  Even though recent years have seen many attacks exposing severe
vulnerabilities in Federated Learning (FL), a holistic understanding of what
enables these attacks and how they can be mitigated effectively is still
lacking. In this work, we demystify the inner workings of existing (targeted)
attacks. We provide new insights into why these attacks are possible and why a
definitive solution to FL robustness is challenging. We show that the need for
ML algorithms to memorize tail data has significant implications for FL
integrity. This phenomenon has largely been studied in the context of privacy;
our analysis sheds light on its implications for ML integrity. We show that
certain classes of severe attacks can be mitigated effectively by enforcing
constraints such as norm bounds on clients' updates. We investigate how to
efficiently incorporate these constraints into secure FL protocols in the
single-server setting. Based on this, we propose RoFL, a new secure FL system
that extends secure aggregation with privacy-preserving input validation.
Specifically, RoFL can enforce constraints such as $L_2$ and $L_\infty$ bounds
on high-dimensional encrypted model updates.
