FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning

Sheng Liu; Panos Papadimitratos

cs.CRMar 19, 2026

FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning

Authors: Sheng Liu, Panos Papadimitratos

Organizations: Networked Systems Security Group, KTH Royal Institute of Technology, 114 28 Stockholm, Sweden

Abstract

FL has emerged as a transformative paradigm for ITS, notably camera-based Road Condition Classification (RCC). However, by enabling collaboration, FL-based RCC exposes the system to adversarial participants launching Targeted Label-Flipping Attacks (TLFAs). Malicious clients (vehicles) can relabel their local training data (e.g., from an actual uneven road to a wrong smooth road), consequently compromising global model predictions and jeopardizing transportation safety. Existing countermeasures against such poisoning attacks fail to maintain resilient model performance near the necessary attack-free levels in various attack scenarios due to: 1) not tailoring poisoned local model detection to TLFAs, 2) not excluding malicious vehicular clients based on historical behavior, and 3) not remedying the already-corrupted global model after exclusion. To close this research gap, we propose FedTrident, which introduces: 1) neuron-wise analysis for local model misbehavior detection (notably including attack goal identification, critical feature extraction, and GMM-based model clustering and filtering); 2) adaptive client rating for client exclusion according to the local model detection results in each FL round; and 3) machine unlearning for corrupted global model remediation once malicious clients are excluded during FL. Extensive evaluation across diverse FL-RCC models, tasks, and configurations demonstrates that FedTrident can effectively thwart TLFAs, achieving performance comparable to that in attack-free scenarios and outperforming eight baseline countermeasures by 9.49% and 4.47% for the two most critical metrics. Moreover, FedTrident is resilient to various malicious client rates, data heterogeneity levels, complicated multi-task, and dynamic attacks.

Figures & tables

Fig. 1: Illustration of TLFAs in FL-RCC systems. (A) Training Phase: Malicious clients deliberately mislabel their data, e.g., from uneven to smooth; thus, their local models are poisoned after local training, and the global model is also poisoned after global aggregation. (B) Inference Phase: Vehicles equipped with the learned model would predict wrong road conditions that threaten transportation safety, e.g., consider actual uneven roads as smooth.

Abbreviation	Meaning
ITS	Intelligent Transportation Systems
DNN	Deep Neural Network
RCC	Road Condition Classification
FL	Federated Learning
TLFA	Targeted Label-Flipping Attack
Non-IID	Non-Independent and Identically Distributed

TABLE I: The list of key abbreviations used in this paper.

Solutions	Detection ∗	Exclusion †	Remediation ‡	Highlights (+ pros and - cons)
TMean/Median [ 24 ]	●	○	○	Removes extremes or takes the median of client updates to limit outlier influence: + Simple, could work when most clients are honest and under IID data - Vulnerable to optimization-based and colluding attacks as well as Non-IID data
FoolsGold [ 11 ]	●	○	○	Down-weights clients whose gradient histories are overly similar: + Directly exploits behavioral similarity as a robust, model-agnostic signal - Effectiveness drops with sophisticated diversification and non-Sybil strategies
FLAME [ 12 ]	◐	○	○	Clusters client updates and injects calibrated noise plus clipping to erase backdoor: + Demonstrates practical backdoor mitigation with modest impact on benign accuracy - Challenged by adaptive attacks and extreme heterogeneity
FreqFed [ 13 ]	◐	○	○	Uses frequency-domain analysis of model updates to distinguish poisoned contributions: + Effectively exposes backdoor and untargeted attacks - Heavily tied to assumed spectral patterns and model structures
LFGurad [ 7 ]	●	○	○	Uses last-layer activations with an SVM to flag malicious participants: + Tailored to vehicular networks with a concrete pipeline for attack detection - Depends on a representative, trusted auxiliary dataset
FLDetector [ 39 ]	◐	◐	○	Checks temporal consistency of local updates via Hessian-informed trajectory prediction: + Works without a clean validation set on the server side - Fragile under strong non-IID and large number of malicious clients

TABLE II: Comparative evaluation of available solutions ( ● Supported ◐ Partially Supported ○ Not Supported)

Notation	Meaning
$K$	The total number of clients/vehicles
$\mathbb{C}$	The entire client cluster
$E$	the number of road condition classes
$S$	The ordered label sequence
$L$	The output layer of RCC model
$\mathbb{D}_{k}$	The local dataset of client $c_{k}$

TABLE III: The list of key notations used in this paper.

Fig. 2: Overview of FedTrident in FL round $t$ : (1) poisoned local model detection based on neuron-wise analysis, (2) malicious vehicular client exclusion based on adaptive rating, and (3) corrupted global model remediation based on machine unlearning.

Fig. 3: Comparison of poisoned and benign models based on three kinds of features: (A) whole model parameters, (B) output layer parameters, and (C) neuron-wise parameters (with two more distinctive clusters).

Fig. 4: Workflow of poisoned local model detection in round $t$ . Steps (1) and (4) extract neuron-wise features and are executed in parallel for each local model. Steps (2) and (3) identify source and target neurons in TLFAs. Step (5) executes the local model clustering based on GMM. Output layer parameters are marked in blue, while identified source and target neuron parameters are marked in red.

Term	Value
Loss Function	Cross-Entropy
Batch Size	64
Learning Rate (LR)	0.03
Momentum for LR	0.5
Optimizer	SGD
Local Epoch	3

TABLE IV: Default training configurations used in this paper.

Fig. 5: Image examples of RSCD dataset: (A) Friction level, (B) Material level, and (C) Unevenness level.

Fig. 6: Local data distribution of 100 clients generated using the Dirichlet distribution with different $\alpha$ values based on RCC @ Friction dataset.

Device	Model	Params	Inference	Memory
Type	Type	(FP32, M)	Latency (ms)	(Peak, M)
Jetson	ResNet-18	42.65	9.93	60.97
	ResNet-34	81.21	16.43	101.07
	MobileNet-V3	5.81	17.26	16.53
	EfficientNet-B1	24.88	38.14	43.87
	DenseNet-121	26.55	50.79	45.24

TABLE V: Summary of practical model information with both Jetson and A100, for the Friction task.

Model Type	Method	RCC @ Friction				RCC @ Material				RCC @ Unevenness
Model Type	Method	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$
ResNet-18	FedAvg-NA ‡ [ 3 ]	$72.28$	$5.84$	$85.26$	$75.27$	$82.24$	$3.07$	$80.36$	$71.84$	$67.90$	$9.93$	$74.65$	$66.65$
	FedAvg [ 3 ]	$44.88$	$30.85$	$72.83$	$63.23$	$35.49$	$44.13$	$70.17$	$62.19$	$46.74$	$50.34$	$69.14$	$60.49$
	Krum [ 23 ]	$48.89$	$22.92$	$81.44$	$66.93$	$23.09$	$21.84$	$58.87$	$48.66$	$45.70$	$53.38$	$48.54$	$39.93$
	TMean [ 24 ]	$45.84$	$18.48$	$80.78$	$68.54$	$34.27$	$40.43$	$55.75$	$47.80$	$44.37$	$25.23$	$52.65$	$45.72$
	Median [ 24 ]	$48.44$	$22.52$	$81.56$	$68.43$	$46.85$	$25.07$	$73.87$	$64.89$	$47.33$	$34.55$	$65.45$	$58.19$

TABLE VI: Overall results within default configurations on three RCC tasks. All values are ratios in %.

Panel of Figure 13 — Fig. 7: Confusion matrices of FedTrident with ResNet-18 in three RCC tasks. Classes in green and red are source and target classes, respectively.

Panel of Figure 14 — Fig. 10: ASR curves of malicious client rates with ResNet-18.

Fig. 13: ASR and SRE curves of IID levels with EfficientNet-B1 in Friction.

Model Type	Method	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$
ResNet-18	FedAvg-NA ‡ [ 3 ]	$73.17$	$0.17$	$60.64$	$27.03$
	FedAvg [ 3 ]	$42.00$	$30.17$	$59.49$	$25.82$
	Krum [ 23 ]	$45.33$	$25.33$	$50.27$	$21.61$
	TMean [ 24 ]	$46.17$	$22.50$	$59.78$	$26.14$
	Median [ 24 ]	$59.83$	$24.00$	$59.60$	$26.22$
[ 18 ]	FoolsGold [ 11 ]	$45.67$	$24.83$	$59.75$	$26.17$

TABLE VII: Results on RCC @ All dataset. All values are ratios in %.

RCC Task	Method	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$
Friction	FedAvg [ 3 ]	$37.20$	$36.88$	$78.98$	$70.55$
	Krum [ 23 ]	$3.12$	$67.36$	$64.52$	$55.99$
	TMean [ 24 ]	$52.20$	$27.04$	$82.25$	$74.47$
	Median [ 24 ]	$49.08$	$23.36$	$81.40$	$73.34$
	FoolsGold [ 11 ]	$51.88$	$20.56$	$82.52$	$74.91$
	FLAME [ 12 ]	$43.22$	$34.56$	$58.24$	$47.77$

TABLE VIII: Results with dynamic attacks based on EfficientNet-B1. All values are ratios in %.

Model Type	Method	RCC @ Friction				RCC @ Material				RCC @ Unevenness
Model Type	Method	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$	SRE $\uparrow$	ASR $\downarrow$	GAC $\uparrow$	GAS $\uparrow$
ResNet-18	Detection	$61.04$	$14.04$	$83.31$	$72.42$	$72.11$	$10.24$	$77.40$	$68.78$	$63.17$	$11.22$	$73.63$	$66.48$
	Detection + Exclusion ‡	$\underline{75.02}^{\dagger}$	$\underline{3.80}$	$\underline{84.69}$	74.39	$\underline{81.33}$	$\underline{4.53}$	$\underline{79.54}$	71.03	$\underline{79.85}$	$\underline{8.80}$	$\underline{73.71}$	66.56
	FedTrident (Full)	$\textbf{88.04}^{\ast}$	1.72	85.16	75.12	87.47	1.89	79.77	71.76	80.17	5.68	74.16	67.21
EfficientNet-B1	Detection	$64.52$	$11.04$	$83.82$	$73.41$	$75.81$	$8.59$	$\underline{78.99}$	$70.10$	$66.43$	$11.93$	$71.74$	$64.32$
	Detection + Exclusion	$\underline{81.60}$	$\underline{5.32}$	$\underline{84.09}$	$\underline{74.17}$	$\underline{82.99}$	$\underline{4.18}$	$78.22$	$\underline{71.52}$	$\underline{75.78}$	$\underline{8.90}$	$\underline{72.26}$	$\underline{64.71}$

TABLE IX: The ablation results of FedTrident within default configurations. All values are ratios in %.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 943 papers

Jun 8, 2026

Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips

Federated Learning (FL) allows a set of clients to collectively train a global model without sharing local training data. Giving the responsibility of the training to decentralized actors may lead to poisoning attacks: clients controlled by malicious third party potentially poison the training dataset to install a backdoor in neural networks. In FL, these backdoor attacks rely solely on algorithmic approach, however, recent advances in hardware faults threats (e.g, Rowhammer) have widen the overall attack surface. In the context of federated model adaptation, we introduce a novel category of backdoor attack against FL systems that relies on model poisoning based on hardware-fault attacks. More precisely, we propose a task-agnostic backdoor attack that is implanted during the FL training time by inducing hardware faults (bit-flips) in parameters of a single local model. The backdoor is crafted during a previous offline phase from the pretrained model initially used by the FL system. Our results show that a backdoor can be successfully applied on different type of models and datasets. Typically, with up to 10 faults per malicious client occurrence and 19 total occurrences on a ResNet-18 are enough to reach 94% of attack success rate. Finally, we discuss the practicality and the robustness of the attack potential defenses, while putting into perspective the practical constraints of Rowhammer, which is the preferred attack vector for this type of threats.

Bastien Vuillod, Kevin Hector, Pierre-Alain Moellic +2

CEA-Leti, Mines Saint-Etienne, Equipe Commune SAS, F-13541 Gardanne, France · Mines Saint-Etienne, CEA-Leti, Centre CMP, Equipe commune SAS, F-13541 Gardanne, France

Adversarial Attacks Backdoor Attacks in Federated Learning Federated Learning

Ask PDF

Jul 8, 2026

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting.

Chongkai Li, Bang Zhang, Wenjian Luo

Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China

Privacy-Preserving ML Training Data Extraction Attacks Federated Learning

Ask PDF

May 4, 2026

Adversarial Update-Based Federated Unlearning for Poisoned Model Recovery

Federated learning (FL) is vulnerable to poisoning attacks, where malicious clients upload manipulated updates to degrade the performance of the global model. Although detection methods can identify and remove malicious clients, the model remains affected. Retraining from scratch is effective but costly, and existing unlearning methods remain unsatisfactory in both effectiveness and efficiency. We propose Federated Adversarial Unlearning (FAUN), a lightweight framework that retains only a short window of malicious clients' updates and employs adversarial optimization on a proxy dataset to derive updates that eliminate malicious directions. Applying these updates for a few unlearning rounds, followed by benign fine-tuning, enables fast removal of malicious effects and stable recovery. Experiments on three canonical datasets show that FAUN achieves recovery comparable to retraining while requiring far fewer rounds and reduces attack success rates to near zero, confirming FAUN successfully eliminates the contributions of unlearned clients.

Wenwei Zhao, Xiaowen Li, Yao Liu +1

Department of Electrical Engineering, University of South Florida,Tampa, FL, USA · Bellini College, University of South Florida, Tampa, FL, USA

Federated Unlearning Machine Unlearning Federated Learning

Ask PDF

Abstract

Federated Learning

Explore similar work

Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Adversarial Update-Based Federated Unlearning for Poisoned Model Recovery