# Universal Multi-Party Poisoning Attacks

arXiv: https://arxiv.org/abs/1809.03474 · HTML: https://mlsanity.com/paper/1809.03474/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Sep 2018.

## Built on by (most cited first, 17 of 17)

- [Robustifying Safety-Aligned Large Language Models through Clean Data Curation](https://mlsanity.com/paper/2405.19358/) (2024)
- [FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective](https://mlsanity.com/paper/2110.13864/) (2021)
- [Robust learning under clean-label attack](https://mlsanity.com/paper/2103.00671/) (2021)
- [Achieving Byzantine-Resilient Federated Learning via Layer-Adaptive Sparsified Model Aggregation](https://mlsanity.com/paper/2409.01435/) (2024)
- [Learning and Certification under Instance-targeted Poisoning](https://mlsanity.com/paper/2105.08709/) (2021)
- [Turning Federated Learning Systems Into Covert Channels](https://mlsanity.com/paper/2104.10561/) (2021)
- [Backdoors Stuck At The Frontdoor: Multi-Agent Backdoor Attacks That Backfire](https://mlsanity.com/paper/2201.12211/) (2022)
- [Low-Loss Subspace Compression for Clean Gains against Multi-Agent Backdoor Attacks](https://mlsanity.com/paper/2203.03692/) (2022)
- [Overcoming the Challenges of Batch Normalization in Federated Learning](https://mlsanity.com/paper/2405.14670/) (2024)
- [ByzFL: Research Framework for Robust Federated Learning](https://mlsanity.com/paper/2505.24802/) (2025)
- [Widen The Backdoor To Let More Attackers In](https://mlsanity.com/paper/2110.04571/) (2021)
- [HYDRA-FL: Hybrid Knowledge Distillation for Robust and Accurate Federated Learning](https://mlsanity.com/paper/2409.19912/) (2024)
- [Covert Communication Based on the Poisoning Attack in Federated Learning](https://mlsanity.com/paper/2306.01342/) (2023)
- [Poisoning Attacks on Federated Learning for Autonomous Driving](https://mlsanity.com/paper/2405.01073/) (2024)
- [Decoding FL Defenses: Systemization, Pitfalls, and Remedies](https://mlsanity.com/paper/2502.05211/) (2025)
- [Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach](https://mlsanity.com/paper/2505.16403/) (2025)
- [XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers](https://mlsanity.com/paper/2604.09489/) (2026)

## Abstract (arXiv)

In this work, we demonstrate universal multi-party poisoning attacks that adapt and apply to any multi-party learning process with arbitrary interaction pattern between the parties. More generally, we introduce and study (k,p)-poisoning attacks in which an adversary controls k∈[m] of the parties, and for each corrupted party Pi, the adversary submits some poisoned data T'i on behalf of Pi that is still ``(1-p)-close'' to the correct data Ti (e.g., 1-p fraction of T'i is still honestly generated). We prove that for any ``bad'' property B of the final trained hypothesis h (e.g., h failing on a particular test example or having ``large'' risk) that has an arbitrarily small constant probability of happening without the attack, there always is a (k,p)-poisoning attack that increases the probability of B from μ to by μ1-p · k/m = μ + Omega(p · k/m). Our attack only uses clean labels, and it is online. More generally, we prove that for any bounded function f(x1,dots,xn) ∈ [0,1] defined over an n-step random process X = (x1,dots,xn), an adversary who can override each of the n blocks with even dependent probability p can increase the expected output by at least Omega(p · Var[f(x)]).