PaperlayerView exact revision on arXiv

Source-linked AI summary

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense

Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy

arXiv:2609.27124v1cs.CRcs.AI

TL;DR

Federated learning defenses face dynamically coordinated attacks that adapt poisoned updates to evade detection. Fed-ADR combines an orchestrator-led attack with historical-gradient detection and in-situ recovery; experiments report severe accuracy degradation under attack and recovery with substantially less computation than retraining.

  • Problem

    Malicious clients can craft updates to evade parameter-server defenses, allowing poisoned updates into aggregation and compromising global-model performance.

    Source: §3.1 · p. 3

  • Method

    Fed-ADR uses an orchestrator to adapt malicious clients’ gradients, detects suspicious updates using historical consistency, and recovers the model using estimated pre-attack client parameters.

    Source: §1 · p. 2, §6 · p. 12

  • Results

    On MNIST, global accuracy drops from 92.62% to 9.22% under MUD-HoG, while defense and recovery restore it from approximately 9% to 90% with at least 20× lower overhead than retraining.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The reported recovery restores global-model accuracy without full retraining, and its computational overhead is substantially lower than restarting training from scratch.

    Source: §5.3 · p. 10, §6 · p. 12

    The threat model assumes orchestrators know the parameter server’s defenses; future work will consider orchestrators that infer the deployed defense online.

    Source: §3.2 · p. 4, §6 · p. 12

Abstract

from arXiv · show

Federated Learning enables decentralized model training by exchanging model updates--rather than raw data--with a central parameter server (PS). While most of the existing defenses primarily assume static or independently acting adversaries, we reveal a new class of dynamically adaptive attacks that systematically bypass such protections. We propose Fed-ADR, a holistic attack framework in which a malicious orchestrator server (OS) dynamically coordinates a heterogeneous set of adversarial clients, including both targeted and untargeted attackers. Through real-time coordination by the OS, malicious clients strategically adapt their gradient updates to evade defenses deployed by the PS, while either severely degrading global model performance or steering training toward adversarial objectives.To mitigate this threat, we offer a detection mechanism that estimates each client's true gradient from historical updates, enabling real-time detection of coordinated malicious behavior without additional overhead. We further introduce an in-situ recovery mechanism that restores global model performance without restarting training, preserving convergence and minimizing recovery time. Comprehensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 benchmark datasets demonstrate that Fed-ADR's attack scheme can reduce global accuracy from over 90% to below 10%, bypassing several state-of-the-art defenses. When our detection and recovery modules are employed, they identify malicious clients and restore accuracy to over 90% within a few rounds, at a substantially lower cost than retraining from scratch--achieving a reduction of at least 20x in computational overhead.

1 Introduction

The introduction presents Fed-ADR as a coordinated attack framework that adapts malicious client updates to evade parameter-server defenses, alongside mechanisms for detection and recovery. Its experiments report severe accuracy loss under attack and recovery at substantially lower computational cost than retraining.

1 Introduction

  • Existing defenses use thresholds or assume attackers act independently, leaving them vulnerable to false positives or coordinated adversaries.The introduction identifies robust aggregation and historical-gradient detection among the approaches with these limitations.Source: §1 · p. 1
  • Restarting training from scratch is impractical because malicious clients could rejoin, motivating recovery that restores performance without full retraining.Source: §1 · p. 2
  • On MNIST, global accuracy falls from 92.62% to 9.22% under MUD-HoG; recovery restores it from approximately 9% to 90% with at least 20× lower overhead than retraining.The attack coordinates malicious clients through an orchestrator that adjusts their gradients to evade the parameter server.Source: §1 · p. 2
  • Fed-ADR combines an orchestrator-coordinated attack with detection based on update consistency over historical rounds and recovery that estimates clients’ pre-attack parameters.The orchestrator adjusts local gradients to appear benign, without requiring direct communication among malicious clients.Source: §1 · p. 2

2 Related Work

The related work reviews attack strategies and defenses for federated learning, then identifies coordinated attacks and in-place recovery as gaps addressed by this paper.

2.1 Attack Strategies in Federated Learning

  • Targeted attacks seek specific incorrect outputs, while untargeted attacks degrade overall performance through strategies such as label manipulation, noise, or sign flipping.The reviewed examples include label flipping and backdoor triggers for targeted attacks, and gradient divergence and sign-bit flipping for untargeted attacks.Source: §2.1 · p. 2
  • Prior attack work typically targets one or two attack types, while the authors identify a gap in holistic attacks that compromise training while evading early detection.Source: §2.1 · p. 2

2.2 Defense Mechanisms in Federated Learning

  • Defenses include robust aggregation and history-based detection, but methods can rely on heuristics, struggle with diverse attackers, or suppress poisoned updates without removing malicious clients.Source: §2.2 · p. 2
  • Attacks may compromise the global model before detection, and retraining from scratch adds cost; the paper proposes defense and recovery without full retraining.Source: §2.2 · pp. 2–3

3 Federated Learning System & Threat Modeling

The section describes iterative federated training in which clients send local updates to a parameter server for aggregation, then specifies the attack and server assumptions. The threat model allows orchestrators to coordinate malicious clients while the defender detects and recovers using observed updates and history.

3.1 System Model and Problem Formulation

  • Clients train on private datasets, send local updates to the parameter server, and receive the aggregated global model for the next round.FedAvg weights local models by dataset size, and training continues until a termination criterion is met.Source: §3.1 · p. 3
  • A malicious client can craft a poisoned update to evade filtering, allowing it into aggregation and potentially compromising global-model performance.The paper proposes defense and recovery that restore the model without requiring benign clients to restart training.Source: §3.1 · p. 3

3.2 Threat Model & Server Capabilities

  • The threat model includes targeted and untargeted attacks, with adversaries seeking to degrade accuracy, hinder convergence, or deceive the parameter server’s defenses.Source: §3.2 · p. 3
  • Orchestrators can intercept colluding clients’ updates, know the parameter server’s defenses, and coordinate attacks without direct communication among malicious clients.The defender has update histories but no access to clients’ private data, labels, or training processes, and operates in a gray-box setting.Source: §3.2 · pp. 3–4

4 Proposed Fed-ADR Framework

Fed-ADR combines a coordinated attack that deceives the parameter server with detection and recovery mechanisms designed to identify malicious clients and restore the global model without retraining from scratch.

4 Proposed Fed-ADR Framework

  • Fed-ADR couples a strategic attack, a defense that detects and isolates malicious clients, and a recovery scheme that reconstructs compromised-round updates from historical data.The framework is designed to restore global-model accuracy without retraining from scratch.Source: §4 · p. 4

4.1 Fed-ADR Attack Scheme

  • The orchestrator server coordinates targeted and untargeted attackers, adapting poisoned gradients using current and historical updates to evade the parameter server’s defenses.The OS assumes access to its colluding clients’ gradients and the PS’s aggregation and defense mechanisms, but not benign clients’ gradients.Source: §4.1 · pp. 4–5

4.2.1 Detection Mechanism.

  • The detection mechanism estimates each client’s update using an integrated Hessian approximated by L-BFGS, then clusters sliding-window maliciousness scores to identify clients.When scores form two clusters, the one with the higher average score is labeled malicious; detected clients are excluded from future aggregation.Source: §4.2.1 · pp. 6–7

4.2.2 Recovery Mechanism.

  • Recovery uses stored client updates and global-model snapshots to reconstruct updates, with bootstrapping, periodic exact-update checks, validation, and final-round fine-tuning.The validation threshold Γ balances over-detection and the risk of admitting harmful updates, and is dynamically calibrated using historical data.Source: §4.2.2 · p. 7

5 Performance Evaluation

Fed-ADR is evaluated against robust aggregation defenses across client populations, datasets, and attack settings, then assessed for detection, recovery, and computational cost. The experiments report substantial attack-induced accuracy losses and recovery performance that approaches or exceeds retraining outcomes at lower cost.

5.1 Experimental Setup

  • Experiments span 40–300 clients, 5%–45% malicious clients, three datasets, non-IID Dirichlet partitions, and Krum, Trimmed Mean, FoolsGold, and MUD-HoG baselines.The primary heterogeneity setting is α=0.9, with additional tests at α=0.7, 0.5, and 0.3; the recovery comparison uses restarting from scratch after malicious clients are removed.Source: §5.1 · pp. 7–8

5.2 Evaluation Results of the Fed-ADR’s Attack Scheme

  • At 10% malicious clients, MUD-HoG accuracy fell 91.35% to 67.46% (MNIST), 83.86% to 68.46% (F-MNIST), and 69.89% to 10% (CIFAR-10); above 30%, all baseline defenses failed.Figure 3 compares accuracy across datasets and malicious-client ratios from 5% to 45%, with attacks starting at round 1.Source: §5.2 · p. 8, Figure 3 · p. 9
  • On Fashion-MNIST, 20% malicious clients held accuracy at 10% for α=0.9, 0.7, and 0.5, while α=0.3 recovered to about 30% by round 40; at 30%, all α remained at 10%.At 10% malicious clients, effectiveness varied by distribution: α=0.7 collapsed to the 10% baseline, while α=0.9 and 0.5 partially recovered to 30%–38%.Source: §5.2 · p. 8, Figure 4 · p. 9
  • A single orchestrator maximized disruption; distributing clients across three orchestrators restored nearly 75% accuracy at 10% malicious clients, while 30% still overwhelmed the defense.The multiorchestrator comparison uses Fashion-MNIST with 100 total clients and disruption beginning at round 10.Source: §5.2 · p. 10, Figure 6 · p. 11
  • With 20% malicious clients, FedAvg, Trimmed Mean, and FoolsGold collapsed near 10% when the OS assumed MUD-HoG; Krum rebounded to about 60%–70% around round 30 after roughly 20 disrupted rounds.The defense-mismatch experiment evaluates Fashion-MNIST, with the attack optimized for MUD-HoG and starting at round 10.Source: §5.2 · p. 10, Figure 7 · p. 11

5.3 Evaluation Results of Fed-ADR’s Defense & Recovery Schemes

  • On MNIST, recovery and retraining both reached 80%–90% accuracy by round 40, but recovery converged 10–20 rounds faster and reduced computation time by up to 73.8% versus training from scratch.Recovery times remained stable or improved over time by recovering affected rounds rather than restarting; reported computation-time savings ranged from 19.7% to 74%.Source: §5.3 · p. 10, Table 2 · p. 11, Figure 8 · p. 12
  • At 35% malicious clients, ACC stayed approximately 92.7% on MNIST and reached 85.91% on Fashion-MNIST, while ACP converged to 11.54%–11.67%.Table 1 reports defense and recovery performance across datasets, rounds, and attack rates.Source: §5.3 · p. 10, Table 1 · p. 11
  • For 40-client Hessian-based recovery, HVPs took 0.02 seconds on MNIST and 0.05 seconds on Fashion-MNIST, with 180 MB and 500 MB server-side Hessian memory, respectively.On MNIST under a 35% attack, the most efficient tested recovery configuration was t_b=4, t_c=2, and t_f=4, with 32 ms HVP cost and 108 optimizer calls.Source: Table 3 · p. 11, §5.3 · pp. 11–12, Table 4 · p. 12

6 Conclusion and Future Work

Fed-ADR combines a coordinated gradient attack with detection and recovery mechanisms, and experiments on three public benchmarks report accuracy degradation and restoration. Future work will consider orchestrators that infer the deployed defense online.

6 Conclusion and Future Work

  • Fed-ADR coordinates poisoned updates through an orchestrator server, while its detection and recovery components identify malicious clients and restore accuracy without full retraining.The detection scheme estimates clients’ true gradients from past updates without added communication or computation overhead.Source: §6 · p. 12
  • On MNIST, Fashion-MNIST, and CIFAR-10, Fed-ADR reduces accuracy from over 90% to below 10%, while detection and recovery restore it to around 90% within a few rounds.The reported defense and recovery overhead is minimal.Source: §6 · p. 12
  • Future work will explore orchestrators that infer the deployed defense online instead of assuming it.Source: §6 · p. 12

A Open Science

The authors provide implementation code and scripts to reproduce every reported figure and table, and document the public datasets and experimental settings.

A Open Science

  • The implementation, baseline defenses, and scripts for reproducing every reported figure and table are available.Source: A Open Science · p. 13
  • Experiments use public MNIST, Fashion-MNIST, and CIFAR-10 datasets, with no new data collected.Source: A Open Science · p. 13
  • The repository documents the experimental environment, hyperparameters, and random seeds.Source: A Open Science · p. 13

B Ethical Considerations

The authors considered misuse risks in releasing a working federated-learning attack and judged disclosure justified alongside its defenses and recovery mechanisms. The attack requires control of multiple clients and knowledge of the server’s aggregation rule.

B Ethical Considerations

  • The attack remains dual-use, and the authors weighed its potential for misuse before release.Source: B Ethical Considerations · p. 13
  • The attack requires control of several clients at once and knowledge of the aggregation rule used by the server.The authors describe this as a stronger position than the single, non-colluding attacker assumed by current defenses.Source: B Ethical Considerations · p. 13
  • The paper releases the detection and recovery mechanisms alongside the attack, so practitioners receive the proposed remedy with the disclosed weakness.Source: B Ethical Considerations · p. 13

C Evaluating the Evasion Capability of Our Attack Against MUD-HoG Defense

On MNIST, the experiments test Fed-ADR against MUD-HoG with 45% malicious clients and attack starts at rounds 1, 10, 20, and 30. When attacks start at round 10, many malicious clients remain undetected, including in targeted attacks.

C Evaluating the Evasion Capability of Our Attack Against MUD-HoG Defense

D Impact of the Fed-ADR Attack Scheme Across Different Client Sizes

Fed-ADR’s impact tends to increase with client count, particularly on Fashion-MNIST, where data distributed across many clients slows convergence and makes the model more susceptible. The attack is most impactful early in training, though its effects on Fashion-MNIST become more pronounced later.

D Impact of the Fed-ADR Attack Scheme Across Different Client Sizes

  • As client counts rise from 100 to 300, model performance tends to decline, particularly on Fashion-MNIST.The passages attribute this pattern to slower convergence and greater susceptibility when data is distributed across more clients.Source: D Impact of the Fed-ADR Attack Scheme… · p. 14
  • The attack is most impactful early in training, when the model is still learning fundamental patterns.On Fashion-MNIST, effects become more pronounced later as the model struggles to integrate knowledge from a fragmented client base.Source: D Impact of the Fed-ADR Attack Scheme… · p. 14
  • Higher error rates at larger client sizes suggest that the attack becomes increasingly effective, especially with dispersed data.The passages describe this effect for federated learning scenarios involving many clients.Source: D Impact of the Fed-ADR Attack Scheme… · p. 14

E Algorithms

The algorithms describe how the orchestrator adapts malicious gradients, how the defense detects malicious clients, and how recovery reconstructs the global model without retraining from scratch.

E Algorithms

  • The orchestrator generates candidate gradients with Gaussian perturbations, scores them by simulating server aggregation and detection, then submits selected gradients and updates history.The workflow takes the global model, aggregation type, history length, candidate count, and client histories as inputs, and outputs modified gradients.Source: E Algorithms · p. 14
  • Detection estimates client gradients using L-BFGS-based Hessian-vector approximation, scores inconsistencies over a sliding window, then clusters and removes malicious clients.Clustering uses Gap Statistics to identify clients for removal from aggregation.Source: E Algorithms · p. 14
  • Recovery bootstraps with exact gradients, reconstructs updates using L-BFGS-based Hessian approximation with periodic correction and validation, then fine-tunes with exact gradients.The workflow returns a reconstructed global model without retraining from scratch.Source: E Algorithms · p. 14
  • Figure 10 covers MUD-HoG and Trimmed Mean under attack across 100, 200, and 300 clients on MNIST and Fashion-MNIST, with malicious ratios from 10% to 50%.The attack starts at round 10 for MUD-HoG and round 1 for Trimmed Mean.Source: Figure 10 · p. 15

1 Bootstrapping: for 𝑡= 1 to 𝑇𝑏do

The bootstrapping steps shown request exact gradients for correction, mark an update as abnormal, and collect exact gradients to update the model.

1 Bootstrapping: for 𝑡= 1 to 𝑇𝑏do

  • Exact gradients are requested for correction during the displayed update process.This step is identified in the Adaptive Correction & Validation subsection.Source: §4 · p. 15
  • An update is marked as abnormal in the displayed process.The supplied step places this action within Adaptive Correction & Validation.Source: §4 · p. 15
  • Exact gradients are collected and used to update the model.This action is listed as a separate step in Adaptive Correction & Validation.Source: §4 · p. 15

Related papers

Loading 2609.27124v1…