## 6 Defenses against Model and Data Attacks
### Adversarial Training  
Such defense frameworks are designed for data and model poising attacks. Since data are controlled by individual devices, these frameworks are placed at each local model. The working principle of these frameworks is based on teaching the framework identifying actual and poised data or updates. This is achieved by training the model on adversarial updates. The block diagram of adversarial training is presented in Figure 7. The authors in [90] presented the integration of adversarial training into the FL training process. In each communication round, the server distributes the global model to all the clients. The clients then train their local version of the model using a mix of real data and adversarial examples generated from their own private datasets. After training, the clients send both their regular model updates and the perturbed updates from the adversarial training back to the server. The server combines these updates--both natural and perturbed--from all the clients to refine the global model. The goal is that, by averaging the perturbed updates from various clients, the global model becomes more robust, similar to the effect of centralized adversarial training. This process is repeated over multiple rounds, with the clients continually training their local models and the server aggregating the updates, ultimately resulting in a robust final model.  
The authors in [91] observed a significant decline in model performance when applying adversarial training directly within an FL setup compared to centralized training. This drop was due to model drift and non-IID data distribution. To address these issues, they proposed the FedDynAT framework. FedDynAT builds on FL algorithms like Federated Averaging (FedAvg) and Federated Curvature (FedCurv) [92] for model aggregation. Each client uses adversarial training with Projected Gradient Descent (PGD) to create adversarial examples from their local data. Unlike the traditional methods, FedDynAT employs a dynamic schedule for local training epochs (\(E\)) instead of a fixed number. The schedule starts with a high initial value (\(E_{0}\)) and decreases over communication rounds by a factor \(\gamma E\) every \(F_{E}\) rounds, balancing convergence speed and model drift. FedDynAT uses FedCurv for model aggregation, adding a regularization term to minimize the drift between local models. The process alternates between local adversarial training with dynamic epochs, model sharing, and FedCurv aggregation until convergence is reached.  
Another framework called Generative Adversarial Label Poisoner (GALP) [93] is a system to counteract label poisoning attacks in FL. It includes a generator (G) and a discriminator (D). The generator creates artificial label noise from random inputs, while the discriminator distinguishes between real and noisy labels. Noisy label classifiers, like LMNL and Masking, are trained on data poisoned by the generator, effectively \"vaccinating\" them against label poisoning attacks. In each round, benign clients send parameters of their vaccinated classifiers to the server, which aggregates these to update the global model. Malicious clients then initialize their local models with this global update. Since the update  
Figure 7: Visual representation of adversarial training.  
includes vaccinated parameters, the malicious models are also vaccinated, reducing the impact of any local label poisoning attempts. The attacker's parameters have minimal effects on the global model. By combining GALP with noisy label classifiers, the framework ensures that the global model update is resistant to label poisoning attacks in FL.