CoChat
Sign Up
Cited by 310Privacy-Preserving Technologies in DataAdversarial Robustness in Machine LearningNetwork Security and Intrusion Detection

Data Poisoning Attacks on Federated Machine Learning

Open access
Sun, Gan, Cong, Yang, Dong, Jiahua, Wang, Qiang, Lyu, Lingjuan, Liu, Ji·2022·IEEE Internet of Things Journal
DOI 10.1109/jiot.2021.3128646
Open this paper in CoChat — free accountOpen PDF

Abstract

Federated machine learning which enables resource-constrained node devices (e.g., Internet of Things (IoT) devices and smartphones) to establish a knowledge-shared model while keeping the raw data local, could provide privacy preservation, and economic benefit by designing an effective communication protocol. However, this communication protocol can be adopted by attackers to launch data poisoning attacks for different nodes, which has been shown as a big threat to most machine learning models. Therefore, we in this article intend to study the model vulnerability of federated machine learning, and even on IoT systems. To be specific, we here attempt to attacking a popular federated multitask learning framework, which uses a general multitask learning framework to handle statistical challenges in the federated learning setting. The problem of calculating optimal poisoning attacks on federated multitask learning is formulated as a bilevel program, which is adaptive to the arbitrary selection oftargetnodes andsource attackingnodes. We then propose a novel systems-aware optimization method, called as attack on federated learning (AT2FL), to efficiently derive the implicit gradients for poisoned data, and further attain optimal attack strategies in the federated machine learning. This is an earlier work, to our knowledge, that explores attacking federated machine learning via data poisoning. Finally, experiments on several real-world data sets demonstrate that when the attackers directly poison thetargetnodes or indirectly poison the related nodes via using the communication protocol, the federated multitask learning model is sensitive to both poisoning attacks.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper studies data poisoning attacks on federated machine learning, focusing on a federated multi-task learning framework. It formulates optimal attacks as a bilevel program and proposes AT²FL to compute poisoned data that degrades target-node performance, including indirect attacks via the communication protocol.

Key findings

  • Direct attacks substantially degrade performance: on EndAD and Human Activity, classification Error deteriorates by 21.707% and 26.836%, respectively, compared with non-attack baselines.
  • The proposed attack strategies outperform random attacks in most cases, e.g., direct attack Error on EndAD is 28.588 ± 3.74 vs. random direct 7.659 ± 1.14; on Human Activity, 29.422 ± 2.96 vs. random direct 3.275 ± 0.71.
  • Indirect attacks are generally weaker than direct and hybrid attacks, but can work when node correlations are high; the paper reports Landmine indirect attack Error of 7.428 ± 0.39 vs. non-attack 5.682 ± 0.28, and attributes this to high correlation in its Ω matrix.
  • Attack effectiveness increases with the ratio of injected data, and AT²FL converges to a local optimum after a few iterations across the tested attack types.

Methods

  • The paper formulates poisoning attacks on federated multi-task learning as a bilevel optimization problem, with upper-level poisoned data and lower-level federated multi-task learning, covering direct, indirect, and hybrid attacks.
  • It proposes ATTack on Federated Learning (AT²FL), a projected stochastic gradient ascent method that computes implicit gradients for poisoned data using dual variables for least-square and hinge losses.
  • Experiments use five datasets: EndAD (6 nodes), Human Activity Recognition (30 nodes), Landmine (29 nodes), Parkinson-Total, and Parkinson-Motor (42 regression tasks each); metrics are classification Error and RMSE, averaged over 10 random runs, with injected data set to 20% of clean data and step size η₁ = 100, λ₁ = λ₂ = 0.001.

Limitations

  • The paper does not state limitations explicitly; it notes future work on vertical (feature-based) federated learning and federated transfer learning.
  • Evident from the text: the study is limited to horizontal federated multi-task learning and does not evaluate defenses or other federated learning settings.
  • Evident from the text: the attack assumes the attacker can inject poisoned data into source nodes and exploit the communication protocol, and the empirical evaluation is limited to the selected datasets and tasks.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/jiot.2021.3128646

Cites

38 of 38 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 16 cited sources checked · 0 supported · 0 flagged

  • Findingown data
    § B. Evaluating Attack Strategies · p. 6

    Proposed attack strategies obtain better deterioration performance than random attack strategies in most cases for federated machine learning problems.

    “When comparing with the random attack strategies, our proposed attack strategies can obtain better deterioration performance among most cases for the federated machine learning problems”
    Quote in the paperSubstantial claim
  • Findingown data
    § C. Sensitivity Study and Convergence Analysis · p. 6

    For all used datasets, model performance under different attack strategies decreases as the ratio of injected data increases.

    “For all the used datasets, the performances under different attack strategies are decreased with the increasing of the injected data.”
    Quote in the paperSubstantial claim
  • Findingreasoning
    § B. Evaluating Attack Strategies · p. 6

    Indirect attack strategy performs better on the Landmine dataset when compared with other used datasets.

    “This observation indicates the reason why indirect attack strategy performs better on the Landmine dataset when comparing with other used datasets.”
    Quote in the paperSubstantial claim
  • Findingnone given
    § C. Sensitivity Study and Convergence Analysis · p. 6

    The classification Error on the test data obtains the upper bound when the ratio of injected data is 10%.

    “Meanwhile, the classification Error on the test data obtains the upper bound when the ratio of injected data is 10% .”
    Quote in the paperNot a substantial claim
  • Findingreasoning
    § B. Evaluating Attack Strategies · p. 6

    Indirect attack performance is not as good as direct and hybrid attack strategies (e.g., on Human Activity Recognition dataset).

    “For the indirect attack strategy, we can notice its performances are not good as direct and hybrid attack strategies, e.g., Human Activity Recognition dataset.”
    Quote in the paperSubstantial claim
  • May combine two claims. 10
  • The quote only partly states this claim. 1
  • Classified as probably not a substantial claim. 12

  • May combine two claims.

    Findingnone given
    § A. Attacking Alternating Minimization · p. 4

    In the bilevel formulation, the upper level problem is a simple primal problem, while the lower level problem is highly non-linear and non-convex.

    “In our bilevel formulation Eq. (3), although the upper level problem is a simple primal problem, the lower level problem is highly non-linear and non-convex.”
    Quote in the paperSubstantial claim

  • May combine two claims. The quote only partly states this claim.

    Findingown data
    § I. INTRODUCTION · p. 2

    Federated multi-task learning models are very sensitive to poisoning attacks when attackers either directly poison target nodes or indirectly poison related nodes by exploiting the communication protocol.

    “The experiment results strongly support our proposed model when attacking federated machine learning based on the communication protocol.”
    • Also stated in: § I. INTRODUCTION · p. 2 · hedged
      “The experiment results indicate that the communication protocol among multiple nodes opens a door for attacker to attack federated machine learning.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingreasoning
    § B. Poisoning Attacks on Federated Multi-task Learning · p. 3

    The lower level problem in the bilevel formulation is a federated multi-task learning problem with training set consisting of both clean and injected data points.

    “The lower level problem in the Eq. (3) is a federated multi-task learning problem with training set consisting of both clean and injected data points.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § II. RELATED WORK · p. 2

    The data on each node in federated learning may be non-IID and unbalanced.

    “the training data it can handle are with the following properties [12]: 1) Non-IID : data on each node/device may be drawn from a different distribution; 2) Unbalanced : the number of training samples for different nodes/devices may vary by orders of magnitude.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [12] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation
    § IV. ATTACK ON FEDERATED LEARNING (AT 2 FL) · p. 3

    The proposed algorithm is based on projected stochastic gradient ascent that efficiently maximally increases the empirical loss of target nodes and damages their classification/regression performance.

    “we follow the setting of most data poisoning attack strategies ( e.g., [5], [21]), and design a projected stochastic gradient ascent based algorithm that efficiently maximally increases the empirical loss of target nodes, and further damages their classification/regression performance.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [5] Biggio, Poisoning attacks against support vector machines

      Not checked in the free run.

    • cites [21] Liu, 2018, FADL:Federated-autonomous deep learning for distributed electronic health record, arXiv:1811.11400

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § B. Gradients Computation · p. 4

    The first term on the right side of the gradient equation can be easily computed because it depends only on the loss function L_t.

    “From the equation above, we can notice that the first term on the right side can be easily computed since it depends only on the loss function L t ( · ) .”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § IV. ATTACK ON FEDERATED LEARNING (AT 2 FL) · p. 3

    There is no closed-form relation between the empirical loss and the injected data.

    “Notice that there is no closed-form relation between the empirical loss and the injected data, so we intend to compute the gradients by exploiting the optimality conditions of the subproblem.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § II. RELATED WORK · p. 2

    The multi-task style federated learning system allows multiple nodes to complete separate tasks while preserving security and sharing knowledge.

    “The representative work is a multi-task style federated learning system [15], which is proposed to allow multiple nodes to complete separate tasks while preserving security and sharing knowledge”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15] source

      Not checked in the free run.

  • May combine two claims.

    Premisereasoning
    § A. Federated Machine Learning · p. 3

    Solving for matrix Ω is not dependent on the data and can be computed centrally.

    “From the equation above, we can notice that solving for matrix Ω is not dependent on the data and therefore can be computed centrally; one major contribution of [15] is an efficient distributed optimization method for the W step.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § Data Poisoning Attacks on Federated Machine Learning · p. 1

    The proposed AT2FL algorithm efficiently derives implicit gradients for poisoned data and computes optimal attack strategies in federated machine learning.

    “Then we propose a novel systems-aware optimization method, ATTack on Federated Learning (AT 2 FL), which is efficiency to derive the implicit gradients for poisoned data, and further compute optimal attack strategies in the federated machine learning.”
    • Also stated in: § I. INTRODUCTION · p. 2 · plain
      “we thus design a novel optimization method, ATTack on Federated Learning (AT 2 FL), to derive the implicit gradients for computing poisoned data in the source attacking nodes. Furthermore, the obtained gradient can be effectively used to compute the optimal attack strategies.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § B. Gradients Computation · p. 4

    W and α can be connected via the formulation in Eq. (9) following [14].

    “W and α could be connected via defining the next formulation by following [14]:”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [14] source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation
    § I. INTRODUCTION · p. 2

    The federated multi-task learning model captures node relationships among multiple nodes to tackle statistical challenges in the federated setting.

    “we focus on the recently-proposed federated multi-task learning framework [15], a federated learning framework which captures node relationships among multiple nodes to tackle the statistical challenges in the federated setting.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [15] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § B. Gradients Computation · p. 4

    The second term on the right side of the gradient equation depends on the optimality conditions of the lower level problem.

    “However, the second term on the right side depends on the optimality conditions of lower level problem of Eq. (3).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A. Federated Machine Learning · p. 3

    The update of W can be achieved by extending works on distributed primal-dual optimization [14].

    “Furthermore, the update of W can be achieved by extending works on distributed primal-dual optimization [14].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [14] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § II. RELATED WORK · p. 2

    Federated learning can be categorized into horizontal (sample-based), vertical (feature-based), and federated transfer learning based on data distribution.

    “Based on the distribution characteristics of the data, federated learning [18] can be categorized into: 1) horizontal (sample-based) federated learning, i.e., datasets share the same feature space but different in samples.”
    • Also stated in: § II. RELATED WORK · p. 2 · plain
      “2) vertical (feature-based) federated learning, i.e., two datasets share the same sample ID space but differ in feature space.”
    • Also stated in: § II. RELATED WORK · p. 2 · plain
      “3) federated transfer learning, i.e., two datasets differ not only in samples but also in feature space.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18] Konečnỳ, 2015, Federated optimization:Distributed optimization beyond the datacenter, arXiv:1511.03575

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § I. INTRODUCTION · p. 2

    The proposed AT2FL can address systems challenges associated with federated machine learning.

    “We derive an effective optimization method, i.e., ATTack on Federated Learning (AT 2 FL), to solve the optimal attack problem, which can address systems challenges associated with federated machine learning.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given
    § VI. CONCLUSION · p. 7

    They propose a bilevel data poisoning attacks formulation by following general data poisoning attacks framework, where it can include three different kinds of attacks.

    “we propose a bilevel data poisoning attacks formulation by following general data poisoning attacks framework, where it can include three different kinds of attacks.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationnone given
    § VI. CONCLUSION · p. 7

    They design AT2FL to address system challenges (e.g., high communication cost) existing in federated setting, and further compute optimal attack strategies.

    “As a key contribution of this work, we design a ATTack on Federated Learning (AT 2 FL) to address the system challenges ( e.g., high communication cost) existing in federated setting, and further compute optimal attack strategies.”
    Quote in the paperSubstantial claim
18 of 18

  • The paper relies on this without support.

    The attempt to make federated learning more reliable under poisoning attacks is still scarce.

    “Although recent improvements have been focusing on overcoming the statistical challenges ( i.e., the data collected across the network are in a non-IID manner, where the data on each node are generated by a distinct distribution) or improving privacypreserving, the attempt that makes federated learning more reliability under poisoning attacks, is still scarce.”

  • The paper relies on this without support.

    Current optimization methods for the bilevel problem are not suited to tackle systems challenges that exist in federated learning, such as high communication cost and stragglers.

    “However, current optimization methods for this bilevel problem are not suited to tackle the systems challenges ( e.g., high communication cost, stragglers) that exist in federated learning.”

  • The authors state this as an assumption.

    The attacker aims to degrade the performance of a set of target nodes by injecting corrupted/poisoned data to a set of source attacking nodes.

    “Suppose that the attacker aims to degrade the performance of a set of target nodes N tar ⊂ m by injecting corrupted/poisoned data to a set of source attacking nodes N sou ⊂ m .”

  • The authors state this as an assumption.

    The communication protocol in federated learning is bridged by the model relationship matrix Ω.

    “where the communication protocol is bridged by the model relationship matrix Ω in this paper.”

  • The paper relies on this without support.

    The benchmark datasets used are representative of real-world applications.

    “Extensive experiments demonstrate that the attack strategies computed by AT 2 FL can significantly damage performances of real-world applications.”
5 of 5

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • To generate a malicious model, the attacker can use a specific dataset or train the model on a benign dataset by projected gradient ascent.

    “To generate a malicious model w k+1 0 , the attacker can use a specific dataset (e.g., different kinds of green cars labeled as birds [29]) or train the model in a benign dataset by projected gradient ascent (while the benign clients use stochastic gradient descent) algorithm [23], [67], [77].”

    From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [77]

  • Polynomial approximations need to be made to evaluate non-linear functions in machine learning algorithms, resulting in a trade-off between utility and privacy.

    “Moreover, polynomial approximations need to be made to evaluate non-linear functions in machine learning algorithms, resulting in a trade-off between utility and privacy [79], [80].”

    From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [79]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Sensitivity study describes a direct attack with disjoint source nodes

    Minor

    The attack definitions require direct attacks to use the target nodes as source nodes. The sensitivity study instead says that, for a direct attack, source nodes are formed from the remaining nodes.

  • Exploratory attacks are described as both affecting and not affecting training

    Minor

    The introduction says exploratory attacks influence learning by controlling training data, then describes them as exploiting misclassifications without affecting training.

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Caldas, Federated kernelized multi-task learning, 1

Cited by

Sorted by citations

Related

Authors
Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J.
Affiliations
  • Shenyang Institute of Automation (CN)
  • Sony (Japan) (JP)
  • Kuaishou (China) (CN)
ORCID
Venue
IEEE Internet of Things Journal
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2022-07-01
Volume
9
Issue
13
Pages
11365-11375
ISSN
  • 2327-4662 (ISSN-L)
  • 2372-2541
DOI
10.1109/jiot.2021.3128646
OpenAlex
W3213330817
Cited by
310
References
37
Citations by year
2026: 43 · 2025: 79 · 2024: 78 · 2023: 64 · 2022: 32 · 2021: 10 · 2020: 4
FWCI
16.19
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Internet of Things Journal (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Natural Science Foundation of China (62003336, 62073205)
  • National Postdoctoral Innovative Talents Support Program (BX20200353)
  • State Key Laboratory of Robotics (2022-Z06)
  • Nature Foundation of Liaoning Province of China (2020-KF-11-01)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
data poisoning, federated learning, bi-level optimization, Internet of Things security, privacy preservation, model vulnerability

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review