  Targeted model poisoning attacks pose a significant threat to federated
learning systems. Recent studies show that edge-case targeted attacks, which
target a small fraction of the input space are nearly impossible to counter
using existing fixed defense strategies. In this paper, we strive to design a
learned-defense strategy against such attacks, using a small defense dataset.
The defense dataset can be collected by the central authority of the federated
learning task, and should contain a mix of poisoned and clean examples. The
proposed framework, LearnDefend, estimates the probability of a client update
being malicious. The examples in defense dataset need not be pre-marked as
poisoned or clean. We also learn a poisoned data detector model which can be
used to mark each example in the defense dataset as clean or poisoned. We
estimate the poisoned data detector and the client importance models in a
coupled optimization approach. Our experiments demonstrate that LearnDefend is
capable of defending against state-of-the-art attacks where existing fixed
defense strategies fail. We also show that LearnDefend is robust to size and
noise in the marking of clean examples in the defense dataset.
