PaperlayerView exact revision on arXiv

Source-linked AI summary

Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning

Hangtao Zhang, Zeming Yao, Leo Yu Zhang, Shengshan Hu, Chao Chen, Alan Liew, Zhetao Li

arXiv:2304.10783v3cs.LGcs.CRcs.DC

TL;DR

Model poisoning can disrupt federated learning, while existing attacks often rely on prescribed perturbation directions or strong adversary assumptions. FMPA uses historical global models to craft poisoned models with low accuracy and small perturbations; experiments report stronger attack impact under weaker assumptions, and the framework also supports fine-grained control.

  • Problem

    Model poisoning can disrupt federated learning and cause denial-of-service, while prescribed malicious directions do not guarantee strong attack performance.

    Source: §1 · pp. 1–2

  • Method

    FMPA uses historical global models to estimate a benign reference model, then fine-tunes it into a low-accuracy poisoned model with small perturbations.

    Source: §1 · p. 2

  • Results

    FMPA achieves better attack impact under weaker and more realistic adversary assumptions, and I-FMPA outperforms state-of-the-art attacks.

    Source: §1 · p. 2, §5 · p. 7

  • Takeaways & Limitations

    Fine-grained control can let malicious FL service providers gain an advantage over competitors without getting noticed.

    Source: §1 · p. 2

    Earlier attacks’ practicality is constrained by assumptions that adversaries know aggregation rules or benign-client update statistics.

    Source: §1 · p. 2

Abstract

from arXiv · show

Federated learning (FL) is vulnerable to poisoning attacks, where adversaries corrupt the global aggregation results and cause denial-of-service (DoS). Unlike recent model poisoning attacks that optimize the amplitude of malicious perturbations along certain prescribed directions to cause DoS, we propose a Flexible Model Poisoning Attack (FMPA) that can achieve versatile attack goals. We consider a practical threat scenario where no extra knowledge about the FL system (e.g., aggregation rules or updates on benign devices) is available to adversaries. FMPA exploits the global historical information to construct an estimator that predicts the next round of the global model as a benign reference. It then fine-tunes the reference model to obtain the desired poisoned model with low accuracy and small perturbations. Besides the goal of causing DoS, FMPA can be naturally extended to launch a fine-grained controllable attack, making it possible to precisely reduce the global accuracy. Armed with precise control, malicious FL service providers can gain advantages over their competitors without getting noticed, hence opening a new attack surface in FL other than DoS. Even for the purpose of DoS, experiments show that FMPA significantly decreases the global accuracy, outperforming six state-of-the-art attacks.

1 Introduction

Federated learning is vulnerable to model poisoning, while existing advanced attacks can rely on strong adversary assumptions and prescribed perturbation directions. FMPA uses historical global-model information to craft low-accuracy poisoned models with small perturbations and also supports fine-grained control.

1 Introduction

  • Model poisoning submits malicious models to disrupt FL training, potentially causing high testing error and denial of service.The paper also identifies FMPA as the first model-poisoning attack to exploit both vertical and horizontal information in FL systems.Source: §1 · pp. 1–2
  • FMPA extends untargeted poisoning beyond indiscriminate DoS to fine-grained control of attack extent, which the authors describe as a stealthier attack surface.The paper notes that malicious service providers could use this control to gain an advantage without being noticed.Source: §1 · pp. 1–2
  • Existing advanced attacks may require knowledge of the aggregation rule or benign-client updates, while prescribed directions do not guarantee good attack performance.For DoS, pushing updates farthest from the global model makes them easier to detect.Source: §1 · p. 2
  • FMPA uses historical global models to estimate a benign reference and fine-tunes it into a low-accuracy poisoned model with small perturbations, without extra FL-system information.The paper distinguishes this approach from optimizing perturbation magnitude along prescribed directions.Source: §1 · p. 2
  • FMPA achieves better attack impact under weaker, more realistic assumptions about the adversary.The reported attack also reaches maximum loss with the same perturbation amount as the compared directions.Source: §1 · p. 2

2 Background and Related Work

The section outlines federated learning’s client–server training cycle and reviews model-poisoning attacks and Byzantine-robust aggregation defenses. It distinguishes attack strategies and notes a privacy-related constraint on evaluating some defenses.

2.1 Federated Learning

  • FL minimizes the sum of clients’ losses through rounds that synchronize a global model, train local models, aggregate updates, and update the global model.The optimization objective is defined over client datasets and loss functions.Source: §2.1 · pp. 2–3

2.2 Poisoning Attacks on FL

  • Poisoning attacks include data poisoning and model poisoning; this paper focuses on model poisoning, which directly manipulates local updates.Earlier model-poisoning approaches such as sign flipping and Gaussian attacks can create differences from benign updates that make detection easier.Source: §2.2 · p. 3, Model Poisoning Attack (MPA) · p. 3

Model Poisoning Attack (MPA)

  • Prior model-poisoning methods include update-statistics attacks, defense-specific optimization, heuristic perturbation directions, and attacks limited to breaking a few simple defenses.LIE assumes access to all client updates; Min-Max and Min-Sum optimize distances to benign updates, while IPM and MPAF have stated defense limitations.Source: Model Poisoning Attack (MPA) · p. 3

2.3 Existing Byzantine-Robust AGRs

  • Byzantine-robust aggregation defenses detect suspicious models using distance comparisons, statistical features, or validation performance; some require a clean server dataset.The paper does not evaluate certain defenses in detail because clean-data use conflicts with FL’s privacy principle.Source: §2.3 · p. 3

3 Flexible Model Poisoning Attack (FMPA)

FMPA builds a benign reference from global history and optimizes a poisoned model against it, supporting both denial-of-service and precise accuracy control under limited adversary knowledge.

3 Flexible Model Poisoning Attack (FMPA)

  • FMPA targets both indiscriminate accuracy downgrading and precisely controlled poisoning with fewer than half the clients malicious and no knowledge of the server’s AGR or benign clients.Source: §3 · p. 3

3.1 Model Poisoning Problem Formulation

  • The general untargeted formulation directly optimizes model perturbations under a model-similarity objective, unlike prior attacks constrained to prescribed directions.Source: §3.1 · p. 4

3.2 Optimization-Based Malicious Model Update

  • PRM forecasts the next-round benign reference from global history and achieves the most stable poison effect among the three reference models.Source: §3.2 · p. 4

Indiscriminate Untargeted Attack (I-FMPA)

sup

  • Projection within the certified radius preserves the radius condition; benign updates can nevertheless be the largest mean-deviation outliers and more likely to be reprocessed than poisoned updates.Source: sup · p. 5

Fine-Grained Control Attack (F-FMPA)

4 Experimental Results and Analyses

The experiments evaluate FMPA across datasets, defenses, adversary settings, reference models, and client-sampling scenarios. I-FMPA outperforms comparison attacks in the reported settings, while F-FMPA controls accuracy drops with small deviation.

4.1 Experimental Setup

  • Experiments use MNIST with a fully connected network, EMNIST with a CNN, and CIFAR-10 with ResNet20 or VGG-16.Unless otherwise specified, adversarial setups assume 20% malicious clients; evaluations mainly use IID data, except EMNIST, and also vary non-IID degree.Source: §4.1 · p. 6

4.2 Evaluation Results

  • I-FMPA’s attack impact is 2.4×, 2.7×, 3.5×, and 2.8× higher on average than AGRT, LIE, IPM, and MPAF, respectively, and it beats Min-Max/Sum in most cases.The evaluation compares attacks under varying AGRs; AGRT knows the AGR, while the other listed attacks are AGR-agnostic.Source: §4.2 · pp. 6–7
  • 22 of 27 (81.48%) F-FMPA combinations have attack deviation below 1% across defenses and expected accuracy drops ξ.The reported deviation is the absolute difference between expected and actual accuracy drop.Source: §4.2 · p. 7, Table 2 · p. 7

4.3 Ablation Studies

  • Across CIFAR-10 with Resnet20, I-FMPA is superior to existing attacks for most tested malicious-client percentages, defenses, datasets, and models.Figure 2 plots global accuracy against increasing malicious-client percentages under different AGRs.Source: §4.3 · p. 7, Figure 2 · p. 7
  • PRM performs consistently well as a reference model; HRM performs poorly, while ARM has no advantage when malicious clients are fewer.The comparison uses I-FMPA with α = 0.7.Source: §4.3 · p. 7, Figure 3 · p. 7
  • As non-IID degree increases, attack impact rises for all evaluated attacks, and I-FMPA performs better than state-of-the-art attacks.The non-IID-degree experiment uses MNIST.Source: §4.3 · p. 7
  • Random client sampling reduces the effectiveness of all attacks because adversaries cannot consistently corrupt the global model, but I-FMPA performs best across client counts and sample rates.Figure 4 varies the client sampling rate and total number of clients.Source: §4.3 · p. 7, Figure 4 · p. 7

5 Conclusion

The conclusion presents FMPA as a framework for more effective model poisoning under weaker adversary assumptions. It also introduces fine-grained attacks and identifies zero-shot FMPA as future work.

5 Conclusion

  • I-FMPA uses historical FL data to iteratively optimize malicious models through neuron perturbations, outperforming state-of-the-art attacks with weaker assumptions.The framework addresses inefficiency from prescribed perturbation directions.Source: §5 · p. 7
  • F-FMPA enables malicious service providers to surpass competitors stealthily through a fine-grained attack surface.The conclusion contrasts this with indiscriminate degradation of global-model performance.Source: §5 · p. 7
  • FMPA still uses data from malicious clients; applying it to zero-shot attacks remains future work.Source: §5 · p. 7
Loading 2304.10783v3…