Source-linked AI summary
Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks
Will Jedrzejczak, Cole Walther, Dilpreet Gill, Moh Khalid Hasan
TL;DR
Federated UAV spoofing detection can preserve receiver-data privacy, but accuracy-weighted aggregation relies on client reports the coordinator cannot verify. This paper replaces those reports with coordinator-built receiver-domain probes; under IID clients, probing suppresses the attack, while client heterogeneity remains a limitation.
Problem
Accuracy-weighted federated learning relies on client-reported metrics that the coordinator cannot verify because it does not see client data.
Source: A. Federated Detection · p. 2Method
Receiver-domain behavioral probing scores each submitted model on counterfactual spoofed samples built by the coordinator, without consulting reported accuracy.
Source: §I · p. 1Results
Under IID clients, probing removes the attacker’s advantage and flags compromised aircraft at a 0.3% honest false-flag rate.
Source: §VI · p. 6Takeaways & Limitations
The method needs no exact attacker count under an honest-majority assumption, unlike Byzantine-robust rules configured for a fixed f.
Source: §VI · p. 6Under client skew, cohort-relative suspicion loses flagging power and the median layer provides essentially all of the defense’s protection.
Source: C. Client Heterogeneity: Where the… · pp. 5–6
Abstract
from arXiv · showhide
Federated learning lets a UAV fleet train a shared GPS spoofing detector without raw receiver data leaving any aircraft, and several recent UAV-FL designs weight each client by the validation accuracy it reports about itself. We show this self-report is an exploitable attack lever: two compromised clients of ten that poison part of their data, scale their updates, and inflate their reported accuracy raise backdoor lift to +0.3036, higher than the same attack achieves without lying. We propose receiver-domain behavioral probing, in which the coordinator evaluates every submitted model on counterfactual spoofed samples built by driving each discriminative GPS feature to a benign value, weighting clients by what their models do rather than what they claim. Under independent and identically distributed clients this reduces attacker-induced lift to -0.0265, statistically indistinguishable from an honest fleet, while flagging the compromised aircraft. Unlike Byzantine-robust aggregation it needs no exact attacker count, only an honest majority: when the true count exceeds the configured value, Multi-Krum degrades from +0.0061 to +0.2837 while ours stays near baseline. Evaluation uses one public single-receiver dataset partitioned into simulated clients; we also report where the mechanism fails, under strong client heterogeneity.
I. INTRODUCTION
UAV GPS spoofing detection is safety-relevant, and federated learning keeps receiver data on aircraft, but some aggregation schemes rely on client-reported metrics that coordinators cannot verify. The paper attacks this trust assumption with receiver-domain probing and evaluates where the mechanism works and fails.
I. INTRODUCTION
- Existing UAV-FL systems use client-reported performance or behavioral metrics for weighting, and assume those reports are truthful.The cited examples include Chai et al., Ud Din et al., and Mowla et al..Source: §I · p. 1
- The privacy constraint prevents coordinators from inspecting client data to verify self-reported metrics, leaving that metric as an adversarial lever.Prior defenses either target different aggregation rules or inspect client data distributions unavailable in privacy-preserving deployments.Source: §I · p. 1
- The mechanism needs no exact attacker count under IID conditions, flags individual aircraft, and degrades under client heterogeneity, where robust aggregation provides a backstop.Multi-Krum is highly competitive in the nominal setting.Source: §I · p. 1
- Two compromised clients of ten raise backdoor lift from +0.2415 to +0.3036 by inflating their reported accuracy.The reported metric makes the weighted rule worse than no weighting at all.Source: §I · p. 1
- Receiver-domain behavioral probing scores submitted models on coordinator-built counterfactual spoofed samples across discriminative receiver features, without using client-reported metrics.The probes make accuracy inflation inert by construction.Source: §I · p. 1
II. SYSTEM AND THREAT MODEL
UAV clients train locally on private, labeled GPS receiver observations and transmit model parameters and accuracy-derived weights. The coordinator aggregates with those weights but cannot inspect client data or verify the reported accuracy.
II. SYSTEM AND THREAT MODEL
- Each UAV holds private per-epoch GPS receiver observations labeled authentic or spoofed and runs local training steps after the coordinator broadcasts global parameters.The system denotes each client’s private dataset as Di.Source: A. Federated Detection · p. 2
- Clients compute accuracy on their own local validation sets, normalize it into a weight, and transmit that weight with their trained model.The server applies the received weights directly.Source: A. Federated Detection · p. 2
- The server cannot recompute or validate client accuracy because it never sees the private data, while it holds a small clean root set as the proposed method’s trust anchor.The weighted aggregation is a convex combination and reduces to FedAvg when all clients report equal accuracy.Source: A. Federated Detection · p. 2
B. Adversary
The adversary controls fewer than half of the UAV clients and combines partial data poisoning, update scaling, and accuracy inflation to increase a backdoor while keeping ordinary-data accuracy near an honest run.
B. Adversary
- The adversary controls fewer than half the clients and can author everything compromised aircraft transmit, but cannot access honest clients or the coordinator’s root set.The honest-majority bound is needed for the cohort statistics used by rank-based defenses.Source: B. Adversary · p. 2
- The attack seeks to make trigger-bearing spoofed samples appear authentic while keeping accuracy on ordinary traffic within the noise of an honest run.Its three coupled steps are poisoning, model-replacement scaling, and accuracy inflation.Source: B. Adversary · p. 2
- For a fraction of spoofed rows, the attacker sets one discriminative feature to its benign-high value and flips the label to authentic.The chosen value is the authentic distribution’s 75th percentile.Source: B. Adversary · p. 2
- The compromised feature remains within its own benign marginal range, so per-feature range or threshold checks do not flag it, although joint-density checks could separate the rows.Only a fraction of rows is poisoned to avoid conspicuously shifting client accuracy and update direction.Source: B. Adversary · p. 2
- The attacker scales its update away from the global model to counter dilution, using γ = 3.0 rather than the approximately N scale needed for full replacement.The paper characterizes this as quieter than the strongest attack form.Source: B. Adversary · p. 2
- Inflated client accuracy drives the attacker’s aggregation weight upward, exploiting a scalar that defenses focused only on model parameters cannot see.The lever applies only to rules that consume an unverified client-supplied metric.Source: B. Adversary · p. 2, Figure 1 · p. 2
C. Objective and Metrics
The evaluation reports backdoor success and lift, plus client flagging or exclusion depending on how an aggregation rule operates.
C. Objective and Metrics
- Backdoor success rate is the fraction of trigger-bearing spoofed test samples classified as authentic, while backdoor lift subtracts the same seed’s honest-FedAvg success rate.Lift is primary because benign-range triggers already cause honest detectors to misclassify many samples.Source: C. Objective and Metrics · p. 2
- For rules assigning weights, client flagging measures compromised clients held below half the uniform weight and honest false flags measure the same for honest clients.Both are computed over client-rounds.Source: C. Objective and Metrics · p. 2
- For selection rules without explicit weights, exclusion measures the fraction of compromised client-rounds omitted from the selected set.Exclusion and client flagging describe different mechanisms and are not interchangeable.Source: C. Objective and Metrics · p. 3
A. Design Requirements
The design requires coordinator-computable, trigger-agnostic and attributable client scoring without knowing the attacker count. Behavioral probing meets these requirements by comparing submitted models on counterfactual spoofed inputs.
A. Design Requirements
- Behavioral probing targets four requirements: coordinator-computable inputs, trigger-agnostic scoring within the probed set, no exact attacker count, and identification of misbehaving aircraft.An honest majority is still assumed.Source: A. Design Requirements · p. 3
B. Probe Construction
- Each probe overwrites one discriminative feature of a spoofed root row with its benign-high value, leaving the other features spoofed and the label known.The method probes each feature with class-separation Cohen’s d ≥0.05; the benign-high value is the 75th percentile of that feature’s authentic distribution.Source: B. Probe Construction · p. 3
- A backdoored model’s recall falls further on the trigger-feature slice than the honest cohort’s, so probing uses a cohort-relative deficit rather than an absolute recall threshold.Even honest models may have recall below one because overwriting a discriminative feature removes real evidence.Source: B. Probe Construction · p. 3
C. Suspicion and Trust
The method measures each client’s worst feature-specific recall deficit against cohort behavior, then converts suspicion into trust. Clean-root accuracy also influences trust, and trust-scaled updates are combined by a coordinate-wise median.
C. Suspicion and Trust
- Suspicion is the largest client recall deficit below the cohort median across probed slices, expressed in units of each slice’s median absolute deviation.The one-sided, relative statistic avoids penalizing above-median recall and accommodates honest recall drift as the global model trains.Source: C. Suspicion and Trust · p. 3
- Median and MAD tolerate corruption of up to half the cohort, while taking the maximum across features preserves a localized backdoor signal that averaging could dilute.The method assumes M < N/2.Source: C. Suspicion and Trust · p. 3
- Client trust is gated by suspicion and modulated by coordinator-measured accuracy on the clean root set; a dead-zone reduces honest false flags, and an EMA smooths trust across rounds.Development runs reduced honest false flags from 20.5% to 0.3% without loss of attacker flagging. Trust-scaled updates are combined by a coordinate-wise median.Source: C. Suspicion and Trust · p. 3
D. Composition, Cost and Scope
The method pairs targeted trust scoring with an untargeted coordinate-wise median, addressing different failure modes. Its coordinator-side probing requires forward passes that scale linearly with fleet size and probed-feature count, without changing client compute or uplink.
D. Composition, Cost and Scope
- Trust scoring identifies misbehaving clients but depends on informative cohort statistics; the coordinate-wise median identifies no client but bounds any single update’s influence regardless of its score.The table caption distinguishes client-flagging entries from Krum and Multi-Krum’s fraction of compromised client-rounds excluded; those measures are not directly comparable.Source: D. Composition, Cost and Scope · p. 3, Table I · p. 4
- Each round trains clients locally, evaluates their models on probe slices, computes cohort-based suspicion and trust, and aggregates trust-scaled updates by coordinate-wise median.The median is untargeted; it does not identify individual clients.Source: D. Composition, Cost and Scope · pp. 3–4
- Coordinator computation uses |Fprobe| N forward passes over spoofed data plus one accuracy evaluation per client, scaling linearly with fleet size and probed-feature count.Client compute and uplink are unchanged; no backward pass is needed, and submitted models need only be evaluable on feature-vector batches.Source: D. Composition, Cost and Scope · p. 4
IV. EXPERIMENTAL SETUP
The evaluation uses a public software-defined-radio GPS spoofing collection partitioned into simulated clients, so its results characterize the aggregation rule rather than a deployed system. The setup fixes a ten-client split and varies client partitioning, poison draws, initialization, and batch order across three seeds.
IV. EXPERIMENTAL SETUP
- The evaluation uses one public single-receiver dataset partitioned into simulated clients because no public dataset records genuine multi-UAV wireless traffic with labeled attacks.The results characterize the aggregation rule, not a deployed system.Source: §IV · p. 4
- The experiment subsamples 150,000 rows, splits them into test, root, and ten-client training sets, and uses two compromised clients.The three sets are disjoint; the fixed test set is 30,000 rows, the root set is 6,000 rows, and 114,000 rows are distributed across clients.Source: §IV · p. 4
- Figure 2 plots backdoor lift as the true compromised-client count varies while Byzantine-robust baselines remain configured for f = 2; error bars show one standard deviation over three seeds.The figure caption specifies the plotted quantities and error bars, not the comparative outcomes.Source: Figure 2 · p. 4
- Each client trains a 10-64-32-16-1 MLP for three local epochs per round over 12 rounds; reported values are means over three seeds.The test split is fixed at seed 42, while client partition, poison draw, initialization, and batch order vary across seeds 42, 7, and 123.Source: §IV · p. 4
V. RESULTS
The reported attack makes self-reported weighting worse than FedAvg, while Multi-Krum is competitive in the nominal setting; Fig. 3 shows behavioral trust weakening under class-ratio skew.
A. Attack Validity and Comparison with Existing Defenses
- Under class-ratio skew, behavioral trust alone converges toward undefended FedAvg, while the full defense tracks the median.As attacker trust climbs toward the uniform share, flagging collapses.Source: Figure 3 · p. 5
- +0.3036 backdoor lift under accuracy inflation exceeds FedAvg’s +0.2415, while clean accuracy falls by under two points.The attack makes a rule consuming an unverified self-report worse than one ignoring quality entirely.Source: A. Attack Validity and Comparison with… · p. 5
- +0.0061 lift makes Multi-Krum indistinguishable from behavioral trust alone at +0.0039 in the nominal setting.The passage notes that probing is not necessary to suppress this attack in that setting, while adding per-client flagging.Source: A. Attack Validity and Comparison with… · p. 5
B. Unknown Number of Compromised Clients
With the Byzantine-robust rules configured for two attackers, Multi-Krum degrades as the true count rises, while the proposed method stays within a narrow lift range. Under client skew, behavioral flagging collapses and the median layer provides essentially all of the full defense’s protection.
B. Unknown Number of Compromised Clients
- With f=2, Multi-Krum’s lift rises from +0.0061 at two attackers to +0.2837 at four, while the proposed method stays between −0.0265 and +0.0114.Multi-Krum reaches +0.0005 at one attacker and +0.1609 at three; trimmed mean reaches +0.2992 at four.Source: B. Unknown Number of Compromised Clients · p. 5
C. Client Heterogeneity: Where the Mechanism Stops Working
- Under skew, attacker trust rises to 0.0942 and 0.1023 as flagging falls to 8% and 0%; full-defense lift tracks median alone.The full-defense lifts are +0.0647 and +0.1002, compared with median’s +0.0710 and +0.1046.Source: C. Client Heterogeneity: Where the… · p. 5
- Skew inflates MAD_f, shrinking a backdoored client’s deficit relative to cohort spread; lowering τ to 0.5 restores flagging only to 38.9% at an 11.8% honest false-flag cost.The authors identify cohort-relative scaling, rather than the threshold, as the limitation.Source: C. Client Heterogeneity: Where the… · pp. 5–6
D. Trigger Generalization
Receiver-domain probing detects trigger relocation and attributes compromised clients, while adaptive-adversary and root-set studies delimit its operating conditions. The conclusion reports protection under IID clients but reduced reliability under strong heterogeneity.
D. Trigger Generalization
- With one fixed configuration, defended lift is negative for all four tested trigger settings, including PD and the untested CN0+TCD combination.DO and LC yield −0.0470 and −0.0056; relocating the trigger changes which feature slice exposes the client.Source: D. Trigger Generalization · p. 6
E. Per-Client Attribution
- Compromised clients are flagged in 72 of 72 attacker client-rounds at mean trust 0.000, while one honest client-round in 288 is flagged.No honest client is driven to zero trust; a false positive down-weights an aircraft for one round rather than excluding it.Source: E. Per-Client Attribution · p. 6
F. Adaptive Adversary, Root Set, Parameters and Cost
- At λ = 2, probe-evasion raises compromised clients’ mean trust from 0.0001 to 0.0834, while undefended lift falls from +0.2457 to −0.1433.At λ = 10, undefended lift falls to −0.4782; defended lift remains between −0.0253 and −0.0829, but the authors do not claim this trade-off holds for every defense-aware adversary.Source: F. Adaptive Adversary, Root Set,… · p. 6
- Flipping 30% of root-set labels drops flagging to 83.3%, while shrinking the clean root set tenfold to 600 rows moves defended lift only to −0.0276 at 100% flagging.Server cost is 38.6 ms per round at ten clients and 139.1 ms at forty, so the authors make no large-fleet scalability claim.Source: F. Adaptive Adversary, Root Set,… · p. 6
VI. CONCLUSION
- Under IID clients, probing removes attackers’ advantage and flags compromised aircraft at a 0.3% honest false-flag rate, but cohort-relative suspicion degrades under strong heterogeneity.It requires no exact attacker count, only an honest majority; under heterogeneity, the median layer carries protection.Source: §VI · p. 6