PaperlayerView exact revision on arXiv

Source-linked AI summary

Clean-label Poisoning Attack and Defense Game for Federated Learning in Vehicular Networks

Yalin E. Sagduyu, Tugba Erpek, Nathan Stephenson, Mengran Xue

arXiv:2610.32765v1cs.NIcs.AIcs.DCcs.LGeess.SP

TL;DR

Vehicular federated learning can be poisoned by clean-label attacks that preserve labels while shifting benign features toward malicious extremes. The paper pairs this attack with a feature-consistency relabeling defense and models their strategic interaction. Attack success scales with compromised nodes, while the defense keeps it low without degrading clean accuracy and shifts equilibrium regions toward no-attack outcomes.

  • Problem

    Federated learning supports vehicular anomaly detection without sharing raw data, but compromised nodes can poison training, and clean-label attacks evade obvious detection by preserving labels.

    Source: §I · p. 1

  • Method

    The paper introduces a feature-space clean-label attack, a feature-consistency defense that relabels suspicious samples, and a game-theoretic model of attacker-defender strategies and costs.

    Source: §I · p. 1, B. Payoff Model · p. 3

  • Results

    Attack success rises with attacked nodes without defense, while the proposed defense keeps it low and clean accuracy nearly constant; stronger defense effectiveness shifts equilibrium regions toward no-attack outcomes.

    Source: §III · p. 2, §VI · p. 4, §VII · p. 5

  • Takeaways & Limitations

    In this vehicular FL setting, combining relabeling with equilibrium analysis links reduced attack success to attacker incentives and no-attack outcomes.

    Source: §VI · p. 4, §VII · p. 5

Abstract

from arXiv · show

This paper studies interactions between clean-label poisoning attack and defense in vehicular networks using federated learning (FL). Basic Safety Message (BSM) classification for anomaly detection is modeled as a distributed learning problem over a vehicular network with dynamic topology. As a critical threat to FL, a feature-space clean-label attack is introduced, wherein benign samples are perturbed toward malicious feature extremes, degrading class separability while preserving labels. To counter this, a feature-consistency relabeling defense is proposed to detect and relabel suspicious samples. A game-theoretic framework is developed to capture attack-defense interactions and characterize equilibrium strategies based on attack effectiveness and cost parameters. Results show that the attack scales effectively with compromised nodes, while the proposed defense keeps attack success low without degrading clean accuracy and shifts equilibrium regions toward attack-averse regimes.

I. INTRODUCTION

Reliable classification of Basic Safety Messages (BSMs) is essential for vehicular safety, while federated learning (FL) offers distributed training but exposes models to poisoning. The paper introduces a feature-space clean-label attack, a feature-consistency relabeling defense, and a game-theoretic analysis of their interaction.

I. INTRODUCTION

  • BSM reliability is critical because falsified vehicle-state messages can create hazardous outcomes, making accurate benign-versus-malicious classification essential.BSMs support situational awareness, collision avoidance, and traffic management.Source: §I · p. 1

A. Anomaly Detection Problem in Vehicular Networks

  • FL supports distributed training without sharing raw data, but compromised nodes can poison global training in networks where centralized detection faces heterogeneity, privacy, and topology challenges.The paper models anomaly detection over vehicular BSMs, where samples encode vehicle states and consistency or plausibility information.Source: §I · p. 1, A. Anomaly Detection Problem in… · pp. 1–2

I. INTRODUCTION

  • The feature-space clean-label attack preserves labels while shifting features toward malicious patterns, degrading malicious-sample detection while retaining high accuracy on clean data.Its evaluation applies the same feature replacements to malicious test samples without a learned trigger.Source: §I · p. 1
  • The proposed defense relabels samples whose features conflict with their labels, while a non-cooperative game models attack and defense costs and characterizes Nash equilibria.The paper identifies operating regions and analyzes how system parameters influence security outcomes.Source: §I · p. 1

B. Federated Learning over Vehicular Networks

Vehicular FL trains local models and aggregates updates over a changing communication graph, creating a route for poisoned updates to spread. The paper's clean-label attack modifies selected benign features toward malicious extremes while preserving labels; attack success rises with compromised nodes, whereas defense keeps it low and clean accuracy nearly constant.

B. Federated Learning over Vehicular Networks

  • Vehicular FL aggregates neighbor models over a time-varying graph, allowing poisoned local updates to propagate through connected components.This decentralized setup reflects dynamic connectivity and heterogeneous data.Source: B. Federated Learning over Vehicular… · p. 2

III. CLEAN-LABEL POISONING ATTACK

  • The attacker selects informative features using top SHAP scores and builds target values from upper-tail malicious-feature statistics, using quantiles above 0.99 in numerical results.The selected benign samples are modified while their labels are preserved.Source: §III · p. 2
  • The attack mixes the original benign feature distribution with a target distribution concentrated near malicious extremes, reducing class separability and shifting the decision boundary.Modified malicious test samples are evaluated for classification as benign, without an explicit trigger.Source: §III · p. 2
  • Attack success increases significantly as attacked nodes increase, while clean accuracy remains nearly constant and the proposed defense keeps attack success low.The evaluation uses a poisoning rate of 0.1 and applies the selected feature replacements to malicious test samples.Source: §III · p. 2, Figure 1 · p. 2

IV. FEATURE-RELABEL DEFENSE

The feature-consistency defense identifies benign-labeled samples that resemble malicious data, then relabels suspicious samples and removes residual outliers before federated updates. Its suspicion score combines feature-distance, tail, neighborhood, loss, and duplicate-pattern evidence.

IV. FEATURE-RELABEL DEFENSE

  • The defense models selected informative features using benign and malicious class means and coordinate-wise standard deviations, with a diagonal covariance approximation for efficient computation.The distance score is larger when a sample is closer to the malicious distribution than the benign distribution.Source: §IV · pp. 2–3
  • Tail, neighborhood, and loss-based scores complement distance by checking malicious-feature extremes, neighboring labels, and loss inconsistency for benign-labeled samples.The neighborhood score is the fraction of malicious labels among the K nearest neighbors; results use K = 11.Source: §IV · p. 3
  • The combined suspicion score adds a duplicate-pattern indicator because deterministic overwriting may create near-identical samples.The score is a weighted sum of the five suspicion signals.Source: §IV · p. 3
  • Before federated updates, the defense standardizes suspicion scores, relabels the highest-scoring suspicious samples within a budget, then removes selected remaining outliers.Numerical results use a suspicion threshold of 2.25; relabeling precedes removal.Source: §IV · p. 3

V. GAME FOR ATTACK-DEFENSE INTERACTIONS

The paper models attack-defense interaction as a two-player normal-form game, with the number of attacked nodes treated as a fixed parameter and zero attacks represented by nA = 0.

  • The interaction is modeled as a two-player normal-form game between a defender and an attacker.Source: §V · p. 3
  • The defender chooses whether to deploy protection, while the attacker decides whether to attack.Source: §V · p. 3
  • The number of attacked nodes nA is fixed, with nA = 0 corresponding to no attack.Source: §V · p. 3

A. Strategy Spaces

The game assigns each player attack or defense actions and defines utilities from attack success, its reduction under defense, and the players’ costs.

A. Strategy Spaces

  • The defender chooses D or ND, and the attacker chooses A or NA; A attacks nA > 0 nodes, while nA = 0 corresponds to NA.Source: A. Strategy Spaces · p. 3

B. Payoff Model

  • The attacker’s reward is attack success probability, the defender’s reward is its reduction, and each player’s utility is reward minus cost.Source: B. Payoff Model · p. 3
  • The payoff matrix gives outcomes for attack and no-attack choices under defense and no defense.Source: B. Payoff Model · p. 3
  • For nA = 0, the outcome is (ND, NA) when cD > 0; clean accuracy is comparable across defense settings and is excluded from defender utility.Source: B. Payoff Model · p. 3

C. Best Responses

The section states best-response conditions for positive attack scale and specifies the defender’s response when the attacker chooses no attack.

D. Pure-Strategy Nash Equilibria

The section gives iff conditions for pure-strategy equilibrium profiles and rules out (D, A) as an equilibrium when defense has positive cost.

E. Mixed-Strategy Equilibrium

For nA > 0, the mixed-strategy analysis uses the players’ indifference conditions to characterize their equilibrium probabilities. With no attacked nodes, the equilibrium is no defense and no attack.

E. Mixed-Strategy Equilibrium

  • For nA > 0, the defender’s and attacker’s mixing probabilities are characterized by their respective indifference conditions.The passages define pD as the probability of defense and pA as the probability of attack.Source: E. Mixed-Strategy Equilibrium · p. 4
  • In a strict mixed equilibrium, the attacker’s equilibrium payoff is zero.The passage states that a strict mixed equilibrium exists if and only if a condition is met, but the condition is not included here.Source: E. Mixed-Strategy Equilibrium · p. 4
  • When nA = 0 and cD > 0, the equilibrium is (ND, NA), with neither defense nor attack deployed.No nodes are attacked, so the attacker incurs no attack cost.Source: E. Mixed-Strategy Equilibrium · p. 4

VI. GAME EQUILIBRIUM REGIONS AND UTILITIES

Equilibrium areas depend on attack and defense costs and on nA: as nA grows, the attack and defense regions expand while no-attack and no-defense regions shrink. The regions are partitioned by cost thresholds, and equilibrium utilities vary across them.

VI. GAME EQUILIBRIUM REGIONS AND UTILITIES

  • The equilibrium regions are bounded by cA = rD(nA), cA = rA(nA), and cD = ∆(nA); the mixed region has rD(nA) < cA < rA(nA) and 0 < cD < ∆(nA).For nA = 40, small changes in cA near rD(nA) and rA(nA) produce sharp transitions; larger ∆(nA) expands defense-relevant and mixed regions.Source: §VI · p. 4, Figure 2 · p. 4
  • Attacker utility is positive only in pure-attack regions and zero in mixed and (ND, NA) regions; defender utility is highest in (ND, NA).Defender utility is independent of cD in (ND, A) and decreases with cD in (D, A) and mixed regions.Source: §VI · p. 4, Figure 3 · p. 5, Figure 4 · p. 5
  • For each fixed nA, equilibrium areas are computed over a bounded (cA, cD) domain using thresholds cA = rD(nA), cA = rA(nA), and cD = ∆(nA).Pure-strategy regions contribute rectangular areas, while the mixed region is apportioned using equilibrium mixing probabilities.Source: §VI · pp. 4–5
  • As nA increases, attack and defense regions grow while no-attack and no-defense regions shrink, shifting the system toward no-attack dominance as ∆(nA) grows.Fig. 5 plots equilibrium areas versus nA under fixed cA; the passage attributes the shifts to changes in rA(nA), rD(nA), and ∆(nA).Source: §VI · p. 5, Figure 5 · p. 5

VII. CONCLUSION

The paper unifies clean-label feature-space poisoning, relabeling defense, and game-theoretic analysis for federated anomaly detection in vehicular networks. Results show reduced attack success and a shift toward no-attack equilibria.

VII. CONCLUSION

  • The framework combines a feature-space attack, a feature-label consistency relabeling defense, and game-theoretic analysis of attacker incentives.The defense uses distance, malicious-tail, neighborhood-label, loss-based, and duplicate-pattern evidence.Source: §VII · p. 5
  • The defense reduces attack success and shifts equilibria toward no attack.The conclusion presents these as outcomes of the unified attack-defense framework.Source: §VII · p. 5
  • The attack exploits feature overlap to remain stealthy and scalable, and is evaluated by modifying malicious samples without explicit triggers.Source: §VII · p. 5
  • The game-theoretic analysis identifies threshold structures governing equilibria and how defense effectiveness reshapes attacker incentives.Source: §VII · p. 5

Related papers

Loading 2610.32765v1…