Exploiting Feature Non-IIDness for Untargeted Data Poisoning Attacks in Byzantine-Robust Federated Learning

Abstract

Federated Learning (FL) allows multiple clients (e.g., edge devices) to collaboratively train a global machine learning model without sharing their local, private data. However, FL systems are vulnerable to poisoning attacks from compromised clients controlled by adversaries, who aim to degrade the global model’s performance by uploading malicious updates to the server. This vulnerability has led to the development of Byzantine-robust FL systems that employ Robust Aggregation (RA) rules to detect and filter out such malicious updates. Although recent studies have proposed various attacks to bypass RA rules and inject malicious updates into the global model, many rely on strong or impractical assumptions, limiting their practicality in real-world FL deployments. In this paper, we identify and exploit feature non-IIDness, demonstrating that by manipulating only the features of local data on compromised clients, adversaries can generate malicious updates to bypass RA rules and significantly degrade the global model’s performance. We formulate these data poisoning attacks as optimization problems, propose solutions, and evaluate them against multiple Byzantine-robust defense strategies on real-world datasets. Our results show that these attacks are highly practical, requiring significantly less knowledge and fewer assumptions than other state-of-the-art untargeted poisoning attacks while achieving better performance. To address the severe impact of feature non-IIDness, we also propose a novel local defense mechanism called Local Feature-oriented CutMix (LFCM). Experimental results show that LFCM effectively mitigates data poisoning attacks in some scenarios while maintaining high global model performance.