Federated learning screens clients before round one: one wavelet summary each, training survives 90% malicious

Malicious clients can be filtered out before the first communication round instead of being contained after they have already contaminated training. Earlier defenses either work during training through robust aggregation or screen clients offline with a supervised classifier that needs attack labels. On MNIST, CIFAR-10 and CIFAR-100, as the malicious fraction rises from 60% to 90%, WaSA-Boltzmann gives the best results in most settings and on CIFAR-100 at 90% corruption surpasses both the Oracle and FedAvg.

Each client compresses its local data into one spectral summary that is not invertible back to raw pixels, and the server judges from it whether the client deviates from the clean distribution. The summary is a variance-weighted superposition of the leading principal directions from a truncated singular value decomposition, then projected through a wavelet scattering transform that keeps only first-order coefficients. On CIFAR-10 at 60% corruption, a Fourier representation makes Gaussian blur and random pixel masking overlap with clean clients around the threshold, while the wavelet scattering representation keeps all 40 clean clients below the threshold and pushes all four corruption profiles consistently above it.

Whether a client takes part is decided by its reconstruction error, either by hard exclusion or by probabilistic down-weighting. Hard thresholding keeps only clients scoring below a threshold, while Boltzmann sampling treats the score as an energy and uses a temperature parameter to interpolate continuously between hard exclusion and uniform sampling. At temperature 0.1, clean clients are selected at roughly the uniform rate over the clean pool, high-anomaly clients are exponentially suppressed, and mildly distorted clients retain residual probabilities below that level.

The pipeline targets cross-device federated learning where the server holds a small clean auxiliary set, and detection happens before the first communication round, so it adds no overhead to the training rounds. Experiments cover image classification on MNIST, CIFAR-10 and CIFAR-100, with Gaussian noise, Gaussian blur, random pixel masking and black images as corruptions, at 60% and 90% malicious fractions. A reader following up could watch how the approach behaves on non-image modalities and real IoT data.

Detection depends on the server-side auxiliary data resembling the real client distribution, and the auxiliary set is one tenth of the training set. Deterministic thresholding shows higher variance in the severe 90% regime and is more sensitive to hyperparameters; the Boltzmann variant is designed mainly to bias client participation, and its detection decision is defined after the fact as negligible expected participation over the whole training horizon. Wavelet scattering keeps only first-order coefficients, with scattering parameters set separately for each image size.