mlsanityData to 7 Oct 2026

MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clients

arXiv 2203.08669 ↗First posted 16 Mar 2022cs.CR cs.LGcited by 65

Not on the map. Why?

Abstract (arXiv)

Existing model poisoning attacks to federated learning assume that an attacker has access to a large fraction of compromised genuine clients. However, such assumption is not realistic in production federated learning systems that involve millions of clients. In this work, we propose the first Model Poisoning Attack based on Fake clients called MPAF. Specifically, we assume the attacker injects fake clients to a federated learning system and sends carefully crafted fake local model updates to the cloud server during training, such that the learnt global model has low accuracy for many indiscriminate test inputs. Towards this goal, our attack drags the global model towards an attacker-chosen base model that has low accuracy. Specifically, in each round of federated learning, the fake clients craft fake local model updates that point to the base model and scale them up to amplify their impact before sending them to the cloud server. Our experiments show that MPAF can significantly decrease the test accuracy of the global model, even if classical defenses and norm clipping are adopted, highlighting the need for more advanced defenses.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). Builds on 18 of its 31 references that are in the map. First posted on arXiv 16 Mar 2022.

Builds on

18 of 31 references.

References · 18

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  3. 2018How To Backdoor Federated Learningcited by 745
  4. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  5. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  6. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  7. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  8. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  9. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  10. 2019Can You Really Backdoor Federated Learning?cited by 250
  11. 2019Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulationcited by 136
  12. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
6 more
  1. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  2. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  3. 2017Distributed Statistical Machine Learning in Adversarial Settings: Byzantine Gradient Descentcited by 59
  4. 2020Free-rider Attacks on Model Aggregation in Federated Learningcited by 57
  5. 2019Free-riders in Federated Learning: Attacks and Defensescited by 48
  6. 2019DETOX: A Redundancy-based Framework for Faster and More Robust Gradient Aggregationcited by 44

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 6; 2023: 8; 2024: 27; 2025: 14; 2026: 10.

65 papers.

Sort:

By area:

  1. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
  2. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
  3. 2024Byzantine-Robust Decentralized Federated Learningcited by 47
  4. 2023One-shot Unsupervised Domain Adaptation with Personalized Diffusion Modelscited by 35
  5. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  6. 2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
  7. 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 29
  8. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  9. 2024Emerging Safety Attack and Defense in Federated Instruction Tuning of Large Language Modelscited by 18
  10. 2024Poisoning Federated Recommender Systems with Fake Userscited by 15
  11. 2025Do We Really Need to Design New Byzantine-robust Aggregation Rules?cited by 13
  12. 2024Poisoning Attacks on Federated Learning-based Wireless Traffic Predictioncited by 10
38 more
  1. 2023Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learningcited by 9
  2. 2023Data-Agnostic Model Poisoning against Federated Learning: A Graph Autoencoder Approachcited by 9
  3. 2024Fast-FedUL: A Training-Free Federated Unlearning with Provable Skew Resiliencecited by 8
  4. 2024Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learningcited by 6
  5. 2022Security-Preserving Federated Learning via Byzantine-Sensitive Triplet Distancecited by 5
  6. 2024Federated Learning Under Attack: Exposing Vulnerabilities through Data Poisoning Attacks in Computer Networkscited by 5
  7. 2024ACE: A Model Poisoning Attack on Contribution Evaluation Methods in Federated Learningcited by 5
  8. 2024DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learningcited by 5
  9. 2024EAB-FL: Exacerbating Algorithmic Bias through Model Poisoning Attacks in Federated Learningcited by 4
  10. 2024FedCFA: Alleviating Simpson's Paradox in Model Aggregation with Counterfactual Federated Learningcited by 4
  11. 2025Toward Malicious Clients Detection in Federated Learningcited by 4
  12. 2024Resilience in Online Federated Learning: Mitigating Model-Poisoning Attacks via Partial Sharingcited by 3
  13. 2024Leverage Variational Graph Representation For Model Poisoning on Federated Learningcited by 3
  14. 2025Maximizing Uncertainty for Federated learning via Bayesian Optimisation-based Model Poisoningcited by 3
  15. 2023Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verificationcited by 2
  16. 2023Competitive Advantage Attacks to Decentralized Federated Learningcited by 2
  17. 2024Fake or Compromised? Making Sense of Malicious Clients in Federated Learningcited by 2
  18. 2024Partner in Crime: Boosting Targeted Poisoning Attacks against Federated Learningcited by 2
  19. 2024Poisoning with A Pill: Circumventing Detection in Federated Learningcited by 2
  20. 2024Uncovering Attacks and Defenses in Secure Aggregation for Federated Deep Learningcited by 2
  21. 2025On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directionscited by 2
  22. 2025Graph Representation-based Model Poisoning on the Heterogeneous Internet of Agentscited by 2
  23. 2024Logits Poisoning Attack in Federated Distillationcited by 1
  24. 2024Peak-Controlled Logits Poisoning Attack in Federated Distillationcited by 1
  25. 2024SoK: Towards Security and Safety of Edge AIcited by 1
  26. 2024TPFL: A Trustworthy Personalized Federated Learning Framework via Subjective Logiccited by 1
  27. 2025Secure Cluster-Based Hierarchical Federated Learning in Vehicular Networkscited by 1
  28. 2025Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Thingscited by 1
  29. 2026Safe-FedLLM: Delving into the Safety of Federated Large Language Modelscited by 1
  30. 2023The Landscape of Modern Machine Learning: A Review of Machine, Distributed and Federated Learningcited by 0
  31. 2023AIJack: Let's Hijack AI! Security and Privacy Risk Simulator for Machine Learningcited by 0
  32. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  33. 2024Secure Hierarchical Federated Learning in Vehicular Networks Using Dynamic Client Selection and Anomaly Detectioncited by 0
  34. 2024A Novel Defense Against Poisoning Attacks on Federated Learning: LayerCAM Augmented with Autoencodercited by 0
  35. 2024SHFL: Secure Hierarchical Federated Learning Framework for Edge Networkscited by 0
  36. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  37. 2024How to Defend Against Large-scale Model Poisoning Attacks in Federated Learning: A Vertical Solutioncited by 0
  38. 2025FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learningcited by 0

50 most cited of 65 All 65 (JSON)