mlsanityData to 14 Oct 2026

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning

arXiv 1911.11815 ↗First posted 26 Nov 2019cs.CR cs.DC cs.LGcited by 493

Not on the map. Why?

Cited by 58 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In federated learning, multiple client devices jointly learn a machine learning model: each client device maintains a local model for its local training dataset, while a master device maintains a global model via aggregating the local models from the client devices. The machine learning community recently proposed several federated learning methods that were claimed to be robust against Byzantine failures (e.g., system failures, adversarial manipulations) of certain client devices. In this work, we perform the first systematic study on local model poisoning attacks to federated learning. We assume an attacker has compromised some client devices, and the attacker manipulates the local model parameters on the compromised client devices during the learning process such that the global model has a large testing error rate. We formulate our attacks as optimization problems and apply our attacks to four recent Byzantine-robust federated learning methods. Our empirical results on four real-world datasets show that our attacks can substantially increase the error rates of the models learnt by the federated learning methods that were claimed to be robust against Byzantine failures of some client devices. We generalize two defenses for data poisoning attacks to defend against our local model poisoning attacks. Our evaluation results show that one defense can effectively defend against our attacks in some cases, but the defenses are not effective enough in other cases, highlighting the need for new defenses against our local model poisoning attacks to federated learning.

Key facts. Cited by 493 papers in the map (data through 14 Oct 2026). First posted on arXiv 26 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 61; 2022: 70; 2023: 85; 2024: 108; 2025: 106; 2026: 63.

493 papers.

Sort:

By area:

  1. 2021A Field Guide to Federated Optimizationcited by 315
  2. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  3. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  4. 2021Federated Learning for Smart Healthcare: A Surveycited by 184
  5. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  6. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
  7. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
  8. 2021Federated Unlearning via Class-Discriminative Pruningcited by 115
  9. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 99
  10. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  11. 2021Federated Learning: Opportunities and Challengescited by 84
  12. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 84
38 more
  1. 2023When Foundation Model Meets Federated Learning: Motivations, Challenges, and Future Directionscited by 84
  2. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  3. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
  4. 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 68
  5. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 67
  6. 2021From Distributed Machine Learning to Federated Learning: A Surveycited by 66
  7. 2021Provably Secure Federated Learning against Malicious Clientscited by 63
  8. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 58
  9. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 58
  10. 2021Collaborative Federated Learning For Healthcare: Multi-Modal COVID-19 Diagnosis at the Edgecited by 56
  11. 2021Adversarial Attacks On Multi-Agent Communicationcited by 49
  12. 2021Federated Learning: A Signal Processing Perspectivecited by 49
  13. 2024Byzantine-Robust Decentralized Federated Learningcited by 48
  14. 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
  15. 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
  16. 2023A Data-Free Approach to Mitigate Catastrophic Forgetting in Federated Class Incremental Learning for Vision Taskscited by 41
  17. 2023Eliminating Domain Bias for Federated Learning in Representation Spacecited by 38
  18. 2021PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotioncited by 37
  19. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  20. 2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 36
  21. 2024Advances and Open Challenges in Federated Foundation Modelscited by 36
  22. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 36
  23. 2022Federated Learning for Medical Applications: A Taxonomy, Current Trends, Challenges, and Future Research Directionscited by 35
  24. 2023A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutionscited by 35
  25. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 34
  26. 2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
  27. 2022LoMar: A Local Defense Against Poisoning Attack on Federated Learningcited by 31
  28. 2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
  29. 2021Byzantine-robust Federated Learning through Collaborative Malicious Gradient Filteringcited by 30
  30. 2022Byzantine-Robust Federated Learning with Optimal Statistical Rates and Privacy Guaranteescited by 30
  31. 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 30
  32. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  33. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generationcited by 28
  34. 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 27
  35. 2023A Survey on Decentralized Federated Learningcited by 27
  36. 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 27
  37. 2024Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metricscited by 27
  38. 2022TCT: Convexifying Federated Learning using Bootstrapped Neural Tangent Kernelscited by 26

50 most cited of 493 All 493 (JSON)