  Federated learning has become prevalent in medical diagnosis due to its
effectiveness in training a federated model among multiple health institutions
(i.e. Data Islands (DIs)). However, increasingly massive DI-level poisoning
attacks have shed light on a vulnerability in federated learning, which inject
poisoned data into certain DIs to corrupt the availability of the federated
model. Previous works on federated learning have been inadequate in ensuring
the privacy of DIs and the availability of the final federated model. In this
paper, we design a secure federated learning mechanism with multiple keys to
prevent DI-level poisoning attacks for medical diagnosis, called SFPA.
Concretely, SFPA provides privacy-preserving random forest-based federated
learning by using the multi-key secure computation, which guarantees the
confidentiality of DI-related information. Meanwhile, a secure defense strategy
over encrypted locally-submitted models is proposed to defense DI-level
poisoning attacks. Finally, our formal security analysis and empirical tests on
a public cloud platform demonstrate the security and efficiency of SFPA as well
as its capability of resisting DI-level poisoning attacks.
