promptly detect non-independent and identically distributed (non-IID) data, helping to identify potential malicious or anomalous data, thus improving the model’s robustness and security.

According to the KL divergence, the local weight distribution of MD is calculated: ${\lambda }_i^2=1/(1+D_{\mathrm{KL}}(D_i\Vert D_c))$ .

Add the local weight of MD to the cluster weight of its cluster to get the final score weight: ${\lambda }_i={\lambda }_j^1+{\lambda }_i^2$ . The obtained weights are normalized to the maximum and minimum values, and the weight values are scaled to a specific range of $[0,1]$ to better compare and process the weight values: ${\lambda }_i^{{}^{\prime }}=({\lambda }_i-{\lambda }_{min})/({\lambda }_{max}-{\lambda }_{min})$ . Among them, ${\lambda }_{min}$ and ${\lambda }_{\max }$ are the minimum and maximum values of the weight values.

Abnormal detection based on dual-layer filtering

DF-HFL uses a two-layer filtering mechanism to identify abnormal updates and reduce the impact of such updates on the original gradients. The first layer employs a maximum filter amplifier to identify active gradients and amplify the difference between abnormal and normal gradients, helping to detect abnormal updates. The second layer applies mean filtering to smooth the filtered gradients, further reducing the impact of noise and other malicious attacks on the gradients, ensuring that gradient updates are more continuous, and making the model updates smoother and more consistent, as shown in Figure 3.

Figure 3.

Abnormal filtering based on dual-layer filtering.

Filter amplifier

The heterogeneous nature of data distribution may cause the uploaded gradient directions to become disordered, making it difficult to filter out abnormal gradients. In DF-HFL, the local updates uploaded by clients are collected at the ES, consisting of gradient updates from each participant’s local model training. These updates may contain both benign gradients and traces of malicious gradients. DF-HFL uploads the aggregated gradients from the ES to the CS, where maximum filtering is applied to the uploaded gradient updates to identify the most active feature gradients. Cosine similarity between the active gradients and all received gradients is used to filter out abnormal gradients, ensuring that the model training remains on the correct trajectory.

Upon receiving the updated gradients $\omega i$ at the CS, the most active features—those with the greatest impact on the model—are extracted. This helps amplify the differences between benign and malicious gradients, making the discrepancies more apparent on specific features. The process begins by applying maximum filtering and cascading operations to the received updates. During maximum filtering, each participant’s update $\omega i$ is divided into $kp\times kp$ blocks, and maximum filtering is performed using a kernel size to retain the most active feature gradients within each block. The most active feature gradient can be calculated as follows:

$$\begin{array}{rl}{\omega }_{\mathrm{act}}^{{}^{\prime }}=& max(\{{\omega }_{g_i,w_i}\mid g_i\in [k_p*(g_j-1)+1,k_p*g_j]\\ & w_i\in [k_p*(w_j-1)+1,k_p*w_j]\}),\end{array}$$

(7)

$$g_j\in \{1,2,\dots ,G_{\mathrm{out}}\},w_j\in \{1,2,\dots ,W_{out}\},$$

(8)

where $G_{\mathrm{out}}=G_i/k_p,W_{\mathrm{out}}=W_i/k_p$ , $G_i$ represents the height of each gradient update, $W_i$ represents the width of each gradient update, and $k_p$ is the size of the block. Then, the amplified gradients are combined through cascading operations to form an amplified gradient set ${\omega }_{\mathrm{act}}=\{{\omega }_{\mathrm{ac}{\mathrm{t}}_i}^{{}^{\prime }}|i=1,2,\dots ,N\}$ . This step achieves gradient selection by retaining the information that has the most impact on the model. The final amplified gradient set is used as an evaluation metric for gradient security. Even if a participant is subject to model poisoning attacks, the gradients processed by the maximum filter will not be significantly affected. This security evaluation metric helps ensure the safe aggregation of the model and can effectively counter attacks at the model poisoning level.

By combining active feature extraction with maximum filtering, this method enhances the model’s sensitivity to gradients. Thus, it improves the model’s ability to detect and resist malicious attacks, ensuring its safety and stability.

For each gradient vector in the amplified gradient set, the cosine similarity with other gradient vectors is calculated, and a threshold is set to determine whether the gradient vectors are abnormal. For those gradient vectors with cosine similarity below the threshold, they are regarded as abnormal gradients and filtered out. The abnormal gradients are also removed from the gradient set. The cosine similarity between the gradient vector ${\omega }_i$ and the global gradient ${\omega }_c$ can be calculated as:

$$\mathrm{similarity}({\omega }_i,{\omega }_c)=\frac{\sum _{i=1}^n{\omega }_i\times {\omega }_c}{\sqrt{\sum _{i=1}^n{\left({\omega }_i\right)}^2}\times \sqrt{\sum _{i=1}^n{\left({\omega }_c\right)}^2}},$$

(9)

Through this hierarchical filtering mechanism, abnormal MD data distributions and gradient updates can be filtered out layer by layer, preventing malicious attackers from providing false data or tampering with real data and gradients, which could affect the accuracy of model training. This ensures the safety and accuracy of the global model.

To find the difference between the MD gradient updates and the global model gradient updates, the difference value is multiplied by the MD’s scoring weight: $p_i={\lambda }_i^{{}^{\prime }}*\mathrm{similarity}({\omega }_i,{\omega }_c)$ , selecting the $k$ MDs with the smallest distance for aggregation. Finally, DF-HFL applies mean filtering to the model parameters to be aggregated, enhancing the robustness of the updated gradients.

Mean filter

DF-HFL uses mean filtering to average multiple gradient data points to smooth the gradient data of MD, so as to effectively suppress the influence of noise or outliers. Although DF-HFL identifies abnormal updates through the first layer, so that the gradient abnormality of a certain MD is weakened in the first layer of mean filtering, there may still be some residual abnormal influence. Therefore, DF-HFL can eliminate this long-tail effect through further smoothing in the second layer, ensure more stable gradient updates, and reduce the excessive impact of a single client upload.

The original gradient of MD is represented as a matrix, and DF-HFL defines a convolution kernel sliding filter window to perform a sliding mean filtering operation from left to right and from top to bottom on the original gradient tensor ${\omega }_i$ of MD. For example, the gradient of each dimension of the original gradient tensor is represented by a 6  $\times$  6 matrix, and the size of the convolution kernel sliding filter window is 2  $\times$  2. The mean filtering of DF-HFL uses a 2  $\times$  2 sliding filter window to gradually traverse the 6  $\times$  6 original gradient and finally obtain the gradient after mean filtering. In order to make the gradient dimension after filtering consistent with the original gradient, we expand the original 6  $\times$  6 matrix into a 7  $\times$  7 matrix, fill part of the newly expanded matrix with 0, and then perform a mean filtering operation on the expanded 7  $\times$  7 gradient matrix. This method can counteract the influence of abnormal data on the original gradient, effectively eliminate the drastic changes in local gradients caused by illegal attacks on data or gradients, and improve the robustness of the system.

The computational burden of DF-HFL mainly exists in the two-layer filtering mechanism. The first is the maximum filtering mechanism, which requires dividing the gradient of each MD into blocks, taking the maximum value and reconstructing the gradient. The computational complexity is $O(N\times d)$ , where $d$ is the dimension of the gradient. The second is the mean filtering, which calculates the mean of the gradient matrix of each MD through a sliding window operation, with a complexity of $O(N\times d)$ .

Performance analysis

This section introduces the experimental results of the proposed method. First, we introduce the simulation environment and hyperparameter settings of the DF-HFL anomaly recognition algorithm. Secondly, we verify the recognition performance of the DF-HFL method for malicious updates during FL training by increasing the attack ratio and attack intensity and comparing the performance with other baseline algorithms.

Simulation settings

The performance of the experimental platform used in this study is as follows: Intel(R) Xeon(R) Gold 6330 CPU @ 2.00 GHz, with a base processor frequency of 2.00 GHz and memory of 32  $\times$  4 GB. The software environment is Ubuntu 20.04 and Python 3.10. We simulated a total of 60 devices and 3 edge servers, with 20 devices under the range of each edge server.

Dataset and parameter settings: To verify the resilience of DF-HFL against different attacks, we conducted experiments on the following three datasets:

MNIST ³⁵ : This dataset contains approximately 70,000 handwritten digit image samples, with 60,000 images used for training and 10,000 for testing. All images are grayscale with a size of 28  $\times$  28 pixels, and each pixel’s grayscale value ranges from 0 to 255. For this dataset, the attacker injected 100 malicious participants into the HFL system. The source label was set to the digit 7, and the target label was set to the digit 1.

Fashion-MNIST(FMNIST) ³⁶ : This dataset contains grayscale images of various clothing and accessory items, totaling 10 categories. Each category has 6,000 images, with a total of 60,000 training images and 10,000 test images. Each image is sized at 28x28 pixels, with grayscale levels ranging from 0 to 255.

Heart Disease ³⁷ : This dataset is a classic medical dataset that is often used in machine learning and statistical modeling research to predict the presence or risk of heart disease.

Bank Market ³⁸ : This dataset is used to predict customer responses in bank marketing activities. Specifically, the dataset records the bank’s interactions with customers during telephone marketing.

Potential attacks and comparison methods: This article evaluates the detection performance of DF-HFL against malicious attacks during model training from five aspects: the selection of aggregation threshold parameters, the convergence performance of DF-HFL under different malicious attack ranges, ablation experiments on the effectiveness of each module in DF-HFL, comparisons of the time required for each training round across different methods, and computational overhead, as well as the global model accuracy under varying malicious attack ranges and intensities.

We employed Gaussian noise attacks, which can lead to misjudgments in anomaly detection models, incorrectly identifying normal data as anomalous or failing to correctly detect actual anomalous data. We varied the variance of the Gaussian noise, which represents the intensity of the attack. To validate the adaptive real-time resistance capability of DF-HFL against attacks of varying intensities during training, we defined the intensities of malicious attacks as 0.3, 0.4, and 0.5. Here, higher values indicate stronger attack intensities.

We compared DF-HFL with the following four methods:

FedAvg ³⁹ : This method averages all received local updates at the cloud server without performing any malicious gradient detection operations.

Random ³⁹ : In this method, for the gradient updates received by the cloud server, a random selection of updates is made for aggregation in each round, with a new random selection in every round.

Krum ¹⁰ : This method filters out anomalous models by calculating the differences between the model updates provided by each participant and the other model updates using Euclidean distance.

Multi-Krum ⁴⁰ : A robust aggregation algorithm for aggregating client gradients. It calculates the distance between the gradient update uploaded by each client and the gradient updates of other clients based on the Euclidean distance, and selects the client with the closest distance to aggregate.

Simulation results

In this section, we evaluate the performance of DF-HFL and four other methods in resisting malicious attacks during HFL training.

Threshold parameter selection

DF-HFL selects the top $a_k$ gradient updates from each cluster based on anomaly scores for aggregation at the cloud server (CS). Considering that the optimal aggregation threshold varies for different datasets and attack ranges, we fixed the attack ranges at 10%, 20%, 30%, and 40% for the MNIST, FMNIST, Heart Disease, and Bank Market datasets to verify the best aggregation threshold. The attack range percentage indicates the ratio of malicious devices (MDs) affected by attacks to the participating MDs during the training process of the HFL model. The optimal threshold is the ratio of the number of MDs selected for aggregation to the total number of MDs. According to the experimental results in Table 2, a higher attack range necessitates a lower aggregation threshold to achieve a higher accuracy of the global model, and vice versa. Specifically, for the MNIST dataset, the optimal aggregation thresholds for attack ranges of 10%, 20%, 30%, and 40% are 90%, 70%, 60%, and 50%, respectively. For the FMNIST dataset, the optimal aggregation thresholds for the same attack ranges are 90%, 80%, 60%, and 50%. In the Heart Disease dataset, the optimal aggregation thresholds for attack ranges of 10%, 20%, 30%, and 40% are 90%, 70%, 60%, and 50%, respectively. In the Bank Market dataset, the optimal aggregation thresholds for attack ranges of 10%, 20%, 30%, and 40% are 80%, 70%, 60%, and 50%, respectively. All the following experiments are tested under the corresponding optimal aggregation threshold values. All subsequent experiments are conducted at their corresponding optimal aggregation threshold sizes.

Table 2.

Global model accuracy for different aggregation thresholds.

Threshold	Attack range
	50%	60%	70%	80%	90%
MNIST
10%	0.933	0.937	0.959	0.967	0.968
20%	0.94	0.951	0.964	0.962	0.95
30%	0.952	0.955	0.953	0.944	0.917
40%	0.953	0.95	0.927	0.9	0.876
FMNIST
10%	0.806	0.809	0.812	0.813	0.815
20%	0.805	0.807	0.807	0.808	0.762
30%	0.800	0.802	0.791	0.759	0.630
40%	0.797	0.793	0.679	0.609	0.507
Heart Disease
10%	0.803	0.803	0.819	0.819	0.869
20%	0.801	0.801	0.803	0.786	0.786
30%	0.803	0.819	0.786	0.803	0.812
40%	0.803	0.801	0.736	0.786	0.770
Bank Market
10%	0.882	0.882	0.882	0.885	0.875
20%	0.879	0.879	0.881	0.854	0.776
30%	0.859	0.882	0.872	0.876	0.867
40%	0.869	0.845	0.868	0.846	0.723

Global model convergence of DF-HFL

We first verify the convergence performance of DF-HFL on four datasets, MNIST, FMNIST, Heart Disease, and Bank Market. In order to verify the ability of DF-HFL to withstand different levels of attacks, we fix the attack range as 10%, 20%, 30%, and 40%, and the attack intensity as 0.3, 0.4, and 0.5. The percentage of the attack range denotes the ratio of the MDs that have been maliciously attacked to those that have participated in the training of the HFL model during the training process. Meanwhile, the attack intensity denotes the variance of Gaussian noise attack as 0.3, 0.4, and 0.5. We plot the convergence results of DF-HFL in Figure 4. DF-HFL can maintain convergence on both datasets. Meanwhile, under the MNIST dataset, DF-HFL can maintain convergence with 40 rounds of iterations when the attack intensity is 0.3. When the attack intensity is 0.1, and the attack range is 10% to 40%, the DF-HFL can be maintained at a lower level after 50 rounds of iterations, and the DF-HFL fluctuates when the attack intensity is 0.5, and the attack range is 40%, but it always stays at a lower level. It can be seen that DF-HFL can always reach convergence with fewer training rounds for different strengths and different ranges of malicious attacks.

Figure 4.

Convergence of DF-HFL under different attack intensities. (a) MNIST-0.3 attack intensity; (b) MNIST-0.4 attack intensity; (c) MNIST-0.5 attack intensity; (d) FMNIST-0.3 attack intensity; (e) FMNIST-0.4 attack intensity; (f) FMNIST-0.5 attack intensity; (g) Heart Disease-0.3 attack intensity; (h) Heart Disease-0.4 attack intensity; (i) Heart Disease-0.5 attack intensity; (j) Bank Market-0.3 attack intensity; (k) Bank Market-0.4 attack intensity; (l) Bank Market-0.5 attack intensity.

Accuracy of global models with different malicious attack range

We verified the resistance of DF-HFL compared to FedAvg, Krum, Random, and Multi-Krum under different ranges of malicious attacks on the datasets MNIST, FMNIST, Heart Disease, and Bank Market. We fixed the attack intensity to 0.3, respectively, and compared the global model accuracy change curves for 300 rounds of iterative training with different methods under 10%, 20%, 30%, and 40% attack ranges. According to the experimental results in Figure 5, on the one hand, under the MNIST dataset, when the attack range is small, the global models of DF-HFL, FedAvg, and Random can quickly converge to a high accuracy. The accuracy of the global models of FedAvg and DF-HFL with 12 rounds of iterative training can be maintained at around 0.95, Random needs 65 rounds of iterative training to maintain convergence, and Multi-Krum needs 95 rounds of iterative training to maintain convergence, but Krum needs 280 rounds of iterative training to converge to lower accuracy. On the other hand, when the attack range is increased to 40%, DF-HFL can still converge to a higher accuracy with fewer iterations, and the final accuracy of its global model is higher than that of the other methods. Although Random can converge, its accuracy is lower, as is that of Krum. This is because DF-HFL scores the MDs involved in training abnormally jointly based on distance and density methods and amplifies the distance between normal and malicious updates through a dual-layer filtering mechanism, which helps to better identify abnormal updates and ensures the accuracy of the global model.

Figure 5.

Accuracy of DF-HFL under different attack range. (a) MNIST-10% attack range; (b) MNIST-20% attack range; (c) MNIST-30% attack range; (d) MNIST-40% attack range; (e) FMNIST-10% attack range; (f) FMNIST-20% attack range; (g) FMNIST-30% attack range; (h) FMNIST-40% attack range; (i) Heart Disease-10% attack range; (j) Heart Disease-20% attack range; (k) Heart Disease-30% attack range; (l) Heart Disease-40% attack range; (m) Bank Market-10% attack range; (n) Bank Market-20% attack range; (o) Bank Market-30% attack range; (p) Bank Market-40% attack range.

Comparison of global model accuracy under different attack ranges and attack intensities

In order to verify the ability of DF-HFL to resist malicious attacks under different attack ranges and attack strengths, we fixed the attack strengths to 0.3, 0.4, and 0.5, and fixed the attack ranges to 10%, 20%, 30%, and 40% on the datasets MNIST, FMNIST, Heart Disease, and Bank Market, and compared the global model accuracy of DF-HFL with FedAvg, Krum, Random and Multi-Krum after 300 rounds of iterative training. According to the experimental results in Figure 6, under the Mnist dataset, when the attack intensity is 0.3, the global model accuracies after 300 rounds of training can reach more than 0.9 for all methods except Krum, but as the attack intensity increases, the global model accuracies of the other methods are lower than that of DF-HFL, for example, at an attack intensity of 0.3 and an attack range of 40%, the DF-HFL s global model accuracy is 5.63%, 16.46%, 23.32%, and 8.59% higher than the other four methods, respectively. In summary, DF-HFL calculates the data of the MDs involved in training, the anomaly scores of the gradient updates from multiple perspectives, and amplifies the gap between the anomaly updates and the normal updates through the dual-layer filtering mechanism while reducing the impact of the removed anomalies on the correct data, so that it can maximize the retention of the effective training information and improve the accuracy of the global model while identifying the malicious attacks.

Figure 6.

Accuracy under different attack ranges and attack intensities. (a) MNIST-0.3 attack intensity; (b) MNIST-0.4 attack intensity; (c) MNIST-0.5 attack intensity; (d) FMNIST-0.3 attack intensity; (e) FMNIST-0.4 attack intensity; (f) FMNIST-0.5 attack intensity; (g) Heart Disease-0.3 attack intensity; (h) Heart Disease-0.4 attack intensity; (i) Heart Disease-0.5 attack intensity; (j) Bank Market-0.3 attack intensity; (k) Bank Market-0.4 attack intensity; (l) Bank Market-0.5 attack intensity.

Computational overhead

We compared the computational overhead of DF-HFL with FedAvg, Krum, Random, and Multi-Krum on the datasets MNIST, FMNIST, Heart Disease, and Bank Market for 300 epochs. We set the attack range to 10% and the attack intensities to 0.3. According to the experimental results in Table 3, the computational overhead of DF-HFL for 300 epochs is slightly higher than that of FedAvg and Random because it needs to perform a double-layer filtering anomaly detection mechanism to identify anomalies, while FedAvg directly trains all data samples and aggregates all updates without doing any anomaly detection. Random minimizes the computational overhead by selecting only one update to aggregate in each round. However, through the above experiments, the accuracy of FedAvg and Random is much lower than that of DF-HFL. Therefore, DF-HFL only needs a little more computational overhead to obtain a global model with much higher accuracy than other methods.

Table 3.

Computational overhead.

Overhead(s)	MNIST	FMNIST	Heart Disease	Bank Market
DF-HFL	2726.07	4081.20	1062.39	3621.60
FedAvg	2757.51	3802.99	974.30	3630.98
Krum	2779.37	4439.88	2960.43	4273.87
Random	2436.88	3998.21	946.22	3355.71
Multi-Krum	2785.6	4441.29	3099.3	4326.38

Conclusions

In this article, we study the anomaly filtering problem under the HFL framework, which aims to avoid operations such as malicious attackers providing false data or tampering with normal gradient updates to degrade the accuracy of the global model by identifying illegal attacks during model training and transmission. Therefore, we propose a robust hierarchical federated learning method with a two-layer filtering mechanism, which gets rid of the limitations imposed by the original method of identifying malicious attacks by using only the distance or density gaps in the data distributions or gradient updates, and approximates the data distributions by the updated gradients through a kernel density estimation method, and classifies the devices with similar distributions into the same cluster. A two-layer filtering mechanism is used to identify malicious updates while reducing the impact of malicious data on the normal gradient. In this process the distance between malicious updates and normal updates using maximum filtering method strips the malicious updates from the overall trend of the gradient. Mean value filtering is also used to make the filtered model updates smoother and more continuous, to enhance the robustness of the gradient and to guarantee the balance between model performance and privacy protection.