mlsanityData to 7 Oct 2026

Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning

arXiv 2108.10241 ↗First posted 23 Aug 2021cs.LG cs.CR cs.DCcited by 116

Not on the map. Why?

Abstract (arXiv)

While recent works have indicated that federated learning (FL) may be vulnerable to poisoning attacks by compromised clients, their real impact on production FL systems is not fully understood. In this work, we aim to develop a comprehensive systemization for poisoning attacks on FL by enumerating all possible threat models, variations of poisoning, and adversary capabilities. We specifically put our focus on untargeted poisoning attacks, as we argue that they are significantly relevant to production FL deployments. We present a critical analysis of untargeted poisoning attacks under practical, production FL environments by carefully characterizing the set of realistic threat models and adversarial capabilities. Our findings are rather surprising: contrary to the established belief, we show that FL is highly robust in practice even when using simple, low-cost defenses. We go even further and propose novel, state-of-the-art data and model poisoning attacks, and show via an extensive set of experiments across three benchmark datasets how (in)effective poisoning attacks are in the presence of simple defense mechanisms. We aim to correct previous misconceptions and offer concrete guidelines to conduct more accurate (and more realistic) research on this topic.

Key facts. Cited by 116 papers in the map (data through 7 Oct 2026). Builds on 42 of its 71 references that are in the map. First posted on arXiv 23 Aug 2021.

Builds on

42 of 71 references.

References · 42

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2019Advances and Open Problems in Federated Learningcited by 3,021
  4. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  5. 2020Adaptive Federated Optimizationcited by 1,036
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2019Towards Federated Learning at Scale: System Designcited by 826
  8. 2018LEAF: A Benchmark for Federated Settingscited by 780
  9. 2018How To Backdoor Federated Learningcited by 745
  10. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  11. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 678
  12. 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
30 more
  1. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  2. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  3. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  4. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  5. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  6. 2019Robust Aggregation for Federated Learningcited by 314
  7. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  8. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  9. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  10. 2019Can You Really Backdoor Federated Learning?cited by 250
  11. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  13. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  14. 2018RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasetscited by 148
  15. 2020Salvaging Federated Learning by Local Adaptationcited by 142
  16. 2018Generalized Byzantine-tolerant SGDcited by 94
  17. 2019Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfercited by 91
  18. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  19. 2021Federated Evaluation and Tuning for On-Device Personalization: System Design & Applicationscited by 84
  20. 2018Byzantine Stochastic Gradient Descentcited by 81
  21. 2018DRACO: Byzantine-resilient Distributed Training via Redundant Gradientscited by 74
  22. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  23. 2020Data Poisoning Attacks on Federated Machine Learningcited by 58
  24. 2020IBM Federated Learning: an Enterprise Framework White Paper V0.1cited by 57
  25. 2017Generative Poisoning Attack Method Against Neural Networkscited by 49
  26. 2019Attack-Resistant Federated Learning with Residual-based Reweightingcited by 40
  27. 2020Mitigating Backdoor Attacks in Federated Learningcited by 39
  28. 2019Poisoning Attacks with Generative Adversarial Netscited by 21
  29. 2020Byzantine-Resilient SGD in High Dimensions on Heterogeneous Datacited by 17
  30. 2019Genuinely Distributed Byzantine Machine Learningcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 19; 2023: 29; 2024: 35; 2025: 19; 2026: 14.

116 papers.

Sort:

By area:

  1. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  2. 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 65
  3. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  4. 2024Byzantine-Robust Decentralized Federated Learningcited by 47
  5. 2022Cross-Silo Federated Learning: Challenges and Opportunitiescited by 38
  6. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  7. 2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
  8. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
  9. 2023Towards Federated Foundation Models: Scalable Dataset Pipelines for Group-Structured Learningcited by 29
  10. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  11. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  12. 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 20
38 more
  1. 2023FLINT: A Platform for Federated Learning Integrationcited by 17
  2. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  3. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
  4. 2023FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregationcited by 16
  5. 2023A Survey for Federated Learning Evaluations: Goals and Measurescited by 16
  6. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networkscited by 15
  7. 2024Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challengescited by 14
  8. 2022Machine Learning with Confidential Computing: A Systematization of Knowledgecited by 13
  9. 2025Do We Really Need to Design New Byzantine-robust Aggregation Rules?cited by 13
  10. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 12
  11. 2023FedDefender: Client-Side Attack-Tolerant Federated Learningcited by 12
  12. 2022Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasurescited by 11
  13. 2023Backdoor Attacks in Peer-to-Peer Federated Learningcited by 9
  14. 2023Data-Agnostic Model Poisoning against Federated Learning: A Graph Autoencoder Approachcited by 9
  15. 2022Byzantines can also Learn from History: Fall of Centered Clipping in Federated Learningcited by 8
  16. 2022ScionFL: Efficient and Robust Secure Quantized Aggregationcited by 8
  17. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8
  18. 2022Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learningcited by 7
  19. 2024Towards Efficient and Certified Recovery from Poisoning Attacks in Federated Learningcited by 7
  20. 2022zPROBE: Zero Peek Robustness Checks for Federated Learningcited by 6
  21. 2023Can Decentralized Learning be more robust than Federated Learning?cited by 6
  22. 2023Incentivizing Honesty among Competitors in Collaborative Learning and Optimizationcited by 6
  23. 2023Samplable Anonymous Aggregation for Private Federated Data Analysiscited by 6
  24. 2024Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defensecited by 6
  25. 2025FedSV: Byzantine-Robust Federated Learning via Shapley Valuecited by 6
  26. 2022Security Analysis of SplitFed Learningcited by 5
  27. 2024Federated Learning Under Attack: Exposing Vulnerabilities through Data Poisoning Attacks in Computer Networkscited by 5
  28. 2023Analyzing the vulnerabilities in SplitFed Learning: Assessing the robustness against Data Poisoning Attackscited by 4
  29. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 4
  30. 2023FLTracer: Accurate Poisoning Attack Provenance in Federated Learningcited by 4
  31. 2023Secure and Verifiable Data Collaboration with Low-Cost Zero-Knowledge Proofscited by 4
  32. 2023Near-Optimal Resilient Aggregation Rules for Distributed Learning Using 1-Center and 1-Mean Clustering with Outlierscited by 4
  33. 2024EAB-FL: Exacerbating Algorithmic Bias through Model Poisoning Attacks in Federated Learningcited by 4
  34. 2025Toward Malicious Clients Detection in Federated Learningcited by 4
  35. 2022Robust Federated Learning against both Data Heterogeneity and Poisoning Attack via Aggregation Optimizationcited by 3
  36. 2023Protecting Federated Learning from Extreme Model Poisoning Attacks via Multidimensional Time Series Anomaly Detectioncited by 3
  37. 2024FedQV: Leveraging Quadratic Voting in Federated Learningcited by 3
  38. 2024FedRDF: A Robust and Dynamic Aggregation Function against Poisoning Attacks in Federated Learningcited by 3

50 most cited of 116 All 116 (JSON)