FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning

1. Problem Statement

Context: Federated Learning (FL) is increasingly used in Intelligent Transportation Systems (ITS) to train Road Condition Classification (RCC) models across vehicles without sharing raw image data, thereby preserving privacy and utilizing edge resources.
The Threat: The system is vulnerable to Targeted Label-Flipping Attacks (TLFAs). In this scenario, malicious vehicles (clients) deliberately relabel their local training data (e.g., changing "uneven" road labels to "smooth") to poison the global model.
The Impact: Unlike untargeted attacks that degrade overall accuracy, TLFAs cause specific, safety-critical misclassifications. For instance, misclassifying a hazardous "uneven" or "icy" road as "smooth" leads to vehicles failing to adjust speed or traction, significantly increasing accident risks.
Limitations of Existing Defenses: Current countermeasures fail to restore performance to attack-free levels because:

1. They lack detection mechanisms tailored to the specific nature of TLFAs (often treating them as generic poisoning).
2. They do not effectively exclude malicious clients based on historical behavior over time.
3. They fail to remediate the global model after a malicious client is removed, leaving "residual poison" from previous rounds intact.

2. Methodology: FedTrident

The authors propose FedTrident, a comprehensive defense framework that integrates three sequential modules: Detection, Exclusion, and Remediation.

A. Poisoned Local Model Detection (Neuron-wise Analysis)

Instead of analyzing the entire model or just output magnitudes, FedTrident focuses on the output layer neurons of the Deep Neural Network (DNN).

• Attack Goal Identification: It calculates the magnitude ($\ell_2$-norm) and angular inconsistency (cosine similarity) of parameter updates for each output neuron.
• Source/Target Identification: It identifies the two neurons with the highest combined scores (magnitude $\times$ angular inconsistency) as the Source Class (hazardous, e.g., "ice") and Target Class (benign, e.g., "dry").
• Feature Extraction: It extracts only the parameters connected to these specific source and target neurons.
• Clustering: These neuron-wise features are fed into a Gaussian Mixture Model (GMM) to probabilistically cluster clients into "benign" and "poisoned" groups. GMM is chosen over hard clustering (like K-Means) to better handle data heterogeneity and uncertainty.

B. Malicious Vehicular Client Exclusion (Adaptive Rating)

To prevent persistent adversaries from re-entering the system:

• Adaptive Rating: Each client maintains a rating score ($r_k$).
• Dynamic Updates: If a client's model is detected as poisoned in a round, their rating is penalized; if benign, it is rewarded.
• Exclusion: Once a client's rating falls below a minimum threshold, they are added to a blacklist and permanently excluded from future FL rounds. This mechanism accumulates evidence over time, reducing false positives while ensuring persistent attackers are removed.

C. Corrupted Global Model Remediation (Machine Unlearning)

Simply removing a malicious client does not fix the damage already done to the global model in previous rounds.

• Retroactive Correction: FedTrident utilizes Machine Unlearning.
• Mechanism: It calculates the accumulated historical contributions ($\Delta \omega_{k,sum}$) of the excluded malicious client and subtracts them from the current global model.
• Result: This effectively "unlearns" the poison, restoring the global model to a state as if the malicious client had never participated.

3. Key Contributions

1. First Integrated Defense: FedTrident is the first solution to systematically combine detection, exclusion, and remediation specifically for FL-based RCC against TLFAs.
2. Neuron-Wise Analysis: Introduces a novel detection method that isolates attack footprints at the specific output neurons involved in the label flip, making it robust against Non-IID (Non-Independent and Identically Distributed) data heterogeneity common in vehicular networks.
3. Adaptive Exclusion & Remediation: Proposes a decision-theory-based adaptive rating system for long-term client management and a machine unlearning approach to actively repair the global model, addressing the "residual poison" gap in prior work.
4. Safety-Aware Metrics: Introduces Global Accuracy of Safety (GAS), a metric that weights misclassifications based on the severity of the error (e.g., misclassifying ice as dry is penalized more heavily than wet as dry).

4. Experimental Results

The authors evaluated FedTrident across six DNN architectures (ResNet-18/34, MobileNet-V3, EfficientNet-B1, DenseNet-121, DeiT-Tiny) and three RCC tasks (Friction, Material, Unevenness) using the Road Surface Classification Dataset (RSCD).

• Performance vs. Baselines: FedTrident outperformed eight state-of-the-art baselines (including FedAvg, Krum, FLAME, FLARE, and DEFEND).
  • Improvement: It achieved an average improvement of 9.49% in Source Recall (SRE) and 4.47% in Attack Success Rate (ASR) compared to the best existing baseline (DEFEND).
  • Attack-Free Parity: Crucially, FedTrident's performance under attack was statistically indistinguishable from the attack-free scenario (FedAvg-NA), effectively neutralizing the threat.
• Resilience:
  • Malicious Client Rate: Maintained low ASR even when malicious client rates increased from 0% to 40%.
  • Data Heterogeneity: Remained robust across varying levels of Non-IID data (Dirichlet distribution $\alpha$).
  • Dynamic Attacks: Successfully adapted to attacks where the adversary changed source/target classes mid-training, a scenario where other defenses failed.
• Ablation Study: Confirmed that all three modules (Detection, Exclusion, Remediation) are necessary; removing any single module resulted in significant performance degradation.

5. Significance

• Safety Critical: By specifically targeting TLFAs, FedTrident directly addresses the risk of catastrophic accidents caused by misclassifying hazardous road conditions.
• Practicality: The method is computationally efficient ($O(M \cdot d_o)$ complexity), making it suitable for resource-constrained edge devices (vehicles) and real-time ITS applications.
• Generalizability: While focused on RCC, the neuron-wise analysis approach is agnostic to specific classification semantics, suggesting applicability to other safety-critical FL tasks in autonomous driving (e.g., obstacle detection, traffic sign recognition).
• Paradigm Shift: Moves the defense paradigm from passive filtering (detect and discard) to active recovery (detect, exclude, and heal), setting a new standard for robustness in collaborative learning systems.