StratFL: Countering Covert Model Poisoning Attacks with Strategic Federated Learning

Manoj Twarakavi; Venkata Sriram Siddhardh Nadendla

cs.CROct 15, 2026

StratFL: Countering Covert Model Poisoning Attacks with Strategic Federated Learning

Authors: Manoj Twarakavi, Venkata Sriram Siddhardh Nadendla

Organizations: Missouri University of Science and Technology, Rolla MO 65409, USA

Abstract

Advanced persistent threats (APTs) are a major concern in federated learning (FL) deployments in critical sectors such as healthcare, and finance. Traditional defense mechanisms fail to contain APTs due to their intermittent attacking behavior. This paper addresses a specific type of APT called covert model poisoning (CMP) where the attacker intermittently injects poisoned model updates in a covert manner. The interaction between the FL server and a CMP attacker is modeled as an imperfect repeated game where both players cannot observe each other's actions. A novel adversarial search algorithm called StratFL is designed alongside novel belief update algorithms at both the server and adversary. Experiments are designed using MNIST and CIFAR-10 datasets to evaluate and compare StratFL's performance against state-of-the-art methods. Empirical convergence of belief update algorithms is demonstrated across various security vignettes. At the same time, StratFL is found to exhibit an improved accuracy of 10% compared to state-of-the-art methods.

Figures & tables

Figure 1: Strategic Federated Learning and Covert Model Poisoning

Panel of Figure 2 — Algorithm 1 Server Belief Update

Panel of Figure 3 — Algorithm 2 Adversary Belief Update

Panel of Figure 4 — Algorithm 3 Strategic Federated Learning ( StratFL )

Figure 4: Empirical Convergence of Mean Squared Belief Deviation on CIFAR-10 Dataset across Different Security Vignettes

Figure 5: Empirical Convergence of Mean Squared Belief Deviation on CIFAR-10 Dataset across across Different Security Vignettes

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 961 papers

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers
Apr 10, 2026Israt Jahan Mouri, Muhammad Ridowan, Muhammad Abdullah AdnanFederated Learning Byzantine-Robust Federated Learning
Bangladesh University of Engineering and Technology (BUET), Dhaka, Bangladesh · TigerIT Bangladesh Ltd., Dhaka, Bangladesh
STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregation
Aug 14, 2026Nawrin Tabassum, Yanzhao WuFederated Learning Federated Learning Aggregation
Department of Computer Science and Engineering Ahsanullah University of Science and Technology Dhaka, Bangladesh · Knight Foundation School of Computing and Information Sciences Florida International University Miami, FL, USA
Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips
Jun 8, 2026Bastien Vuillod, Kevin Hector, Pierre-Alain Moellic +2Adversarial Attacks Backdoor Attacks in Federated Learning
CEA-Leti, Mines Saint-Etienne, Equipe Commune SAS, F-13541 Gardanne, France · Mines Saint-Etienne, CEA-Leti, Centre CMP, Equipe commune SAS, F-13541 Gardanne, France

Apr 10, 2026J/K move · Enter open · S save

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

Israt Jahan Mouri, Muhammad Ridowan, Muhammad Abdullah Adnan

Bangladesh University of Engineering and Technology (BUET), Dhaka, Bangladesh · TigerIT Bangladesh Ltd., Dhaka, Bangladesh

Federated Learning Byzantine-Robust Federated Learning

Open paper AskPDF arXiv

Model poisoning attacks pose a significant security threat to Federated Learning (FL). Most existing model poisoning attacks rely on collusion, requiring adversarial clients to coordinate by exchanging local benign models and synchronizing the generation of their poisoned updates. However, sustaining such coordination is increasingly impractical in real-world FL deployments, as it effectively requires botnet-like control over many devices. This approach is costly to maintain and highly vulnerable to detection. This context raises a fundamental question: Can model poisoning attacks remain effective without any communication between attackers? To address this challenge, we introduce and formalize the non-collusive attack model, in which all compromised clients share a common adversarial objective but operate independently. Under this model, each attacker generates its malicious update without communicating with other adversaries, accessing other clients' updates, or relying on any knowledge of server-side defenses. To demonstrate the feasibility of this threat model, we propose XFED, the first aggregation-agnostic, non-collusive model poisoning attack. Our empirical evaluation across six benchmark datasets shows that XFED bypasses eight state-of-the-art defenses and outperforms six existing model poisoning attacks. These findings indicate that FL systems are substantially less secure than previously believed and underscore the urgent need for more robust and practical defense mechanisms.

Abstract

Federated Learning

Explore similar work

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregation

Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips