FLVaccin: Unbalanced Hierarchical Federated Learning with Vaccination-Calibrated Adaptive Quarantine for Robust Poisoning Defense

Abstract

Federated learning (FL) enables collaborative training without centralizing raw data, yet malicious clients can poison local data or updates and degrade the global model. We present FLVaccin, a hierarchical framework on an unbalanced tree in which every non-root node aggregates and hosts local clients—to our knowledge, the first design not confining all clients to the deepest level; only the root aggregates with zero local clients. All experiments use personalized federated learning (FedPer): shared feature layers are federated bottom-up, while each client keeps a private classifier head. FLVaccin combines two defenses: (i) node-level vaccination, mixing CIFAR-100 images into CIFAR-10 shards, and (ii) depth- and round-adaptive quarantine, whose per-client tolerances are set from vaccination mean-accuracy calibration (30 single-round trials across injection-intensity bands); clients exceeding allowed metric swings are temporarily excluded, while the root rejects global backbone updates with deteriorating validation trends. Implemented with MobileNetV2/FedPer and Dirichlet Non-IID partitioning (α = 0.5), 100 clients federate across 25 nodes over four levels. Without defense, 130 attacks collapse test accuracy from 77.4% to 21.0%; with our defense mechanism, 535 attacks yield 77.3% (k-fold 76.5%±0.4%), within 2.6 percentage points of the clean baseline (96.8% of clean accuracy), showing practical tree-aware robustness while preserving privacy.