A newly proposed framework called FedDefend++ improves resistance against adversarial model inversion attacks while maintaining defensive accuracy against data poisoning in federated learning environments, according to experimental findings published in Neural Computing and Applications. Researchers Mohammed R. Al-Matari, Qasem Abu Al-Haija, and Hassan Najadat evaluated the enhanced variant alongside the previously introduced FedDefend framework across diverse machine learning datasets. Their experimental investigations demonstrated that the enhanced system achieved up to a 10 percent reduction in Attack Success Rate compared to the baseline FedDefend defense. At the same time, the architecture maintained robust classification accuracy across non-independent and identically distributed data partitions subjected to substantial adversarial poisoning.
Federated learning establishes collaborative model training among distributed clients without requiring the exchange of raw local data, providing inherent privacy benefits for participating systems. Despite these privacy protections, decentralized architectures remain susceptible to adversarial interference through data poisoning attacks and model inversion attacks. The research team validated the operational effectiveness of FedDefend, an earlier defensive framework that incorporates multi-feature trust scoring alongside privacy-preserving techniques.
Building directly upon the foundational design of FedDefend, the authors introduced FedDefend++ to reinforce privacy defenses against inversion threats during decentralized aggregation.
To assess defensive robustness, the authors conducted extensive experiments comparing both variants across multiple standardized image benchmarks: MNIST, Fashion-MNIST, CIFAR-10, and PathMNIST. The evaluation protocol simulated diverse adversarial conditions by varying the proportion of compromised clients and examining both independent and identically distributed and non-independent and identically distributed data configurations.
In benchmark evaluations against competing defenses, the original FedDefend framework demonstrated marked classification improvements under adverse conditions. In non-independent and identically distributed settings affected by random noise attacks, FedDefend increased model accuracy by up to 71.23 percent relative to its closest competing defensive method. The framework concurrently maintained false positive rates below 10 percent across the majority of evaluated testing scenarios.
The enhanced FedDefend++ variant matched the defensive accuracy of FedDefend while delivering superior protection against model inversion attacks. Under a severe 40 percent malicious client ratio with random noise attacks on non-independent and identically distributed Fashion-MNIST, both defensive variants sustained approximately 88 percent classification accuracy. Coupled with the 10 percent reduction in Attack Success Rate, these results confirm enhanced resistance against adversarial inversion.
Despite these defensive advantages, the researchers observed notable utility trade-offs, particularly when applying the privacy-preserving mechanisms to more complex data distributions. On the independent and identically distributed CIFAR-10 dataset, substantial performance degradation occurred, with classification accuracy falling below 30 percent alongside a median Structural Similarity Index Measure dropping under 0.05. The authors noted that while FedDefend and FedDefend++ provide robust and privacy-preserving defenses against sophisticated adversarial threats in mission-critical deployments like finance and healthcare, the pronounced degradation on complex data distributions highlights an inherent trade-off between strict privacy enforcement and overall model utility.
Subject of Research: Adversarial defenses in federated learning under non-IID data distributions
Article Title: FedDefend++: a weighted federated learning framework against data poisoning and model inversion attacks under non-IID settings
Article References: Al-Matari, M. R., Abu Al-Haija, Q., & Najadat, H. (2026). FedDefend++: a weighted federated learning framework against data poisoning and model inversion attacks under non-IID settings. Neural Computing and Applications, 38(21), Article 857. https://doi.org/10.1007/s00521-026-12537-7
Image Credits: AI Generated
DOI: 10.1007/s00521-026-12537-7
Keywords: federated learning, data poisoning attacks, model inversion attacks, FedDefend, FedDefend++, non-IID data, local differential privacy, adversarial robustness, weighted, federated, learning, framework
News Source: Veronica Carney. (November 10, 2026). Trust-Weighted Framework FedDefend++ Cuts Federated Learning Inversion Attack Success Rate. Scienmag.
