CoChat
Sign Up
Cited by 292Adversarial Robustness in Machine LearningPrivacy-Preserving Technologies in DataDigital Media Forensic Detection

PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems

Zhang, Jiale, Chen, Bing, Cheng, Xiang, Binh, Huynh Thi Thanh, Yu, Shui·2021·IEEE Internet of Things Journal
DOI 10.1109/jiot.2020.3023126
Open this paper in CoChat — free account

Abstract

Edge computing is a key-enabling technology that meets continuously increasing requirements for the intelligent Internet-of-Things (IoT) applications. To cope with the increasing privacy leakages of machine learning while benefiting from unbalanced data distributions, federated learning has been wildly adopted as a novel intelligent edge computing framework with a localized training mechanism. However, recent studies found that the federated learning framework exhibits inherent vulnerabilities on active attacks, and poisoning attack is one of the most powerful and secluded attacks where the functionalities of the global model could be damaged through attacker's well-crafted local updates. In this article, we give a comprehensive exploration of the poisoning attack mechanisms in the context of federated learning. We first present a poison data generation method, named Data_Gen, based on the generative adversarial networks (GANs). This method mainly relies upon the iteratively updated global model parameters to regenerate samples of interested victims. Second, we further propose a novel generative poisoning attack model, named PoisonGAN, against the federated learning framework. This model utilizes the designed Data_Gen method to efficiently reduce the attack assumptions and make attacks feasible in practice. We finally evaluate our data generation and attack models by implementing two types of typical poisoning attack strategies, label flipping and backdoor, on a federated learning prototype. The experimental results demonstrate that these two attack models are effective in federated learning.

Integrity signals

Registry

Crossref · 10.1109/jiot.2020.3023126

Cites

40 of 40 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In local model training phase backdoor attacks, an attacker is required to fully control the compromised clients, including the training data set and training algorithm.

    “In local model training phase backdoor attacks, an attacker is required to fully control the compromised clients, including the training data set and training algorithm [29], [32], [116], [122]-[124].”

    From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [29]

  • The increment of compromised clients controlled by the attacker can contribute to improving the attack performance.

    “Thus, the increment of the compromised clients controlled by the attacker can contribute to improving the attack performance [29].”

    From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [29]

  • Jiale et al. use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack, allowing an attacker to execute a poisoning attack without prior knowledge.

    “To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [26]

  • An attacker can use a GAN to reconstruct other clients' datasets and thereby execute an attack by generating fake data, even without a specific class of sample data.

    “For example, an attacker can use GAN to reconstruct other clients' datasets so that the attacker can execute the attack by generating fake data, even if the attacker lacks a specific class of sample data [26].”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [26]

Cites

Flagged first, then by citations

2 of the 42 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S.
Affiliations
  • Nanjing University of Aeronautics and Astronautics (CN)
  • School of Information and Communication Technology, Hanoi University of Science and Technology, Hanoi, Vietnam
  • University of Technology Sydney (AU)
ORCID
Venue
IEEE Internet of Things Journal
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2021-03-01
Volume
8
Issue
5
Pages
3310-3322
ISSN
  • 2327-4662 (ISSN-L)
  • 2372-2541
DOI
10.1109/jiot.2020.3023126
OpenAlex
W3084847664
Cited by
291
References
42
Citations by year
2026: 34 · 2025: 61 · 2024: 72 · 2023: 63 · 2022: 43 · 2021: 18
FWCI
12.18
Type
journal article
Language
en
Open access
closed
Licence
Locations
  • IEEE Internet of Things Journal (publishedVersion)
  • UTS ePRESS (University of Technology Sydney) (submittedVersion)
Funders
  • National Key Research and Development Program of China (2019YFB2102000)
  • National Natural Science Foundation of China (61672283)
  • Science and Technology on Avionics Integration Laboratory and the National Aeronautical Science Foundation of China (20175552039)
  • Postgraduate Research and Practice Innovation Program of Jiangsu Province (KYCX18_0308)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
federated learning, generative adversarial networks, data poisoning, edge computing, Internet of Things, label flipping, backdoor attacks, privacy leakage

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review