Research map / Federated learning and privacy / Privacy attacks and secure learning

Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning

NeurIPS 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FLForensics, a poison-forensics method that, given a misclassified target input after deployment, traces back malicious FL clients by clustering two-dimensional influence scores (target vs. synthetic non-target input) with HDBSCAN.

Problem

Poisoning attacks in federated learning cause a deployed global model to misclassify attacker-chosen target inputs; training-phase defenses fail under highly non-iid data or many malicious clients, so the malicious clients responsible must be traced back after deployment.

Approach

Attribute the loss change of a misclassified target input to each client's updates across checkpoint rounds via a Taylor-expansion influence score, add a second influence score on a non-target input to separate malicious clients from benign clients that hold many target-label examples, then cluster the 2-D scores with HDBSCAN using scaled Euclidean distance and flag clusters/outliers with low gap

Key results

• FLForensics achieves DACC 1.000 with FPR 0 and FNR 0 on CIFAR-10 under Scaling and ALIE attacks, and 0.980/0.000/0.100 under Edge attack.
• FLDetector reaches only DACC 0.000-0.160 on CIFAR-10 under ALIE and Edge attacks, showing training-phase detection fails in these settings.
• FLForensics-A (target input only) mislabels more than 10% of benign clients on CIFAR-10, while full FLForensics reduces FPR to 0.

Measured effects reported in the paper

Surprising findings

• Training-phase defense FLDetector gets DACC 0.000 with FPR 1.000 under ALIE on MNIST, Fashion-MNIST and CIFAR-10, i.e., it flags all benign clients and misses all malicious ones.
• Using only the target input (FLForensics-A) is insufficient because Category I benign clients with many target-label examples look malicious.

Limitations

• Theoretical guarantees rely on assumptions (local linearity, behavioral difference, label-rich advantage) that may not hold in practice.
• Assumes the given misclassified input is a true target input; adaptive attacks with intermittent or weak triggers degrade detection.
• Only targeted poisoning attacks are studied; untargeted attacks are left to future work.

Experimental setup

Datasets: CIFAR-10 Fashion-MNIST MNIST Sentiment140 ImageNet-Fruits EMNIST edge-case examples

Benchmarks: CIFAR-10 Fashion-MNIST MNIST Sentiment140 ImageNet-Fruits

Metrics: DACC FPR FNR ASR

Baselines: PF GAS (FLForensics-G) FLForensics-A FLDetector Trimmed Mean Median FLTrust FLAME

Builds on: GAS FLDetector FedRecover FedAvg

Closest papers by meaning

• Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.92)
• FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.91)
• Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning (AAAI 2025 · similarity 0.89)
• Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.88)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.87)
• Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · similarity 0.86)