WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning

The gist The WaSA framework proposes a fully unsupervised, offline framework for malicious client detection in Federated Learning by training a denoising autoencoder on clean spectral prototypes to score clients based on their deviation from the learned benign manifold.

Methodology Overview

WaSA operates in two distinct phases: an offline phase and a subsequent online evaluation phase The server approximates the compact manifold of benign client data by minimizing a denoising empirical risk objective over synthetic WST embeddings derived from an auxiliary dataset Before the federated training starts, clients perform a locally optimal rank-reduced projection of their data, transforming it via wavelet scattering operator The server subsequently evaluates these representations by computing their reconstruction error, which formally quantifies their structural deviation from the expected benign distribution

Client-Side Representation and Transformation

The client-side process involves generating a privacy-preserving summary of the local data using spectral prototypes This prototype is constructed as the variance-weighted superposition of the empirical principal directions derived from a rank-reduced SVD To ensure stability against local geometric deformations, this prototype is projected through a Wavelet Scattering Transform The final client embedding zk is formed by vectorizing the first-order scattering coefficients of the transform

Offline Manifold Learning

The core of the offline detection is a fully unsupervised denoising autoencoder This autoencoder is trained exclusively on clean spectral prototypes derived from an auxiliary dataset The network's encoder compresses the WST embedding into a strict bottleneck, compelling it to learn only the intrinsic low-dimensional manifold of benign representations Training minimizes the expected empirical reconstruction error over noise-corrupted batches

Client Evaluation and Filtering

Prior to FL communication, clients transmit their embeddings zk to the server for evaluation The server computes the scale-free normalized anomaly score Ek using the formula Ek = zk − fϕ(zk) squared / (2d · Lfinal) Embeddings mapping near the learned benign manifold yield Ek ≲ 1, while anomalous embeddings yield Ek ≫ 1 WaSA utilizes these scores to govern participation via two strategies: Deterministic Thresholding, where clients with Ek ≤ τ are verified participants, or Boltzmann Sampling, which assigns a selection probability πk = exp(-Ek/T) / P

Experimental Validation and Performance

Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios demonstrate consistent improvements over supervised baselines The WaSA-WST backbone yields a clear spectral separation between benign clients and all four corruption types, including structurally subtle attacks like Gaussian blur The Boltzmann sampling strategy recovers near-oracle sampling behavior without ground-truth labels when the clean client pool is small WaSA outperforms both WAFFLE-FT and WAFFLE-WST on every metric in the client detection evaluation The model achieves 98.8% F1 and 100% recall on CIFAR-10 under the 60% corruption scenario using WaSA-Boltz with T = 0.5

Conclusion

WaSA advances offline FL defense from a supervised, threat-specific paradigm to a fully unsupervised, attack-agnostic one by grounding client screening in the geometry of a learned benign WST manifold This design choice enables generalization to unseen and composite corruptions without retraining The Boltzmann sampling strategy further decouples defensive filtering from hard exclusion, gracefully sustaining convergence when the clean client pool is critically small This work presents WaSA, the first unsupervised offline detector for FL. The contributions advance offline FL defense from a supervised, threat-specific paradigm to a fully unsupervised, attack-agnostic one

ACKNOWLEDGMENT A.L. is a member of GNFM-INdAM and was supported by the PNRR-NGEU project of the Italian MUR (DM 117/2023), and thanks Prof. Lamberto Rondoni for valuable discussions

REFERENCES [1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics, pp. 1273–1282, PMLR, 2017.[3] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith, “Federated optimization in heterogeneous networks,” Proceedings of Machine learning and systems, vol. 2020., pp. 429–450.[8] D. Goswami, S. Magistri, K. Wang, B. Twardowski, A. D. Bagdanov, and J. van de Weijer, “Covariances for free: Exploiting mean distributions for training-free federated learning,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.[9] A. Licciardi, D. Leo, and D. Carbone, “Wavelet scattering transform and fourier representation for offline detection of malicious clients in federated learning,” IEEE Internet of Things Journal, 2026.[10] S. Mallat, “Group invariant scattering,” Communications on Pure and Applied Mathematics, vol. 65, no. 10, pp. 1331–1398, 2012.[14] C. Eckart and G. Young, “The approximation of one matrix by another of lower rank,” Psychometrika, vol. 1, no. 3, pp. 211–218, 1936.[15] G. Golub and W. Kahan, “Calculating the singular values and pseudoinverse of a matrix,” Journal of the Society for Industrial and Applied Mathematics, Series B: Numerical Analysis, vol. 2, no. 2, pp. 205–224, 1965.[16] J. Bruna and S. Mallat, “Invariant scattering convolution networks,” IEEE transactions on pattern analysis and machine intelligence, vol. 35, no. 8, pp. 1872–1886, 2013.[17] P. Vincent, H. Larochelle, I. Lajoie, Y. Bengio, P.-A. Manzagol, and L. Bottou, “Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion.,” Journal of machine learning research, vol 11, no 12, 2010.[18] G. Strang, Linear algebra and its applications. Belmont, CA: Thomson, Brooks/Cole, 2006.[19] G. Gallavotti, Statistical mechanics: A short treatise. Springer Science & Business Media, 2013.[27] M. Andreux et al., “Kymatio: Scattering transforms in python,” Journal of Machine Learning Research, vol 21, no 60, pp 1–6, 2020. [24] M. Fang et al., “Local model poisoning attacks to Byzantine-Robust federated learning,” in 29th USENIX security symposium (USENIX Security 20), pp. 1605–1622, 2020.[31] Y. LeCun, “The mnist database of handwritten digits,” http://yann. lecun.com/exdb/mnist/, 1998.[32] A. Krizhevsky, G. Hinton, et al., “Cifar-10 (canadian institute for advanced research),” [2610.13186] A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009.[33] A. Krizhevsky, G. Hinton, et al.

1. No prior attack labels are required for client detection, as WaSA train[s] a denoising autoencoder exclusively on clean spectral prototypes derived from an auxiliary dataset. This enables the system to be attack-agnostic, generalizing to novel corruptions without needing retraining when threat models shift.

2. The system implements a mechanism that smoothly interpolates between hard exclusion and standard aggregation through a Boltzmann sampling strategy, allowing the server to gracefully sustain convergence when the clean client pool is critically small.

3. The detection framework provides a clear geometric boundary for benign behavior, as anomalous embeddings that deviate from this manifold cannot be accurately reconstructed from the latent space, thereby exposing malicious clients via a normalized reconstruction error Ek.

Federated Learning (FL) enables collaborative model training without exposing raw data, yet remains vulnerable to malicious clients injecting poisoned datasets. Existing defenses are typically reactive (operating during training) or supervised (requiring prior knowledge of attack types) - assumptions that rarely hold in open-ended IoT deployments. We propose WaSA, a fully unsupervised, offline framework for malicious client detection. Before training, each client transmits a single, privacy-preserving spectral summary of its data to the server. A denoising autoencoder, trained solely on clean auxiliary data, scores clients based on their deviation from the learned benign manifold, identifying corruptions regardless of the attack type. WaSA requires no attack labels, generalizes to unseen anomalies, and introduces a Boltzmann sampling strategy for client selection that smoothly interpolates between hard exclusion and standard aggregation. Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios (up to 90 % malicious clients) demonstrate consistent improvements over supervised baselines and robust aggregation methods, with negligible communication overhead. Code is available at https://github.com/alelicciardi99/wavelet autoencoders malicious.