An underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients is studied, demonstrating that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Abstract
Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques—label flipping, backdoor trigger injection, and model fingerprinting—which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1–2 training rounds with F1 scores exceeding 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.
Hal Ferguson, Rui Ning, Hongyi Wu et al.· IEEE Internet of Things Jour...· 0 citations
This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
Machine learning requires diverse training datasets from multiple clients for improved performance. However, sharing datasets is often a legal and privacy issue across countries and organizations. Federated Learning (FL) is a machine learning framework allowing individual clients to train datasets locally and share only the weight updates to a central server where the updates are aggregated. FL addresses the security and privacy issues concerned with data-sharing; however, it is vulnerable to poisoning attacks where a malicious client can purposefully alter the model updates. Even a smallest input deviation can exploit the system leading to misclassification. In this study, we propose a lightweight defense mechanism for mitigating poisoning attacks in Federated Learning (FL) systems. Our approach involves transforming model weights into the frequency domain to identify core frequency components containing sufficient model weight information. Additionally, we employ a model filtering algorithm to predict poisoning attacks based on the output of the frequency analysis method. This enables effective filtering of malicious updates during local training on client devices. Our proposed defense mechanism enhances the security and integrity of FL systems against adversarial attack ensuring secure model aggregation.
A. R., D. Renuka· Bulletin of the Polish Acade...· 0 citations
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
Federated Learning (FL) is vulnerable to backdoor attacks, where adversaries can stealthily manipulate the global model. Most existing defense methods are developed under IID assumptions, an assumption that rarely holds in practice. In highly non-IID settings, heterogeneous data distributions across clients make it difficult to distinguish malicious updates from benign ones, particularly when benign clients exhibit atypical patterns due to minority-class data. To address this challenge, existing defenses operate at different levels of granularity. Coarse-grained methods perform client-level filtering, which often mistakenly excludes benign clients under non-IID conditions. Fine-grained methods instead analyze data at the sample level for more precise detection, but typically rely on explicit per-sample gradient analysis, leading to substantial memory and computational overhead. As a result, defending against backdoor attacks in non-IID environments involves a fundamental trade-off between robustness and computational efficiency. To address this challenge, we propose FedRGD, a federated risk-guided dynamic defense framework that enables efficient fine-grained protection. FedRGD maps sample-level risks into structured parameter masking without requiring explicit per-sample gradient storage. It combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency. Extensive experiments on CIFAR-10 and Fashion-MNIST demonstrate that FedRGD consistently reduces the attack success rate while maintaining high main-task accuracy, achieving a favorable security-utility balance with low computational overhead.
Ruiying Wang· Poster Volume 0008 The 2026...· 0 citations
Artificial intelligence (AI) systems are increasingly deployed in high-stakes domains, where poisoning attacks can corrupt training data, manipulate model updates, or implant covert backdoors. This survey examines poisoning attacks in federated learning (FL), using centralized learning as a baseline to explain how distributed data, client heterogeneity, privacy-preserving aggregation, and untrusted coordination expand the threat surface. It positions prior surveys and synthesizes representative primary studies through an accountability-oriented lens focused on attribution, audit evidence, traceability, and forensic readiness. The review compares major attack classes, including data poisoning, model poisoning, backdoor insertion, server-side manipulation, Sybil behavior, collusion, and multi-round poisoning. It also evaluates countermeasures such as Byzantine-robust aggregation, anomaly detection, validation-based filtering, malicious-secure aggregation, authenticated update handling, provenance mechanisms, ledger-based evidence, and verifiable aggregation protocols. The analysis shows that robustness alone is insufficient for trustworthy FL unless defenses also preserve evidence that supports independent verification, post-incident reconstruction, and governance review. Persistent gaps remain in causal forensic attribution, privacy-preserving evidence governance, malicious-server threat modeling, scalable verifiability tooling, recovery after poisoning, and deployment-ready benchmarks. The survey concludes that accountable FL should be designed as an evidence-producing system, not merely as a privacy-preserving or attack-resistant training architecture, especially for regulated, cross-silo, and high-risk real-world deployments.
S. Mohammed, D. Alhadidi, A. Ngom· Journal of Cybersecurity and...· 0 citations
