# FLGQM: Robust Federated Learning Based on Geometric and Qualitative Metrics
## 1 Introduction  
With the continuous increase in data scale and the growing importance of data privacy, new machine learning paradigms have been proposed, such as federated learning (FL) [1]. Federated learning allows multiple distributed clients to jointly train a global model without sharing their privacy data. Federated learning can summarize the three main steps of model distribution, local training, and aggregation. Compared to traditional machine learning, federated learning offers a compelling advantage by effectively safeguarding user privacy while maintaining the high accuracy of the global model. Consequently, it has garnered significant research interest in recent years. However, the inherent distributed nature of federated learning renders it particularly susceptible to attacks orchestrated by malicious clients. Attackers can exploit this vulnerability by launching poisoning attacks through client control, thereby impeding the convergence of the global model. Finally, it will destroy the performance of federatedlearning. Based on the attacker's objectives, poisoning attacks in federated learning can be categorized into two distinct types: untargeted poisoning attacks and targeted poisoning attacks. In an untargeted poisoning attack, the goal is to diminish the performance of the global model, resulting in low accuracy across all classes of test inputs. For example, in data poisoning attacks [2; 3; 4; 5], malicious clients can compromise the integrity of the global model by poisoning local data. Another example is the local model poisoning attack [6; 7; 8; 9; 10; 11; 12; 13], where the attacker compromises the integrity of the global model by uploading a locally corrupted model. The objective of a target poisoning attack [7; 11; 14] is to diminish the global model's accuracy, particularly for specific test inputs. For example, in backdoor attacks [14], attackers can compromise a subset of clients and exploit the compromised client to embed a backdoor within the global model, thereby posing a threat to the integrity of the entire global model. Researchers have proposed a large number of robust federated learning methods [6; 15; 16; 17; 18; 19; 20] to address the above problems. Most of the works assume that malicious local models are geometrically distant from other benign models. Therefore, they would exclude malicious local models by detecting anomalies through statistical analysis before aggregation. Another approach is to maintain a clean dataset on the server and utilize it to perform anomaly detection on all local models. It is evident that the existing methods possess certain limitations. Firstly, in the first scheme, some advanced poisoning attacks have the capability to construct malicious local model updates that exhibit geometric similarity to benign local model updates, enabling them to evade existing defense mechanisms. Secondly, the alternative approach necessitates directly collecting clean datasets from individual clients, a practice that contradicts the privacy principles of federated learning. To tackle the aforementioned challenges, we propose a novel and robust federated learning method called FLGQM. It measures local models from two aspects: quality and geometry, and assigns metric scores to different local models. Table 1 lists the main differences between the current mainstream defense approach and the approach we propose. As evident from Table 1, the current mainstream defense methods either detect malicious attacks geometrically or utilize a small, clean dataset to evaluate the quality of a local model. It is evident that certain methods fail to effectively resist all attacks using only Euclidean distance or the median method, and they are also prone to failure under non-IID data [21]. Moreover, the use of a centralized dataset contradicts the principle of federated learning, which aims to avoid data collection. In contrast, our approach leverages cosine similarity and Euclidean distance to defend against malicious attacks from a geometric perspective.