The DOI matches its Crossref record; 40 of the 42 references it cites were found in a registry or an index.
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Abstract
Edge computing is a key-enabling technology that meets continuously increasing requirements for the intelligent Internet-of-Things (IoT) applications. To cope with the increasing privacy leakages of machine learning while benefiting from unbalanced data distributions, federated learning has been wildly adopted as a novel intelligent edge computing framework with a localized training mechanism. However, recent studies found that the federated learning framework exhibits inherent vulnerabilities on active attacks, and poisoning attack is one of the most powerful and secluded attacks where the functionalities of the global model could be damaged through attacker's well-crafted local updates. In this article, we give a comprehensive exploration of the poisoning attack mechanisms in the context of federated learning. We first present a poison data generation method, named Data_Gen, based on the generative adversarial networks (GANs). This method mainly relies upon the iteratively updated global model parameters to regenerate samples of interested victims. Second, we further propose a novel generative poisoning attack model, named PoisonGAN, against the federated learning framework. This model utilizes the designed Data_Gen method to efficiently reduce the attack assumptions and make attacks feasible in practice. We finally evaluate our data generation and attack models by implementing two types of typical poisoning attack strategies, label flipping and backdoor, on a federated learning prototype. The experimental results demonstrate that these two attack models are effective in federated learning.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“In local model training phase backdoor attacks, an attacker is required to fully control the compromised clients, including the training data set and training algorithm [29], [32], [116], [122]-[124].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [29]
In the citing paper
“Thus, the increment of the compromised clients controlled by the attacker can contribute to improving the attack performance [29].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [29]
In the citing paper
“To solve this problem, Jiale et al. [26] use a generative adversarial network to generate samples similar to those of other clients and then use these fake samples to execute an attack.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [26]
In the citing paper
“For example, an attacker can use GAN to reconstruct other clients' datasets so that the attacker can execute the attack by generating fake data, even if the attacker lacks a specific class of sample data [26].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [26]
Citations
Cites
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Lin, J., Yu, W., Zhang, N., Yang, X., Zhang, H., & Zhao, W. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2683200 · Cited by 2,793
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Federated Learning with Non-IID Data
Zhao, Y., Li, M., Lai, L., Suda, N., Civin, D., & Chandra, V. (2018) · arXiv · doi:10.48550/arxiv.1806.00582 · Cited by 2,077
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
A Survey on the Edge Computing for the Internet of Things
Yu, W., Liang, F., He, X., Hatcher, W. G., Lu, C., Lin, J., & Yang, X. (2018) · IEEE Access · doi:10.1109/access.2017.2778504 · Cited by 1,520 · cited 1×
“…and efficiency issues in conventional centralized learning framework, federated learning [1] has emerged as an attractive technique for communication efficiency and privacy-sensitive Internet-of-Things (IoT) applications, such as mobile-edge computing [2], [3] and crowdsourced system [4], [5].”
BackgroundHow to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
(2017) · neural information processing systems · Cited by 1,413
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning
Wang, Z., Song, M., Zhang, Z., Song, Y., Wang, Q., & Qi, H. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737416 · Cited by 881
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E. C., & Roli, F. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140451 · Cited by 549
Systematic Poisoning Attacks on and Defenses for Machine Learning in Healthcare
Kermani, M. M., Sur‐Kolay, S., Raghunathan, A., & Jha, N. K. (2014) · IEEE Journal of Biomedical and Health Informatics · doi:10.1109/jbhi.2014.2344095 · Cited by 383
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners
Mei, S., & Zhu, X. (2015) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v29i1.9569 · Cited by 346
Is feature selection secure against training data poisoning?Preprint
Huang, X. X., Biggio, B., Gavin Brown, B., Fumera, G., Eckert, C. M., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.07933 · Cited by 315
Big privacy: challenges and opportunities of privacy study in the age of big data
Yu, S. (2016) · IEEE Access · doi:10.1109/access.2016.2577036 · Cited by 307
Self-citationPrivacy-preserving Machine Learning as a Service
Hesamifard, E., Takabi, H., Ghasemi, M., & Wright, R. N. (2018) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2018-0024 · Cited by 250
Learning to Pivot with Adversarial NetworksPreprint
Louppe, G., Kagan, M., & Cranmer, K. (2016) · Neural Information Processing Systems · doi:10.48550/arxiv.1611.01046 · Cited by 250
A uror: defending against poisoning attacks in collaborative deep learning systems
Shen, S., Tople, S., & Saxena, P. (2016) · Proceedings of the 32nd Annual Conference on Computer Security Applications · doi:10.1145/2991079.2991125 · Cited by 228
Support vector machines under adversarial label contamination
Huang, X. X., Biggio, B., Nelson, B. A., Xiao, H., Eckert, C. M., & Roli, F. (2015) · Neurocomputing · doi:10.1016/j.neucom.2014.08.081 · Cited by 220
Poisoning Attack in Federated Learning using Generative Adversarial Nets
Zhang, J., Chen, J., Wu, D., Chen, B., & Yu, S. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00057 · Cited by 216
Self-citationGenerative Poisoning Attack Method Against Neural NetworksPreprint
Yang, C., Wu, Q., Li, H. H., & Chen, Y. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.01340 · Cited by 215
Adversarial Label Flips Attack on Support Vector Machines
Xiao, H., Huang, X. X., & Claudia, E. (2012) · Frontiers in artificial intelligence and applications · doi:10.3233/978-1-61499-098-7-870 · Cited by 208
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. B. (2019) · International Conference on Machine Learning · Cited by 188
Mitigating Poisoning Attacks on Machine Learning Models: A Data Provenance Based Approach
Baracaldo, N., Chen, B., Ludwig, H., & Safavi, J. A. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140450 · Cited by 108
Self-citationPEFL: A Privacy-Enhanced Federated Learning Scheme for Big Data Analytics
Zhang, J., Chen, B., Yu, S., & Deng, H. (2019) · Globecom · doi:10.1109/globecom38437.2019.9014272 · Cited by 96
Self-citationEvasion and causative attacks with adversarial deep learning
Shi, Y., & Sagduyu, Y. E. (2017) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2017.8170807 · Cited by 52
Contamination Attacks and Mitigation in Multi-Party Machine LearningPreprint
Hayes, J., & Ohrimenko, O. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.02402 · Cited by 51
On the Convergence of a Family of Robust Losses for Stochastic Gradient Descent
Han, B., Tsang, I. W., & Chen, L. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-46128-1_42 · Cited by 25
Data Poisoning Attacks in Multi-Party Learning.
Mahloujifar, S., Mahmoody, M., & Mohammed, A. (2019) · International Conference on Machine Learning · Cited by 9
Cited by
Sorted by citations
Heterogeneous Federated Learning: State-of-the-art and Research Challenges
Ye, M., Fang, X., Du, B., Yuen, P. C., & Tao, D. (2023) · ACM Computing Surveys · doi:10.1145/3625558 · Cited by 709
Distributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 439
Blockchain-Based Federated Learning for Securing Internet of Things: A Comprehensive Survey
Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., & Tari, Z. (2022) · ACM Computing Surveys · doi:10.1145/3560816 · Cited by 347
Federated Learning for Cybersecurity: Concepts, Challenges, and Future Directions
Alazab, M., Ramu, S. P., Parimala, M., Maddikunta, P. K. R., Gadekallu, T. R., & Pham, Q. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3119038 · Cited by 326
Rodríguez-Barroso, N., Jiménez-López, D., Luzón, M. V., Herrera, F., & Martínez-Cámara, E. (2023) · Information Fusion · doi:10.1016/j.inffus.2022.09.011 · Cited by 296
Metadata
- Authors
- Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S.
- Affiliations
- Nanjing University of Aeronautics and Astronautics (CN)
- School of Information and Communication Technology, Hanoi University of Science and Technology, Hanoi, Vietnam
- University of Technology Sydney (AU)
- Venue
- IEEE Internet of Things Journal
- Published
- 2021-03-01
- Volume
- 8
- Issue
- 5
- Pages
- 3310-3322
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3084847664
- Cited by
- 291
- References
- 42
- Citations by year
- 2026: 34 · 2025: 61 · 2024: 72 · 2023: 63 · 2022: 43 · 2021: 18
- FWCI
- 12.18
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- UTS ePRESS (University of Technology Sydney) (submittedVersion)
- Funders
- National Key Research and Development Program of China (2019YFB2102000)
- National Natural Science Foundation of China (61672283)
- Science and Technology on Avionics Integration Laboratory and the National Aeronautical Science Foundation of China (20175552039)
- Postgraduate Research and Practice Innovation Program of Jiangsu Province (KYCX18_0308)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, generative adversarial networks, data poisoning, edge computing, Internet of Things, label flipping, backdoor attacks, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
