XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

Israt Jahan Mouri; Muhammad Ridowan; Muhammad Abdullah Adnan

cs.CRApr 10, 2026

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

Authors: Israt Jahan Mouri, Muhammad Ridowan, Muhammad Abdullah Adnan

Organizations: Bangladesh University of Engineering and Technology (BUET), Dhaka, Bangladesh · TigerIT Bangladesh Ltd., Dhaka, Bangladesh

Abstract

Model poisoning attacks pose a significant security threat to Federated Learning (FL). Most existing model poisoning attacks rely on collusion, requiring adversarial clients to coordinate by exchanging local benign models and synchronizing the generation of their poisoned updates. However, sustaining such coordination is increasingly impractical in real-world FL deployments, as it effectively requires botnet-like control over many devices. This approach is costly to maintain and highly vulnerable to detection. This context raises a fundamental question: Can model poisoning attacks remain effective without any communication between attackers? To address this challenge, we introduce and formalize the non-collusive attack model, in which all compromised clients share a common adversarial objective but operate independently. Under this model, each attacker generates its malicious update without communicating with other adversaries, accessing other clients' updates, or relying on any knowledge of server-side defenses. To demonstrate the feasibility of this threat model, we propose XFED, the first aggregation-agnostic, non-collusive model poisoning attack. Our empirical evaluation across six benchmark datasets shows that XFED bypasses eight state-of-the-art defenses and outperforms six existing model poisoning attacks. These findings indicate that FL systems are substantially less secure than previously believed and underscore the urgent need for more robust and practical defense mechanisms.

Figures & tables

	$\mathchar 28993_{\mathchar 28946}$	$\mathchar 29016_{\mathchar 29043\mathchar 29031\mathchar 29038}$	$\mathchar 29016_{\mathchar 29045\delimiter 69640972}$	Min-Sum	Min-Max	Fang	LIE	MPAF	PoisonedFL	$\mathchar 28993_{\mathchar 28946}$	$\mathchar 29016_{\mathchar 29043\mathchar 29031\mathchar 29038}$	$\mathchar 29016_{\mathchar 29045\delimiter 69640972}$	Min-Sum	Min-Max	Fang	LIE	MPAF	PoisonedFL
	(a) Purchase (Cross-silo, 100 FL clients, 500 global iterations & 3 layer DNN model)									(b) MNIST (Cross-silo, 100 FL clients, 275 global iterations & 4 layer DNN model)
FedAvg	74.82	55.2	67.53	22.01	35.39	74.35	7.65	65	72.18	95.02	29.42	81.43	9.39	17.7	85.22	4.98	84.92	83.62
Median	72.14	37.14	36.31	33.11	35.46	7.09	14.85	16.8	35.7	94.61	13.73	12.21	12.5	11.43	14.31	8	5.15	8.28
Tr-Mean	73.79	42.71	43.43	33.17	36.1	21.13	14.77	24.24	43	94.69	14.38	15.19	10.97	13.64	21.27	6.91	5.55	14
M-Krum	74.54	4.04	17.48	16.85	9.48	17.55	13.56	3.54	4.67	94.57	9.34	12.5	10.32	9.08	11.91	7.68	5.58	4.69
CC	74.69	50.48	68.86	33.82	48.03	-	3.65	4.88	4.71	94.08	13.13	80.1	13.49	23.57	-	4.62	3.32	5.6

Table 1: Attack impact

\mathchar 29001_{\mathchar 28946}

of the global model under different attacks (20% malicious clients), aggregation rules, and defenses for different datasets. We assume Fang, LIE, Min-Max, and Min-Sum have access to the model updates on all compromised clients, and Fang further has access to the aggregation rule, which gives advantages to these attacks. Our proposed

\mathchar 29016_{\mathchar 29043\mathchar 29031\mathchar 29038}

and

\mathchar 29016_{\mathchar 29045\delimiter 69640972}

do not have access to any of these knowledge. In each row, we highlight in bold the highest attack impact or the closest to the highest.

Panel of Figure 1 — Figure 1: Attack Impact $\mathchar 29001_{\mathchar 28946}$ on global models with increasing malicious clients across various defenses and attacks (MNIST dataset).

Panel of Figure 2 — Figure 2: Attack impact $\mathchar 29001_{\mathchar 28946}$ on global models as a function of the degree of non-IID under different defenses and attacks (Purchase Dataset).

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Distribution	Relationship with standard deviation $\mathchar 28955$
Normal	$\mathchar 28955\mathchar 12825\mathchar 28721\mathchar 314\mathchar 28724\mathchar 28728\mathchar 28722\mathchar 28726\mathchar 8706\mathchar 29037\mathchar 29025\mathchar 29028$
Uniform	$\mathchar 28955\mathchar 12825\mathchar 28721\mathchar 314\mathchar 28721\mathchar 28725\mathchar 28724\mathchar 28727\mathchar 8706\mathchar 29037\mathchar 29025\mathchar 29028$
Exponential	$\mathchar 28955\mathchar 12825\mathchar 28722\mathchar 314\mathchar 28720\mathchar 28727\mathchar 28728\mathchar 28721\mathchar 8706\mathchar 29037\mathchar 29025\mathchar 29028$
Laplace	$\mathchar 28955\mathchar 12825\mathchar 28722\mathchar 314\mathchar 28720\mathchar 28724\mathchar 28720\mathchar 28725\mathchar 8706\mathchar 29037\mathchar 29025\mathchar 29028$
Logistic	$\mathchar 28955\mathchar 12825\mathchar 28721\mathchar 314\mathchar 28726\mathchar 28722\mathchar 28720\mathchar 28725\mathchar 8706\mathchar 29037\mathchar 29025\mathchar 29028$

Appendix

Table 2: Constants for Common Distributions

Parameter	MNIST	EMNIST	Purchase-100	Fashion-MNIST	CIFAR-10	HAR
Architecture	4 layer DNN	3 layer DNN	3 layer DNN	AlexNet, 3 layer DNN	AlexNet	LR
Number of clients in FL	100	200	100	40	50	30
# local iterations	1	1	1	1	1	1
# global iterations	275	400	500	250	255	1000
Batch size	256	256	128	256	250	32
Learning rate	1	0.3	0.1	0.3	1	0.001

Appendix

Table 3: The default cross-silo FL system parameter settings.

	$\mathchar 28993_{\mathchar 28946}$	$\mathchar 29016_{\mathchar 29043\mathchar 29031\mathchar 29038}$	$\mathchar 29016_{\mathchar 29045\delimiter 69640972}$	Min-Sum	Min-Max	Fang	LIE	MPAF	PoisonedFL
	Purchase(Cross-device, 10000 FL clients, 500 global iterations & 3 layer DNN model)
FedAvg	75.07	62.23	70.72	25.18	38.23	72.37	9.26	72.22	72.08
Median	72.39	41.96	44.7	38.89	41.93	40.22	19.32	22.82	43.22
Tr-Mean	74.04	60.02	60.97	36.94	44.21	23.56	15.63	59.22	62.22
M-Krum	74.79	9.09	40.22	35.97	42.47	32.88	13.3	45.22	41.37
CC	74.94	13.68	70.79	39.52	52.77	-	4.31	3.53	4.39

Appendix

Table 4: Attack impact

\mathchar 29001_{\mathchar 28946}

on the global model under different attacks (20% malicious clients), aggregation rules, and defenses for the Purchase dataset in cross-device settings. In each row, we highlight in bold the highest attack impact or the closest to the highest.

Panel of Figure 3 — Figure 3: Attack Impact $\mathchar 29001_{\mathchar 28946}$ on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-silo setting (Purchase dataset).

Panel of Figure 4 — Figure 4: Attack Impact $\mathchar 29001_{\mathchar 28946}$ on global model with increasing % of malicious clients for different attacks and aggregations (FedAvg and Median) in different FL settings for different datasets (MNIST & Purchase).

Panel of Figure 5 — Figure 5: Attack Impact $\mathchar 29001_{\mathchar 28946}$ on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-device setting (Purchase dataset).

Panel of Figure 6 — Figure 6: Attack impact $\mathchar 29001_{\mathchar 28946}$ on global models as a function of the degree of non-IID for different aggregations, defenses, and attacks (MNIST Dataset).

Panel of Figure 7 — Figure 7: Attack Impact $\mathchar 29001_{\mathchar 28946}$ on global model as a function of the degree of non-IID for different attacks and aggregations (FedAvg and Median) for different datasets (MNIST & Purchase).

Aggregation Rule	FedAvg	Median	Tr-Mean	Multi-Krum	Clipped-Clustering	SignGuard	FLTrust	FreqFed	FoolsGold	FLAME
$\mathchar 28993_{\mathchar 28946}$	95.02	94.61	94.69	94.57	94.08	95.31	95.49	94.32	95.12	93.33
$\mathchar 28682\mathchar 12349\mathchar 28724$	83.71	11.15	14.99	12.5	78.08	79.16	3.26	84.5	36.11	76.17
$\mathchar 28682\mathchar 12349\mathchar 28728$	77.26	13.41	15.48	12.56	82.89	78.41	7.46	82.16	34.5	74.82
$\mathchar 28682\mathchar 12349\mathchar 28721\mathchar 28722$	78.47	11.96	13.49	13.22	81.28	84.39	3.49	76.5	29.49	76.88
$\mathchar 28682\mathchar 12349\mathchar 28721\mathchar 28726$	84.82	11.45	12.98	11.22	76.87	79.67	4.19	79.59	34.14	78.69
$\mathchar 28682\mathchar 12349\mathchar 28722\mathchar 28720$	76.45	12.15	15.72	12.52	79.08	80.16	1.79	76.91	31.08	70.83

Appendix

Table 5: Attack impact

\mathchar 29001_{\mathchar 28946}

of the global model under the

\mathchar 29016_{\mathchar 29045\delimiter 69640972}

attack (20% malicious clients) for different values of

\mathchar 28682

across various aggregation rules and defenses on the MNIST dataset in the cross-silo setting. In all experiments, we set

\mathchar 28949\mathchar 12349\mathchar 28724

Panel of Figure 8 — Figure 8: Impact of the history window size $\mathchar 28682$ on the execution time of the $\mathchar 29016_{\mathchar 29045\delimiter 69640972}$ attack (20% malicious clients) on the MNIST dataset in the cross-silo setting. As $\mathchar 28682$ increases, the runtime grows noticeably.

Panel of Figure 9 — Figure 9: Effect of $\mathchar 28949$ on the attack impact $\mathchar 29001_{\mathchar 28946}$ of the $\mathchar 29016_{\mathchar 29045\delimiter 69640972}$ attack (20% malicious clients) on the MNIST dataset in cross-silo setting. In all experiments, we set $\mathchar 28682\mathchar 12349\mathchar 28728$ .

Aggregation Rules & Defenses	$\mathchar 28949\mathchar 12349\mathchar 28720$	$\mathchar 28949\mathchar 12349\mathchar 28724$	$\mathchar 28949\mathchar 12349\mathchar 28721\mathchar 28720\mathchar 28720$
FedAvg	24.64	81.43	10
Median	9.35	12.21	11
Tr-Mean	12.15	15.19	12.6
M-Krum	4.11	12.5	1.23
Clipped-Clustering	24.21	80.1	2.45
SignGuard	23.53	81.18	4.51

Appendix

Table 6: Effect of extreme values of

\mathchar 28949

on the attack impact

\mathchar 29001_{\mathchar 28946}

of the

\mathchar 29016_{\mathchar 29045\delimiter 69640972}

attack (20% malicious clients) on the MNIST dataset.

Bias Probability	No Attack Accuracy	Attack Impact (20% malicious clients)
0.1	73.91	8.83
0.3	71.52	9.95
0.5	68.50	10.25
0.7	61.90	14.82
0.9	60.22	17.11

Appendix

Table 7: Effect of root-data bias probability on FLTrust performance for the Purchase dataset. The table reports test accuracy under no attack and the attack impact

\mathchar 29001_{\mathchar 28946}

(20% malicious clients) for

\mathchar 29016_{\mathchar 29045\delimiter 69640972}

attack with different bias probabilities, showing that higher bias in the root dataset degrades clean accuracy and increases vulnerability to attacks.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 943 papers

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning
Mar 17, 2026Reek Das, Biplab Kanti SenByzantine-Robust Federated Learning Federated Learning Aggregation
APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College
FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning
Feb 23, 2025Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad SaifData Poisoning Attacks Federated Learning
Department of Electrical and Computer Engineering, University of Windsor, Windsor ON, Canada · Faculty of Computer Science, University of New Brunswick, Fredericton NB, Canada
AdaBFL: Multi-Layer Defensive Adaptive Aggregation for Bzantine-Robust Federated Learning
Apr 30, 2026Zehui Tang, Yuchen Liu, Feihu HuangFederated Learning Aggregation Byzantine-Robust Federated Learning
College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China · MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, Nanjing, China.

Mar 17, 2026J/K move · Enter open · S save

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning

Reek Das, Biplab Kanti Sen

APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College

Byzantine-Robust Federated Learning Federated Learning Aggregation Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) is increasingly applied in sectors like healthcare, finance, and IoT, enabling collaborative model training while safeguarding user privacy. However, FL systems are susceptible to Byzantine adversaries that inject malicious updates, which can severely compromise global model performance. Existing defenses tend to focus on specific attack types and fail against untargeted strategies, such as multi-label flipping or combinations of noise and backdoor patterns. To overcome these limitations, we propose FedAOT-a novel defense mechanism that counters multi-label flipping and untargeted poisoning attacks using a metalearning-inspired adaptive aggregation framework. FedAOT dynamically weights client updates based on their reliability, suppressing adversarial influence without relying on predefined thresholds or restrictive attack assumptions. Notably, FedAOT generalizes effectively across diverse datasets and a wide range of attack types, maintaining robust performance even in previously unseen scenarios. Experimental results demonstrate that FedAOT substantially improves model accuracy and resilience while maintaining computational efficiency, offering a scalable and practical solution for secure federated learning.

Abstract

Federated Learning

Explore similar work

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning

FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning

AdaBFL: Multi-Layer Defensive Adaptive Aggregation for Bzantine-Robust Federated Learning