Research map / Federated learning and privacy / Privacy attacks and secure learning
Exploit Gradient Skewness to Circumvent Byzantine Defenses for Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes STRIKE, a two-stage Byzantine attack for federated learning that exploits "gradient skew" from non-IID data by hiding malicious gradients within densely distributed but skewed honest gradients.
Problem
Byzantine-robust federated learning under non-IID data, where existing defenses assume densely clustered gradients are honest, but heterogeneous honest gradients are skewed away from the optimal (mean) gradient.
Approach
Discover that dense groups of non-IID honest gradients skew away from the average gradient, and craft Byzantine gradients inside this skewed cluster: search for skewed gradients along the mean-to-coordinate-median direction (guided by Karl Pearson's mode-median-mean relation), then scale a perturbation by per-coordinate std via a bisection-solved constraint so the fakes stay within the cluster dia
Key results
- STRIKE improves over the best baseline by 57.84% against DnC on FEMNIST with 20% Byzantine clients.
- On ImageNet-12 against Multi-Krum, STRIKE reaches 27.24% accuracy versus 52.66% for the best baseline under bucketing-free settings in the main table (lower is better).
- With NNM on ImageNet-12, STRIKE achieves 38.91-40.38% accuracy across Median, RFA and DnC, versus 53.68% or higher for baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the skew-aware STRIKE attack instead of baseline attacks | Byzantine attacks against robust aggregation defenses · CIFAR-10, ImageNet-12, and FEMNIST | accuracy | Helped |
| Use STRIKE instead of the best baseline attack | DnC on FEMNIST with 20% Byzantine clients · FEMNIST | accuracy: 57.84% | Helped |
| Use STRIKE instead of baseline attacks with NNM | NNM with robust aggregation on ImageNet-12 · ImageNet-12 | accuracy | Helped |
| Vary the STRIKE attack-strength parameter ν (ablation) | STRIKE on ImageNet-12 · ImageNet-12 | accuracy | Mixed |
| Reduce the non-IID level | STRIKE and baseline attacks against DnC · ImageNet-12 | accuracy | Mixed |
Surprising findings
- Gradient skew is prevalent across CIFAR-10, ImageNet-12 and FEMNIST, and the defenses' bias toward dense gradients becomes a vulnerability.
- The attack gap narrows as the non-IID level decreases, suggesting gradient skew weakens in near-IID settings.
Limitations
- Performance is limited in the IID setting since the attack relies on gradient skew induced by non-IID data.
- Attack assumes the adversary only knows honest gradients and uses fixed Byzantine client ratio f=0.2n in main experiments.
Experimental setup
Datasets: CIFAR-10 ImageNet-12 FEMNIST
Benchmarks: CIFAR-10 ImageNet-12 FEMNIST
Metrics: top-1 accuracy
Baselines: BitFlip LIE IPM Min-Max Min-Sum Mimic
Builds on: Min-Max Min-Sum LIE Bucketing NNM
Closest papers by meaning
- Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.88)
- Self-Driven Entropy Aggregation for Byzantine-Robust Heterogeneous Federated Learning (ICML 2024 · similarity 0.86)
- From Inexact Gradients to Byzantine Robustness: Acceleration and Optimization under Similarity (NeurIPS 2026 · similarity 0.85)
- On the Tension between Byzantine Robustness and No-Attack Accuracy in Distributed Learning (ICML 2025 · similarity 0.85)
- Byzantine-Robust Decentralized Learning via Remove-then-Clip Aggregation (AAAI 2024 · similarity 0.85)
- A Huber Loss Minimization Approach to Byzantine Robust Federated Learning (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.