Data Poisoning in Sequential and Parallel Federated Learning
Abstract
Federated Machine Learning has recently become a prominent approach to leverage data that is distributed across different clients, without the need to centralize data. Models are trained locally, and only model parameters are shared and aggregated into a global model. Federated learning can increase privacy of sensitive data, as the data itself is never shared, and benefit from the distributed setting by utilizing computational resources of the clients. Adversarial Machine Learning attacks machine learning systems in respect to their confidentiality, integrity or availability. Recent research has shown that many forms of machine learning are susceptible to these types of attacks. Besides its advantages, federated learning opens new attack surfaces due to its distributed nature, which amplifies concerns of adversarial attacks. In this paper, we evaluate data poisoning attacks in federated settings. By altering certain training inputs that are used in the training phase with a specific pattern, an adversary may later trigger malicious behavior in the prediction phase. We show on datasets for traffic sign and face recognition that federated learning is effective on a similar level as centralized learning, but is indeed vulnerable to data poisoning attacks. We test both a parallel as well as a sequential (incremental cyclic) federated learning, and perform an in-depth analysis on several hyper-parameters of the adversaries.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.
“Florian et al. [88] pointed out that an attacker with sufficiently long continuous learning cycles can achieve high accuracy on backdoor samples.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [88]
Cites
Overcoming catastrophic forgetting in neural networks
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., et al. (2017) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.1611835114 · Cited by 7,899 · see citing works
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Privacy-Preserving Deep Learning via Additively Homomorphic Encryption
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2787987 · Cited by 1,662 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Communication-Efficient Federated Learning for Wireless Edge Intelligence in IoT
Mills, J., Hu, J., & Min, G. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2019.2956615 · Cited by 436 · see citing works
Machine Learning and Knowledge Extraction
Holzinger, A., Kieseberg, P., Tjoa, A. M., & Weippl, E. R. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-29726-8 · Cited by 33 · see citing works
HIERARCHICAL STRUCTURE BASED CONVOLUTIONAL NEURAL NETWORK FOR FACE RECOGNITION
Khalajzadeh, H., MANSOURI, M., & Teshnehlab, M. (2013) · International Journal of Computational Intelligence and Applications · doi:10.1142/s1469026813500181 · Cited by 26 · see citing works
Poisoning Attacks in Federated Learning
Nuding, F., & Mayer, R. L. (2020) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3374664.3379534 · Cited by 22 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212 · see citing works
A systematic review of federated learning: Challenges, aggregation methods, and development tools
Guendouzi, S. B., Ouchani, S., Assaad, H. E., & Zaher, M. E. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103714 · Cited by 163 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“…How to Balance the Model Performance and the Detection Rate Before the Aggregation Phase: Defending before the aggregation phase is a common strategy in which the server aggregator detects and ignores malicious updates and restricts participation from suspicious clients [212], [246], [247], [248].”
BackgroundUddin, M. P., Xiang, Y., Hasan, M., Bai, J., Zhao, Y., & Gao, L. (2025) · ACM Computing Surveys · doi:10.1145/3727643 · Cited by 94 · see citing works
Anomaly detection and defense techniques in federated learning: a comprehensive review
Zhang, C., Yang, S., Mao, L., & Ning, H. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10796-1 · Cited by 66 · see citing works
Li, K., Li, C., Yuan, X., Li, S., Zou, S., Ahmed, S. S., Ni, W., Niyato, D. T., Jamalipour, A., Dressler, F., et al. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3603957 · Cited by 61 · see citing works
Dependable federated learning for IoT intrusion detection against poisoning attacks
Yang, R., He, H. X., Wang, Y., Qu, Y., & Zhang, W. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103381 · Cited by 58 · see citing works
Federated Learning for Mobility Applications
Geçer, M., & Garbinato, B. (2023) · ACM Computing Surveys · doi:10.1145/3637868 · Cited by 57 · see citing works
Karras, A., Γιάνναρος, Α., Theodorakopoulos, L., Krimpas, G. A., Kalogeratos, G., Karras, C., & Sioutas, S. (2023) · Electronics · doi:10.3390/electronics12224633 · Cited by 36 · see citing works
Collusive Backdoor Attacks in Federated Learning Frameworks for IoT Systems
Alharbi, S., Guo, Y., & Yu, W. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3368754 · Cited by 34 · see citing works
A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems
Roux, Q. L., Bourbao, E., Teglia, Y., & Kallas, K. (2024) · IEEE Access · doi:10.1109/access.2024.3382584 · Cited by 24 · see citing works
Leverage Variational Graph Representation for Model Poisoning on Federated Learning
Li, K., Yuan, X., Zheng, J., Ni, W., Dressler, F., & Jamalipour, A. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3394252 · Cited by 20 · see citing works
Geng, T., Liu, J., & Huang, C. (2024) · IEEE Annual Congress on Artificial Intelligence of Things (AIoT) · doi:10.1109/aiot63253.2024.00032 · Cited by 18 · see citing works
FedCSD: A Federated Learning Based Approach for Code-Smell Detection
Alawadi, S., Alkharabsheh, K., Alkhabbas, F., Kebande, V. R., Awaysheh, F. M., Palomba, F., & Awad, M. (2024) · IEEE Access · doi:10.1109/access.2024.3380167 · Cited by 17 · see citing works
Lavaur, L., Busnel, Y., & Autrel, F. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104462 · Cited by 14 · see citing works
Lavaur, L., Busnel, Y., & Autrel, F. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3670434 · Cited by 12 · see citing works
Federated Learning in the Detection of Fake News Using Deep Learning as a Basic Method
Machová, K., Mach, M., & Balara, V. (2024) · Sensors · doi:10.3390/s24113590 · Cited by 9 · see citing works
Blockchain Based Secure Federated Learning With Local Differential Privacy and Incentivization
Chaudhury, S. D., Morreddigari, L. R., Varun, M., Sengupta, T., Chakraborty, S., Sural, S., Vaidya, J. S., & Atluri, V. (2024) · IEEE Transactions on Privacy · doi:10.1109/tp.2024.3487819 · Cited by 9 · see citing works
How to cope with malicious federated learning clients: An unsupervised learning-based approach
Önsü, M. A., Kantarcı, B., & Boukerche, A. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109938 · Cited by 8 · see citing works
SSI − FL : Self-sovereign identity based privacy-preserving federated learning
Haque, R. U., Hasan, A. S. M. T., Al-Hababi, M. A. M., Zhang, Y., & Xu, D. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104907 · Cited by 8 · see citing works
Mali, B., Singh, P. K., & Mazumdar, N. (2024) · Security and Privacy · doi:10.1002/spy2.403 · Cited by 7 · see citing works
Kaushal, V., & Sharma, S. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02339-z · Cited by 7 · see citing works
Evaluating the Impact of Mobility on Differentially Private Federated Learning
Kim, E.-J., & Lee, E. (2024) · Applied Sciences · doi:10.3390/app14125245 · Cited by 6 · see citing works
SoK: Systematizing Attack Studies in Federated Learning – From Sparseness to Completeness
Sharma, G., Chamikara, M. A. P., Chhetri, M. B., & Chen, Y. P. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3590328 · Cited by 6 · see citing works
Combining Defences Against Data-Poisoning Based Backdoor Attacks on Neural Networks
Milakovic, A., & Mayer, R. L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-10684-2_3 · Cited by 5 · see citing works
Self-citationAyensu, F., Turner, C., & Osunmakinde, I. O. (2025) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2025.0160501 · Cited by 4 · see citing works
SPoiL: Sybil-Based Untargeted Data Poisoning Attacks in Federated Learning
Lian, Z., Zhang, C., Nan, K., & Su, C. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-39828-5_13 · Cited by 4 · see citing works
Secured edge intelligence in smart manufacturing CPS
Qian, C., Guo, Y., Liang, H., Song, J., & Yu, W. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-326572-3.00024-3 · Cited by 3 · see citing works
Adaptive Aggregation for Robust Federated Learning Against Label Flipping and Backdoor Attacks
Lhasnaoui, C., Bergling, O., Ait‐Mlouk, A., & Agouti, T. (2025) · International Conference on Fog and Mobile Edge Computing (FMEC) · doi:10.1109/fmec65595.2025.11119245 · Cited by 3 · see citing works
Alsuwat, H. (2023) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2023.0141170 · Cited by 3 · see citing works
Evading model poisoning attacks in federated learning by a long-short-term-memory-based approach
Arazzi, M., Lax, G., & Nocera, A. (2024) · Integrated Computer-Aided Engineering · doi:10.1177/10692509241301588 · Cited by 3 · see citing works
Mitigating Adversarial Attacks against IoT Profiling
Neto, E. C. P., Dadkhah, S., Sadeghi, S., & Molyneaux, H. (2024) · Electronics · doi:10.3390/electronics13132646 · Cited by 2 · see citing works
MPHM: Model poisoning attacks on federal learning using historical information momentum
Shi, L., Chen, Z., Shi, Y., Lin, W., Tao, Y., He, M., Wang, Q., Zhou, Y. H., & Gao, Y. (2023) · Security and Safety · doi:10.1051/sands/2023006 · Cited by 2 · see citing works
AF-MCDC: Active Feedback-Based Malicious Client Dynamic Detection
Du, H., Zhang, S., Xv, X., Ji, Y. Y., Shao, S., Wu, F., & Liu, S. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111234 · Cited by 2 · see citing works
A Voting-Based Poisoning Attack to Federated Learning with Quantization
Ma, X., Wei, L., Zhang, B., Wang, Y., Zhang, C., & Li, Y. (2022) · International Conference on Hot Information-Centric Networking (HotICN) · doi:10.1109/hoticn57539.2022.10036222
Aghdam, A. G. (2023) · IEEE Systems Journal · doi:10.1109/jsyst.2023.3241415
The Cost of Privacy: A Comprehensive Analysis of the Security Issues in Federated Learning
Sundar, A. P., Li, F., Zou, X., & Gao, T. (2024) · Advances in information security · doi:10.1007/978-3-031-53510-9_14
BR-CPPFL: A Blockchain-Based Robust Clustered Privacy-Preserving Federated Learning System
Li, Y., Wang, X., Zhang, K., Zhang, B., Zheng, L., Ding, X., & Xu, Q. H. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3543-9_20
A Federated Learning Data Poisoning Attacker Detection Method based on Credibility and Data Quality
Song, H., Shi, S., Zhao, X., Xu, C., Zhang, S., & Xu, X. (2025) · International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC) · doi:10.1109/cyberc66434.2025.00012
Defending Against Backdoor Attacks in Federated Learning: A Triple-Phase Client-Side Approach
Chen, Y., & Li, B. (2026) · Electronics · doi:10.3390/electronics15020273
Threat Landscape in Federated Learning
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_2
Model Poisoning via Variational Graph Representations
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_4
- Authors
- Nuding, F., & Mayer, R.
- Affiliations
- TU Wien (AT)
- ORCID
- Mayer, Rudolf
- Venue
- Proceedings of the 2022 ACM on International Workshop on Security and Privacy Analytics
- Publisher
- ACM
- Published
- 2022-04-18
- Pages
- 24-34
- OpenAlex
- W4224316323
- Cited by
- 42
- References
- 10
- Citations by year
- 2026: 3 · 2025: 10 · 2024: 16 · 2023: 11 · 2022: 2
- FWCI
- 5.39
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM International Workshop on Security and Privacy Analytics (IWSPA) (publishedVersion)
- Funders
- FFG (COMET SBA-K1)
- EU H2020 (826078 (project 'FeatureCloud'))
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- data poisoning, federated learning, adversarial learning, traffic sign recognition, face recognition, hyperparameter analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
