A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning

TL;DR

This paper proposes a Bayesian incentive mechanism that encourages honest participation in federated learning by making malicious behavior economically irrational, thereby improving robustness against data-poisoning attacks.

Contribution

It introduces a proactive, economic defense mechanism using Bayesian game theory to incentivize honest updates and resist poisoning attacks in federated learning.

Findings

Maintains 96.7% accuracy under 50% label-flipping attacks on MNIST.

Outperforms standard FedAvg by 51.7 percentage points under attack.

Is computationally lightweight and easily integrable into existing FL frameworks.

Abstract

Federated learning (FL) enables collaborative model training across decentralized clients while preserving data privacy. However, its open-participation nature exposes it to data-poisoning attacks, in which malicious actors submit corrupted model updates to degrade the global model. Existing defenses are often reactive, relying on statistical aggregation rules that can be computationally expensive and that typically assume an honest majority. This paper introduces a proactive, economic defense: a lightweight Bayesian incentive mechanism that makes malicious behavior economically irrational. Each training round is modeled as a Bayesian game of incomplete information in which the server, acting as the principal, uses a small, private validation dataset to verify update quality before issuing payments. The design satisfies Individual Rationality (IR) for benevolent clients, ensuring their participation is profitable, and Incentive Compatibility (IC), making poisoning an economically dominated strategy. Extensive experiments on non-IID partitions of MNIST and FashionMNIST demonstrate robustness: with 50% label-flipping adversaries on MNIST, the mechanism maintains 96.7% accuracy, only 0.3 percentage points lower than in a scenario with 30% label-flipping adversaries. This outcome is 51.7 percentage points better than standard FedAvg, which collapses under the same 50% attack. The mechanism is computationally light, budget-bounded, and readily integrates into existing FL frameworks, offering a practical route to economically robust and sustainable FL ecosystems.