Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning

Virat Shejwalkar; Amir Houmansadr; Peter Kairouz; Daniel Ramage

Source-linked AI summary

Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning

Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, Daniel Ramage

arXiv:2108.10241v2Aug 23, 2021cs.LGcs.CRcs.DC

TL;DR

The real-world impact of poisoning attacks on production federated learning systems remains unclear. This paper systematizes practical threat models, develops untargeted data and model poisoning attacks, and evaluates them under production settings, finding that simple, low-cost defenses can effectively protect FL against poisoning.

Problem
The significance of untargeted poisoning attacks and the need for sophisticated defenses in production federated learning remain insufficiently understood.
Method
The paper systematizes poisoning threat models, designs improved untargeted data and model attacks, and evaluates attacks and defenses under production FL settings.
Results
Simple, low-cost defenses effectively protect production FL against state-of-the-art poisoning attacks, while data poisoning is completely ineffective in production cross-silo FL.
Takeaways & Limitations
Robustness conclusions from prior FL studies cannot be directly extended to production deployments, which should be explicitly considered in FL robustness research.

Abstract

from arXiv · show

While recent works have indicated that federated learning (FL) may be vulnerable to poisoning attacks by compromised clients, their real impact on production FL systems is not fully understood. In this work, we aim to develop a comprehensive systemization for poisoning attacks on FL by enumerating all possible threat models, variations of poisoning, and adversary capabilities. We specifically put our focus on untargeted poisoning attacks, as we argue that they are significantly relevant to production FL deployments. We present a critical analysis of untargeted poisoning attacks under practical, production FL environments by carefully characterizing the set of realistic threat models and adversarial capabilities. Our findings are rather surprising: contrary to the established belief, we show that FL is highly robust in practice even when using simple, low-cost defenses. We go even further and propose novel, state-of-the-art data and model poisoning attacks, and show via an extensive set of experiments across three benchmark datasets how (in)effective poisoning attacks are in the presence of simple defense mechanisms. We aim to correct previous misconceptions and offer concrete guidelines to conduct more accurate (and more realistic) research on this topic.

I. INTRODUCTION · II. BACKGROUND · A. Federated Learning (FL)

The paper frames federated learning as collaborative private-data training vulnerable to targeted, backdoor, and untargeted poisoning, while focusing on realistic untargeted attacks in production deployments. It systematizes poisoning threats, develops improved attacks, and argues that simple defenses can make attacks ineffective in practical settings.

I. INTRODUCTION: FL enables clients to train a common model without sharing private training data, but compromised clients can submit malicious updates intended to corrupt the global model.
I. INTRODUCTION: The study focuses on untargeted poisoning because it can affect a large population of clients in production FL deployments, [32].
I. INTRODUCTION: The paper systematizes poisoning threats across adversary objective, knowledge, and capability, then evaluates the practicality of their possible combinations.
I. INTRODUCTION: The authors design improved data- and model-poisoning attacks for the practical threat models identified in their systemization.
I. INTRODUCTION: Increasing label-flipped data can enlarge update loss and norm, but overly large poisoned updates may fail robustness checks; limiting each client’s dataset size is therefore an effective simple defense.
I. INTRODUCTION: Simple low-cost defenses such as norm-bounding can provide protection equivalent to sophisticated robust aggregation rules, without their high computation and memory costs.
I. INTRODUCTION: For production cross-silo FL with up to hundred clients [32], data-poisoning attacks are completely ineffective even against non-robust Average AGR, while contractual and professionally maintained client environments reduce the likely risk of model poisoning.
A. Federated Learning (FL): In FL, each round selects clients to fine-tune the latest global model locally, after which the server aggregates their updates and applies a server learning-rate update to obtain the next global model.

B. Existing Defenses Against Untargeted Poisoning … 4) Trimmed-mean:

The paper organizes untargeted-poisoning defenses as robust aggregation rules replacing vanilla averaging, then evaluates representative methods for production FL based on accuracy, overhead, and guarantees. It emphasizes practical tradeoffs: several defenses lose performance or impose substantial memory/compute costs, while simple defenses can still protect production FL.

B. Existing Defenses Against Untargeted Poisoning: Robust aggregation replaces vanilla averaging to handle untargeted poisoning and Byzantine failures, with dimension-wise and vector-wise defenses as the main categories.Dimension-wise methods filter malicious values per coordinate, whereas vector-wise methods remove entire client updates; examples include Median, Trimmed-mean, signSGD, RFA, RSA, Krum, and Multi-krum.
C. Defenses We Evaluate in Our Work: The study selects representative aggregation rules with practical performance and overheads, while noting that higher-overhead defenses may improve robustness without changing its main conclusions.The authors argue that even simple defenses are sufficient to protect production FL.
1) Average:: Average is the efficient dimension-wise aggregator used by FL applications in practice for non-adversarial settings.Its practical adoption is attributed to efficiency.
2) Norm-bounding:: Norm-bounding scales any client update whose L2 norm exceeds threshold τ to norm τ before averaging all submitted updates.The method is motivated by the intuition that effective poisoned updates have unusually high norms.
C. Defenses We Evaluate in Our Work: Table I compares aggregation rules on CIFAR10 with 1,000 clients, highlighting performance, computation, memory, and theoretical-guarantee limitations that hinder production adoption.The paper identifies significant performance losses for SignSGD with majority voting, Krum, Bulyan, RSA, and certified defenses, plus high client memory costs for certified defenses.
3) Multi-krum:: Multi-krum repeatedly selects updates with Krum, retaining c updates subject to n −c > 2m + 2, then averages the selected set.Here n denotes selected clients and m denotes compromised clients in the round.
4) Trimmed-mean:: Trimmed-mean sorts each update dimension, removes the m largest and smallest values, and averages the remaining values coordinate-wise.The parameter m represents the number of compromised clients.

III. SYSTEMIZATION OF FL POISONING THREAT MODELS … 2) Adversary’s Knowledge:

The paper systematizes FL poisoning threats along three dimensions and argues that only two combinations are practically relevant in production FL. It focuses on untargeted availability attacks, whose modest accuracy degradation can threaten services and remain undetected, while distinguishing adversaries by model knowledge.

A. Dimensions of Poisoning Threat to FL: The framework organizes FL poisoning threats across three key dimensions, extending prior adversarial-ML systemizations,,, rather than merely cataloging existing attacks [27],.Each combination defines a threat model, but the paper argues that only two combinations are practical for production FL.
1) Adversary’s Objective:: The threat model distinguishes security objectives, attack specificity, and error specificity: integrity versus availability, discriminative versus indiscriminate attacks, and specific versus generic errors.Security violations concern evading detection without disrupting service or compromising service for legitimate users.
1) Adversary’s Objective:: The attack model distinguishes data poisoning, where adversaries manipulate compromised clients’ local data, from online attacks that repeatedly and adaptively poison clients during training,,.Online impacts can persist across training, whereas data poisoning does not require breaking into compromised clients.
1) Adversary’s Objective:: It also distinguishes offline attacks, which poison compromised clients once at FL’s beginning, from online attacks whose effects can persist throughout training.Baseline label flipping is an example of offline poisoning,, and its impact may quickly fade.
1) Adversary’s Objective:: The paper focuses on untargeted attacks—indiscriminate availability attacks with generic error specificity—because they affect all clients and test inputs in production FL.On FEMNIST, benign accuracy is 85%, while untargeted attacks can reduce it to [78, 82]% depending on the percentage of compromised clients.
1) Adversary’s Objective:: Untargeted attacks can remain undetected for long periods because small overall accuracy reductions are difficult to identify without reliable application-specific benchmarks.Affected providers may interpret [78, 82]% accuracy as the highest achievable level rather than recognize degradation from 85%.
2) Adversary’s Knowledge:: Adversary knowledge is characterized by access to the global model and benign-distribution data; global-model knowledge can be nobox or whitebox.Nobox adversaries lack the architecture, parameters, and outputs and represent the most practical FL setting, whereas whitebox adversaries know global parameters and outputs when the server selects a compromised client.

3) Adversary’s Capability: … 3) Practical Ranges of FL Parameters:

The paper characterizes poisoning capabilities and production constraints, identifying T4 (nobox offline data poison) and T5 (whitebox online model poison) as the only practically relevant threat models while showing that literature parameter ranges often diverge sharply from production settings.

3) Adversary’s Capability:: Model poisoning requires breaking into a client device, whereas data poisoning alters only local datasets and indirectly affects updates, potentially reducing impact while lowering access requirements.The two capabilities correspond to poisoning different stages of the FL pipeline.
3) Adversary’s Capability:: The analysis assumes compromised clients may collude by exchanging local data and model updates to increase attack impact.This is an explicit adversarial capability assumption.
1) Salient Features of Production Federated Learning:: Production FL spans cross-device and cross-silo settings; cross-device deployments involve thousands to billions of clients, select n ≪ N per round, and impose resource and connectivity constraints.These constraints limit the data each device can process and mean that some selected clients may be unavailable.
1) Salient Features of Production Federated Learning:: Production assumptions exclude inference-model access to training details, require whitebox device compromise, and treat large-scale Sybil attacks as security failures rather than ordinary FL threats.Operating a persistent large-scale botnet on modern operating systems is also considered non-trivial.
3) Practical Ranges of FL Parameters:: Table III shows stark differences between untargeted-poisoning literature ranges and practical ranges, reflecting the difficulty of achieving successful untargeted attacks under realistic settings.Previous work commonly uses very high compromised-client percentages or model poisoning on cross-silo FL, unlike the production-oriented evaluation.
2) Understanding the practicality of threat models:: For untargeted poisoning with partial benign-data knowledge, eight threat models reduce to two practical deployments: T4 (nobox offline data poison) and T5 (whitebox online model poison).Model poisoning requires whitebox access, while nobox online attacks cannot adapt poisoning data to the current global model.
3) Practical Ranges of FL Parameters:: The production-oriented settings use M ≤1 compromised clients, N ∈[1, 000, 34, 000] with n ∈[25, 50] ≪N for cross-device FL, and also evaluate N=n=50.State-of-the-art attacks and defenses instead assume up to 25% or 50% compromised clients.
3) Practical Ranges of FL Parameters:: Data-poisoning analyses limit poisoned data because cross-device devices have low processing capacity, while cross-silo inspection motivates the bound |Dp| up to 100 × |D|avg.The bound reflects the ability of silos to remove unusually large poisoned datasets.

C. Threat Models in Practice … 2) Model Poisoning Attacks (MPAs):

The paper distinguishes practical nobox offline data poisoning from costly whitebox online model poisoning, with the former scalable but weak and the latter powerful but limited to few clients. Existing FL poisoning work includes label-flipping DPAs and AGR-aware or optimization-based MPAs, but prior untargeted DPAs were not tailored to FL.

C. Threat Models in Practice: The practical threat-model analysis centers on two adversaries: nobox offline data poisoning and whitebox online model poisoning.The adversaries differ primarily in access to compromised devices and the resulting compromise scale and update-manipulation ability.
1) Nobox Offline Data Poisoning (T4):: Nobox adversaries know the server’s aggregation rule and compromised clients’ benign data, while architecture knowledge may vary, but lack global-model internals or outputs.They mount offline DPAs without requiring access to FL binaries or device memory.
1) Nobox Offline Data Poisoning (T4):: Despite potentially compromising up to 0.1% of production clients, nobox poisoning has limited impact because arbitrary poisoned updates may not correspond to valid data.The passage contrasts this limitation with MPAs that can produce arbitrarily manipulated updates.
2) Whitebox Online Model Poisoning (T5):: Whitebox online model-poisoning adversaries know global-model parameters and predictions when a compromised client is selected, plus the aggregation rule and benign device data.They directly manipulate model updates after breaking into compromised devices.
IV. EXPLORING THE SPACE OF FL POISONING ATTACKS / A. Existing FL Poisoning Attacks: Whitebox model poisoning can theoretically craft highly poisonous updates, but its extreme device-compromise cost restricts attackers to roughly 0.01% of clients.This creates a practical tradeoff between attack strength and compromise scale.
1) Data Poisoning Attacks (DPAs):: Prior DPA research focused mainly on centralized ML; in FL, Fang et al. demonstrated simple label flipping that maps each true label to a false label based on the number of classes.The passage states that no prior work had studied untargeted DPAs tailored to FL settings.
2) Model Poisoning Attacks (MPAs):: Existing MPAs include LIE, which adds statistically calibrated noise, and STAT-OPT, which selects a malicious direction and optimizes its magnitude to circumvent the target AGR.STAT-OPT tailors attacks to the target AGR and therefore performs better than LIE; DYN-OPT proposes a general framework tailored to specific FL settings.

B. Our Improved FL Poisoning Attacks · 1) Formulating FL Poisoning as an Optimization Problem: · 2) Our Data Poisoning Attacks (DPAs):

The paper formulates poisoning as maximizing the distance between poisoned and benign aggregates, then develops dataset- and AGR-specific data and model poisoning attacks. Its DPAs use label-flipped data, with static and dynamic strategies selected per dataset and tailored to each aggregation rule.

1) Formulating FL Poisoning as an Optimization Problem:: The optimization objective maximizes the distance between an aggregate containing poisoned updates and the benign-only aggregate.The formulation models compromised clients, a target aggregation rule, benign updates, a reference benign aggregate, replicated poisoned updates, and the final poisoned aggregate.
1) Formulating FL Poisoning as an Optimization Problem:: Unlike, the authors use this objective to construct systematic data poisoning attacks and tailor model poisoning to the aggregation rule, dataset, and global model.They use stochastic gradient ascent to adapt model poisoning, which they report boosts attack efficacy.
2) Our Data Poisoning Attacks (DPAs):: The DPA optimization searches for poisoning data that produces an update circumventing the target aggregation rule while increasing cross-entropy loss on benign data.The poisoned update is computed by fine-tuning the global model with poisoning data using a training algorithm such as mini-batch SGD.
2) Our Data Poisoning Attacks (DPAs):: Because the server cannot observe client data or dataset sizes, the attacks use an appropriate amount of label-flipped data for each compromised client.More poisoned data is intended to increase the poisoned model’s loss and update norm, thereby increasing aggregate deviation; Figure 2 evaluates this intuition on FEMNIST.
2) Our Data Poisoning Attacks (DPAs):: The authors propose static label flipping and dynamic label flipping, which changes each label to the least probable class under a surrogate global model.The impact of the two strategies is dataset dependent, so both are tested and the better strategy is used when appropriate.
2) Our Data Poisoning Attacks (DPAs):: For Average aggregation, the attack combines compromised clients’ data, flips labels, and adds Gaussian-noise features to create large poisoned datasets and high-loss, high-norm updates.The described strategies are SLF or DLF, applied to the enlarged dataset.
2) Our Data Poisoning Attacks (DPAs):: For Norm-bounding aggregation, the attack likewise uses large poisoned datasets to generate updates that incur high loss on benign data.The passage identifies Figure 2-(b) as evidence for the loss behavior of these generated updates.

3) Our Model Poisoning Attacks (MPAs): · V. ANALYSIS OF FL ROBUSTNESS IN PRACTICE · A. Evaluating Non-robust FL (Cross-device)

The paper introduces modular model poisoning attacks that optimize malicious updates to evade arbitrary aggregation rules, then shows that production cross-device FL with naive Average aggregation remains highly accurate under practical untargeted poisoning.

3) Our Model Poisoning Attacks (MPAs):: The MPA constructs θ′ by stochastic gradient ascent on benign data, increasing loss while producing a poisoned update ∇′ that circumvents the target aggregation rule.The attack uses the opposite of the benign gradient direction to increase loss.
3) Our Model Poisoning Attacks (MPAs):: The attack computes a malicious update, then projects it to evade the target aggregator’s robustness criteria using an empirically effective scaling search.The procedure estimates benign-update norms, fine-tunes with poisoned data, and searches γ over a range such as [1, Γ].
3) Our Model Poisoning Attacks (MPAs):: Because the attack is modular, any aggregation rule can be targeted by plugging its algorithm into the projection procedure, unlike Sun et al. ’s norm-bounding-only attack.The authors also tailor the projection function to state-of-the-art aggregation rules, including Average, where arbitrarily large malicious updates suffice.
V. ANALYSIS OF FL ROBUSTNESS IN PRACTICE: The evaluation compares state-of-the-art DPAs and MPAs against non-robust and robust FL algorithms under practical threat models, beginning with cross-device FL.Cross-device FL is emphasized because it is barely studied previously and more susceptible to poisoning; cross-silo FL is analyzed later.
A. Evaluating Non-robust FL (Cross-device): For FEMNIST, MPA impact is ∼2% at M=0.01%, while DPA impact is ∼5% at M=0.1%, versus 82.3% no-attack accuracy.Purchase and CIFAR10 likewise show very low attack impacts.
A. Evaluating Non-robust FL (Cross-device): Client sampling explains this robustness because, when M<1%, many rounds select no compromised clients.Cross-device FL samples only a very small fraction of all clients in each round.
A. Evaluating Non-robust FL (Cross-device): Production cross-device FL with naive Average aggregation converges with high accuracy despite untargeted poisoning attacks.This contradicts the common belief that a single compromised client can prevent convergence.

B. Evaluating Robust FL (Cross-device) · 1) Cross-device FL with robust AGRs is highly robust in practice: · 2) Investigating simple and efficient robustness checks is necessary:

In production cross-device FL, robust AGRs withstand state-of-the-art untargeted poisoning under practical compromise rates, largely because of client sampling. Simple Norm-bounding provides comparable protection to costlier robust AGRs while avoiding their computational overhead.

1) Cross-device FL with robust AGRs is highly robust in practice:: After 5,000 rounds with M = 0.1%, Multi-krum and Trimmed-mean remain unaffected, while Norm-bounding reduces global-model accuracy by <5%.The strongest model-poisoning attacks were applied continuously and slowly over the extended run; Multi-krum and Trimmed-mean accuracy actually increased.
1) Cross-device FL with robust AGRs is highly robust in practice:: These robust AGRs are sufficient for practical production cross-device FL despite weaker-than-theoretical robustness, due to cross-device client sampling.The evaluation concerns practical regimes with M <0.1% and n ≪N, where state-of-the-art attacks,, fail to substantially degrade the model.
1) Cross-device FL with robust AGRs is highly robust in practice:: For production cross-device FL (M <0.1%, n ≪N), robust AGRs are highly robust to state-of-the-art poisoning attacks.Across all three datasets, Iθ ≤1% when M ≤0.1% for DPAs and M ≤0.01% for MPAs; Figure 4b evaluates these attacks on Norm-bounding, Multi-krum, and Trimmed-mean.
2) Investigating simple and efficient robustness checks is necessary:: Sophisticated robust AGRs impose substantial production costs: Multi-krum requires O(dn^2) computation and Trimmed-mean O(dnlogn) for n updates of length d.With n potentially reaching 5,000, [32], these input robustness checks can prohibit deployment.
2) Investigating simple and efficient robustness checks is necessary:: Norm-bounding checks only input norms and has O(d) complexity, matching Average’s asymptotic cost.This makes Norm-bounding a substantially simpler and more efficient robustness check than Multi-krum and Trimmed-mean.
2) Investigating simple and efficient robustness checks is necessary:: For all datasets and M ≤1%, every evaluated AGR achieves Iθ < 1%, showing that Norm-bounding protects cross-device FL similarly to theoretically robust, expensive AGRs.Figure 4b compares the poisoning impact of the evaluated attacks across the robust AGRs.
2) Investigating simple and efficient robustness checks is necessary:: Even low-cost Norm-bounding is enough to protect production FL against untargeted poisoning, questioning the need for more sophisticated and costlier AGRs.The findings motivate further investigation and invention of simple robust AGRs.

3) Thorough empirical assessment of robustness is inevitable: … 2) Effect of the Average Dataset Size of Benign FL Clients (|D|avg):

Across practical production settings, robust aggregation rules (AGRs) and bounded client datasets make federated learning highly resistant to untargeted poisoning, despite theoretical guarantees alone being insufficient. Cross-device FL with robust AGRs nearly eliminates state-of-the-art data and model poisoning when benign-client datasets are moderately sized, whereas Average AGR remains vulnerable to model poisoning.

3) Thorough empirical assessment of robustness is inevitable:: Theoretically robust AGRs such as Mkrum and Trmean do not consistently outperform simple Norm-bounding, even at their theoretically claimed poisoning fractions.At M=10%, Trmean has higher Iθ than Norm-bounding on FEMNIST, while their Iθ values are almost similar on CIFAR10.
3) Thorough empirical assessment of robustness is inevitable:: These results expose shortcomings in prior AGR evaluations,, [68],, which relied on preliminary attacks, and establish thorough empirical assessment as necessary.The paper argues that theoretical robustness analysis alone cannot characterize robustness in production FL systems.
1) Effect of the Size of Local Poisoning Datasets (|Dp|) on DPAs.:: The poisoning attacks’ success depends on |Dp|, but practical client-data limits satisfy |Dp|≤100×|D|avg; experiments use larger values only to measure worst-case impacts.For example, the analysis uses |Dp|=50,000 for CIFAR10 and explores up to 10^4×|D|avg experimentally.
1) Effect of the Size of Local Poisoning Datasets (|Dp|) on DPAs.:: For FEMNIST and CIFAR10, poisoning impacts increase only slightly with |Dp| and remain negligible even at 1000×|D|avg for M≤1%, including under Average AGR.Mkrum is omitted because effective attacks against it use practical poisoned-dataset sizes close to |D|avg.
1) Effect of the Size of Local Poisoning Datasets (|Dp|) on DPAs.:: For all robust AGRs, poisoning impacts are negligible when poisoned-dataset size and compromised-client fraction are practical; limiting each client’s local dataset is therefore an effective defense.For non-robust AGRs, impact reductions are non-trivial and dataset dependent.
2) Effect of the Average Dataset Size of Benign FL Clients (|D|avg):: Varying |D|avg has no clear overall effect on Iθ: some CIFAR10 attacks decrease as |D|avg grows, while FEMNIST attacks under robust AGRs remain unchanged.The observed dependence varies by dataset, attack, and aggregation rule.
2) Effect of the Average Dataset Size of Benign FL Clients (|D|avg):: With |D|avg=50 for CIFAR10 and |D|avg=200 for FEMNIST, all robust AGRs almost completely mitigate DPAs and MPAs despite impractically high M; Average AGR mitigates DPAs but not MPAs.The exception is model poisoning against Average AGR, where impacts remain high because MPAs are highly effective.
2) Effect of the Average Dataset Size of Benign FL Clients (|D|avg):: When benign-client dataset sizes are practical, cross-device FL with robust AGRs is highly robust to untargeted poisoning.This conclusion is stated for the practical regimes summarized in Table III.

3) Number of Clients Selected Per Round.: … VI. CONCLUSIONS

Across production FL settings, client-selection count generally does not affect untargeted poisoning impact, while mismatched surrogate architectures weaken DPAs and cross-silo FL remains robust. The paper concludes that practical threat models and production-focused evaluations are needed, leaving theoretical guarantees under sparse client sampling open.

3) Number of Clients Selected Per Round.:: The number of clients selected per round has no noticeable effect on untargeted poisoning impacts, except for MPAs on Average AGR.For MPAs on Average AGR, selecting more clients increases the chance of including a compromised client, preventing further global-model learning.
4) Effect of Unknown Global Model Architecture on DPAs:: DPA-DLF becomes less effective when the adversary’s surrogate architecture differs from the global model architecture.On FEMNIST, the substitute convolutional network produced lower attack impact than the true LeNet architecture.
D. Evaluating Robustness of Cross-silo FL: The cross-silo analysis considers only data poisoning because model poisoning requires persistent compromise of large, contract-bound organizations with professionally maintained software stacks.Short-lived data breaches can steal information but do not provide the infrastructure-changing access required for online model poisoning.
D. Evaluating Robustness of Cross-silo FL: Cross-silo experiments distribute compromised users uniformly or concentrate them in selected silos while assuming each compromised user shares poisoned data Dp with its parent silo.The setup assumes equal user counts per silo and |Dp| = 100 × |D|avg for each compromised user.
D. Evaluating Robustness of Cross-silo FL: State-of-the-art data poisoning attacks have no impact in production cross-silo FL, while model poisoning attacks are not practical, even with Average AGR.The analysis assumes silos train on all user-contributed data and studies data poisoning because persistent compromise of professionally maintained silos is implausible.
VI. CONCLUSIONS: The paper systematizes poisoning threat models, practical FL parameter ranges, and untargeted model and data poisoning attacks to evaluate defenses under production settings.Its stated goal is to redirect FL robustness research toward practically significant threat models and experiments.
VI. CONCLUSIONS: A remaining open problem is obtaining concrete theoretical robustness guarantees when only a very small fraction of clients is randomly selected in each FL round.The paper presents this as an example of a practically significant research direction enabled by its threat-model systematization.

APPENDIX … 1) Missing data poisoning attack methods:

The appendix distinguishes targeted and backdoor attacks from untargeted poisoning, describes their defense mechanisms, and details attack-construction procedures for Multi-Krum and Trimmed-mean aggregation. It emphasizes that simple extensions of targeted or backdoor attacks do not reliably achieve untargeted impact.

1) Targeted and Backdoor Attacks:: Targeted attacks,, seek misclassification of specific test samples, including single-sample attacks using model poisoning designed to resemble benign updates.
1) Targeted and Backdoor Attacks:: Label-flipping untargeted poisoning can insert a backdoor under state-of-the-art defenses, yet has no effect even on unprotected federated learning.
2) Existing Defenses Against Targeted and Backdoor Attacks:: Existing defenses include similarity-based detection in FoolsGold, norm-bounding studied by Sun et al., and certified accuracy against backdoors through CRFL.FoolsGold can incur very high performance losses, as noted in [25].
B. Missing details of our data and model poisoning attacks from Sections IV-B2 and IV-B3: The PGA model-poisoning procedure updates a model through stochastic gradient ascent, computes the poisoned update, projects it through the aggregation rule, and scales it appropriately.
B. Missing details of our data and model poisoning attacks from Sections IV-B2 and IV-B3: PGA’s projection function norm-scales the update, computes a benign reference update, searches scaling factors, and returns the factor maximizing deviation under the aggregation rule.
1) Missing data poisoning attack methods:: The Multi-Krum attack maximizes poisoned updates selected in its fixed-size selection set, equivalently minimizing selected benign updates.
1) Missing data poisoning attack methods:: For FEMNIST, Multi-Krum discards most poisoned updates when poisoned-data size slightly exceeds the benign average of 23.7, but selects most when the size is approximately 10.The attack varies poisoned-data size from 0.5·|D|avg to 3·|D|avg, repeats each setting 10 times, and reports the maximum-impact sample.
1) Missing data poisoning attack methods:: For Trimmed-mean, the attack uses the objective in (2) but instead assigns large poisoned datasets to compromised clients, paralleling attacks on Average and norm-bounding aggregation.

2) Missing model poisoning attack methods: … D. Explanations of effects of |D|avg from Section V-C2

The paper extends model-poisoning attacks to Multi-krum and Trimmed-mean, evaluates them in production-like non-IID FL settings, and explains how average client-dataset size changes attack impact across datasets and aggregators.

2) Missing model poisoning attack methods:: For Multi-krum, the model-poisoning attack searches for a scaling factor γ that maximizes the number of scaled poisoned updates selected into S.The optimization targets selection-set membership rather than directly maximizing a model-loss objective.
2) Missing model poisoning attack methods:: The Multi-krum optimization searches γ within [1, Γ] and updates γ* when all scaled poisoned updates are selected; Trimmed-mean is directly inserted into Algorithm 2.The Trimmed-mean attack is described as similar to, but the supplied passage truncates its distinction.
C. Experimental setup: The experimental setup uses image and categorical datasets while approximating production FL through many clients with extremely non-IID data.Real-world FL datasets, [49] are proprietary, so the study follows prior untargeted-poisoning work,,,.
FEMNIST [13],: FEMNIST is a 62-class handwritten character task with 3,400 clients and 671,585 grayscale images, whose client data are divided into non-IID parts using a Dirichlet distribution.Unless otherwise specified, p=10 produces 34,000 clients, and the model uses LeNet.
D. Explanations of effects of |D|avg from Section V-C2: On CIFAR10, STAT-OPT impact decreases as average client-dataset size increases because improved benign updates eventually overpower poisoning effects.This effect is reported for M=1% with Normb.
D. Explanations of effects of |D|avg from Section V-C2: FEMNIST attack impact remains unchanged as average client-dataset size varies because the easy task makes compromised clients ineffective against robust aggregators.The passage attributes this stability to FEMNIST’s task difficulty and robust AGRs.
D. Explanations of effects of |D|avg from Section V-C2: CIFAR10 model-poisoning impact with Average AGR increases as average client-dataset size grows because one selected compromised client can completely corrupt the global model.The explanation depends on CIFAR10’s difficulty and the high effectiveness of these attacks under Average AGR.

E. Miscellaneous figures

The supplementary figures examine poisoning robustness across robust aggregation rules, client-selection and data-size settings, unknown architectures, and cross-silo FL. They show negligible cross-silo impact, no clear data-size effect on attack impact, increased global-model accuracy with larger benign datasets, and limited dependence on selected-client count.

E. Miscellaneous figures: Figure 6 evaluates the strongest model-poisoning attacks against robust AGRs over a very large number of FL rounds.The passage identifies the figure’s scope but does not provide numerical outcomes.
E. Miscellaneous figures: Figure 7 studies unknown-architecture effects on the state-of-the-art data-poisoning attacks, using a surrogate CNN architecture to emulate the true LeNet architecture.Table V specifies the surrogate model architecture used in this setting.
E. Miscellaneous figures: All data poisoning attacks have negligible impacts on cross-silo FL, whether compromised clients are concentrated in a few silos or distributed uniformly.Figure 8 covers the cross-silo setting.
E. Miscellaneous figures: Increasing the average benign-client dataset size has no clear effect on attack impacts but increases global-model accuracy across the examined aggregation rules.Figures 9 and 11 report these effects for 1% compromised clients; Figure 12 extends the observations to Multi-krum and Trimmed-mean.
E. Miscellaneous figures: The number of clients selected per FL round has no noticeable effect on attack impacts, except for model poisoning against Average AGR.Figure 10 uses M = 1% compromised clients.