PaperlayerView exact revision on arXiv

Source-linked AI summary

Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning

Zuobin Xiong, Deval Mukherjee, Homook Cho, Wei Li

arXiv:2608.25133v1cs.LGcs.CR

TL;DR

Federated learning faces security risks from untrusted clients, while existing poisoning and Byzantine attacks may be ineffective under realistic large-scale settings. This paper analyzes adversarial-example transferability across client models, develops a robustness-based defense, and reports improved robust accuracy with competitive clean performance on real-world datasets.

  • Problem

    Existing poisoning and Byzantine attacks may not achieve satisfactory performance in realistic FL settings, motivating analysis of transferable evasion attacks under practical assumptions.

  • Method

    The paper theoretically analyzes how adversarial examples transfer across FedProx client models and designs a defense using adversarial training, SVD, and robustness propagation.

  • Results

    Experiments on real-world datasets show improved robust accuracy while maintaining competitive clean performance and outperforming strong federated baselines.

  • Takeaways & Limitations

    Transferability is a critical security dimension in federated learning, and robustness-aware defenses can substantially strengthen FL in practice.

Abstract

from arXiv · show

The development of federated learning (FL) techniques has helped improve the privacy preservation of users' data and extended the applications of machine learning models. However, the involvement of a large number of users in FL also creates open opportunities for different adversaries, such as poisoning attacks, Byzantine attacks, and adversarial example attacks. Yet, recent research has disclosed that existing poisoning attacks and Byzantine attacks can not achieve satisfactory penetration in realistic FL scenarios caused by strong assumptions, \textit{e.g.,} client selection rate, and the ratio of malicious attackers. In this paper, the transferability of adversarial examples among different client models is analyzed to understand the relation between adversarial examples and clients' data distribution. Moreover, to mitigate the attacks of transferable adversarial examples, we design a defense mechanism stemming from the transferability of model robustness by adversarial training. As a result, through theoretical analysis of transferability, we gain insights into adversarial examples and the vulnerability of federated learning systems. Our proposed adversarial attack and defense methods are evaluated via real-life datasets in various settings to show their performance over the existing state-of-the-art methods.

I. INTRODUCTION

Federated learning enables collaborative model training without sharing private data, but mutually untrusted clients create security risks that existing poisoning and Byzantine attacks may not address realistically. This paper studies transferable evasion attacks in realistic FL and develops a theoretical analysis and robust defense.

  • Motivation: FL lets private data owners collaboratively train a centrally aggregated model while keeping their data local.Clients perform private local updates and send updated parameters to a service provider for iterative aggregation.
  • Motivation: System and statistical heterogeneity challenge widely used FedAvg-based training, while FedProx addresses these heterogeneity issues but overlooks security.Clients may have different computational power and highly skewed non-identically distributed data.
  • Threats: Mutually untrusted clients can launch poisoning, Byzantine, and evasion attacks against federated systems.Evasion attacks use adversarially crafted inputs, whereas poisoning and Byzantine attacks target training behavior or model quality.
  • Research gap: Poisoning and Byzantine attacks may fail to achieve claimed performance in large-scale FL even without robust defenses.This motivates studying evasion attacks under a more practical threat model with minimal attacker knowledge.
  • Contributions: The paper theoretically analyzes adversarial-example transferability in realistic FedProx FL and proposes an efficient robust defense against transferable attacks.The contributions include theoretical transferability analysis, experimental evaluation, and a defense framework with efficiency and strong performance.

B. Robust Defenses in FL

Federated defenses include pruning, robust aggregation, and regularization, but the paper focuses on robust training for heterogeneous FedProx systems. Its setting models local objectives, weighted server aggregation, and assumptions supporting later analysis.

  • Existing defenses: Existing FL defenses use pruning, Byzantine-robust aggregation, or regularization to improve robustness against poisoning and model-poisoning attacks.These mechanisms can operate during aggregation, local updates, or model training, depending on the defense.
  • Open challenge: Adversarial training is computationally expensive and primarily protects against attacks represented in its training dataset.Efficient local-client defenses against evasion attacks therefore remain an open challenge.
  • FedProx setting: FedProx models system heterogeneity and statistical heterogeneity through a central server, K clients, local objectives, and weighted aggregation.Local clients minimize objectives on private datasets, while the server constructs the updated global model through weighted averaging.
  • FedProx setting: Each client’s local objective combines loss on its dataset with a proximal term involving the previous global model parameter.The optimized local parameter is obtained by minimizing F_k(w; w_t) before server aggregation.
  • Assumptions: The analysis assumes Lipschitz continuity of the loss and Lipschitz continuity of its gradient.These assumptions are introduced to facilitate the theoretical analysis in later sections.

B. Threat Model

The threat model considers a malicious current or previous FL client that crafts adversarial examples locally and relies on their transferability to attack other clients in a black-box setting.

  • The attacker targets performance degradation on a victim client, such as misclassification, within the FedProx-based FL setting.
  • The attacker knows the FL task, private data, and local model parameters, but not necessarily the victim’s model parameters.
  • The attacker generates adversarial examples on its local model, potentially avoiding detection mechanisms, then uses them against victim clients.
  • Transferability can increase another client’s loss and push an adversarial example across its decision boundary, causing misclassification.
  • The study focuses on transferability regardless of which attack method generates the adversarial example.

B. Transferability of Adversarial Example

The paper defines adversarial-example transferability through attacker–victim loss similarity and theoretically relates it to differences between their local data distributions.

  • Transferability is measured by the difference between attacker and victim loss values on the same adversarial example.
  • Theorem 1 relates adversarial-example transferability between attacker A and victim V to their local data distributions.
  • The analysis uses common optimization assumptions, including Lipschitz continuity of the loss and its gradient.
  • The theoretical analysis bounds loss-value transferability through the distance between attacker and victim model parameters over iterative local training rounds.
  • Transferability is positively related to distribution differences in the theorem’s stated relation, while similar attacker and victim distributions yield more transferable examples and more successful attacks.

V. METHODOLOGY: ROBUST DEFENSE IN FL

The robust defense combines an SVD-driven feature-evolution module with adversarial training to make victim models more robust and less susceptible to transferable adversarial examples.

  • The defense is motivated by transferability arising from similarities in client data distributions and attacker–victim model weights.
  • SDFEM and adversarial training are combined to encourage models to learn more robust and unique features.
  • The proposed methodology is presented as a robust-defense framework for mitigating transferable adversarial-example attacks in federated learning.

A. SDFEM for Feature Robustness

SDFEM applies SVD at each client’s input layer and learns a mask that reweights singular values to distinguish and attenuate non-robust feature components.

  • The module is deployed at the client model’s input layer without changing the original model parameters, functioning as a plug-in kit.
  • SDFEM applies Singular Value Decomposition to an input feature map, representing it through orthogonal matrices and singular values.
  • The singular values represent the energy of the feature channels used to distinguish robust from non-robust features.
  • A learnable evolution mask reweights the singular values through elementwise multiplication during reconstruction.

2 Initialize w0, global mask M

The procedure initializes federated training and generates adversarial data using local surrogates while learning a mask that reweights singular values. The mask attenuates singular values associated with gradients exploited by transfer-based attacks.

  • Each round selects a participating client subset, generates adversarial data using a local surrogate, and performs local epochs before updating the model and mask.
  • The feature evolution mask is applied through elementwise multiplication with singular values during reconstruction.
  • Learning the mask attenuates singular values contributing to transfer-attack gradients and lowers the gradient maximum term Gmax from Theorem 1.

B. Adversarial Training in Federated Aggregation

The defense combines local adversarial-example generation with masked model optimization and adversarial training during federated aggregation. This allows robustness learned by local models to propagate through the global model.

  • B. Adversarial Training in Federated Aggregation: SDFEM generates robust local features and parameters, while adversarial training modifies federated optimization so robust features enter global aggregation.
  • Adversarial Data Generation: Each client uses a local surrogate to generate PGD adversarial examples from local clean data as proxies for transferable attacks.
  • Modified Local Objective: The modified local objective jointly optimizes model weights wk and the feature evolution mask Mk.
  • Modified Local Objective: The hyperparameter α balances clean accuracy and robustness, and the complete procedure is given in Algorithm 1.

VI. EXPERIMENTS

The experiments test whether observed attack-transferability relationships match the theoretical analysis and whether the proposed mechanism mitigates transferable adversarial attacks in federated learning.

  • The evaluation addresses alignment between empirical findings and Theorem 1, alongside the effectiveness of the robust mechanism against transferable adversarial attacks.

A. Experimental Setup

The experimental setup uses two image-classification datasets, two model architectures, and federated clients under IID and heterogeneous non-IID partitions. Training varies client participation and local-update settings across these conditions.

  • Experiments use CIFAR-10 and SVHN with VGG11 and WideResNet-28-10 to represent standard and high-capacity models.
  • The federated environment includes K ∈ {10, 100} clients and randomly selects C = {0.8, 1} of clients per communication round.
  • IID Setting: IID data are shuffled and uniformly distributed across clients.
  • Non-IID Setting: Non-IID partitions sample class labels from a Dirichlet distribution with α ∈ {0.1, 0.5, 1}, where smaller α indicates greater data skewness.Training runs for T = 400 rounds, using E = 1 local epoch for ideal IID settings and E = 3 for non-IID settings.

3) Attack and Defense Implementation:

The paper implements transfer-based evasion attacks under a gray-box threat model and evaluates a robustness defense across IID and Non-IID FL settings. Experiments support the theoretical link between transferability, model differences, and client data distributions, while showing that the proposed method improves adversarial robustness over federated baselines.

  • Attack implementation: The gray-box attacker generates transfer-based adversarial examples from a local surrogate model using four gradient-based attacks.The evaluated attacks are VMIFGSM, BIM, VNIFGSM, and DIFGSM; the perturbation budget is ϵ = 8/255, with step size 2 and 100 steps.
  • Theoretical verification: Theorem 1 bounds adversarial-example transferability by attacker–victim model-parameter differences and distributional distance.Experiments measure attack success rate and prediction-loss changes, with empirical trends aligning with the theoretical analysis.
  • Defense performance: On IID CIFAR-10, the proposed defense consistently improves robustness over FAT while maintaining comparable clean accuracy across VGG11 and WRN28.For WRN28, robustness gains over FAT are +3.36, +2.04, +3.21, and +4.28 points for VMIFGSM, BIM, VNIFGSM, and DIFGSM, respectively.
  • Defense performance: On IID SVHN, the proposed method achieves roughly 60% and 6% average BIM robustness improvements over FedProx and FAT, respectively, for VGG11.The method also maintains robust accuracy against transfer attacks where standard FedProx models are extremely vulnerable.
  • Defense performance: Under Non-IID CIFAR-10 conditions, the proposed defense outperforms FAT and can provide larger robustness gains amid pronounced client-distribution heterogeneity.For WRN28, gains over FAT are +9.26, +9.07, +9.26, and +8.43 points across VMIFGSM, BIM, VNIFGSM, and DIFGSM, while clean accuracy improves by +2.99 points.
Loading 2608.25133v1…