Research map / Federated learning and privacy / Privacy attacks and secure learning
Competitive Advantage Attacks to Decentralized Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SelfishAttack, an insider attack in which selfish clients send crafted shared models to non-selfish clients in decentralized federated learning so that the selfish clients' final models are more accurate than non-selfish ones.
Problem
Decentralized federated learning is vulnerable to insider collusion: selfish clients may manipulate the models they share so that their own final local models outperform those of non-selfish clients, while still benefiting from DFL.
Approach
Formulate crafting of shared models as an optimization balancing staying close to the target's pre-aggregation model (utility) against pushing its post-aggregation model away from the no-attack aggregate (competitive advantage); derive closed-form shared models for FedAvg, Median and Trimmed-mean and transfer them to other rules.
Key results
- On CIFAR-10 with FedAvg, SelfishAttack achieves a Gap of 0.150 (MTAS 0.475 vs MTANS 0.326), versus 0.043 for TrimAttack and 0.008 for GaussianAttack.
- On CIFAR-10 under Median and Trimmed-mean, SelfishAttack reaches Gaps of 0.119 and 0.113, while TrimAttack and GaussianAttack give near-zero gaps.
- Attacks transferred to Krum, FLTrust, FLDetector, RFA and FLAME yield gaps of 0.069 to 0.189.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SelfishAttack instead of the strongest poisoning baseline | DFL with FedAvg, Median, or Trimmed-mean · CIFAR-10, FEMNIST, and Sent140 | Gap: CIFAR-10: 0.043 -> 0.150 (FedAvg), 0.011 -> 0.119 (Median), 0.016 -> 0.113 (Trimmed-mean); FEMNIST: 0.001 -> 0.123 (FedA | Helped |
| Use SelfishAttack against Krum | DFL · Krum | Gap: 0.189 | Helped |
| Use SelfishAttack against FLTrust | DFL · FLTrust | Gap: 0.069 | Helped |
| Use SelfishAttack against FLDetector | DFL · FLDetector | Gap: 0.118 | Helped |
| Use SelfishAttack against RFA | DFL · RFA | Gap: 0.151 | Helped |
| Use SelfishAttack against FLAME | DFL · FLAME | Gap: 0.105 | Helped |
| Increase λ from 0.5 to 1.0 (ablation) | SelfishAttack with Trimmed-mean · CIFAR-10 | Gap: 6.2% -> 11.3% | Helped |
| Increase λ beyond the effective threshold (ablation) | SelfishAttack with Median or Trimmed-mean · CIFAR-10 | Gap | Hurt |
| Increase the non-IID level (ablation) | SelfishAttack · CIFAR-10, FedAvg | Gap: 7.2% | Mixed |
| Increase the fraction of selfish clients (ablation) | SelfishAttack with Median or Trimmed-mean · CIFAR-10 | Gap | Helped |
| Aggregate only selfish clients' models instead of all clients' models (ablation) | SelfishAttack · CIFAR-10, Trimmed-mean for non-selfish clients | Gap: 0.113 -> 0.057 | Hurt |
| Aggregate all clients' models instead of only selfish clients' models (ablation) | SelfishAttack · CIFAR-10, Trimmed-mean for non-selfish clients | MTAS: 0.540 -> 0.597 | Helped |
Surprising findings
- Under FedAvg, SelfishAttack's selfish-client MTAS on CIFAR-10 (0.475) is below the Two Coalitions baseline (0.505), so the utility goal is not met there.
- Aggregating only selfish clients' models gives TrimAttack a larger gap (0.100) than aggregating all models, while SelfishAttack performs best when aggregating all shared models.
Limitations
- Optimality is not established for non-coordinate-wise rules such as Krum and FLAME; transferred attacks may be suboptimal.
- Requires selfish clients to know the aggregation rule and receive all non-selfish pre-aggregation models.
- Evaluated only with small CNN/LSTM models on three datasets with 20 clients.
Experimental setup
Datasets: CIFAR-10 FEMNIST Sent140
Benchmarks: CIFAR-10 FEMNIST Sent140
Metrics: mean test accuracy of selfish clients (MTAS) mean test accuracy of non-selfish clients (MTANS) Gap
Baselines: Independent Two Coalitions TrimAttack GaussianAttack
Builds on: TrimAttack FedAvg Krum FLTrust FLAME
Closest papers by meaning
- Byzantine-robust Decentralized Federated Learning via Dual-domain Clustering and Trust Bootstrapping (CVPR 2024 · similarity 0.88)
- Decentralized Sporadic Federated Learning: A Unified Algorithmic Framework with Convergence Guarantees (ICLR 2025 · similarity 0.87)
- FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.87)
- Overcoming Data and Model heterogeneities in Decentralized Federated Learning via Synthetic Anchors (ICML 2024 · similarity 0.87)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.86)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.