  Current defense mechanisms against model poisoning attacks in federated
learning (FL) systems have proven effective up to a certain threshold of
malicious clients. In this work, we introduce FLANDERS, a novel pre-aggregation
filter for FL resilient to large-scale model poisoning attacks, i.e., when
malicious clients far exceed legitimate participants. FLANDERS treats the
sequence of local models sent by clients in each FL round as a matrix-valued
time series. Then, it identifies malicious client updates as outliers in this
time series by comparing actual observations with estimates generated by a
matrix autoregressive forecasting model maintained by the server. Experiments
conducted in several non-iid FL setups show that FLANDERS significantly
improves robustness across a wide spectrum of attacks when paired with standard
and robust existing aggregation methods.
