Research map / Federated learning and privacy / Privacy attacks and secure learning

Adversarial Attacks on Federated-Learned Adaptive Bitrate Algorithms

AAAI 2024 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MAFL, a two-stage model-poisoning attack that backdoors a federated-learned DRL ABR model to degrade QoE on one target client while preserving benign clients.

Problem

Federated learning for DRL-based adaptive bitrate video streaming is vulnerable to model poisoning; the attacker must degrade performance on a single target client without harming benign clients, under secure aggregation.

Approach

Combines lifelong learning (LwF) with imitation learning to train a malicious model that moves away from a target-environment model and stays close to the global model, uses classifier- and entropy/disagreement-based state selection to limit attacks to target-like states, and then scales the malicious update to survive FL averaging (model replacement).

Key results

• In Case #1, target client rebuffering time rose from 1.27s to 7.81s per minute (over 5x) while benign clients' QoE stayed about 21.80 vs 22.06 before attack.
• In Case #2, target client rebuffering increased from 3.08s to 6.34s per minute (over 2x) while benign QoE stayed near 0.95 vs 0.96.
• State classifier precision reached 0.941 in Case #1 and 0.821 in Case #2 (0.972 and 0.953 with p>0.7).

Measured effects reported in the paper

Surprising findings

• Attack succeeds more clearly when target and benign network distributions differ; overlapping cellular environments (Case #2) make precise targeting harder.

Limitations

• Assumes secure aggregation and that the attacker knows the target client's environment dynamics (BWmax, BWmin, interval).
• Attack effectiveness drops when target and benign environments overlap (Case #2 classifier precision 0.82).
• Evaluated only in simulation with two attack cases; defenses not studied.

Experimental setup

Datasets: Puffer HSDPA 4K video dataset (Quinlan and Sreenan 2018)

Benchmarks: Puffer network traces HSDPA network traces

Metrics: QoE bitrate rebuffering penalty smoothness

Baselines: Benign FL-based ABR model (no attack)

Builds on: Learning without Forgetting PPO Model replacement (Bagdasaryan et al.) Genet Pensieve-style ABR state space

Closest papers by meaning

• Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.83)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.83)
• FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.83)
• Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.83)
• Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Bandit (ICLR 2024 · similarity 0.83)
• Competitive Advantage Attacks to Decentralized Federated Learning (NeurIPS 2025 · similarity 0.83)