All Projects

2025

Federated Learning on RetinaMNIST with PID Client Filtering

Federated learning system for diabetic retinopathy classification that defends against label-flipping attacks using a PID-based anomaly detection controller to filter malicious clients during FedAvg aggregation.

Python PyTorch Flower Federated Learning RetinaMNIST
View Report Download PDF
Federated Learning on RetinaMNIST with PID Client Filtering — image 1
Federated Learning on RetinaMNIST with PID Client Filtering — image 2
Federated Learning on RetinaMNIST with PID Client Filtering — image 3

Overview

Diabetic retinopathy (DR) is a leading cause of blindness, yet the medical data needed to train classification models is subject to strict privacy regulations — centralized collection is often impossible. This project implements a federated learning (FL) pipeline using the RetinaMNIST dataset, where each simulated client (hospital or clinic) trains locally and shares only model updates — not patient images — with a central server running FedAvg aggregation.

The core research question: what happens when some of those clients are actively trying to sabotage the global model?

The Attack: Label Flipping

Eight of twenty clients were randomly designated as adversarial and had their training labels flipped at varying rates (10%, 25%, 50%, 75%, 100%). Even at high flip rates, the standard FL setup showed surprising resilience — average accuracy stabilized around 76–82% — but the poisoned clients were clearly identifiable through per-client accuracy plots, and nothing in standard FedAvg acted on that signal.

The Defense: PID Anomaly Detection

A PID controller monitors each client’s update behavior across rounds. Clients whose updates deviate from the running expected pattern (high proportional error, sustained integral drift) are flagged and excluded from the FedAvg aggregation for that round.

Results after adding PID filtering:

  • Loss curves became smoother and dropped in a nearly linear pattern vs. noisy curves in undefended FL
  • Accuracy improved measurably across all attack severities
  • At Flip-50, the PID controller was most effective — filtering out exactly the right clients while keeping clean ones, producing the best accuracy of any attack scenario

Key Findings

The system showed that a lightweight control-theory-based filter can meaningfully improve FL robustness without requiring cryptographic overhead or trusted execution environments. The unexpected peak performance at the 50% flip rate suggests the PID controller hits a sweet spot where corruption is detectable but not so universal that it overwhelms the anomaly signal.

Preprocessing

RetinaMNIST images with white backgrounds were removed and remaining images were augmented (flips, rotations, brightness jitter) to create a more robust, balanced local dataset for each simulated client.