Sparsification Under Siege: Dual-Level Defense Against Poisoning in Communication-Efficient Federated Learning

1 Introduction

Federated Learning (FL) has emerged as a paradigm shift in distributed artificial intelligence, enabling collaborative training across decentralized edge devices while preserving data locality [Kairouz et al., 2021]. Despite its privacy benefits, the communication bottleneck inherent in transmitting high-dimensional parameter updates remains a critical hurdle. To address this, gradient sparsification techniques, such as Top-k selection, have become the de facto standard, reducing uplink communication overheads by orders of magnitude (often exceeding 99%) without significantly compromising convergence [Sattler et al., 2019b; Sattler et al., 2019a; Han et al., 2020].

∗Corresponding authors.

However, we argue that this pursuit of efficiency has inadvertently introduced a fundamental structural vulnerability. Existing robust aggregation protocols, such as Krum [Blanchard et al., 2017], Geometric Median (RFA) [Pillutla et al., 2022], and FLGuardian [Zhou et al., 2025], are predicated on the geometric assumption of Dense Euclidean Consensus. They assume that benign updates cluster around a global mean in a dense vector space, allowing outliers to be detected via Euclidean metrics (L2 norm).

We reveal that Top-k sparsification violates this premise. Mathematically, the sparsification operator acts as a nonlinear projection that maps updates into low-dimensional subspaces. In non-IID settings, this results in benign updates becoming sparse orthogonal, namely, their non-zero indices (masks) barely overlap. Consequently, Euclidean distance becomes mathematically ambiguous as a similarity metric; two benign clients holding disjoint but valid features may appear infinitely distant from each other. We term this phenomenon the Sparsity-Robustness Trade-off: the very mechanism used to save bandwidth destroys the geometric landscape required for security. By manipulating the sparse index masks (Structure) rather than just the parameter values (Semantics), malicious clients can artificially concentrate their contributions into specific parameter packs. This allows them to achieve "local dominance" in targeted subspaces even while remaining a minority globally, effectively bypassing norm-based defenses that look for global outliers.

To resolve this geometric crisis, we propose SafeSparse, a consensus restoration framework that recouples sparsification and robustness through a dual-space calibration mechanism. Specifically, SafeSparse first enforces topological consensus by utilizing Jaccard similarity to filter structural outliers induced by index poisoning. It then establishes semantic alignment by mapping updates to a directional unit-sphere via sign-based vectors and employing density-based clustering. This approach effectively isolates the benign consensus cluster without relying on the flawed Euclidean magnitude, thereby neutralizing both structural and magnitude-invariant attacks.

Our contributions are summarized as follows: (1) We systematically identify and formalize the geometric dissonance problem in sparse FL, proving that standard robust aggregators possess a theoretical failure mode when inputs are sparse and orthogonal. (2) We present SafeSparse, the first defense framework explicitly tailored to reconcile the tension between communication efficiency and robust aggregation through mask-aware and sign-aware inspection. (3) We provide theoretical convergence guarantees for our method and demonstrate through extensive experiments that SafeSparse significantly outperforms existing baselines, recovering global model accuracy in highly corrupted environments where traditional defenses fail.

Defense Mechanism

Figure 1: Empirical validation of poisoning vulnerability. The violin plots illustrate the accuracy distribution across 12 diverse scenarios (3 datasets × 4 attacks) as detailed in Section 4.3.

2 Vulnerabilities in Sparsified FL

Traditional robust FL often assumes that malicious updates are "outliers" in the full parameter space. However, we identify a fundamental shift in the attack surface when sparsification-based communication-efficiency method is employed.

Specifically, in the context of sparsified FL, we identify two distinct attack vectors. (1) Index Poisoning: Adversaries manipulate the sparse index masks to maximize the Malicious Contributor Ratio (fp) for specific target parameters, effectively hijacking the aggregation weight of critical neurons. (2) Masked Value Manipulation: Adversaries inject malicious perturbations (e.g., sign flipping) into the selected parameters while mimicking the sparsity patterns of benign clients to evade detection. Unlike standard FL, where attackers are diluted globally, sparsification allows attackers to achieve local dominance in specific parameter packs.

Theoretical Analysis. Unlike dense FL, sparsified aggregation allows adversaries to concentrate their influence. We define attack effectiveness ρ = ∥WG -W ′G∥22 as the squared Euclidean distance between the poisoned global model WG and an ideal benign model W ′G.

Theorem 1 (Vulnerability under Sparsified Aggregation). Assume the malicious perturbation per parameter pack is bounded by E[∥Wa(p) -W ′G(p)∥2] ≤ ϵ. The attack effectiveness ρ is upper-bounded by:

where fp = N A p /Np is the malicious contributor ratio for parameter pack p.

Theorem 1 reveals that the attack impact is determined by the pack-level ratio fp rather than the global attacker ratio in sparsified FL. By coordinating sparse masks, adversaries can drive fp → 1 for specific packs, exerting immense influence. SafeSparse mitigates this by using Jaccard and Sign-based filtering to minimize fp across all packs. Detailed proof is provided in Appendix C.

In addition to theoretical analysis, we experimentally verified the vulnerability. As illustrated in Figure 1, we evaluate the global model accuracy across 12 diverse scenarios (comprising three datasets and four coordinated attacks). The probability density (represented by the width of the violins) and the quartiles (indicated by the dashed lines within) reveal a systemic performance collapse for traditional defenses. Specifically, mechanisms like Multi-KRUM and RFA exhibit extreme variance, with their interquartile ranges stretching significantly toward low-accuracy zones (often < 40%). This high instability empirically confirms Theorem 1: since these defenses fail to account for the mask-level distribution fp, adversaries can effectively bypass geometric filters by concentrating malicious energy to become a "local majority" within coordinated sparse subspaces.

3 SafeSparse Framework

3.1 Overview of SafeSparse

The goal of the proposed SafeSparse framework is to enhance robustness against untargeted poisoning attacks in the context of sparsified, communication-efficient FL. As illustrated in Figure 2, SafeSparse is built on a common communicationefficient FL paradigm, where each client communicates with the server by transmitting only the most important model parameters using sparsification techniques. Specifically, each client performs local training on its data, applies top-k sparsification, and uploads the sparse model parameters along with a sparse index mask to the server. The server then aggregates the received sparse model updates to form the global model based on the sparse index mask.

To achieve the robustness guarantee and sparsification communication-efficiency in SafeSparse, two key components are designed at the server side: sparse index mask inspection and model update sign similarity analysis. Specifically, the sparse index mask inspection module filters out clients whose model updates are inconsistent with the majority by measuring the overlap in parameter selections across clients using the Jaccard similarity metric. The model update sign similarity analysis module, another critical component of SafeSparse, detects adversarial behavior patterns by grouping clients with similar update directions (i.e., the signs of parameter differences) using cosine similarity and applying density-based clustering to identify malicious clients. Clients identified as potentially malicious are excluded from the subsequent sparsified communication-efficient aggregation process, ensuring that only benign clients contribute to the final global model.

SecurityModel. In the SafeSparse framework, we consider a Byzantine threat model in which the proportion of adversarial participating clients is assumed to remain below 50% of the total clients. Each adversarial client is capable of launching poisoning attacks, aiming to manipulate the global model aggregation process by transmitting falsified model parameters during the FL process. This can be achieved either by directly manipulating the local model or by indirectly falsifying the local training samples. Consistent with the threat assumptions of existing poisoning attack studies, we assume that attackers do not have direct access to the local model updates or raw training data of benign participants. Furthermore, in this work, the primary adversarial objective is to conduct untargeted attacks designed to degrade the overall performance of the global model. It is important to note that privacy leakage threats, such as those caused by privacy inference attacks or gradient leakage attacks, are beyond the scope of this paper.

3.2 Sparsified and Robust Aggregation

Structural Integrity Verification via Jaccard Filtering

Typical sparsified frameworks rely on sparse index masks, which introduces the risk of Index Poisoning. As shown in our theoretical derivation (Appendix C), the success of an attack in sparse FL depends on the malicious contributor ratio fp within each parameter pack. To minimize this ratio, we enforce structural consensus.

To further investigate their properties, we analyzed the structural characteristics of these masks and examined their consistency across clients. As shown in Figure 3, our empirical analysis reveals that, even under non-IID training settings, a significant degree of overlap exists among the masks generated by different clients. Leveraging this observation, we propose a filtering mechanism to eliminate potential adversarial clients whose sparse index masks exhibit low overlap with others or form isolated groups of similarity. Typically, clients with highly distinct sparse index masks introduce a significant degree of uncertainty in detecting poisoning attacks, thereby hindering the establishment of a robust defense. By filtering out these outliers, our approach enhances the reliability of attack detection and ensures a more consistent aggregation process.

Specifically, we compute the Jaccard similarity between the sparse index masks of different clients. Formally, for each client i, let Mi represent its sparse index mask, which contains the indices of the selected model parameters after top-k sparsification. The Jaccard similarity between two clients i and j is defined as:

where |Mi ∩Mj| represents the number of common selected indices between the two clients, and |Mi ∪Mj | represents the total number of unique selected indices.

For each client, we compute its Jaccard score as the average Jaccard similarity with all other clients, defined as:

where m is the total number of participating clients. The Jaccard score quantifies the similarity of a client's sparse index mask to those of the other clients in the system.

To identify anomalous clients, we define a threshold for filtering as follows:

Here, Jmax and Jmin represent the highest and lowest Jaccard scores among all clients, respectively, and β is a manually tuned hyperparameter, with a default value of 0.6. Any client with a Jaccard score below this threshold is classified as an outlier and is excluded from the global model aggregation process.

Semantic Consistency via Sign-based Clustering

While Jaccard filtering ensures structural integrity, it cannot detect malicious values within a valid mask (e.g., Label Flipping or IPM). To address this, we examine the Semantic Consistency of the updates. Since magnitude clipping is ineffective against scaling attacks in sparse regimes, we abstract the updates to their sign vectors Sign(∆wi). This transformation renders the defense robust to magnitude manipulation and focuses purely on the optimization direction.

As illustrated in Figure 4, the first eight clients represent malicious adversaries, while the remaining twelve are benign clients. The results demonstrate that the sign similarity among malicious clients is significantly higher than that among benign clients in the sparsified communication scenario. Furthermore, the similarity between malicious and benign clients remains low, further emphasizing the distinct update patterns introduced by adversarial attacks. It is important to note that, due to the nature of sparsification, the sign similarity between any two clients can only be computed over the overlapping regions of their sparse index masks. In short, our observations reveal that the success of poisoning attacks typically relies on controlling multiple adversarial clients and injecting relatively consistent perturbations into the model updates.

Building upon these insights, we design a Model Update Sign Similarity Analysis module to cluster potential malicious clients for detection. The process begins by computing the model parameter differences between the sparse model parameters uploaded by each client and the global model from the previous round, as ∆wi = wi - wG. These differences are then converted into their corresponding sign directions, defined as:

where wi represents the model parameters from client i, and wG denotes the global model parameters from the previous aggregation round. It is important to note that parameters for which no client participated in the aggregation during the previous round are excluded from the similarity calculation. This exclusion arises because the server lacks the corresponding model parameters for these positions, as they are determined solely by the local models of the clients, which are independently set by each client.

Next, we compute the pairwise cosine similarity of model update signs between clients, considering only the overlapping portions of their sparse index masks. This restriction ensures that the comparison is performed on the same model elements between clients, thereby making the similarity measurement meaningful. The cosine similarity, cos(θi,j), is defined as follows:

where ⟨·, ·⟩ denotes the dot product, and ∥ · ∥ represents the Euclidean norm.

Subsequently, the cosine similarity is transformed into a distance metric using 1 - cos(θi,j), which quantifies the distance between the updates of two clients. The resulting distance matrix is then utilized as input to a clustering algorithm. Specifically, we employ the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm [Ester et al., 1996] within our framework, as detailed in Algorithm 1 in the Appendix B.1.

To determine the optimal value of ϵ, which defines the scan radius for core points in DBSCAN, we utilize the K-nearest neighbors (KNN) method. In this approach, ϵ is set as the average distance to the n-th nearest neighbor, where n = N · γ. Here, N represents the total number of clients, and γ is a hyperparameter that controls the sensitivity of the clustering process. In practice, we set γ = 0.2 to balance sensitivity to adversarial clients and false positives. Additionally, the minimum number of points required to form a core point in DBSCAN is set to N · γ, ensuring that each cluster contains a sufficient number of clients. This clustering process enables the effective grouping of clients based on similar attack patterns, while clients exhibiting significantly different update behaviors are identified as outliers. The resulting clusters facilitate the detection and exclusion of malicious clients from the global aggregation process. Consequently, only benign clients are included in the final global model aggregation, thereby enhancing the robustness of the framework.

Sparsified Robust Aggregation. Building on the recent work of Yan et al. [Yan et al., 2024], SafeSparse adopts a pack-level top-k sparsification method. Unlike scalar-level sparsification, this method groups model parameters into small structured packs before applying the sparsification process. By operating at the pack level, this approach preserves the structured information within each group, providing a more efficient and cohesive representation of the model updates.

Specifically, when the server receives sparsified model parameters {W1, ...,Wm} and their sparse index masks {M1, ...,Mm} from m clients, it first resolves sparse index misalignment by identifying contributing clients Si = {j|Mj(Pi) = 1} for each packet Pi. This alignment ensures structural consistency across clients' heterogeneous sparse representations. The aggregation weight for client j is dynamically assigned as |Dj | ∑mk=1 |Dk| , proportional to its local dataset size |Dj|. For each Pi, the server calculates the total aggregation weight APi = ∑j∈Si |Dj | ∑mk=1 |Dk| to quantify cumulative contributions. Each model parameter Wj(Pi) undergoes two sequential transformations: first scaled by its client-specific weight Wj(Pi) ← Wj(Pi) ∗ |Dj| ∑mk=1 |Dk| then normalized by APi via Wj(Pi) ←Wj(Pi)/APi to eliminate dimensional variance caused by differing contributor counts. The aggregated parameter wagg i = ∑j∈Si Wj(Pi) is computed through weighted summation. The detailed algorithm is provided in Appendix B.2.

It is important to note that our aggregation employs a dynamic normalization factor APi . Unlike standard FL averaging which divides by N, SafeSparse normalizes by the count of valid contributing clients for each pack. This prevents the "gradient vanishing" problem for rarely selected parameters and ensures that the global model maintains the correct scale of gradient descent, as guaranteed by our convergence proof in Appendix D.

4 Evaluations

4.1 Convergence Analysis

We further establish the convergence of SafeSparse under standard assumptions and adversarial conditions (Lsmoothness, bounded variance, and Top-k properties, see Appendix D.1).

Theorem 2 (Convergence of SafeSparse). Let α = k/d be the fraction of retained parameters. Under a µ-strongly convex objective and learning rate ηt = 8 µ(t+a) , the global model W TG after T rounds satisfies:

where D is a constant, G2 represents data heterogeneity, and ρ is the residual attack effectiveness defined in Theorem 1.

Theorem 2 demonstrates that SafeSparse converges to an error ball whose radius is explicitly controlled by the sparsity ratio α and the filtering effectiveness. By filtering outliers, SafeSparse restricts ρ, ensuring the model converges even in highly adversarial sparse environments. Detailed proof is deferred to Appendix D.

4.2 Default Experimental Settings

Unless stated otherwise, we use 20 clients with full participation, one local epoch per round, batch size 64, Adam optimizer with learning rate 0.005, and an attacker ratio of 0.4. Attacks start from round 10 and continue until training ends. We evaluate both IID and non-IID settings; the latter uses a Dirichlet split with α = 1.

4.3 Datasets and Baselines

To evaluate the effectiveness and performance of SafeSparse, we conduct several experiments, consistent with the methodologies employed in existing related works. Specifically, we train a ResNet-20 model [He et al., 2016] using SafeSparse and compare it against related baselines on three public datasets: FashionMNIST [Xiao et al., 2017], CIFAR-10 [Krizhevsky et al., 2009], and CIFAR-100 [Krizhevsky et al., 2009].

SafeSparse is compared against a comprehensive set of baselines, including: FedAVG [McMahan et al., 2017], Multi-KRUM [Blanchard et al., 2017], Median [Yin et al., 2018], Trimmed Mean [Yin et al., 2018], FedSign [Guo et al., 2023], Robust-DPFL [Qi et al., 2024], LASA [Xu et al., 2025], FLGuardian [Zhou et al., 2025], and RFA [Pillutla et al., 2022]. The full technical descriptions and mathematical formulations for each baseline are detailed in Appendix E.1.

To evaluate SafeSparse's resilience to poisoning attacks, we conducted experiments on both IID and non-IID datasets under four common poisoning attack scenarios: Label Flip Attack (LFA) [Fang et al., 2020], Gaussian Noise Attack

(GNA) [Fang et al., 2020], Inner Product Manipulation (IPM) [Xie et al., 2020], and Scaling Attack [Bagdasaryan et al., 2020]. Detailed definitions and the implementation mechanisms for these four attack strategies are further elaborated in Appendix E.1.

4.4 Attack Effectiveness in Sparsified FL

As illustrated in Figure 5, we demonstrate the failure of most existing defense strategies against poisoning attacks in the context of sparsified communication-efficient FL. Different types of poisoning attacks commence at the 10th training epoch (marked by the red dashed line), and their impact on common sparsified aggregation is evident. Specifically, FedAvg fails to maintain stability, particularly under Scaling and Inner Product Manipulation (IPM) attacks, where the test accuracy drops drastically after the attack begins. A complementary evaluation under the IID setting is provided in Appendix E.2, which further corroborates these vulnerabilities.

Existing Federated Learning (FL) defenses, including Multi-KRUM, Median, and Trimmed Mean, exhibit limited and inconsistent resilience against poisoning attacks. Their effectiveness is highly sensitive to the dataset and attack type; for instance, while some succeed on CIFAR-10, they fail catastrophically under IPM or scaling attacks on CIFAR-100. Even advanced methods like FedSIGN and Robust-DPFL

struggle with high-intensity attacks on complex datasets. These vulnerabilities are exacerbated in sparsified FL. Traditional robust aggregators rely on full, aligned updates, which are disrupted by the inconsistent parameter subsets inherent in sparsification. Similarly, anomaly detectors like FedSIGN lose detection granularity as sparse representations obscure critical patterns. This allows adversaries to exploit sparse indices to evade detection, highlighting an urgent need for sparsity-aware robust mechanisms.

4.5 Model Performance and Defense Effectiveness

To evaluate our proposed SafeSparse, we compare the model performance and defense effectiveness of SafeSparse with those of baseline methods. As shown in Figure 5, SafeSparse maintains high test accuracy and stability even after the attack is introduced, outperforming other defenses in multiple adversarial settings. Specifically, Scaling and Inner Product Manipulation (IPM) attacks cause many baseline methods to collapse entirely, while SafeSparse remains robust, preserving high accuracy. These results indicate the effectiveness of SafeSparse against various poisoning attacks in adversarial federated learning environments. Detailed comparative results on IID datasets and the corresponding convergence curves are available in Appendix E.2.

4.6 Ablation Experiments

To further evaluate the robustness and adaptability of SafeSparse, we conduct ablation experiments on its two key hyperparameters: the filtering threshold β and the clustering sensitivity γ, as illustrated in Table 1 and Table 2 , while the corresponding results for the IID distribution are provided in Appendix E.3.

Impact of Filtering Threshold β. Filtering threshold controls the cutoff value for sparsity mask similarity when filtering out potentially poisoned clients. We experiment with five values: β ∈ {0.2, 0.4, 0.6, 0.8, 1.0}. As shown in our results, SafeSparse maintains effective defense performance under all settings, indicating its robustness to β variations. However, higher values of β (e.g., 0.8 or 1.0) lead to overfiltering, where benign clients are mistakenly excluded from training, reducing model diversity and performance. On the other hand, lower values retain more benign clients while still effectively filtering out attackers. We adopt β = 0.6 in our main experiments as it strikes a good balance between defense strength and benign client retention.

Impact of Clustering Sensitivity Parameter γ. Clustering sensitivity parameter influences the neighborhood size for DBSCAN-based client clustering. We vary γ from 0.1 to 0.5 in increments of 0.05. The results reveal that excessively high values (e.g., γ > 0.4) cause the clustering step to fail in separating attackers from benign clients, leading to ineffective defense.

Impact of Attacker Ratio and Top-k Ratio. SafeSparse was evaluated with attacker ratios from 0.2 to 0.4 on CIFAR100. Results show that test accuracy remains stable regardless of the increasing proportion of malicious clients, confirming the robustness of our defense. See Appendix E.4 for detailed performance curves. We also tested sparsification ratios between 0.4 and 0.6. SafeSparse maintains strong resilience across all levels, though lower ratios may slightly affect attacker detection stability. Further experimental data and analysis are provided in Appendix E.5.

5 Conclusion

We studied poisoning vulnerabilities in sparsified communication-efficient FL and showed that sparse updates undermine dense robust aggregation assumptions. We proposed SafeSparse, which combines mask-level structural filtering and sign-based semantic clustering to detect and remove malicious clients before sparse aggregation. Experiments demonstrate that SafeSparse improves robustness across datasets, attacks, and sparsification settings while preserving communication efficiency.

Ethical Statement

There are no ethical issues.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (No. 62225202, 62302022, and 62472022).