Fair and secure federated adversarial training

Abstract

Training machine learning models that are simultaneously private, robust, and deployable on resource-constrained edge devices requires resolving three tensions that have largely been treated in isolation. This thesis addresses all three through a unified sequence of contributions in Federated Adversarial Training (FAT). The first tension is architectural: centralized aggregation in federated learning introduces a single point of failure and a source of bias, yet decentralizing aggregation naively degrades model quality. We resolve it with FL-EGM, a framework in which each training round elects the best-performing participating node as the aggregator, and that node subsequently refines the aggregated model on its own local data. This Enhanced Global Model (EGM) step converts the aggregator’s privileged data access from a liability into an asset, delivering accuracy that matches or exceeds centralized baselines (up to 98.5%), converging faster, and remaining stable even when the aggregator is biased, all while eliminating the fixed server bottleneck. The second tension is computational: AT, the most effective known defence against evasion attacks, imposes a multiplicative cost on every participating client, making it infeasible for resource constrained edge devices. We resolve it with FedHAT, a framework that stratifies clients by resource capacity. RR clients perform hybrid AT with attack diversification across PGD and FFGSM; LR clients contribute standard training on clean data, supplying distributional diversity that the adversarial tier alone cannot provide. The two signals are combined via group-weighted aggregation followed by EGM refinement. Across six datasets and attack types, under both IID and non-IID conditions, FedHAT surpasses state-of-the-art baselines and improves robustness against unseen attacks purely through federation-level attack diversification, with ablations confirming that diversification and EGM contribute independently, all without overburdening constrained devices. The third tension is energetic: even tiered frameworks that assign lighter workloads to weaker devices eventually deplete them, because battery levels decline across rounds, and no existing method adapts training intensity to this evolution. We resolve it with EARS (Energy-Aware Robust Selection), which introduces a per-client state machine, the Heterogeneous Adaptive Adversarial Training Intensity (H-AATI), that continuously adjusts attack strength from full PGD to FGSM to standard training as each device’s battery and estimated affordable rounds decline. A companion multi-objective client selector preferentially schedules well-resourced clients for intensive rounds. Across four benchmark datasets and ten baseline comparisons, EARS achieves 100% client survival, 40-43% lower cumulative energy consumption, and robust accuracy within 1-5 percentage points of the strongest energy-agnostic baselines, whereas existing methods deplete 76-100% of low-end devices before training completes. Each percentage point of robustness conceded relative to the strongest baseline buys roughly a 40% reduction in energy and an 80% improvement in survival, making energy-aware adversarial training not an efficiency optimization but a correctness requirement for heterogeneous deployments. Together, the three contributions constitute a coherent progression from decentralized aggregation, through resource-aware role assignment, to energy-adaptive intensity control, demonstrating that robustness, privacy, and sustainability are jointly achievable in heterogeneous federated environments.

Date	21 Aug 2026
Original language	American English
Awarding Institution	École de technologie supérieure
Supervisor	Kaiwen Zhang (Supervisor) & Chamseddine Talhi (Co-supervisor)