ETD

• Adversarial Machine Learning
• Artificial Intelligence
• Attacks in FederatedLearning
• Defenses in FederatedLearning
• Federated Learning
• Fuzzy Regression Trees
• Machine Learning

In recent years, Artificial Intelligence (AI) has transformed industrial operations across healthcare, finance, security and Internet of Things (IoT). However, its adoption remains cautious in high-stakes sectors, particularly in domains that handle sensitive or private data. As a result, industries handling privacy-sensitive data require a system that produces predictions that are transparent and trustworthy.
In this context, transparency refers the extent to which the internal functioning of
a model can be examined and its decisions interpreted. It involves the ability to trace how inputs are processed and to provide explanations that are meaningful to human stakeholders. Trustworthiness, in turn, encompasses a broader set of requirements in artificial intelligence systems, including fairness, interpretability, robustness, explainability, safety and security. An AI system is therefore considered trustworthy not only when it achieves strong predictive performance but also when its behaviour remains consistent, its outputs can be justified, and sensitive information is adequately protected.
Federated Learning (FL) decentralizes the training process, allowing multiple data
owners to collaboratively build a shared model without exchanging raw data. Data
privacy is preserved, as raw data never leaves the source. However, the distributed
nature of federated learning introduces unique security vulnerabilities. Because training is performed across multiple clients, any adversarial behaviour poses a significant risk to the global model. Malicious participants can perform poisoning attacks by injecting corrupted data or manipulate statistics, leading to a degradation in the performance of the global model.
In this work, we investigate the security of a Fuzzy Regression Tree (FRT) model
learned in a federated fashion under data poisoning attacks. The model enhances transparency and trustworthiness and is inherently interpretable by design, by using rule-based predictions. We perform systematic experimental evaluation by analyzing how the performance of the global model changes in the presence of adversarial participants.
Due to the interpretable nature of the model, we also analyze how the structure of the model changes. Unlike black-box models also referred to as "opaque", the FRT encodes knowledge in the form of hierarchical decision paths that can be directly translated into human-readable rules. Structural properties such as tree depth, path length, and number of nodes correspond to changes in how the model partitions the input space and formulates its predictions. Changes in these properties provide insight into the reasoning process of the model.
Our study accounts for realistic federated settings using two widely adopted regression datasets: California Housing dataset and Parkinson Disease dataset, by incorporating data heterogeneity among participants. This includes data with skewed distributions in both data quantity and feature space. In the presence of attacks and heterogeneity, the model’s structural analysis becomes particularly relevant, as it allows assessment of not only performance degradation but also the extent to which interpretability is affected.
Existing literature predominantly focuses on classification tasks. Regression tasks remain comparatively underexplored in federated learning, particularly when considered in conjunction with interpretability and data heterogeneity. By focusing on fuzzy regression trees, this study addresses this gap and investigates how these factors interact under adversarial conditions, extending the analysis beyond the largely studied classification oriented work.
To mitigate these threats, we propose a trimmed aggregation mechanism, which is a variation of "Trimmed Mean". In general, trimming is a robust statistical technique in which extreme values are removed before aggregation, with the goal of reducing the influence of outliers. This concept is applied to participants’ updates, where a fraction of the most extreme contributions is discarded prior to aggregation. We evaluate the effectiveness of this defense by comparing the model performance and structure under attack with and without the proposed defense mechanism.
The observed results indicate that the presence of malicious participants can lead to a severe degradation in model performance. This effect became particularly evident as the number of malicious participants increased. The model’s interpretability, measured through tree complexity and structure, severely deteriorates under the implemented attacks, with the tree becoming increasingly irregular and less linguistically coherent.
The results of this analysis expose the vulnerabilities in explainable federated regression models, providing a foundation for systematic design and development of appropriate countermeasures.