VGPD-FL: Group-level poisoning detection without trusted datasets for secure aggregation

Secure aggregation protects the confidentiality of individual client updates in federated learning, but makes poisoning detection more difficult because the per-client statistics used by classical defenses are hidden. Existing approaches face a dilemma: input-validation schemes such as Aion (USENIX Security’25) expose per-client masked-norm values to validate client updates for poisoning detection, introducing a privacy leakage risk; the group-level pathway exemplified by ClusterGuard (IEEE TDSC’26) keeps updates fully masked, but its dual-threshold detection relies on a trusted reference dataset. This paper presents VGPD-FL, which detects poisoning over recovered group averages without exposing individual client updates, using a trusted-dataset-free robust baseline over group norms. A committee-anchored verifiable grouping mechanism ensures that the group-level detection input cannot be manipulated by the server. We characterize the operating boundary of this approach, explaining when the robust group-level filtering remains effective. Experiments on FMNIST, CIFAR10, and EMNIST under model replacement, distributed backdoor, and label-flipping attacks show that VGPD-FL achieves poisoning defense, convergence, and runtime comparable to Aion in the target operating region, with total communication on par and dimension-independent committee messaging that stays at least two orders of magnitude below Aion’s model-commitment traffic at ResNet-scale model sizes.