Cited by 41Privacy-Preserving Technologies in DataAdversarial Robustness in Machine LearningDigital Media Forensic Detection

Data-Agnostic Model Poisoning Against Federated Learning: A Graph Autoencoder Approach

Open access
Li, Kai, Zheng, Jingjing, Yuan, Xin, Ni, Wei, Akan, Ozgur B., Poor, H. Vincent·2024·IEEE Transactions on Information Forensics and Security

Abstract

This paper proposes a novel, data-agnostic, model poisoning attack on Federated Learning (FL), by designing a new adversarial graph autoencoder (GAE)-based framework. The attack requires no knowledge of FL training data and achieves both effectiveness and undetectability. By listening to the benign local models and the global model, the attacker extracts the graph structural correlations among the benign local models and the training data features substantiating the models. The attacker then adversarially regenerates the graph structural correlations while maximizing the FL training loss, and subsequently generates malicious local models using the adversarial graph structure and the training data features of the benign ones. A new algorithm is designed to iteratively train the malicious local models using GAE and sub-gradient descent. The convergence of FL under attack is rigorously proved, with a considerably large optimality gap. Experiments show that the FL accuracy drops gradually under the proposed attack and existing defense mechanisms fail to detect it. The attack can give rise to an infection across all benign devices, making it a serious threat to FL.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/tifs.2024.3362147

Cites

56 of 56 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Designs of data and model poisoning backdoor attacks specifically targeting WFL have started to emerge in the literature.

    “While there have been no widely reported data and model poisoning backdoor attacks specifically targeting WFL, designs of such attacks have started to emerge in the literature, e.g., [35].”
  • By taking advantage of overheard local models, misbehaved participants can construct malicious local models to escape malicious model detection at the central server, poison the global model and subsequently the benign local models, and manipulate WFL.

    “By taking advantage of the overheard local models, the misbehaved participants can construct malicious local models to escape malicious model detection at the central server, poison the global model and subsequently the benign local models, and manipulate WFL [35].”
  • With the broadcast nature of wireless interfaces, adversaries can potentially overhear local model updates from multiple or even all clients and create malicious local models to compromise WFL.

    “Moreover, with the broadcast nature of wireless interfaces, adversaries can potentially overhear local model updates from multiple or even all clients and accordingly create malicious local models to compromise WFL, e.g., using generative neural networks and machine learning technologies.”
  • A rogue client can collect local model updates that benign clients upload, take them as input to a graph adversarial encoder (GAE) to produce a malicious local model update, which can poison WFL and stop or slow down its convergence.

    “For example, in [35], [114], a new adversarial attack on WFL is studied by exploiting the broadcast nature of wireless channels, where a rogue client collects the local model updates that benign clients upload. The rogue client can take these overheard local model updates as input to a graph adversarial encoder (GAE) to produce a malicious local model update. The malicious local model update can”

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 8

  1. M. Fang, X. Cao, J. Jia, and N. Gong, "Local model poisoning attacks to byzantine-robust federated learning," in Proceedings of the USENIX Security Symposium, 2020, pp. 1605-1622.
  2. Y. Huang, S. Gupta, Z. Song, K. Li, and S. Arora, "Evaluating gradient inversion attacks and defenses in federated learning," Pro- ceedings of the Advances in Neural Information Processing Systems, vol. 34, pp. 7232-7241, 2021.
  3. N. Aviram, S. Schinzel, J. Somorovsky, N. Heninger, M. Dankel, J. Steube, L. Valenta, D. Adrian, J. A. Halderman, V. Dukhovni et al., "{DROWN}: Breaking {TLS} using {SSLv2}," in Proceedings of the USENIX Security Symposium, 2016, pp. 689-706.
  4. S. Hebrok, S. Nachtigall, M. Maehren, N. Erinola, R. Merget, J. Somorovsky, and J. Schwenk, "We really need to talk about session tickets: A {Large-Scale} analysis of cryptographic dangers with {TLS} session tickets," in Proceedings of the USENIX Security Symposium, 2023, pp. 4877-4894.
  5. P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, "Ma- chine learning with adversaries: Byzantine tolerant gradient descent," Advances in Neural Information Processing Systems, vol. 30, 2017.
  6. K. Lange, "Singular value decomposition," in Numerical Analysis for Statisticians. Springer, 2010, pp. 129-142.
  7. M. O'Searcoid, Metric Spaces. Springer Science & Business Media, 2006.
  8. Kai Li (S'09-M'14-SM'20) received the B.E. degree from Shandong University, China, in 2009, the M.S. degree from The Hong Kong University of Science and Technology, Hong Kong, in 2010, and the Ph.D. degree in com- puter science from The University of New South Wales, Sydney, NSW, Australia, in 2014. Cur- rently, he is a Visiting Research Scientist with the Division of Electrical Engineering, Department of Engineering, University of Cambridge, U.K.,

Cited by

Sorted by citations

Authors
Li, K., Zheng, J., Yuan, X., Ni, W., Akan, O. B., & Poor, H. V.
Affiliations
  • University of Cambridge (GB)
  • Centro de Investigação em Sistemas Computacionais Embebidos e de Tempo-Real (PT)
  • Commonwealth Scientific and Industrial Research Organisation (AU)
  • Department of Engineering, Division of Electrical Engineering, University of Cambridge, Cambridge, U.K.
  • Princeton University (US)
Venue
IEEE Transactions on Information Forensics and Security
Published
2024
Volume
19
Pages
3465-3480
ISSN
  • 1556-6013 (ISSN-L)
  • 1556-6021
OpenAlex
W4391547484
Cited by
41
References
56
Citations by year
2026: 10 · 2025: 21 · 2024: 9 · 2023: 1
FWCI
5.89
Type
journal article
Language
en
Open access
Locations
  • IEEE Transactions on Information Forensics and Security (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) (submittedVersion, other-oa)
  • arXiv (Cornell University)
Funders
  • Real-Time and Embedded Computing Systems Research Centre (CISTER) Research Unit (UIDP/UIDB/04234/2020)
  • ADANET Project (PTDC/EEICOM/3362/2021)
  • IBEX Project, funded by the National Funds through FCT/MCTES (PTDC/CCI-COM/4280/2021)
  • AXA Research Fund
  • U.S. National Science Foundation (CNS-2128448, ECCS-2335876)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
federated learning, model poisoning, graph autoencoder, undetectable attacks, convergence analysis, adversarial training

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review