Paper deep dive
Enhanced Detective: A Dual-Stage Proactive Defense Against Internal Poisoning Attacks in Financial Fraud Detection Using Federated Learning
Maria-Ioana-Andrea Ivan, Orhan Ermis, Ruxandra F. Olimid
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:With recent developments in Artificial Intelligence (AI), the adoption of distributed learning paradigms such as Federated Learning (FL) has emerged. In simple terms, FL enables multiple entities to collaboratively train AI models without sharing local data. The FL paradigm is particularly valuable in privacy-sensitive settings, such as financial services, because it enables institutions to collaboratively improve fraud-detection models while keeping sensitive transaction data local. However, FL schemes are prone to security vulnerabilities, where malicious clients can poison local data or model updates and degrade the global model, and hence the performance of the resulting model might be affected. Therefore, in this work, we propose Enhanced Detective, a dual-stage robust aggregation strategy that combines Median Absolute Deviation (MAD), distance-based update filtering, and FedMedian aggregation. Experiments on an imbalanced credit card dataset evaluate targeted label-flipping and weight-scaling attacks over 50 communication rounds. With 40% malicious clients, Enhanced Detective achieves an AUPRC of 0.796 and a Recall of 0.847.
Tags
Links
- Source: https://arxiv.org/abs/2610.17523v1
- Canonical: https://arxiv.org/abs/2610.17523v1
Trouble viewing inline? Open PDF directly →
Full Text
37,190 characters extracted from source content.
Expand or collapse full text
Enhanced Detective: A Dual-Stage Proactive Defense Against Internal Poisoning Attacks in Financial Fraud Detection Using Federated Learning Maria-Ioana-Andrea Ivan * Orhan Ermis ** Ruxandra F. Olimid *,*** * Department of Computer Science, University of Bucharest (e-mail: maria-ioana.ivan@s.unibuc.ro, ruxandra.olimid@fmi.unibuc.ro) ** Luxembourg Institute of Science and Technology (LIST), Luxembourg (e-mail: orhan.ermis@list.lu) *** Research Institute of the University of Bucharest (ICUB), Bucharest, Romania With recent developments in Artificial Intelligence (AI), the adoption of distributed learning paradigms such as Federated Learning (FL) has emerged. In simple terms, FL enables multiple entities to collaboratively train Al models without sharing local data. The FL paradigm is particularly valuable in privacy-sensitive settings, such as financial services, because it enables institutions to collaboratively improve fraud-detection models while keeping sensitive transaction data local. However, FL schemes are prone to security vulnerabilities, where malicious clients can poison local data or model updates and degrade the global model, and hence the performance of the resulting model might be affected. Therefore, in this work, we propose Enhanced Detective, a dual-stage robust aggregation strategy that combines Median Absolute Deviation (MAD), distance-based update filtering, and FedMedian aggregation. Experiments on an imbalanced credit card dataset evaluate targeted label-flipping and weight-scaling attacks over 50 communication rounds. With 40% malicious clients, Enhanced Detective achieves an AUPRC of 0.796 and a Recall of 0.847. Keywords: Federated Learning, Fraud Detection, Poisoning Attack, Machine Learning, Financial Data 1. INTRODUCTION As the digitalization of banking services continues to grow and the attack surface widens, the application of Machine Learning (ML) algorithms in the financial domain to de- tect suspicious activity is becoming a necessity. In contrast to traditional systems that rely on strict rules, modern models that use automated learning can adaptively extract complex correlations from large amounts of data, making it harder for attackers to bypass the system. In the financial sector, dedicated laws and regulations such as the European Anti-Money Laundering Directives (AMLD) and the Payment Services Directive (PSD2) Commission (2024), as well as general requirements such as the GDPR Regulation (EU) 2016/679 (2016), prohibit the plain sharing of transactional data. In this context, Federated Learning (FL), a modern distributed learning approach that enables collaborative model training with- out the need for centralized training data, is particularly useful. FL reverses the traditional process, which brings the data to the model, and keeps sensitive data local by bringing the model to the data, sharing only the update of the model McMahan et al. (2017). The present work examines how FL systems used for fraud detection respond to internal poisoning attacks, attacks for which internals corrupt the training data or the models themselves. Passive strategies mainly restrict the impact of malicious updates by simply isolating or dropping certain updates. However, they still miss some Byzantine nodes and do not allow them to participate in the training process. To overcome the limitations of pas- sive robust aggregation methods, we propose a proactive defense strategy called Enhanced Detective. Our proposed method identifies malicious updates and then individually checks them, with the aim of dynamically reducing the impact of both extreme and more subtle malicious updates before performing the global anomaly detection process. Our contribution can be summarized as follows: • We propose Enhanced Detective, a novel proactive, dual-stage filtering mechanism for FL that mitigates internal poisoning attacks in financial fraud detection systems. • We define our dual-stage Enhanced Detective strategy as an improved version of a simpler initial Detective strategy that proved inadequate under high compro- mise rates. • We run comparative experiments on an imbalanced credit card fraud detection dataset across 50 commu- nication rounds and show that Enhanced Detective achieves an AUPRC of 0.796 and a Recall of 0.847 under a cyber stress level of 40%. The rest of the paper is organized as follows. Section 2 provides the background and places our work in relation to the existing literature. Section 3 gives the problem definition. Section 4 introduces our proposed solution. Section 5 presents the experimental results. Finally, the last section concludes. 2. BACKGROUND AND RELATED WORK In this section, we first present the state of the art analysis with respect to the fraud detection using ML techniques considering effectiveness of different performance metrics used for interpreting the outputs of fraud detection mod- els. Later, we will overview the robust aggregation ap- proaches in the literature. 2.1 Fraud Detection The application of ML algorithms in the financial domain, especially for the detection of suspicious transactions, has become increasingly important as banking services con- tinue to become more digital. In contrast to traditional systems, which are based on strict rules that can be easily bypassed, modern models based on automated learning have the ability to identify patterns in large datasets that are harder to bypass. For the classification of transactions, one of the most widely used feedforward neural network architectures is the Multi-Layer Perceptron (MLP) Good- fellow et al. (2016). The idea is therefore to use Rectified Linear Unit (ReLU) activation function since it helps the model converge faster during training, and the Sigmoid function is placed as the output layer of the neural net- work to produce a probability between 0 and 1, where 1 represents a fraudulent transaction, and 0 represents a legitimate one. The authors evaluated the resulting model using the Credit Card Fraud Detection dataset Machine Learning Group (2018). One of the challenges when working with fraud detection datasets is how greatly imbalanced they are. Usually, in these types of datasets, where the goal is to detect fraud, the fraudulent instances are represented by a very small proportion, around 0.2% or less Goodfellow et al. (2016). This high imbalance creates problems when training a model. Since most transactions are legitimate, the model can become biased towards the majority class. For instance, a model that classifies all transactions as legitimate could achieve an accuracy of 95%, while still missing almost all fraud cases. Such a model would therefore be useless from an operational point of view. To overcome the challenge of imbalanced datasets, a cen- tral metric used is Recall, or sensitivity, defined as the ratio of true positive predictions to the total number of actual positive instances Davis and Goadrich (2006). The maximisation of Recall can lead to the minimisation of false negative cases, but relying only on Recall can result in an uncontrolled rise of false alarms, which would neg- atively affect user experience. Therefore, the Area Under the Precision-Recall Curve (AUPRC) is also used to eval- uate the model's behaviour across all decision-making pro- cesses. In contrast to the Receiver Operating Characteris- tic (ROC) curve, which offers a more optimistic image of the imbalanced dataset, the Precision-Recall curve isolates the performance exclusively on the minority class Davis and Goadrich (2006). AUPRC measures the area under the curve while the classification threshold is changed from 0 to 1. A high AUPRC score demonstrates that the model manages to maintain high precision, meaning fewer false alarms, while also achieving high Recall and detecting most fraudulent transactions. 2.2 Robust Aggregation Schemes Although FL introduces privacy protection for the partici- pating clients' local data locally to some extent, the aggre- gation process can be manipulated by malicious client be- havior. For instance, poisoning attacks are used for manip- ulating either the local training data or the model updates transmitted by the clients to the aggregation server. Tolpe- gin et al. Tolpegin et al. (2020) presented data-poisoning attacks, where malicious clients modify their local class labels before training (data poisoning). Model-poisoning attacks, on the other hand, directly manipulate the client updates submitted to the aggregation server such as an attacker can scale its update to increase its influence on the resulting global model Karame et al. (2023). These studies demonstrate that the conventional averaging operation used by Federated Averaging (FedAvg) McMahan et al. (2017) can be vulnerable to manipulated model updates sent by clients. This motivates aggregation mechanisms that can limit the influence of anomalous client contribu- tions. To cope with the challenges of aggregation process, ro- bust aggregation techniques replace FedAvg by employing additional statistical analysis, which are less sensitive to extreme values. For instance, FedMedian calculates the median of the received updates independently for each model coordinate, whereas Trimmed Mean removes ex- treme coordinate values before averaging the remaining values Yin et al. (2018). These strategies reduce the in- fluence of outlying values but do not explicitly assess the consistency of each complete client update. Other robust aggregation strategies combine different forms of statistical analysis. Bulyan applies an existing Byzantine-resilient aggregation rule to construct a candidate set and then performs an additional coordinate-wise selection and av- eraging step El-Mhamdi et al. (2018). In contrast, Robust Federated Aggregation (RFA) uses the geometric median to aggregate complete client-update vectors, providing a multivariate alternative to coordinate-wise median aggre- gation Pillutla et al. (2022). FoolsGold addresses coor- dinated poisoning by comparing the similarity of clients' historical updates and reducing the influence of clients that exhibit highly similar behavior, as commonly observed in Sybil attacks Fung et al. (2020). These methods illustrate that robustness can be introduced through multi-stage ag- gregation, multivariate statistics, or client-behavior anal- ysis. However, coordinated Sybil attacks are outside the threat model considered in this work. Beyond individual aggregation algorithms, Ermis and Khadraoui Ermis and Khadraoui (2026) examined the broader problem of model-update trustworthiness in FL and proposed MultiTrust-FL, a multi-layered framework combining update anomaly detection, client reputation as- sessment, and defense mechanisms. That work provides a general framework for trustworthiness assurance, whereas the present study focuses on a concrete statistical filtering and aggregation strategy and evaluates it against targeted label-flipping and weight-scaling attacks in financial fraud detection. Additionally, update clipping mechanism can be used as an alternative approach to remove the influence of unusually large updates. It has also been employed together with filtering and robust aggregation mechanisms in FL Nguyen et al. (2022). Moreover, the median absolute deviation (MAD) provides a robust measure of statistical dispersion Leys et al. (2013), while Euclidean distance can be used to quantify the deviation of an update from a reference model Blanchard et al. (2017); Goodfellow et al. Existing approaches either limit the influence of extreme values at the coordinate level or assess the deviation of complete client updates. However, distance-based filtering performed directly on unbounded updates may be affected by some malicious client updates, e.g. if they are scaled higher or lower than the average. This limitation motivates Enhanced Detective, which combines robust coordinate processing, update-level screening, and robust aggregation within a unified strategy. 3. PROBLEM DEFINITION In this section, we formalize the problem studied with re- spect to the FL setting and the aggregation strategies used as baselines, specification of the threat model including the label-flipping and weight-scaling attacks considered and finally, the robust aggregation objective as limiting the influence of malicious client updates while preserving the predictive performance of the global fraud-detection 3.1 Federated Learning and Aggregation Strategies Federated Learning (FL) is a distributed learning paradigm that enables the training of a particular ML model with the involvement of distributed nodes McMahan et al. (2017). The generic FL architecture is as illustrated in Figure 1. The training process is coordinated by an aggregation server, which initializes a global model and distributes its parameters to the participating clients. Each client trains a local copy of the model using its private dataset and returns the resulting model parameters or updates to the server. The server combines the received contributions using an aggregation function and uses the result to update the global model. In Federated Averaging (FedAvg), the client models are aggregated through a weighted average, where each client's contribution is typically weighted ac- cording to the size of its local training dataset. This process is repeated over multiple communication rounds until a predefined convergence criterion or maximum number of rounds is reached. More formally, let S denote the aggregation server, C = C1, C2,...,Ck the set of K participating clients, and Aggregation Server Model Local Mode Local Database Client 1 Client 2 ocal Database Client K Fig. 1. Overview of a Federated Learning scheme. wt € Rd the global model at communication round t, where d denotes the number of model parameters. Then, the server distributes the current global model w to the participating clients. Each client Ci trains the received model using its local dataset and obtains a locally trained model w. The resulting model update is defined as Aw? = w - wt. The set of model updates received from the participating clients in round t is denoted by The aggregation server applies an aggregation function A to the received client updates to obtain the aggregated model updates as follows: Aw = A (AW'). The global model is subsequently updated as w t l = U + A w t . Therefore, A (AW) represents an aggregated model up- date rather than a complete global model. In Federated Averaging (FedAvg), the client updates are averaged according to the sizes of the clients' local datasets McMahan et al. (2017). Let ni denote the number of training samples held by client Ci, and let n = Lay ni The FedAvg aggregation function is defined as given Consequently, clients with larger local datasets have a greater contribution to the aggregated update. FedMedian instead computes the median of the client updates independently for each model coordinate Yin et al. (2018). For each coordinate j € 1,..., d, it is defined as [AredMedian (AW')] = median (A', Д ,..., wk) , t, denotes coordinate j of the update submitted by client C. By selecting the median coordinate value, FedMedian limits the influence of extreme individual val- ues on the aggregated update. Trimmed Mean is another coordinate-wise aggregation strategy Yin et al. (2018). For each coordinate j, let (1) denote the ordered coordinate values received from the K clients. Given a trimming parameter b satisfying 0 ≤ b < K/2, Trimmed Mean removes the b smallest and b largest values and averages the remaining values: L A T N ( A W 9 ) P = - 2 6 2 r = 6 + 1 (2) All the aggregation strategies, namely FedAvg, FedMe- dian, and Trimmed Mean defined in this section are there- fore different in how they combine the received client up- dates. FedAvg computes a dataset-size-weighted average, whereas FedMedian and Trimmed Mean use coordinate- wise statistical operations that reduce the influence of extreme coordinate values. These aggregation functions provide the baseline aggregation strategies considered in this work, while FedMedian is also employed as the final aggregation operation of the proposed Enhanced Detective 3.2 Threat Model In this section, we introduce the threat model for the FL schemes. First, we assume that the aggregation server, S, is honest and fully follows the aggregation protocol, while a subset of the participating clients may behave maliciously. Therefore, for the set of participating clients, C = C1, C2,...,Ck, in the FL scheme, we assume that CH and C correspond to the set of honest and malicious participants, respectively. We also assume that C = CHUCM and CH nCM = Ø conditions hold for our setting. Honest clients follow the prescribed local training procedure and submit their resulting updates to the aggregation server. Malicious clients may manipulate their local training data or the model updates submitted Let AW' = Aw1›...,AWk be the snapshot of model updates transmitted to the aggregation server at commu- nication round t, where Aw; denotes the update submitted by client i. For each honest client, Ci, the model update is defined as Aw¿ = Awi, where C¿ € CH. On the other hand, we define the update submitted by malicious clients according to the label flipping attack and weight-scaling Label-flipping attack. A malicious client manipulates its local training dataset before performing local training. In the considered fraud-detection task, the global model per- forms binary classification with class labels 0, 1, where O represents a legitimate transaction and 1 represents a fraudulent transaction. In the label-flipping attack, a ma- licious client changes the labels of fraudulent transactions from 1 to 0 before performing local training. Thus, let Di denote the original local dataset of a malicious client C; € CM, and let DIF denote the corresponding poisoned dataset in which the labels associated with fraudulent transactions are changed from 1 to 0. The submitted model update is then calculated as Aw; = LocalTrain (w', DIF) - w', CiE CM, (3) where LocalTrain (w, D) denotes the local training proce- dure initialized with w' and performed using dataset D. Weight-scaling attack. In this attack, a malicious client manipulates its locally computed model update before transmitting it to the aggregation server. Particularly, the client multiplies its update by a scaling factor, y > 1, as given in the following equation: УСіЄ См . (4) The scaling operation preserves the direction of the origi- nal update while increasing its magnitude, thereby increas- ing its influence on the aggregated global update. 3.3 Robust Aggregation Objective = AW1,...,AWk denote the set of client updates received by the aggregation server at round t. The objective is to construct a subset Cr C containing the clients whose updates are treated as trusted in that round. Based on the selected updates, the robust aggregated update is computed as follows: (5) where Arob denotes the robust aggregation function. The global model is subsequently updated as w o t t l = w + A w . (6) In the ideal setup, the robust aggregated update should remain as close as possible to the update that would be obtained using only the honest clients. Let this honest-only reference update be defined as AWCH = Arob (AW; | Ci ECHS) . (7) The aggregation error caused by malicious participation can then be expressed as e = I A w ' - A u e n l 2 ' (8) where || • ||½ denotes the Euclidean norm. Because the identities of the malicious clients and the honest-only reference update are not directly available to the aggregation server, &' cannot be evaluated during the aggregation process. The practical objective is therefore to limit the influence of suspicious updates while preserving the predictive performance of the global model. In the considered fraud-detection task, this performance is eval- uated using the Area Under the Precision-Recall Curve (AUPRC) and Recall. The central challenge is to construct a reliable trusted subset under different forms of malicious behavior. Large- magnitude updates produced by weight-scaling attacks can distort update-level distance measurements, whereas updates resulting from label-flipping attacks may exhibit less explicit deviations. A robust aggregation strategy should therefore limit the influence of both attack types without requiring prior knowledge of the malicious clients' 4. PROPOSED SOLUTION The proposed method Enhanced Detective not only iden- tifies the malicious updates but also checks each one using a mathematical verification consisting of two consecutive filtering stages, as detailed in Algorithm 1. The main objective is to dynamically reduce the impact of both extreme and more subtle malicious updates before per- forming global anomaly detection. Phase 1. In the first stage, all the updates received from all participating clients by the central server are processed coordinate by coordinate. For each parameter coordinate w; of the model, the algorithm computes the median value med' and the Median Absolute Deviation (MAD), denoted as mad' Leys et al. (2013): m a d ' = M e d i a n ( l u l - m e d ' l . . . / u k - m e d | ) ( 9 ) Based on these statistical values, the algorithm creates dynamic limits that are updated during each round of training Nguyen et al. (2022). A small constant is also added for numerical stability, namely ‹ = 10-5, and the limits are defined as: lower bound = med' - 5 • mad' - €(10) upper bound = med' + 5 • mad? + € (11) If a parameter goes outside the allowed range [lower bound, upper bound], it is moved back to the closest limit Nguyen et al. (2022). This reduces the impact of extreme values produced by model-poisoning attacks Karame et al. (2023) and prevents these abnormal updates from affecting subse- quent detection steps. Finally, the parameters are flattened into one single vector for each client, denoted as wi. Phase 2. The server then calculates a global median vector, denoted as Umed, which serves as a reference because it is less affected by extreme values. After that, the Euclidean distance between each client vector and the global median vector is calculated using the L2 norm Blanchard et al. (2017); Goodfellow et al. (2016). This distance is denoted as di and is calculated as: di = || ũ i - Umed||2, (12) where w; represents the sanitized weight vector of client i, Umed is the global median vector, and di represents the distance between the client update and the global median. This second stage is useful for detecting label-flipping attacks, since these attacks can produce updates with magnitude similar to those of honest clients and may therefore pass the initial coordinate-wise clipping step Tolpegin et al. (2020). Since suspicious updates are usually located farther from the main group of honest client updates, the algorithm ap- plies MAD to the calculated distances as a second filtering step. The server then calculates a dynamic threshold using the median distance and its MAD value Leys et al. (2013): threshold = max(meddist +3•maddist, 1.5•meddist), (13) where meddist represents the median of the calculated dis- tances and maddist represents their MAD. The threshold is set to the larger value between the MAD-based limit and 1.5 times the median distance. Phase 3. If a client's distance exceeds this threshold, its update is considered suspicious and is excluded from the Algorithm 1 Enhanced Detective Strategy: Dual-Stage Require: Client updates W = W1, W2, ..., WK from K clients Ensure: Aggregated global model wglobal 1: Phase 1: Coordinate-wise Clamping 2: Let € = 10- be a small constant for numerical stability 3: for each parameter coordinate j do medi + Median (wi, w?,..., wk) mad? + Median(|w] - med'|,..., |w - med' |) upper bound + med! + 5 • madi + € lower bound + med? - 5 • mad? - € for each client i € 1, ..., K do w? + Clip(w, lower bound, upper bound) 12: Flatten all sanitized updates into vectors W = w1,..., wk 13: Phase 2: Global Distance Filtering 14: Umed + Median (W) 15: for each client i € 1,..., K do 16: di + || wi - Umed||2 17: end for 18: meddist + Median(d1, ..., dk) 19: maddist + Median(|d1 - meddist|,..., |dk - meddist|) 20: threshold + max(meddist + 3 • maddist, 1.5 • meddist) 21: Phase 3: Robust Aggregation 22: Trusted + Ø 23: for each client i € 1,..., K do 24:if di < threshold then 25:Trusted + Trusted U w¿ 26:end if 27: end for 28: if Trusted is empty then 29:Trusted + W 30: end if 31: Wglobal + FedMedian(Trusted) 32: return Wglobal Algorithm 2 Initial Detective Strategy Require: Client updates W = W1, W2,..., WK from K clients Ensure: Aggregated global model global 1: Phase 1: Vector Flattening and Reference Cal- culation 2: for each client i € 1,.. 3: wi + Flatten(Wi) 5: Umed + Median(1, ..., wK) 6: Phase 2: Distance Calculation and Threshold- ing 7: for each client i € 1,..., K do d i ￩ I o i - U m e d 2 9: end for 10: meddist ‹ Median (1d1,..., dK j) 11: maddist Median(‹ d1 - meddist,..., dk - meddist ) 13 вони 1 12: threshold + max(meddist +3xmaddist, 1.5xmeddist) 13: Phase 3: Robust Aggregation - Same as in current communication round. The remaining trusted up- dates are then aggregated using the FedMedian strategy, helping to keep the global model stable when malicious updates are present Yin et al. (2018). To overcome the basic limitations of passive defenses, a simpler proposed proactive strategy, called Detective, was initially considered. This initial strategy relies on client isolation based on the Median Absolute Deviation Leys et al. (2013) and its two phases, which differ from those of the Enhanced Detective, are given in the algorithm. As discussed in the next section, Detective was a first version that led to the definition of the improved two-filtering- stage algorithm, Enhanced Detective. 5. EXPERIMENTAL RESULTS This section compares the performance of the federated network under several attack scenarios. The primary ob- jective is to demonstrate the drawbacks of conventional ag- gregation algorithms and to assess the performance of the proposed protection mechanisms. The research is based on measures related to the financial sector, such as AUPRC, Recall, and the Confusion Matrix Davis and Goadrich (2006). The findings are observed across 50 communication cycles to examine how the model's performance varies over time. The simulation environment was set up locally on a laptop with an AMD Radeon RX 7600S graphics card, 16 GB RAM and AMD Ryzen 9 7940HS CPU. 5.1 Baseline Performance and Vulnerability Analysis To establish a baseline reference point, initial tests evalu- ated the classic Federated Averaging algorithm in a com- pletely honest environment McMahan et al. (2017). After 50 communication rounds, the classical FedAvg algorithm achieves an AUPRC score of about 0.86 and a Recall score of about 0.85. These findings were close to those produced by the centralized model and, in some cases, even significantly better. This indicates that in the absence of malicious clients on the network, federated learning can achieve similar performance while keeping clients' data local. However, after the introduction of malicious clients, severe vulnerabilities were discovered. Under a data-poisoning attack, such as label flipping Tolpegin et al. (2020), where malicious nodes intentionally flip labels from 1 to 0, the Recall score of the FedAvg algorithm collapsed to roughly 0.23, failing to flag the majority of fraudulent transactions. Moreover, under a model-poisoning attack, namely Weight Scaling Karame et al. (2023), where attackers multiply their weights by an extreme factor, thereby attempting a Dos attack Nguyen et al. (2022), the system collapsed around round 10. 5.2 Evaluation of Passive Defenses To counteract the vulnerabilities found in the baseline algorithm, the conducted experiments evaluated the per- formance of two classical robust aggregation strategies, namely Federated Median and Trimmed Mean Yin et al. (2018); Blanchard et al. (2017). In the case of model- poisoning attacks, the FedMedian method showed very high resistance to severe weight scaling. This means that malicious clients sending extremely large values have little impact on the final aggregated model, as these values are viewed as outliers rather than updates that reflect the model Yin et al. (2018). Even at a compromise rate of 40%, FedMedian maintained the network stable, achieving a Recall score of approximately 0.78 and preventing the collapse of the network. In contrast, Trimmed Mean highlighted the problem of dependence in estimating the attack rate Yin et al. (2018). Configured to eliminate extreme values from the distribu- tion, this strategy functioned without problems under the 20% attack scenario. However, when the attack intensity increased to 40%, the algorithm mathematically failed. Since only a part of the malicious clients were removed, the remaining extreme vectors corrupted the final average, causing the system to collapse during the ninth communi- cation round. The label-flipping attack exposed a common weakness of the passive methods Tolpegin et al. (2020). Since compromised clients transmit weight changes that do not exhibit extreme anomalies but only direct the model towards incorrect decisions, the coordinate-wise filtering process becomes inefficient. Under a 40% attack scenario, Trimmed Mean showed a visible performance degradation, with the Recall score decreasing to approximately 0.50, the network failing to identify a significant number of fraudulent transactions. Although FedMedian performed better, maintaining a Recall score close to 0.70, it still registered a decrease in performance when compared to the ideal environment. The major conclusion of this evaluation stage is that passive defenses strictly treat the symptom of the problem by restricting the impact of malicious updates, while still allowing Byzantine nodes to participate in the training Defenses Against Data Poisoning (Label Flipping) 20% Attack Rate 40% Attack Rate (Theoretical Limits) 1 . 0 0 . 8 0 . 6 0 . 4 0 . 0 Baseline (Honest) Undefended FedAvg FedMedian TrimmedMean Detective (MAD) Enhanced Detective 2030 Round 50 Round Fig. 2. The defense methods' performance against data poisoning. Defenses Against Model Poisoning (100x Scaling Attack DoS Attack) 20% Attack Rate 40% Attack Rate (Theoretical Limits) 1 . 0 0 . 8 0 . 6 Recall 0 . 4 0 . 2 0 . 0 20 • Baseline (Honest) *- Undefended FedAvg (Crashed) FedMedian TrimmedMean Detective (MAD) Enhanced Detective 4010 •... Baseline (Honest) FedMedian TrimmedMean (Crashed) Detective (MAD) Enhanced Detective 30 Round 20 Round Fig. 3. The defense methods' performance against model poisoning. 5.3 Performance of the Proposed Proactive Defense To overcome the basic limitations of passive defenses, the experiments first evaluated the performance of an initially proposed proactive strategy, called Detective, based on client isolation using the Median Absolute Deviation Leys et al. (2013) and defined in the previous section. The comparison graphs in Figure 2 and Figure 3 show that the first version of the Detective strategy performed very well against label-flipping attacks Tolpegin et al. (2020). It worked better than the Trimmed Mean method when the attack rate was set to 20%. This means it was able to identify and isolate the malicious nodes that were sending false updates and leading the model to make incorrect predictions. However, the ultimate stress test, namely model-poisoning Karame et al. (2023) at a compromise rate of 40%, achieved through weight scaling by a factor of 100x, revealed a structural vulnerability. Although the algorithm managed to prevent the complete collapse of the network, surviving until the 50th communication round in comparison with Trimmed Mean, which failed during round 9, the global L2 geometric distances became so strongly distorted by the magnitude of the malicious vectors that the MAD mechanism became excessively sensitive, resulting in a final Recall score of only 0.25. The identification of this mathematical distortion led to the development of Enhanced Detective, which implements a dual filtering mechanism, as explained in the previ- ous section and depicted in Algorithm 1. The effect of this algorithmic optimization proved to be substantial, as demonstrated by the obtained visualizations. In the critical model-poisoning scenario at a compromise rate of 40%, while the other strategies degraded the detection performance, Enhanced Detective instantly neutralized the extreme scaling factor. The network protected by the new algorithm had a performance curve that almost exactly matched that of the ideal baseline environment. According to the final aggregated metrics, illustrated in Figure 4, the upgraded approach achieved an AUPRC of 0.796 and a Recall of 0.847 under a cyber stress level of 40%, correctly Architecture Final Performance (40% Model Poisoning) Onainal Detective:Enhanced Detective Fig. 4. The overall performance of the architecture. A. Baseline Honesication Breakdown (40% Model Poisoning) 0089720890 C. Original Detective D. Enhanced Detective (Dual Filter Fig. 5. Confusion Matrices comparing the final classi- fication performance under a 40% model-poisoning attack. classifying 83 fraudulent transactions while missing only 15, as detailed in the confusion matrix in Figure 5. 6. CONCLUSION We addressed FL's vulnerability to internal poisoning at- tacks in financial fraud detection and proposed Enhanced Detective, a proactive dual-stage filtering mechanism that isolates malicious updates prior to model aggregation. Our experimental evaluation on an imbalanced credit card fraud dataset across 50 communication rounds validated the efficacy of Enhanced Detective under extreme condi- tions (40% compromise rate), which is close to the ideal baseline environment, achieving an AUPRC of 0.796 and a Recall score of 0.847. Future work might include a concrete evaluation of scala- bility with respect to the number of clients, as the proposed solution introduces additional time and resource costs that might limit real-time financial transaction systems. Further, we have considered identical settings; analyzing different transaction data among institutions remains a subject of future investigation. Finally, future work could extend the evaluation of Enhanced Detective to more evolved attacks, including adaptive behaviors and time- varying scaling strategies. ACKNOWLEDGMENTS This work was supported by a grant of the Ministry of Research, Innovation and Digitalization, CNCS/CCCDI - UEFISCDI, project number ERANET-CHISTERA-IV- PATTERN, within PNCDI IV. This research was funded in part, by the Luxembourg National Research Fund (FNR), grant reference INTER/CHIST23/17931746. This work was mostly performed during M.I.A.Ivan MSc studies at the University of Bucharest. REFERENCES Blanchard, P. , El Mhamdi, E.M., Guerraoui, R., and Stainer, J. (2017). Machine learning with adversaries: Byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems (NIPS), 119- Commission, E. (2024). countering the financing of terrorism at EU level. https://finance.ec.europa.eu/financial-crime/ anti-money-laundering-and-countering-financing- terrorism-eu-level en. Last Accessed: August 2026. Davis, J. and Goadrich, M. (2006). The relationship be- tween precision-recall and roc curves. In Proceedings of the 23rd International Conference on Machine Learning (ICML), 233-240. El-Mhamdi, E.M., Guerraoui, R., and Rouault, S. The hidden vulnerability of distributed in Byzantium.In Proceedings 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Research, 3521-3530. PMLR. https://proceedings.mlr.press/v80/mhamdi18a.html. Ermis, O. and Khadraoui, D. (2026).Trustworthi- ness assurance for model updates in federated learn- In S. Ventura (ed.), Data Quality Matters - Best Practices for Integrity and Assurance. In- doi: 10.5772/intechopen.1013666. https://w.intechopen.com/chapters/1235771. Fung, C., Yo o n , C.J.M., and Beschastnikh, I. (2020). The limitations of federated learning in sybil settings. In 23rd International Symposium on Research in Intrusions and Defenses (RAID 2020), 301-316. USENIX Association, San Sebastian. https://w.usenix.org/conference/raid2020/ presentation/fung. Goodfellow, I., Bengio, Y. , and Courville, A. (2016). Deep Learning. MIT Press. Karame, G., Marson, G.A., and Moellering, H. (2023). Thwarting model poisoning in federated learning. US Patent 11,616,804 B2, assigneed to NEC Corporation. https://patents .google.com/patent/US11616804B2/ en. Last Accessed: August 2026. Leys, C., Ley, C., Klein, O., Bernard, P. , and Licata, L. (2013). Detecting outliers: Do not use standard devi- ation around the mean, use absolute deviation around the median. Journal of Experimental Social Psychology, 4 9 ( 4 ) , 7 6 4 - 7 6 6 . Machine Learning Group (201%/ Kaggle Credit Card FraudDetection Dataset. Datasets. https://w.kaggle.com/datasets/mlg-ulb/ creditcardfraud.