Enhanced Detective: A Dual-Stage Proactive Defense Against Internal Poisoning Attacks in Financial Fraud Detection Using Federated Learning

Enhanced Detective: A Dual-Stage Proactive Defense Against Internal

Poisoning Attacks in Financial Fraud Detection Using Federated Learning Maria-Ioana-Andrea Ivan * Orhan Ermis **

Ruxandra F. Olimid *,***

* Department of Computer Science, University of Bucharest (e-mail: maria-ioana.ivan@s.unibuc.ro, ruxandra.olimid@fmi.unibuc.ro)

** Luxembourg Institute of Science and Technology (LIST), Luxembourg (e-mail:

orhan.ermis@list.lu)

*** Research Institute of the University of Bucharest (ICUB), Bucharest, Romania

With recent developments in Artificial Intelligence (AI), the adoption of distributed learning paradigms such as Federated Learning (FL) has emerged. In simple terms, FL enables multiple entities to collaboratively train Al models without sharing local data. The FL paradigm

is particularly valuable in privacy-sensitive settings, such as financial services, because it enables institutions to collaboratively improve fraud-detection models while keeping sensitive transaction data local. However, FL schemes are prone to security vulnerabilities, where

malicious clients can poison local data or model updates and degrade the global model, and hence the performance of the resulting model might be affected. Therefore, in this work, we propose

Enhanced Detective, a dual-stage robust aggregation strategy that combines Median Absolute Deviation (MAD), distance-based update filtering, and FedMedian aggregation. Experiments on an imbalanced credit card dataset evaluate targeted label-flipping and weight-scaling attacks over 50 communication rounds. With 40% malicious clients, Enhanced Detective achieves an AUPRC of 0.796 and a Recall of 0.847. Keywords: Federated Learning, Fraud Detection, Poisoning Attack, Machine Learning, Financial Data 1.

INTRODUCTION

The present work examines how FL systems used for

fraud detection respond to internal poisoning attacks, attacks for which internals corrupt the training data or

As the digitalization of banking services continues to grow and the attack surface widens, the application of Machine Learning (ML) algorithms in the financial domain to de-

tect suspicious activity is becoming a necessity. In contrast to traditional systems that rely on strict rules, modern

models that use automated learning can adaptively extract complex correlations from large amounts of data, making it harder for attackers to bypass the system. In the financial sector, dedicated laws and regulations

such as the European Anti-Money Laundering Directives (AMLD) and the Payment Services Directive (PSD2)

Commission (2024), as well as general requirements such

as the GDPR Regulation (EU) 2016/679 (2016), prohibit

the plain sharing of transactional data. In this context, Federated Learning (FL), a modern distributed learning approach that enables collaborative model training with-

out the need for centralized training data, is particularly

useful. FL reverses the traditional process, which brings

the data to the model, and keeps sensitive data local by bringing the model to the data, sharing only the update

of the model McMahan et al. (2017).

the models themselves. Passive strategies mainly restrict the impact of malicious updates by simply isolating or

dropping certain updates. However, they still miss some Byzantine nodes and do not allow them to participate in the training process. To overcome the limitations of passive robust aggregation methods, we propose a proactive defense strategy called Enhanced Detective. Our proposed

method identifies malicious updates and then individually checks them, with the aim of dynamically reducing the

impact of both extreme and more subtle malicious updates before performing the global anomaly detection process.

Our contribution can be summarized as follows:

• We propose Enhanced Detective, a novel proactive,

dual-stage filtering mechanism for FL that mitigates internal poisoning attacks in financial fraud detection

systems.

• We define our dual-stage Enhanced Detective strategy as an improved version of a simpler initial Detective strategy that proved inadequate under high compro-

mise rates.

• We run comparative experiments on an imbalanced credit card fraud detection dataset across 50 commu-

the Precision-Recall Curve (AUPRC) is also used to eval-

nication rounds and show that Enhanced Detective

cesses. In contrast to the Receiver Operating Characteris-

uate the model's behaviour across all decision-making pro-

achieves an AUPRC of 0.796 and a Recall of 0.847

tic (ROC) curve, which offers a more optimistic image of

under a cyber stress level of 40%.

the imbalanced dataset, the Precision-Recall curve isolates

The rest of the paper is organized as follows. Section 2

provides the background and places our work in relation

to the existing literature. Section 3 gives the problem definition. Section 4 introduces our proposed solution. Section 5 presents the experimental results. Finally, the last section concludes.

the performance exclusively on the minority class Davis and Goadrich (2006). AUPRC measures the area under the curve while the classification threshold is changed from 0

to 1. A high AUPRC score demonstrates that the model manages to maintain high precision, meaning fewer false alarms, while also achieving high Recall and detecting most fraudulent transactions.

2. BACKGROUND AND RELATED WORK

In this section, we first present the state of the art analysis

2.2 Robust Aggregation Schemes

with respect to the fraud detection using ML techniques

considering effectiveness of different performance metrics used for interpreting the outputs of fraud detection models. Later, we will overview the robust aggregation approaches in the literature.

2.1

Fraud Detection

Although FL introduces privacy protection for the partici-

pating clients' local data locally to some extent, the aggregation process can be manipulated by malicious client behavior. For instance, poisoning attacks are used for manip-

ulating either the local training data or the model updates transmitted by the clients to the aggregation server. Tolpe-

gin et al. Tolpegin et al. (2020) presented data-poisoning The application of ML algorithms in the financial domain,

attacks, where malicious clients modify their local class

especially for the detection of suspicious transactions, has

labels before training (data poisoning). Model-poisoning

become increasingly important as banking services con-

attacks, on the other hand, directly manipulate the client

tinue to become more digital. In contrast to traditional

updates submitted to the aggregation server such as an

systems, which are based on strict rules that can be easily bypassed, modern models based on automated learning

attacker can scale its update to increase its influence on the

have the ability to identify patterns in large datasets that

resulting global model Karame et al. (2023). These studies demonstrate that the conventional averaging operation

are harder to bypass. For the classification of transactions,

used by Federated Averaging (FedAvg) McMahan et al.

one of the most widely used feedforward neural network architectures is the Multi-Layer Perceptron (MLP) Goodfellow et al. (2016). The idea is therefore to use Rectified

sent by clients. This motivates aggregation mechanisms

Linear Unit (ReLU) activation function since it helps the

tions.

model converge faster during training, and the Sigmoid function is placed as the output layer of the neural network to produce a probability between 0 and 1, where

1 represents a fraudulent transaction, and 0 represents a legitimate one. The authors evaluated the resulting

model using the Credit Card Fraud Detection dataset Machine Learning Group (2018). One of the challenges when working with fraud detection datasets is how greatly imbalanced they are. Usually, in these types of datasets,

where the goal is to detect fraud, the fraudulent instances are represented by a very small proportion, around 0.2% or

less Goodfellow et al. (2016). This high imbalance creates problems when training a model. Since most transactions are legitimate, the model can become biased towards the majority class. For instance, a model that classifies all

(2017) can be vulnerable to manipulated model updates

that can limit the influence of anomalous client contribu-

To cope with the challenges of aggregation process, robust aggregation techniques replace FedAvg by employing

additional statistical analysis, which are less sensitive to extreme values. For instance, FedMedian calculates the

median of the received updates independently for each model coordinate, whereas Trimmed Mean removes ex-

treme coordinate values before averaging the remaining values Yin et al. (2018). These strategies reduce the influence of outlying values but do not explicitly assess the consistency of each complete client update. Other robust aggregation strategies combine different forms of statistical

analysis. Bulyan applies an existing Byzantine-resilient aggregation rule to construct a candidate set and then

performs an additional coordinate-wise selection and av-

transactions as legitimate could achieve an accuracy of

eraging step El-Mhamdi et al. (2018). In contrast, Robust

95%, while still missing almost all fraud cases. Such a model would therefore be useless from an operational point

to aggregate complete client-update vectors, providing a

Federated Aggregation (RFA) uses the geometric median

of view.

multivariate alternative to coordinate-wise median aggre-

To overcome the challenge of imbalanced datasets, a cen-

dinated poisoning by comparing the similarity of clients'

tral metric used is Recall, or sensitivity, defined as the ratio of true positive predictions to the total number of

historical updates and reducing the influence of clients that exhibit highly similar behavior, as commonly observed in

actual positive instances Davis and Goadrich (2006). The

Sybil attacks Fung et al. (2020). These methods illustrate

maximisation of Recall can lead to the minimisation of

false negative cases, but relying only on Recall can result in an uncontrolled rise of false alarms, which would neg-

atively affect user experience. Therefore, the Area Under

gation Pillutla et al. (2022). FoolsGold addresses coor-

that robustness can be introduced through multi-stage ag-

gregation, multivariate statistics, or client-behavior anal-

ysis. However, coordinated Sybil attacks are outside the

threat model considered in this work.

Beyond individual aggregation algorithms, Ermis and

Aggregation Server

Khadraoui Ermis and Khadraoui (2026) examined the broader problem of model-update trustworthiness in FL

and proposed MultiTrust-FL, a multi-layered framework combining update anomaly detection, client reputation as-

sessment, and defense mechanisms. That work provides a general framework for trustworthiness assurance, whereas

the present study focuses on a concrete statistical filtering and aggregation strategy and evaluates it against targeted label-flipping and weight-scaling attacks in financial fraud

Model

detection. Additionally, update clipping mechanism can be

used as an alternative approach to remove the influence of unusually large updates. It has also been employed together with filtering and robust aggregation mechanisms

in FL Nguyen et al. (2022). Moreover, the median absolute deviation (MAD) provides a robust measure of statistical

dispersion Leys et al. (2013), while Euclidean distance can be used to quantify the deviation of an update from a

Local Mode

reference model Blanchard et al. (2017); Goodfellow et al. Existing approaches either limit the influence of extreme

Local Database

values at the coordinate level or assess the deviation of

Client 1

complete client updates. However, distance-based filtering performed directly on unbounded updates may be affected

by some malicious client updates, e.g. if they are scaled higher or lower than the average. This limitation motivates Enhanced Detective, which combines robust coordinate

processing, update-level screening, and robust aggregation within a unified strategy.

ocal Database

Client 2

Client K

Fig. 1. Overview of a Federated Learning scheme.

wt € Rd the global model at communication round t,

where d denotes the number of model parameters. Then, the server distributes the current global model w to the

participating clients. Each client Ci trains the received model using its local dataset and obtains a locally trained

3. PROBLEM DEFINITION

model w. The resulting model update is defined as Aw? =

In this section, we formalize the problem studied with re-

w - wt. The set of model updates received from the participating clients in round t is denoted by

spect to the FL setting and the aggregation strategies used as baselines, specification of the threat model including the label-flipping and weight-scaling attacks considered

and finally, the robust aggregation objective as limiting the influence of malicious client updates while preserving

the predictive performance of the global fraud-detection 3.1

Federated Learning and Aggregation Strategies

Federated Learning (FL) is a distributed learning paradigm that enables the training of a particular ML model with the

The aggregation server applies an aggregation function A

to the received client updates to obtain the aggregated model updates as follows: Aw = A (AW').

The global model is subsequently updated as

involvement of distributed nodes McMahan et al. (2017). The generic FL architecture is as illustrated in Figure

1. The training process is coordinated by an aggregation

wt l = U + Awt.

server, which initializes a global model and distributes its parameters to the participating clients. Each client trains a local copy of the model using its private dataset

Therefore, A (AW) represents an aggregated model update rather than a complete global model.

and returns the resulting model parameters or updates to

averaged according to the sizes of the clients' local datasets

the server. The server combines the received contributions

using an aggregation function and uses the result to update the global model. In Federated Averaging (FedAvg), the client models are aggregated through a weighted average,

In Federated Averaging (FedAvg), the client updates are McMahan et al. (2017). Let ni denote the number of

training samples held by client Ci, and let n = as Lay ni The FedAvg aggregation function is defined given

where each client's contribution is typically weighted according to the size of its local training dataset. This process is repeated over multiple communication rounds until a predefined convergence criterion or maximum number of

rounds is reached. More formally, let S denote the aggregation server, C =

Consequently, clients with larger local datasets have a

{C1,

greater contribution to the aggregated update.

C2,...,Ck} the set of K participating clients, and

FedMedian instead computes the median of the client

Label-flipping attack.

updates independently for each model coordinate Yin et al. (2018). For each coordinate j € {1,..., d}, it is defined as

local training dataset before performing local training. In the considered fraud-detection task, the global model per-

A malicious client manipulates its

forms binary classification with class labels {0, 1}, where O represents a legitimate transaction and 1 represents a

[AredMedian (AW')] = median (A',

fraudulent transaction. In the label-flipping attack, a ma-

,..., wk) , licious client changes the labels of fraudulent transactions from 1 to 0 before performing local training. Thus, let denote the original local dataset of a malicious client Di t, denotes by client C. atemed j ofian By seleccoordin thecoor update ting the submit dinate valuted e, C; € CM, and let DIF denote the corresponding poisoned FedMedian limits the influence of extreme individual val- dataset in which the labels associated with fraudulent transactions are changed from 1 to 0. The submitted model ues on the aggregated update. update is then calculated as Д

Trimmed Mean is another coordinate-wise aggregation

strategy Yin et al. (2018). For each coordinate j, let

Aw; = LocalTrain (w', DIF) - w',

(1) denote the ordered coordinate values received from the K

CiE

CM,

(3)

where LocalTrain (w, D) denotes the local training proce-

dure initialized with w' and performed using dataset D.

clients. Given a trimming parameter b satisfying 0 ≤ b <

K/2, Trimmed Mean removes the b smallest and b largest values and averages the remaining values:

LATN (AW9)P = ｽﾞ- 2 6

2

(2)

r = 6+ 1

Weight-scaling attack.

In this attack, a malicious client

manipulates its locally computed model update before transmitting it to the aggregation server. Particularly, the

client multiplies its update by a scaling factor, y > 1, as given in the following equation:

All the aggregation strategies, namely FedAvg, FedMedian, and Trimmed Mean defined in this section are there-

УСіЄ

fore different in how they combine the received client updates. FedAvg computes a dataset-size-weighted average,

whereas FedMedian and Trimmed Mean use coordinatewise statistical operations that reduce the influence of

extreme coordinate values. These aggregation functions provide the baseline aggregation strategies considered in this work, while FedMedian is also employed as the final

aggregation operation of the proposed Enhanced Detective

См.

(4)

The scaling operation preserves the direction of the origi-

nal update while increasing its magnitude, thereby increasing its influence on the aggregated global update. 3.3 Robust Aggregation Objective =

{AW1,...,AWk}

denote the set of client

3.2 Threat Model

updates received by the aggregation server at round t. The objective is to construct a subset Cr CC containing the

In this section, we introduce the threat model for the FL schemes. First, we assume that the aggregation server,

update is computed as follows:

clients whose updates are treated as trusted in that round.

Based on the selected updates, the robust aggregated

S, is honest and fully follows the aggregation protocol,

while a subset of the participating clients may behave

(5)

maliciously. Therefore, for the set of participating clients,

C = {C1,

C2,...,Ck},

that CH and C

in the FL scheme, we assume

correspond to the set of honest and

malicious participants, respectively. We also assume that C

=

CHUCM

and CH

nCM

=

where Arob denotes the robust aggregation function. The global model is subsequently updated as

Ø conditions hold for

our setting. Honest clients follow the prescribed local training procedure and submit their resulting updates to the aggregation server. Malicious clients may manipulate

their local training data or the model updates submitted

wott l = w + Aw .

(6)

In the ideal setup, the robust aggregated update should

remain as close as possible to the update that would be

obtained using only the honest clients. Let this honest-only

Let AW' = {Aw1›...,AWk} be the snapshot of model updates transmitted to the aggregation server at communication round t, where Aw; denotes the update submitted

reference update be defined as

by client i. For each honest client, Ci, the model update

The aggregation error caused by malicious participation can then be expressed as

is defined as Aw¿ = Awi, where C¿ € CH. On the other

AWCH = Arob ({AW; | Ci

ECHS) .

(7)

hand, we define the update submitted by malicious clients according to the label flipping attack and weight-scaling

e = IAw' - Auenl 2 '

(8)

where || • ||½ denotes the Euclidean norm.

Blanchard et al. (2017); Goodfellow et al. (2016). This

Because the identities of the malicious clients and the

distance is denoted as di and is calculated as:

honest-only reference update are not directly available to the aggregation server, &' cannot be evaluated during the

di = ||ũi - Umed||2,

the predictive performance of the global model. In the

where w; represents the sanitized weight vector of client i, Umed is the global median vector, and di represents the

aggregation process. The practical objective is therefore to limit the influence of suspicious updates while preserving

(12)

considered fraud-detection task, this performance is eval-

distance between the client update and the global median.

uated using the Area Under the Precision-Recall Curve

This second stage is useful for detecting label-flipping attacks, since these attacks can produce updates with

(AUPRC) and Recall. The central challenge is to construct a reliable trusted

subset under different forms of malicious behavior. Largemagnitude updates produced by weight-scaling attacks

can distort update-level distance measurements, whereas updates resulting from label-flipping attacks may exhibit

less explicit deviations. A robust aggregation strategy

should therefore limit the influence of both attack types

without requiring prior knowledge of the malicious clients' 4. PROPOSED SOLUTION

magnitude similar to those of honest clients and may

therefore pass the initial coordinate-wise clipping step Tolpegin et al. (2020).

Since suspicious updates are usually located farther from

the main group of honest client updates, the algorithm ap-

plies MAD to the calculated distances as a second filtering

step. The server then calculates a dynamic threshold using

the median distance and its MAD value Leys et al. (2013): threshold = max(meddist +3•maddist, 1.5•meddist), (13)

The proposed method Enhanced Detective not only identifies the malicious updates but also checks each one using a mathematical verification consisting of two consecutive

where meddist represents the median of the calculated distances and maddist represents their MAD. The threshold is set to the larger value between the MAD-based limit

filtering stages, as detailed in Algorithm 1. The main

and 1.5 times the median distance.

objective is to dynamically reduce the impact of both extreme and more subtle malicious updates before per-

Phase 3. If a client's distance exceeds this threshold, its

forming global anomaly detection.

Phase 1. In the first stage, all the updates received from all participating clients by the central server are processed

coordinate by coordinate. For each parameter coordinate

update is considered suspicious and is excluded from the Algorithm 1 Enhanced Detective Strategy: Dual-Stage Require: Client updates W = {W1, W2, ..., WK} from K clients

w; of the model, the algorithm computes the median value med' and the Median Absolute Deviation (MAD), denoted

Ensure: Aggregated global model wglobal 1: Phase 1: Coordinate-wise Clamping

as mad' Leys et al. (2013):

3: for each parameter coordinate j do medi + Median ({wi, w?,..., wk}) mad? + Median({|w] - med'|,..., |w - med' |})

mad' = Median ({lul - med' l. .. /uk - med| })

(9 )

2: Let € = 10- be a small constant for numerical stability

upper bound + med! + 5 • madi + €

lower bound + med? - 5 • mad? - €

Based on these statistical values, the algorithm creates dynamic limits that are updated during each round of training Nguyen et al. (2022). A small constant is also

for each client i € {1, ..., K} do w? + Clip(w, lower bound, upper bound)

added for numerical stability, namely ‹ = 10-5, and the

12: Flatten all sanitized updates into vectors W = {w1,..., 13: Phase 2: Global Distance Filtering

limits are defined as:

wk}

14: Umed + Median (W)

lower bound = med' - 5 • mad' - €

(10)

upper bound = med' + 5 • mad? + €

(11)

If a parameter goes outside the allowed range [lower bound,

15: for each client i € {1,..., K} do 16: di + || wi - Umed||2 17: end for 18: meddist + Median({d1, ..., dk}) 19: maddist + Median({|d1 - meddist|,..., 20: threshold +

upper bound], it is moved back to the closest limit Nguyen

21: Phase 3: Robust Aggregation

et al. (2022). This reduces the impact of extreme values produced by model-poisoning attacks Karame et al. (2023)

22: Trusted + Ø

and prevents these abnormal updates from affecting subse-

quent detection steps. Finally, the parameters are flattened into one single vector for each client, denoted as wi.

Phase 2. The server then calculates a global median

23: for each client i € {1,..., K} do 24:

25: 26:

if di < threshold then

Trusted + Trusted U {w¿} end if

27: end for 28: if Trusted is empty then W

vector, denoted as Umed, which serves as a reference

29:

the Euclidean distance between each client vector and

31: Wglobal + FedMedian(Trusted)

because it is less affected by extreme values. After that,

the global median vector is calculated using the L2 norm

Trusted +

|dk - meddist|})

max(meddist + 3 • maddist, 1.5 • meddist)

30: end if 32: return Wglobal

Algorithm

2 Initial

Detective Strategy

Require: Client updates W = {W1, W2,...,

WK} from K

clients Ensure: Aggregated global model global

achieve similar performance while keeping clients' data local.

However, after the introduction of malicious clients, severe vulnerabilities were discovered. Under a data-poisoning

1: Phase 1: Vector Flattening and Reference Cal-

culation 2: for each client i € {1,.. 3: wi + Flatten(Wi)

attack, such as label flipping Tolpegin et al. (2020), where malicious nodes intentionally flip labels from 1 to 0, the Recall score of the FedAvg algorithm collapsed to roughly 0.23, failing to flag the majority of fraudulent transactions. Moreover, under a model-poisoning attack, namely Weight

5: Umed + Median({1, ..., wK})

6: Phase 2: Distance Calculation and Thresholding K} do 7: for each client i € {1,...,

Scaling Karame et al. (2023), where attackers multiply their weights by an extreme factor, thereby attempting

a Dos attack Nguyen et al. (2022), the system collapsed around round 10.

d i ￩ I o i - U me d 2

9: end for

10: meddist ‹ Median (1d1,..., 11: maddist

meddist })

dK j)

Median(‹ d1 - meddist,...,

dk -

5.2 Evaluation of Passive Defenses

12: threshold + max(meddist +3xmaddist, 1.5xmeddist)

Robust Aggregation - Same as in 113:3вPhase он3:и1

current communication round. The remaining trusted updates are then aggregated using the FedMedian strategy,

helping to keep the global model stable when malicious updates are present Yin et al. (2018).

To overcome the basic limitations of passive defenses, a simpler proposed proactive strategy, called Detective, was

initially considered. This initial strategy relies on client

isolation based on the Median Absolute Deviation Leys

et al. (2013) and its two phases, which differ from those of the Enhanced Detective, are given in the algorithm. As

discussed in the next section, Detective was a first version that led to the definition of the improved two-filteringstage algorithm, Enhanced Detective. 5. EXPERIMENTAL RESULTS This section compares the performance of the federated

network under several attack scenarios. The primary ob-

jective is to demonstrate the drawbacks of conventional ag-

gregation algorithms and to assess the performance of the proposed protection mechanisms. The research is based on measures related to the financial sector, such as AUPRC, Recall, and the Confusion Matrix Davis and Goadrich

(2006). The findings are observed across 50 communication cycles to examine how the model's performance varies over time. The simulation environment was set up locally on a

laptop with an AMD Radeon RX 7600S graphics card, 16 GB RAM and AMD Ryzen 9 7940HS CPU.

5.1

Baseline Performance and Vulnerability Analysis

To establish a baseline reference point, initial tests evalu-

ated the classic Federated Averaging algorithm in a com-

pletely honest environment McMahan et al. (2017). After 50 communication rounds, the classical FedAvg algorithm

To counteract the vulnerabilities found in the baseline

algorithm, the conducted experiments evaluated the performance of two classical robust aggregation strategies,

namely Federated Median and Trimmed Mean Yin et al.

(2018); Blanchard et al. (2017). In the case of model-

poisoning attacks, the FedMedian method showed very high resistance to severe weight scaling. This means that malicious clients sending extremely large values have little

impact on the final aggregated model, as these values are viewed as outliers rather than updates that reflect the model Yin et al. (2018). Even at a compromise rate of 40%, FedMedian maintained the network stable, achieving

a Recall score of approximately 0.78 and preventing the collapse of the network.

In contrast, Trimmed Mean highlighted the problem of dependence in estimating the attack rate Yin et al. (2018).

Configured to eliminate extreme values from the distribution, this strategy functioned without problems under the

20% attack scenario. However, when the attack intensity increased to 40%, the algorithm mathematically failed.

Since only a part of the malicious clients were removed, the remaining extreme vectors corrupted the final average,

causing the system to collapse during the ninth communication round.

The label-flipping attack exposed a common weakness

of the passive methods Tolpegin et al. (2020). Since

compromised clients transmit weight changes that do not exhibit extreme anomalies but only direct the model towards incorrect decisions, the coordinate-wise filtering process becomes inefficient. Under a 40% attack scenario,

Trimmed Mean showed a visible performance degradation,

with the Recall score decreasing to approximately 0.50, the network failing to identify a significant number of

fraudulent transactions. Although FedMedian performed

better, maintaining a Recall score close to 0.70, it still

registered a decrease in performance when compared to the ideal environment.

achieves an AUPRC score of about 0.86 and a Recall

The major conclusion of this evaluation stage is that

score of about 0.85. These findings were close to those

passive defenses strictly treat the symptom of the problem

produced by the centralized model and, in some cases, even significantly better. This indicates that in the absence of

malicious clients on the network, federated learning can

by restricting the impact of malicious updates, while still

allowing Byzantine nodes to participate in the training

Defenses Against Data Poisoning (Label Flipping) 20% Attack Rate

40% Attack Rate (Theoretical

Limits)

1.0

0.8

0.6

0.4

Baseline (Honest) Undefended FedAvg FedMedian TrimmedMean Detective (MAD) Enhanced Detective

0. 0

20

Round

Round

30

50

Fig. 2. The defense methods' performance against data poisoning.

Defenses Against Model Poisoning (100x Scaling Attack DoS Attack) 20% Attack

40% Attack

Rate

Rate

(Theoretical

Limits)

1.0

Recall

0.8

0.6

0.4

• Baseline (Honest) *- Undefended FedAvg (Crashed) FedMedian TrimmedMean Detective (MAD) Enhanced Detective

0. 2

0.0 20

Round

•... Baseline (Honest)

FedMedian TrimmedMean (Crashed) Detective (MAD) Enhanced Detective

40

10

20

Round

30

Fig. 3. The defense methods' performance against model poisoning. 5.3

Performance of the Proposed Proactive Defense

in comparison with Trimmed Mean, which failed during

round 9, the global L2 geometric distances became so To overcome the basic limitations of passive defenses, the experiments first evaluated the performance of an initially

strongly distorted by the magnitude of the malicious vectors that the MAD mechanism became excessively

proposed proactive strategy, called Detective, based on

sensitive, resulting in a final Recall score of only 0.25.

client isolation using the Median Absolute Deviation Leys et al. (2013) and defined in the previous section.

The identification of this mathematical distortion led to

The comparison graphs in Figure 2 and Figure 3 show that

a dual filtering mechanism, as explained in the previous section and depicted in Algorithm 1. The effect of

the first version of the Detective strategy performed very well against label-flipping attacks Tolpegin et al. (2020).

It worked better than the Trimmed Mean method when the attack rate was set to 20%. This means it was able to

the development of Enhanced Detective, which implements this algorithmic optimization proved to be substantial,

as demonstrated by the obtained visualizations. In the

critical model-poisoning scenario at a compromise rate

identify and isolate the malicious nodes that were sending

of 40%, while the other strategies degraded the detection

false updates and leading the model to make incorrect predictions. However, the ultimate stress test, namely

extreme scaling factor. The network protected by the new

model-poisoning Karame et al. (2023) at a compromise

rate of 40%, achieved through weight scaling by a factor

of 100x, revealed a structural vulnerability. Although the algorithm managed to prevent the complete collapse of the

network, surviving until the 50th communication round

performance, Enhanced Detective instantly neutralized the algorithm had a performance curve that almost exactly matched that of the ideal baseline environment. According

to the final aggregated metrics, illustrated in Figure 4, the upgraded approach achieved an AUPRC of 0.796 and a Recall of 0.847 under a cyber stress level of 40%, correctly

ACKNOWLEDGMENTS

Architecture Final Performance (40% Model Poisoning)

This work was supported by a grant of the Ministry of Research, Innovation and Digitalization, CNCS/CCCDI - UEFISCDI, project number ERANET-CHISTERA-IV-

PATTERN, within PNCDI IV. This research was funded in part, by the Luxembourg National Research Fund

(FNR), grant reference INTER/CHIST23/17931746. This work was mostly performed during M.I.A.Ivan MSc studies

at the University of Bucharest. Onainal Detective:

Fig. 4. The overall performance of the architecture. A. Baseline Honesication Breakdown (40%

REFERENCES

Enhanced Detective

Model Poisoning)

Blanchard, P., El Mhamdi, E.M., Guerraoui, R., and

Stainer, J. (2017). Machine learning with adversaries: Byzantine tolerant gradient descent.

In Advances in

Neural Information Processing Systems (NIPS), 11920890

00897

Commission, E.

(2024).

countering the financing of terrorism at EU level.

https://finance.ec.europa.eu/financial-crime/ anti-money-laundering-and-countering-financing-

C. Original Detective

D. Enhanced Detective (Dual Filter

terrorism-eu-level en. Last Accessed: August 2026. Davis, J. and Goadrich, M. (2006). The relationship be-

tween precision-recall and roc curves. In Proceedings of

the 23rd International Conference on Machine Learning

(ICML), 233-240. El-Mhamdi, E.M., Guerraoui, R., and Rouault, S.

The hidden vulnerability of distributed

in Byzantium. 35th

International

In Conference

Proceedings on

Machine

Learning, volume 80 of Proceedings of Machine Research, 3521-3530. PMLR. Fig. 5. Confusion Matrices comparing the final classification performance under a 40% model-poisoning attack. classifying 83 fraudulent transactions while missing only

https://proceedings.mlr.press/v80/mhamdi18a.html.

Ermis, O. and Khadraoui, D. (2026). Trustworthiness assurance for model updates in federated learnIn S. Ventura (ed.), Data Quality Matters - Best Practices for Integrity and Assurance. In-

doi: 10.5772/intechopen.1013666.

15, as detailed in the confusion matrix in Figure 5.

https://www.intechopen.com/chapters/1235771.

6. CONCLUSION

We addressed FL's vulnerability to internal poisoning attacks in financial fraud detection and proposed Enhanced

Detective, a proactive dual-stage filtering mechanism that isolates malicious updates prior to model aggregation.

Our experimental evaluation on an imbalanced credit card fraud dataset across 50 communication rounds validated the efficacy of Enhanced Detective under extreme condi-

tions (40% compromise rate), which is close to the ideal

Fung, C., Yoon, C.J.M., and Beschastnikh, I.

(2020).

The limitations of federated learning in sybil settings. In 23rd International Symposium on Research in

Intrusions and Defenses (RAID 2020), 301-316. USENIX Association, San Sebastian. https://www.usenix.org/conference/raid2020/ presentation/fung. Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning. MIT Press.

Karame, G., Marson, G.A., and Moellering, H. (2023).

baseline environment, achieving an AUPRC of 0.796 and

Thwarting model poisoning in federated learning. US

a Recall score of 0.847.

Patent 11,616,804 B2, assigneed to NEC Corporation.

Future work might include a concrete evaluation of scala-

en. Last Accessed: August 2026.

bility with respect to the number of clients, as the proposed

https://patents

.google.com/patent/US11616804B2/

Leys, C., Ley, C., Klein, O., Bernard, P., and Licata, L.

solution introduces additional time and resource costs

(2013).

that might limit real-time financial transaction systems. Further, we have considered identical settings; analyzing

ation around the mean, use absolute deviation around the median. Journal of Experimental Social Psychology,

different transaction data among institutions remains a subject of future investigation. Finally, future work could

extend the evaluation of Enhanced Detective to more evolved attacks, including adaptive behaviors and time-

varying scaling strategies.

Detecting outliers: Do not use standard devi-

4 9 (4 ) , 7 6 4 - 7 6 6 .

Machine Learning Fraud

Credit

Card

roup(201%/ Kagg Datasets. Detection GDataset. le https://www.kaggle.com/datasets/mlg-ulb/

creditcardfraud.

Related documents

• Enhanced Detective: A Dual-Stage Proactive Defense Against Internal Poisoning Attacks in Financial Fraud Detection Using Federated Learning#1342738
• FEDERATED LEARNING TECHNIQUES FOR SECURE AI MODEL TRAINING IN FINTECH#100161
• Incentivize Contribution and Learn Parameters Too: Federated Learning with Strategic Data Owners#1354075
• Govern the Model, Not Only the Data: Storage, Circulation, and Learning in Creative AI#926683
• A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiency#177298