- Feature Paper
- Article
Federated learning has emerged as a privacy-preserving paradigm that collaboratively trains a model without sharing raw data. However, federated learning remains highly vulnerable to abnormal or malicious participants. Differential privacy techniques are widely adopted to safeguard client data during federated optimization, but the added privacy noise makes it harder to detect such malicious behaviors. Existing malicious client detection techniques make the implicit assumption that behavioral signals are still identifiable. However, these signals are distorted by differential privacy, the very mechanism that protects client information, making it harder to identify between benign and malicious clients. Because of this, enhancing privacy often reduces attack detection effectiveness, a problem that is still mostly unsolved. We present a new privacy-preserving temporal multi-relational graph learning framework, which improves the ability to detect malicious clients in the differentially private setting. By taking into account the temporal and relational dependency structures of clients through the communication rounds, our framework minimizes the dependence on single behavioral information that is distorted due to privacy noise. In addition, exponential moving average smoothing and persistence-based temporal voting are introduced to ensure detector stability and minimize potential false positives due to privacy-induced perturbations. The proposed framework is comprehensively evaluated on three benchmark datasets, namely, FashionMNIST, CSE-CIC-IDS2018, and CIC-IoT2023, under both IID and non-IID data distributions across diverse adversarial scenarios, including label-flip, backdoor, gradient-lie, free-rider, and Sybil attacks. Experimental evaluation, supported by privacy-budget analysis, component-wise ablation studies, and comparisons with representative robust aggregation methods and recent malicious client detection baselines, demonstrates that the proposed approach consistently achieves a better balance among malicious client detection accuracy, attack mitigation, global model utility, and privacy preservation. On CIC-IoT2023, under the non-IID gradient-lie attack, the detector achieved a detection accuracy of and a recall of at a composed privacy budget of approximately , demonstrating that malicious client detection can be retained while providing stronger privacy protection. In addition to improving detection performance, the proposed work quantitatively assesses the degradation of malicious client separability caused by increased differential privacy and shows that temporal relational modeling significantly mitigates this effect.
8 November 2026
