# Reducing Defense Vulnerabilities in Federated Learning:
## 3 Methods
### Theoretical Foundation for Neuron-Centric Defense  
The rationale for selecting neurons as the unit of defense, rather than entire layers or arbitrary parameters, is supported by both theoretical considerations and empirical observations. Neural networks naturally develop specialized neurons that respond to specific input patterns during training [21]. Our preliminary experiments revealed that poisoning attacks do not affect all neurons equally but rather create distinctive patterns in specific neurons' gradient behavior. When examining gradient changes during poisoning attacks, we observed that approximately 15-20% of neurons exhibit significantly higher variance compared to benign training scenarios. These \"informative neurons\" provide a more distinctive projection for detecting malicious behavior than examining entire layers or random parameter subsets. Furthermore, using neurons as the unit of analysis provides an appropriate granularity level--finer than layer-level analysis (which can reduce attack effects by averaging across many neurons) but more structured than arbitrary parameter selection (which may miss important architectural relationships). This targeted approach allows defense classifiers to capture subtle attack signatures while maintaining computational efficiency by focusing only on the most relevant parts of the model. Our dynamic neuron selection strategy adapts to different attack patterns, as different attacks may affect different parts of the network. This adaptability represents a key advantage over static defense mechanisms that may become ineffective as attack strategies evolve. The proposed defense method first selects neurons that have the most impact on distinguishing between malicious and benign users. Then, with the dimensionality reduction, the information entropy from the selected neurons is improved. In the final step, a classification method is used to detect malicious users and remove their contribution from the model aggregation process. For the neuron selection phase, our mechanism identifies neurons exhibiting the highest variance in gradient updates. The theoretical justification for this approach stems from the observation that poisoning attacks necessarily alter gradient trajectories to achieve their objective. Let \(\theta\) represent the model parameters, and \(\Delta\theta_{k}^{t}\) denote the gradient update from participant \(k\) at round \(t\). Under benign conditions, the expected gradient behavior is as given in Equation (1). \[E\big{[}\Delta\theta_{k}^{t}\big{|}benign\big{]}\approx\Delta\theta^{*}+ \varepsilon_{k} \tag{1}\]  
where \(\Delta\theta^{*}\) represents the \"true\" gradient direction toward convergence, and \(\varepsilon_{k}\) represents natural noise due to data sampling and stochastic optimisation. In contrast, malicious updates introduce adversarial perturbations as given in Equation (2). \[E\big{[}\Delta\theta_{i}^{t}\big{|}malicious\big{]}=\Delta\theta^{*}+ \varepsilon_{k}+\alpha_{k} \tag{2}\]  
where \(\alpha_{k}\) represents the adversarial manipulation. Crucially, these manipulations \(\alpha_{k}\) cannot be uniformly distributed across all parameters without significantly reducing the attack effectiveness, as this would reduce the poisoning impact. Instead, attacks typically concentrate their effect on specific neurons critical to the target task, creating regions of heightened gradient variance. Our dynamic neuron selection identifies precisely these regions of abnormal variance, providing a theoretical foundation for its effectiveness. The selection threshold \(\tau_{\rho}\) adapts to maintain a consistent proportion of neurons regardless of model scale or attack intensity. Our method's effectiveness can be understood through the lens of statistical anomaly detection. The OC-SVM classification establishes a decision boundary that separates the normal region of gradient behavior from anomalous updates.