DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning
Open accessAbstract
Federated learning (FL) has become an emerging machine learning technique lately due to its efficacy in safeguarding the client’s confidential information. Nevertheless, despite the inherent and additional privacy-preserving mechanisms (e.g., differential privacy, secure multi-party computation, etc.), the FL models are still vulnerable to various privacy-violating and security-compromising attacks (e.g., data or model poisoning) due to their numerous attack vectors which in turn, make the models either ineffective or suboptimal. Existing adversarial models focusing on untargeted model poisoning attacks are not enough stealthy and persistent at the same time because of their conflicting nature (large scale attacks are easier to detect and vice versa) and thus, remain an unsolved research problem in this adversarial learning paradigm. Considering this, in this paper, we analyze this adversarial learning process in an FL setting and show that a stealthy and persistent model poisoning attack can be conducted exploiting the differential noise. More specifically, we develop an unprecedented DP-exploited stealthy model poisoning (DeSMP) attack for FL models. Our empirical analysis on both the classification and regression tasks using two popular datasets reflects the effectiveness of the proposed DeSMP attack. Moreover, we develop a novel reinforcement learning (RL)-based defense strategy against such model poisoning attacks which can intelligently and dynamically select the privacy level of the FL models to minimize the DeSMP attack surface and facilitate the attack detection.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An attacker can add random noise to the local model to affect the convergence of the global model.
“For instance, the attacker can add random noise to the local model to affect the convergence of the global model [34], [35].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [34]
Some attackers exploit the differential privacy mechanism in federated learning to perform stealthy and persistent model poisoning attacks by adding specific fake noise.
“Interestingly, at the same time, some attackers exploit the differential privacy mechanism in FL to perform stealthy and persistent model poisoning attacks by adding specific fake noise [34].”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [34]
Cites
Reinforcement Learning: An Introduction
Sutton, R. S., & Barto, A. G. (1998) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.1998.712192 · Cited by 27,225 · see citing works
Reinforcement Learning: An Introduction
Sutton, R. S., & Barto, A. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2004.842673 · Cited by 25,268 · see citing works
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Calibrating Noise to Sensitivity in Private Data Analysis
Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272 · see citing works
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210 · see citing works
The MNIST Database of Handwritten Digit Images for Machine Learning Research [Best of the Web]
Deng, L. (2012) · IEEE Signal Processing Magazine · doi:10.1109/msp.2012.2211477 · Cited by 4,858 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Differentially Private Federated Learning: A Client Level Perspective
Geyer, R. C., Klein, T., & Nabi, M. (2017) · arXiv · doi:10.48550/arxiv.1712.07557 · Cited by 1,052 · see citing works
Robust Aggregation for Federated Learning
Pillutla, K., Kakade, S. M., & Harchaoui, Z. (2022) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2022.3153135 · Cited by 950 · see citing works
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning
Zhang, C., Li, S., XIA, J., Wang, W., Yan, F., & Liu, Y. (2020) · Rare & Special e-Zone (The Hong Kong University of Science and Technology) · Cited by 522 · see citing works
Local Differential Privacy-Based Federated Learning for Internet of Things
Zhao, Y., Zhao, J., Yang, M., Wang, T., Wang, N., Lyu, L., Niyato, D., & Lam, K.-Y. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3037194 · Cited by 456 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Privacy-Preserving Federated Learning Framework Based on Chained Secure Multiparty Computing
Li, Y., Zhou, Y., Jolfaei, A., Yu, D., Xu, G., & Zheng, X. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3022911 · Cited by 268 · see citing works
Electrical Load Forecasting Using Edge Computing and Federated Learning
Taik, A., & Cherkaoui, S. (2020) · ICC 2020 - 2020 IEEE International Conference on Communications (ICC) · doi:10.1109/icc40277.2020.9148937 · Cited by 252 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. B. (2019) · International Conference on Machine Learning · Cited by 188 · see citing works
Deep Model Poisoning Attack on Federated Learning
Zhou, X., Xu, M., Wu, Y., & Zheng, N. (2021) · Future Internet · doi:10.3390/fi13030073 · Cited by 170 · see citing works
Differential Privacy in Practice: Expose your Epsilons!
Dwork, C., Kohli, N., & Mulligan, D. K. (2019) · Journal of Privacy and Confidentiality · doi:10.29012/jpc.689 · Cited by 147 · see citing works
Classes of Multiagent Q-learning Dynamics with epsilon-greedy Exploration
Wunder, M. B., Littman, M. L., & Babes, M. (2010) · International Conference on Machine Learning · Cited by 97 · see citing works
Local Differential Private Data Aggregation for Discrete Distribution Estimation
Wang, S., Huang, L., Nie, Y., Zhang, X., Wang, P., Xu, H., & Yang, W. (2019) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2019.2899097 · Cited by 83 · see citing works
Cao, H., Liu, S., Zhao, R., & Xiong, X. (2020) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147720919698 · Cited by 70 · see citing works
Adversarial Classification Under Differential Privacy
Giraldo, J., Cárdenas, Á. A., Kantarcıoğlu, M., & Katz, J. I. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.23047 · Cited by 42 · see citing works
A System Architecture of Cybersecurity Information Exchange with Privacy (CYBEX-P)
Sadique, F., Bakhshaliyev, K., Springer, J., & Sengupta, S. (2019) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc.2019.8666600 · Cited by 14 · see citing works
Farokhi, F., & Esfahani, P. M. (2018) · Proceedings of the IEEE Conference on Decision & Control, including the Symposium on Adaptive Processes · doi:10.1109/cdc.2018.8619460 · Cited by 13 · see citing works
Privacy, Security, and Utility Analysis of Differentially Private CPES Data
Hossain, M. T., Badsha, S., & Shen, H. (2021) · IEEE Conference on Communications and Network Security · doi:10.1109/cns53000.2021.9705022 · Cited by 13 · see citing works
Self-citationIslam, S., Badsha, S., & Sengupta, S. (2021) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) · doi:10.1109/wowmom51794.2021.00016 · Cited by 4 · see citing works
Self-citationCybersecurity Information Exchange with Privacy (CYBEX-P) and TAHOE -- A Cyberthreat LanguagePreprint
Sadique, F., Astaburuaga, I., Kaul, R., Sengupta, S., Badsha, S., Schnebly, J., Cassell, A., Springer, J., LaTourrette, N., & Dascalu, S. M. (2021) · arXiv (Cornell University) · doi:10.13140/rg.2.2.32093.54244 · Cited by 3 · see citing works
Self-citationThe Hidden Vulnerability of Distributed Learning in Byzantium
Mhamdi, E. M. E., Guerraoui, R., & Rouault, S. (2018) · arXiv · doi:10.48550/arxiv.1802.07927
Flagged first, then by citations
1 of the 36 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Distributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 439 · see citing works
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212 · see citing works
Security of federated learning with IoT systems: Issues, limitations, challenges, and solutions
Yaacoub, J.-P. A., Noura, H., & Salman, O. (2023) · Internet of Things and Cyber-Physical Systems · doi:10.1016/j.iotcps.2023.04.001 · Cited by 106 · see citing works
A robust analysis of adversarial attacks on federated learning environments
Nair, A. K., Raj, E. D., & Sahoo, J. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103723 · Cited by 70 · see citing works
Joint Device Scheduling and Bandwidth Allocation for Federated Learning Over Wireless Networks
Zhang, T., Lam, K., Zhao, J., & Feng, J. (2023) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2023.3291701 · Cited by 45 · see citing works
Differential privacy in deep learning: Privacy and beyond
Wang, Y., Wang, Q., Zhao, L., & Wang, C. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2023.06.010 · Cited by 47 · see citing works
A review on client-server attacks and defenses in federated learning
Sharma, A., & Marchang, N. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103801 · Cited by 46 · see citing works
Amin, A. A., Hong, J., Bui, V., & Su, W. (2023) · Algorithms · doi:10.3390/a16100474 · Cited by 36 · see citing works
Federated Learning for 6G Networks: Navigating Privacy Benefits and Challenges
Sandeepa, C., Zeydan, E., Samarasinghe, T., & Liyanage, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3513832 · Cited by 27 · see citing works
Leverage Variational Graph Representation for Model Poisoning on Federated Learning
Li, K., Yuan, X., Zheng, J., Ni, W., Dressler, F., & Jamalipour, A. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3394252 · Cited by 20 · see citing works
Mun, H., Han, K., Yeun, H. K., Damiani, E., Puthal, D., Kim, T., & Yeun, C. Y. (2024) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3456852 · Cited by 21 · see citing works
Trustworthy machine learning in the context of security and privacy
Upreti, R., Lind, P. G., Elmokashfi, A. M., & Yazidi, A. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00813-3 · Cited by 19 · see citing works
A Resource Allocation Scheme for Energy Demand Management in 6G-enabled Smart Grid
Islam, S., Zografopoulos, I., Hossain, M. T., Badsha, S., & Konstantinou, C. (2023) · IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT) · doi:10.1109/isgt51731.2023.10066396 · Cited by 16 · see citing works
Self-citationExploiting Gaussian Noise Variance for Dynamic Differential Poisoning in Federated Learning
Hossain, M. T., Badsha, S., La, H. M., Islam, S., & Khalil, I. (2025) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2025.3540030 · Cited by 15 · see citing works
Self-citationGittens, A., Yener, B., & Yung, M. M. (2022) · IEEE Access · doi:10.1109/access.2022.3218715 · Cited by 15 · see citing works
Attacking Modulation Recognition With Adversarial Federated Learning in Cognitive-Radio-Enabled IoT
Zhang, H., Liu, M., Chen, Y., & Zhao, N. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3327953 · Cited by 13 · see citing works
FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks
Castillo, J., Rieger, P., Fereidooni, H., Chen, Q., & Sadeghi, A. R. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627194 · Cited by 10 · see citing works
UaaS-SFL: Unlearning as a Service for Safeguarding Federated Learning
Daluwatta, W., Khalil, I., Edirimannage, S., & Atiquzzaman, M. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3520109 · Cited by 9 · see citing works
GAOR: Genetic Algorithm-Based Optimization for Machine Learning Robustness in Communication Networks
Thompson, A. F.-B., & Suomalainen, J. (2025) · Network · doi:10.3390/network5010006 · Cited by 9 · see citing works
Rectification of Syntactic and Semantic Privacy Mechanisms
Majeed, A., & Hwang, S. O. (2022) · IEEE Security & Privacy · doi:10.1109/msec.2022.3188365 · Cited by 8 · see citing works
HaghighiFard, M. S., & Çöleri, S. (2024) · IEEE Vehicular Networking Conference (VNC) · doi:10.1109/vnc61989.2024.10576001 · Cited by 6 · see citing works
Cristiano, G. M., D’Antonio, S., & Uccello, F. (2024) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr61664.2024.10679472 · Cited by 5 · see citing works
Model Poisoning Attack Against Federated Learning with Adaptive Aggregation
Nabavirazavi, S., Taheri, R., Ghahremani, M., & Iyengar, S. S. (2023) · Advances in information security · doi:10.1007/978-3-031-49803-9_1 · Cited by 4 · see citing works
Vulnerability Characterization and Privacy Quantification for Cyber-Physical Systems
Bhattacharjee, A., Badsha, S., Hossain, M. T., Konstantinou, C., & Liang, X. (2021) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics53846.2021.00045 · Cited by 4 · see citing works
Self-citationHossain, M. T., La, H. M., & Badsha, S. (2024) · ACM Journal on Autonomous Transportation Systems · doi:10.1145/3643137 · Cited by 4 · see citing works
Self-citationBased on model randomization and adaptive defense for federated learning schemes
Yue, G., & Han, X. (2025) · Scientific Reports · doi:10.1038/s41598-024-84797-z · Cited by 3 · see citing works
A Novel Adaptive Cluster-Based Federated Learning Framework for Anomaly Detection in VANETs
Ch, R., Sudheer, P., Batra, I., & Sembiring, F. (2025) · International Global Conference Series on ICT Integration in Technical Education & Smart Society · doi:10.3390/engproc2025107079 · Cited by 3 · see citing works
Practical Implications of Implementing Local Differential Privacy for Smart Grids
Hafeez, K., Rehmani, M. H., Mishra, S., & O’Shea, D. (2025) · IEEE Communications Magazine · doi:10.1109/mcom.004.2400210 · Cited by 3 · see citing works
Anika, T. (2023) · Systematic Literature Review and Meta-Analysis Journal · doi:10.54480/slr-m.v3i4.42 · Cited by 3 · see citing works
Kazmi, S. H. A., Qamar, F., Hassan, R. B., Nisar, K., & Al‐Betar, M. A. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4587651 · Cited by 3 · see citing works
Model Poisoning Detection and Dismissal Safeguarding Federated Learning Against Malicious Attacks
Rahman, M. M., Debnath, A. C., & Giordano, S. (2024) · IEEE International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD) · doi:10.1109/camad62243.2024.10942888 · Cited by 2 · see citing works
Balancing the trilemma: a survey of federated anomaly detection for secure cyber-physical systems
Pinto, A., Donoso, Y., & Gutierrez, J. A. (2026) · Cybersecurity · doi:10.1186/s42400-026-00567-6 · Cited by 2 · see citing works
Gao, M., Zuo, F., & Wang, G. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20309-1_53 · Cited by 2 · see citing works
FedDefense: A Defense Mechanism for Dishonest Client Attacks in Federated Learning
Yue, G., & Han, X. (2025) · Neural Processing Letters · doi:10.1007/s11063-025-11724-2 · Cited by 2 · see citing works
An Analysis of Privacy Attacks in Supervised Machine Learning Algorithms
Gupta, K., Gupta, A., & Rajpoot, A. K. (2024) · International Conference on Computing, Sciences and Communications (ICCSC) · doi:10.1109/iccsc62048.2024.10830403 · Cited by 1 · see citing works
Hossain, M. T., & La, H. M. (2023) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc58545.2023.10327979 · Cited by 1 · see citing works
Self-citationApplication of Novel AI Mechanism for Minimizing Private Data Release in Cyber‐Physical Systems
Yogi, M. K., & Chakravarthy, A. S. N. (2022) · doi:10.1002/9781119905141.ch8 · Cited by 1 · see citing works
Tang, B., & Li, X. (2024) · Springer optimization and its applications · doi:10.1007/978-3-031-58923-2_2
Upeksha, R. G. C., Maduranga, M., Lasantha, N. C., & Aminda, N. G. S. (2024) · SLAAI International Conference on Artificial Intelligence (SLAAI-ICAI) · doi:10.1109/slaai-icai63667.2024.10844954
Federated Learning: An Overview of Attacks and Defense Methods
Sameera, K. M., Arikkat, D. R., Vinod, P., A., R. R. K., Aneez, A., & Conti, M. (2025) · Springer eBooks · doi:10.1007/978-3-031-83157-7_14
Guided by Noise: Vulnerable Poisoning Attack to Differentially Private Federated Learning
Dai, S., Hu, Y., Yu, H., Wang, H., & Wang, S. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11161449
Sayed, A. N., Hossen, M. M., Bensaali, F., & Nhlabatsi, A. (2026) · Lecture notes in networks and systems · doi:10.1007/978-981-96-8793-0_27
Model Poisoning via Variational Graph Representations
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_4
SecureFL-IoV: Differentially Private Federated Intrusion Detection for IoV Using a Two-Stage RF
Le, H., Hossain, M. T., & Alsmadi, I. (2026) · IEEE Conference on Communications and Network Security · doi:10.1109/cns69863.2026.11720883
Self-citation
- Authors
- Hossain, M. T., Islam, S., Badsha, S., & Shen, H.
- Affiliations
- University of Nevada, Reno (US)
- Venue
- 2021 17th International Conference on Mobility, Sensing and Networking (MSN)
- Publisher
- IEEE
- Published
- 2021-12
- Pages
- 167-174
- OpenAlex
- W3200256144
- Cited by
- 44
- References
- 36
- Citations by year
- 2026: 4 · 2025: 8 · 2024: 13 · 2023: 13 · 2022: 5 · 2021: 1
- FWCI
- 3.70
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- International Conference on Mobility, Sensing and Networking (MSN) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- federated learning, model poisoning, differential privacy, stealthy attacks, persistent attacks, attack detection, adversarial learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
