Research map / Federated learning and privacy / Privacy attacks and secure learning

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency

CVPR 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 28 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PoisonedFL, a model poisoning attack on federated learning that enforces a fixed random sign vector across rounds (multi-round consistency) and adaptively scales magnitudes, requiring no genuine-client knowledge or defense knowledge.

Problem

Existing model poisoning attacks on federated learning are weak when defenses are deployed, and many require knowledge of genuine clients' model updates or local training data.

Approach

Existing attacks only enforce in-round consistency, so their updates self-cancel across rounds. PoisonedFL uses a fixed random sign vector shared across all rounds, sets the magnitude vector by estimating genuine updates from the previous round, and adapts the scaling factor with a binomial hypothesis test on whether past attacks succeeded.

Key results

• PoisonedFL increases testing error rate by 15.84 to 90.67 across five datasets and nine FL methods, making the global model nearly random guessing in 29 of 45 cases.
• PoisonedFL outperforms existing attacks in 32 of 40 cases against eight defenses, with gaps from 2.11 to 84.33.
• With only 5% fake clients, PoisonedFL breaks all defenses except Multi-Krum and FLAME.

Measured effects reported in the paper

Surprising findings

• Existing attacks' in-round consistency makes their effects self-cancel across rounds, so stronger per-round attacks do not translate into a larger final error.
• Existing attacks are less effective at low non-IID degree because genuine updates are less diverse, leaving less room to craft malicious updates.

Limitations

• Evaluated mainly in cross-device FL with fake clients; cross-silo FL is a stated limitation.
• Relies on the assumption that the attacker can observe global models each round and knows the number of dimensions and fake clients' updates.
• Hyperparameters (c0, e, beta) were set by the authors and the magnitude floor of 0.5 is a heuristic.

Experimental setup

Datasets: MNIST FashionMNIST Purchase CIFAR-10 FEMNIST

Benchmarks: MNIST FashionMNIST Purchase CIFAR-10 FEMNIST

Metrics: testing error rate

Baselines: Fang Opt. Fang LIE Min-Max Min-Sum Random MPAF

Builds on: FedAvg MPAF Fang attack FLDetector

Closest papers by meaning

• FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.93)
• Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning (NeurIPS 2025 · similarity 0.92)
• Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.89)
• Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.89)
• Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · similarity 0.87)
• RFLPA: A Robust Federated Learning Framework against Poisoning Attacks with Secure Aggregation (NeurIPS 2024 · similarity 0.87)