AdRo-FL: Secure and Informed Client Selection for Federated Learning Under Adversarial Aggregator

Federated Learning (FL) enables distributed clients, from organizational silos to mobile devices, to collaboratively train a global model. While clients only share model updates, malicious aggregators can infer sensitive information from these updates. Secure Aggregation (SA) protects individual updates, but recent work demonstrates a critical vulnerability where adversarial aggregators manipulate client selection to bypass SA protections, constituting a Biased Selection Attack (BSA). Applying pseudorandom functions like verifiable random functions (VRFs) can mitigate BSA, but degrades model performance by precluding informed client selection. Hence, ensuring both informed and secure client selection is an open challenge. To address this, we propose Adversarial Robust Federated Learning (AdRo-FL), which enables: (1) informed client selection based on client utility, and (2) a robust defense against BSA. AdRo-FL implements two client selection frameworks for distinct FL settings. The first framework assumes clients are grouped into clusters managed by a trusted cluster head (e.g., different branches of an organization). The second framework handles distributed clients where no trust relationships exist. AdRo-FL further incorporates quantization to reduce communication overhead and enforces transmission deadlines to improve efficiency. Extensive experiments on MNIST, FMNIST, SVHN, and CIFAR-10 show that AdRo-FL converges up to 1.85× faster while delivering comparable or higher final accuracy than insecure baselines.