Model poisoning attacks pose a significant security threat to Federated Learning (FL). Most existing model poisoning attacks rely on collusion, requiring adversarial clients to coordinate by exchanging local benign models and synchronizing the generation of their poisoned updates. However, sustaining such coordination is increasingly impractical in real-world FL deployments, as it effectively requires botnet-like control over many devices. This approach is costly to maintain and highly vulnerable to detection. This context raises a fundamental question: Can model poisoning attacks remain effective without any communication between attackers? To address this challenge, we introduce and formalize the non-collusive attack model, in which all compromised clients share a common adversarial objective but operate independently. Under this model, each attacker generates its malicious update without communicating with other adversaries, accessing other clients' updates, or relying on any knowledge of server-side defenses. To demonstrate the feasibility of this threat model, we propose XFED, the first aggregation-agnostic, non-collusive model poisoning attack. Our empirical evaluation across six benchmark datasets shows that XFED bypasses eight state-of-the-art defenses and outperforms six existing model poisoning attacks. These findings indicate that FL systems are substantially less secure than previously believed and underscore the urgent need for more robust and practical defense mechanisms.
Table 1: Attack impact \mathchar29001\mathchar28946 of the global model under different attacks (20% malicious clients), aggregation rules, and defenses for different datasets. We assume Fang, LIE, Min-Max, and Min-Sum have access to the model updates on all compromised clients, and Fang further has access to the aggregation rule, which gives advantages to these attacks. Our proposed \mathchar29016\mathchar29043\mathchar29031\mathchar29038 and \mathchar29016\mathchar29045\delimiter69640972 do not have access to any of these knowledge. In each row, we highlight in bold the highest attack impact or the closest to the highest.
Figure 1: Attack Impact \mathchar29001\mathchar28946 on global models with increasing malicious clients across various defenses and attacks (MNIST dataset).
Figure 2: Attack impact \mathchar29001\mathchar28946 on global models as a function of the degree of non-IID under different defenses and attacks (Purchase Dataset).
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Distribution
Relationship with standard deviation \mathchar28955
Table 4: Attack impact \mathchar29001\mathchar28946 on the global model under different attacks (20% malicious clients), aggregation rules, and defenses for the Purchase dataset in cross-device settings. In each row, we highlight in bold the highest attack impact or the closest to the highest.
Figure 3: Attack Impact \mathchar29001\mathchar28946 on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-silo setting (Purchase dataset).
Figure 4: Attack Impact \mathchar29001\mathchar28946 on global model with increasing % of malicious clients for different attacks and aggregations (FedAvg and Median) in different FL settings for different datasets (MNIST & Purchase).
Figure 5: Attack Impact \mathchar29001\mathchar28946 on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-device setting (Purchase dataset).
Figure 6: Attack impact \mathchar29001\mathchar28946 on global models as a function of the degree of non-IID for different aggregations, defenses, and attacks (MNIST Dataset).
Figure 7: Attack Impact \mathchar29001\mathchar28946 on global model as a function of the degree of non-IID for different attacks and aggregations (FedAvg and Median) for different datasets (MNIST & Purchase).
Table 5: Attack impact \mathchar29001\mathchar28946 of the global model under the \mathchar29016\mathchar29045\delimiter69640972 attack (20% malicious clients) for different values of \mathchar28682 across various aggregation rules and defenses on the MNIST dataset in the cross-silo setting. In all experiments, we set \mathchar28949\mathchar12349\mathchar28724 .
Figure 8: Impact of the history window size \mathchar28682 on the execution time of the \mathchar29016\mathchar29045\delimiter69640972 attack (20% malicious clients) on the MNIST dataset in the cross-silo setting. As \mathchar28682 increases, the runtime grows noticeably.
Figure 9: Effect of \mathchar28949 on the attack impact \mathchar29001\mathchar28946 of the \mathchar29016\mathchar29045\delimiter69640972 attack (20% malicious clients) on the MNIST dataset in cross-silo setting. In all experiments, we set \mathchar28682\mathchar12349\mathchar28728 .
Table 6: Effect of extreme values of \mathchar28949 on the attack impact \mathchar29001\mathchar28946 of the \mathchar29016\mathchar29045\delimiter69640972 attack (20% malicious clients) on the MNIST dataset.
Bias Probability
No Attack Accuracy
Attack Impact (20% malicious clients)
0.1
73.91
8.83
0.3
71.52
9.95
0.5
68.50
10.25
0.7
61.90
14.82
0.9
60.22
17.11
Appendix
Table 7: Effect of root-data bias probability on FLTrust performance for the Purchase dataset. The table reports test accuracy under no attack and the attack impact \mathchar29001\mathchar28946 (20% malicious clients) for \mathchar29016\mathchar29045\delimiter69640972 attack with different bias probabilities, showing that higher bias in the root dataset degrades clean accuracy and increases vulnerability to attacks.
Federated Learning (FL) is increasingly applied in sectors like healthcare, finance, and IoT, enabling collaborative model training while safeguarding user privacy. However, FL systems are susceptible to Byzantine adversaries that inject malicious updates, which can severely compromise global model performance. Existing defenses tend to focus on specific attack types and fail against untargeted strategies, such as multi-label flipping or combinations of noise and backdoor patterns. To overcome these limitations, we propose FedAOT-a novel defense mechanism that counters multi-label flipping and untargeted poisoning attacks using a metalearning-inspired adaptive aggregation framework. FedAOT dynamically weights client updates based on their reliability, suppressing adversarial influence without relying on predefined thresholds or restrictive attack assumptions. Notably, FedAOT generalizes effectively across diverse datasets and a wide range of attack types, maintaining robust performance even in previously unseen scenarios. Experimental results demonstrate that FedAOT substantially improves model accuracy and resilience while maintaining computational efficiency, offering a scalable and practical solution for secure federated learning.
Reek Das, Biplab Kanti Sen
APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College
Federated learning systems are increasingly threatened by data poisoning attacks, where malicious clients compromise global models by contributing tampered updates. Existing defenses often rely on impractical assumptions, such as access to a central test dataset, or fail to generalize across diverse attack types, particularly those involving multiple malicious clients working collaboratively. To address this, we propose Federated Noise-Induced Activation Analysis (FedNIA), a novel defense framework to identify and exclude adversarial clients without relying on any central test dataset. FedNIA injects random noise inputs to analyze the layerwise activation patterns in client models leveraging an autoencoder that detects abnormal behaviors indicative of data poisoning. FedNIA can defend against diverse attack types, including sample poisoning, label flipping, and backdoors, even in scenarios with multiple attacking nodes. Experimental results on non-iid federated datasets demonstrate its effectiveness and robustness, underscoring its potential as a foundational approach for enhancing the security of federated learning systems.
Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad Saif
Department of Electrical and Computer Engineering, University of Windsor, Windsor ON, Canada · Faculty of Computer Science, University of New Brunswick, Fredericton NB, Canada
Federated learning (FL) is a popular distributed learning paradigm in machine learning, which enables multiple clients to collaboratively train models under the guidance of a server without exposing private client data. However, FL's decentralized nature makes it vulnerable to poisoning attacks, where malicious clients can submit corrupted models to manipulate the system. To counter such attacks, although various Byzantine-robust methods have been proposed, these methods struggle to provide balanced defense against multiple types of attacks or rely on possessing the dataset in the server. To deal with these drawbacks, thus, we propose an effective multi-layer defensive adaptive aggregation for Bzantine-robust federated learning (AdaBFL) based on a novel three-layer defensive mechanism, which can adaptively adjust the weights of defense algorithms to counter complex attacks. Moreover, we provide convergence properties of our AdaBFL method under the non-convex setting on non-iid data. Comprehensive experiments across multiple datasets validate the superiority of our AdaBFL over the comparable algorithms.
Zehui Tang, Yuchen Liu, Feihu Huang
College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China · MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, Nanjing, China.