# FAT: Federated Adversarial Training

arXiv: https://arxiv.org/abs/2012.01791 · HTML: https://mlsanity.com/paper/2012.01791/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Dec 2020.

## Built on by (most cited first, 24 of 24)

- [Delving into the Adversarial Robustness of Federated Learning](https://mlsanity.com/paper/2302.09479/) (2023)
- [Adversarial training in communication constrained federated learning](https://mlsanity.com/paper/2103.01319/) (2021)
- [Federated Adversarial Learning: A Framework with Convergence Analysis](https://mlsanity.com/paper/2208.03635/) (2022)
- [Federated Robustness Propagation: Sharing Robustness in Heterogeneous Federated Learning](https://mlsanity.com/paper/2106.10196/) (2021)
- [Secure Federated Learning against Model Poisoning Attacks via Client Filtering](https://mlsanity.com/paper/2304.00160/) (2023)
- [Adversarial Training: A Survey](https://mlsanity.com/paper/2410.15042/) (2024)
- [Towards Robust Federated Learning via Logits Calibration on Non-IID Data](https://mlsanity.com/paper/2403.02803/) (2024)
- [Certified Robustness in Federated Learning](https://mlsanity.com/paper/2206.02535/) (2022)
- [Combating Exacerbated Heterogeneity for Robust Models in Federated Learning](https://mlsanity.com/paper/2303.00250/) (2023)
- [Logit Calibration and Feature Contrast for Robust Federated Learning on Non-IID Data](https://mlsanity.com/paper/2404.06776/) (2024)
- [Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks](https://mlsanity.com/paper/2412.19354/) (2024)
- [Characterizing Internal Evasion Attacks in Federated Learning](https://mlsanity.com/paper/2209.08412/) (2022)
- [Robust Learning Protocol for Federated Tumor Segmentation Challenge](https://mlsanity.com/paper/2212.08290/) (2022)
- [Improving Machine Learning Robustness via Adversarial Training](https://mlsanity.com/paper/2309.12593/) (2023)
- [Towards Understanding Adversarial Transferability in Federated Learning](https://mlsanity.com/paper/2310.00616/) (2023)
- [Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2310.11594/) (2023)
- [Towards Communication-Efficient Adversarial Federated Learning for Robust Edge Intelligence](https://mlsanity.com/paper/2501.15257/) (2025)
- [Federated Adversarial Training with Transformers](https://mlsanity.com/paper/2206.02131/) (2022)
- [FADE: Enabling Federated Adversarial Training on Heterogeneous Resource-Constrained Edge Devices](https://mlsanity.com/paper/2209.03839/) (2022)
- [How Does the Smoothness Approximation Method Facilitate Generalization for Federated Adversarial Learning?](https://mlsanity.com/paper/2412.08282/) (2024)
- [Lorica: A Synergistic Fine-Tuning Framework for Advancing Personalized Adversarial Robustness](https://mlsanity.com/paper/2506.05402/) (2025)
- [DART: A Server-side Plug-in for Resource-efficient Robust Federated Learning](https://mlsanity.com/paper/2508.17381/) (2025)
- [TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training](https://mlsanity.com/paper/2512.15123/) (2025)
- [Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning](https://mlsanity.com/paper/2608.25133/) (2026)

## Abstract (arXiv)

Federated learning (FL) is one of the most important paradigms addressing privacy and data governance issues in machine learning (ML). Adversarial training has emerged, so far, as the most promising approach against evasion threats on ML models. In this paper, we take the first known steps towards federated adversarial training (FAT) combining both methods to reduce the threat of evasion during inference while preserving the data privacy during training. We investigate the effectiveness of the FAT protocol for idealised federated settings using MNIST, Fashion-MNIST, and CIFAR10, and provide first insights on stabilising the training on the LEAF benchmark dataset which specifically emulates a federated learning environment. We identify challenges with this natural extension of adversarial training with regards to achieved adversarial robustness and further examine the idealised settings in the presence of clients undermining model convergence. We find that Trimmed Mean and Bulyan defences can be compromised and we were able to subvert Krum with a novel distillation based attack which presents an apparently "robust" model to the defender while in fact the model fails to provide robustness against simple attack modifications.