Clean‐label poisoning attacks on federated learning for IoT
Open accessAbstract
Abstract Federated Learning (FL) is suitable for the application scenarios of distributed edge collaboration of the Internet of Things (IoT). It can provide data security and privacy, which is why it is widely used in the IoT applications such as Industrial IoT (IIoT). Latest research shows that the federated learning framework is vulnerable to poisoning attacks in the case of an active attack by the adversary. However, the existing backdoor attack methods are easy to be detected by the defence methods. To address this challenge, we focus on edge‐cloud synergistic FL clean‐label attacks. Unlike common backdoor attack, to ensure the attack's concealment, we add a small perturbation to realize the clean label attack by judging the cosine similarity between the gradient of the adversarial loss and the gradient of the normal training loss. In order to improve the attack success rate and robustness, the attack is implemented when the global model is about to converge. The experimental results verified that 1% of poisoned data could make an attack successful with a high probability. Our method maintains stealth while performing model poisoning attacks, and the average Peak Signal‐to‐Noise Ratio (PSNR) of poisoning images reaches over 30 dB, and the average Structural SIMilarity (SSIM) is close to 0.93. Most importantly, our attack method can bypass the Byzantine aggregation defence.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Model poisoning can achieve high attack success rates even with minimal poisoned data.
“Model poisoning can achieve high attack success rates even with minimal poisoned data [163].”
From Privacy-preserving Machine Learning in Internet of Vehicle Applications: Fundamentals, Recent Advances, and Future Direction (2025) · cites this paper as [163]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Edge computing: Vision and challenges
Shi, W., Cao, J., Zhang, Q., Li, Y., & Xu, L. (2016) · IEEE Internet of Things Journal · doi:10.1109/jiot.2016.2579198 · Cited by 8,733 · see citing works
Self-citationFederated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Federated Learning: Strategies for Improving Communication Efficiency
Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016) · arXiv · doi:10.48550/arxiv.1610.05492 · Cited by 3,766 · see citing works
A Survey on the Edge Computing for the Internet of Things
Yu, W., Liang, F., He, X., Hatcher, W. G., Lu, C., Lin, J., & Yang, X. (2018) · IEEE Access · doi:10.1109/access.2017.2778504 · Cited by 1,520 · cited 1× · see citing works
“These properties are applicable in real-time response, security & privacy protection, and provide better intelligent services for local users (Al-Khafajiy et al., 2017; Maamar et al., 2019; Puthal et al., 2020; Qian et al., 2021; Shi et al., 2016; Yang et al., 2022).”
BackgroundHow to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626 · see citing works
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291 · see citing works
The security of machine learning in an adversarial setting: A survey
Wang, X., Li, J., Kuang, X., Tan, Y., & Li, J. (2019) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2019.03.003 · Cited by 197 · see citing works
Self-citationAdaptive Asynchronous Federated Learning in Resource-Constrained Edge Computing
Liu, J., Xu, H., Wang, L., Xu, Y., Qian, C., Huang, J., & Huang, H. (2021) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2021.3096846 · Cited by 189 · see citing works
A blockchain based privacy-preserving federated learning scheme for Internet of Vehicles
Wang, N., Yang, W., Wang, X., Wu, L., Guan, Z., Du, X., & Guizani, M. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.05.020 · Cited by 128 · see citing works
MetaPoison: Practical General-purpose Clean-label Data PoisoningPreprint
Huang, W., Geiping, J., Fowl, L., Taylor, G., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.00225 · Cited by 102 · see citing works
Toward Communication-Efficient Federated Learning in the Internet of Things With Edge Computing
Sun, H., Li, S., Yu, F. R., Qi, Q., Wang, J., & Liao, J. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2994596 · Cited by 95 · see citing works
Witches' Brew: Industrial Scale Data Poisoning via Gradient MatchingPreprint
Geiping, J., Fowl, L., Huang, W., Czaja, W., Taylor, G., Moeller, M., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.02276 · Cited by 86 · see citing works
Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability
Aghakhani, H., Meng, D., Wang, Y.-X., Kruegel, C., & Vigna, G. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00021 · Cited by 80 · see citing works
A Practical Cross-Device Federated Learning Framework over 5G Networks
Yang, W., Wang, N., Guan, Z., Wu, L., Du, X., & Guizani, M. (2022) · IEEE Wireless Communications · doi:10.1109/mwc.005.2100435 · Cited by 55 · see citing works
Collaborative Edge Computing for Smart Villages [Energy and Security]
Puthal, D., Mohanty, S., Wilson, S., & Choppali, U. (2021) · IEEE Consumer Electronics Magazine · doi:10.1109/mce.2021.3051813 · Cited by 46 · see citing works
A group key agreement protocol for intelligent internet of things system
Zhang, Q., Zhu, L., Li, Y., Ma, Z., Yuan, J., Zheng, J., & Ai, S. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22644 · Cited by 46 · see citing works
Self-citationTowards a seamless coordination of cloud and fog
Maamar, Z., Baker, T., Faci, N., Ugljanin, E., Al-Khafajiy, M., & Burégio, V. (2019) · ACM Symposium on Applied Computing · doi:10.1145/3297280.3297477 · Cited by 30 · see citing works
Self-citationZhang, Q., Zhu, L., Wang, R., Li, J., Yuan, J., Liang, T., & Zheng, J. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22544 · Cited by 20 · see citing works
Self-citationQian, B., Su, J., Wen, Z., Jha, D. N., Li, Y., Guan, Y., Puthal, D., James, P., Yang, R., Zomaya, A. Y., et al. (2019) · White Rose Research Online (University of Leeds, The University of Sheffield, University of York) · doi:10.48550/arxiv.1910.05433 · Cited by 14 · see citing works
Learning under $p$-Tampering AttacksPreprint
Mahloujifar, S., Diochnos, D. I., & Mahmoody, M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.03707 · Cited by 12 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Zhan, S., Huang, L., Luo, G., Zheng, S., Gao, Z., & Chao, H.-C. (2025) · Electronics · doi:10.3390/electronics14132512 · Cited by 82 · see citing works
Blika, A., Palmos, S., Doukas, G. S., Lamprou, V., Pelekis, S., Kontoulis, M., Ntanos, C., & Askounis, D. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3449563 · Cited by 69 · see citing works
BadVFL: Backdoor Attacks in Vertical Federated Learning
Naseri, M., Han, Y., & Cristofaro, E. D. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00008 · Cited by 43 · see citing works
Federated learning-based robust android malware detection: label-flipping attacks and defenses
Eslamnejad, M., Taheri, R., Shojafar, M., & Bader-El-Den, M. B. (2025) · Neural Computing and Applications · doi:10.1007/s00521-025-11656-x · Cited by 22 · see citing works
Micro-FL: A Fault-Tolerant Scalable Microservice-Based Platform for Federated Learning
Sabuhi, M., Musı́lek, P., & Bezemer, C. (2024) · Future Internet · doi:10.3390/fi16030070 · Cited by 15 · see citing works
ElZemity, A., & Arief, B. (2024) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics62450.2024.00072 · Cited by 16 · see citing works
Ding, Z., Wang, W., Xu, L., Wang, X., Jeon, G., Zhao, J., & Mu, C. (2024) · Scientific Reports · doi:10.1038/s41598-024-70375-w · Cited by 10 · see citing works
Logits Poisoning Attack in Federated Distillation
Tang, Y., Wu, Z., Gao, B., Wen, T., Wang, Y., & Sun, S. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-5498-4_22 · Cited by 5 · see citing works
Crafting Transferable Adversarial Examples Against Face Recognition via Gradient Eroding
Zhou, H., Wang, Y., Tan, Y., Wu, S., Zhao, Y., Zhang, Q., & Li, Y. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3253083 · Cited by 5 · see citing works
Self-citationModel Poisoning Attack Against Federated Learning with Adaptive Aggregation
Nabavirazavi, S., Taheri, R., Ghahremani, M., & Iyengar, S. S. (2023) · Advances in information security · doi:10.1007/978-3-031-49803-9_1 · Cited by 4 · see citing works
Peak-controlled logits poisoning attack in federated distillation
Tang, Y., Zhang, A., Wu, Z., Gao, B., Wen, T., Wang, Y., & Sun, S. (2025) · Discover Computing · doi:10.1007/s10791-025-09742-8 · Cited by 2 · see citing works
Islam, N., & Zulkernine, M. (2025) · arXiv · doi:10.48550/arxiv.2503.01089 · Cited by 1 · see citing works
“Another development for traffic flow prediction is the ability to handle heterogeneous spatial characteristics across participants using vertical FL (VFL) [170].”
A sparse and invisible targeted backdoor attack in federated learning
Zhang, Q., Yu, M., Wang, R., Li, Y., Yuan, J., & Tan, Y. (2025) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-025-00146-8 · Cited by 1 · see citing works
Self-citationFederated Learning Based Energy Conservation Systems is Suffering from Attribute Inference Attacks
Cai, Y., Du, W., Zhu, D., Chen, Z., & Guan, H. (2024) · Asian Conference on Artificial Intelligence Technology (ACAIT) · doi:10.1109/acait63902.2024.11021937
Poisoning-Resilient Federated Learning for MEC-IoT Environments Using Blockchain
García-Sáez, L. M., Ruiz-Villafranca, S., Roldán-Gómez, J., Carrillo-Mondéjar, J., & Martínez, J. L. (2025) · ACM Transactions on Internet Technology · doi:10.1145/3767740
Detoxification of Poisoned Recognition Models by Fine-Tuning with Out-of-Distribution Samples
Takano, J., & Nakamura, K. (2025) · Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) · doi:10.1109/apsipaasc65261.2025.11248971
Visual security defense for industrial inspection based on computer vision
Jiang, Z., Yuan, H., Zeng, C., & Fu, L. (2026) · PLoS ONE · doi:10.1371/journal.pone.0338835
Adversarial Robustness of Federated Learning in Healthcare
Saranya, P., Saranya, A., Janardhanan, J., Shukla, G., Iyer, R., & Panthakkan, A. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6224-3.ch007
A Model Consistency-Based Countermeasure to GAN-Based Data Poisoning Attack in Federated Learning
Sun, W. J., Gao, B., Xiong, K., Wang, Y., Fan, P., & Letaief, K. B. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3665336 · Cited by 2 · see citing works
Clean-Label Data Poisoning Attacks Based on Data FeaturesPreprint
Wang, Y., Zhao, N., Zhang, J., niu, J., & hu, J. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7346357
Recent Advances in Generative Artificial Intelligence for Communication Networks
Zeydan, E., Mangues‐Bafalluy, J., Türk, Y., & Liyanage, M. (2026) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2026.3734283
- Authors
- Yang, J., Zheng, J., Baker, T., Tang, S., Tan, Y., & Zhang, Q.
- Affiliations
- Beijing Institute of Technology (CN)
- University of Sharjah (AE)
- Corresponding author
- Baker, Thar
- Zhang, Quanxin
- Venue
- Expert Systems
- Publisher
- Wiley
- Published
- 2022-10-12
- Volume
- 40
- Issue
- 5
- ISSN
- 0266-4720 (ISSN-L)
- 1468-0394
- OpenAlex
- W4304782753
- Cited by
- 20
- References
- 24
- Citations by year
- 2026: 5 · 2025: 6 · 2024: 7 · 2023: 2
- FWCI
- 1.23
- Type
- journal article
- Language
- en
- Open access
- Licence
- Locations
- Expert Systems (publishedVersion, public-domain)
- University of Brighton Repository (University of Brighton) (submittedVersion, other-oa)
- Funders
- National Key Research and Development Program of China (2020YFB1712101)
- National Natural Science Foundation of China (62072037, U1936218)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, backdoor attacks, Internet of Things, Industrial Internet of Things, attack stealth, adversarial perturbations, gradient-based attacks, model poisoning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
