Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach

2025/05/22 by Pan, Huazi, Yanjun Zhang, Leo Yu Zhang +8
Computer Science · Engineering · #Adversarial Robustness in Machine Learning #FOS: Computer and information sciences #FOS: Electrical engineering #Machine Learning (cs.LG) #Privacy-Preserving Technologies in Data #Smart Grid Security and Resilience #Systems and Control (eess.SY) #electronic engineering #information engineering

paper · pdf · doi:10.48550/arxiv.2505.16403

openalex publication_date 2025/05/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Manipulation of local training data and local updates, i.e., the poisoning attack, is the main threat arising from the collaborative nature of the federated learning (FL) paradigm. Most existing poisoning attacks aim to manipulate local data/models in a way that causes denial-of-service (DoS) issues. In this paper, we introduce a novel attack method, named Federated Learning Sliding Attack (FedSA) scheme, aiming at precisely introducing the extent of poisoning in a subtle controlled manner. It operates with a predefined objective, such as reducing global model's prediction accuracy by 10%. FedSA integrates robust nonlinear control-Sliding Mode Control (SMC) theory with model poisoning attacks. It can manipulate the updates from malicious clients to drive the global model towards a compromised state, achieving this at a controlled and inconspicuous rate. Additionally, leveraging the robust control properties of FedSA allows precise control over the convergence bounds, enabling the attacker to set the global accuracy of the poisoned model to any desired level. Experimental results demonstrate that FedSA can accurately achieve a predefined global accuracy with fewer malicious clients while maintaining a high level of stealth and adjustable learning rates.

Citations

• Not All Edges are Equally Robust: Evaluating the Robustness of Ranking-Based Federated Learning
• Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning
• FL-Defender: Combating Targeted Attacks in Federated Learning
• FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
• Learning from History for Byzantine Robust Optimization
• PrivColl: Practical Privacy-Preserving Collaborative Machine Learning
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Can You Really Backdoor Federated Learning?
• Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulation
• Analyzing Federated Learning through an Adversarial Lens
• Universal Multi-Party Poisoning Attacks
• How To Backdoor Federated Learning
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
• The Hidden Vulnerability of Distributed Learning in Byzantium
• Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
• Learning Feature Pyramids for Human Pose Estimation
• The MNIST Database of Handwritten Digit Images for Machine Learning Research [Best of the Web]

Related

• Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning
• Model Poisoning Attacks to Federated Learning via Multi-Round Consistency
• FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
• FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective
• FedUP: Efficient Pruning-based Federated Unlearning for Model Poisoning Attacks