# How Potent are Evasion Attacks for Poisoning Federated Learning-Based Signal Classifiers?

arXiv: https://arxiv.org/abs/2301.08866 · HTML: https://mlsanity.com/paper/2301.08866/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Jan 2023.

## Built on by (most cited first, 4 of 4)

- [Multi-Source to Multi-Target Decentralized Federated Domain Adaptation](https://mlsanity.com/paper/2304.12422/) (2023)
- [The Impact of Adversarial Node Placement in Decentralized Federated Learning Networks](https://mlsanity.com/paper/2311.07946/) (2023)
- [From Data Heterogeneity to Convergence: A Data-Centric Review of Federated Learning](https://mlsanity.com/paper/2606.10595/) (2026)
- [Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning](https://mlsanity.com/paper/2608.25133/) (2026)

## Abstract (arXiv)

There has been recent interest in leveraging federated learning (FL) for radio signal classification tasks. In FL, model parameters are periodically communicated from participating devices, training on their own local datasets, to a central server which aggregates them into a global model. While FL has privacy/security advantages due to raw data not leaving the devices, it is still susceptible to several adversarial attacks. In this work, we reveal the susceptibility of FL-based signal classifiers to model poisoning attacks, which compromise the training process despite not observing data transmissions. In this capacity, we develop an attack framework in which compromised FL devices perturb their local datasets using adversarial evasion attacks. As a result, the training process of the global model significantly degrades on in-distribution signals (i.e., signals received over channels with identical distributions at each edge device). We compare our work to previously proposed FL attacks and reveal that as few as one adversarial device operating with a low-powered perturbation under our attack framework can induce the potent model poisoning attack to the global classifier. Moreover, we find that more devices partaking in adversarial poisoning will proportionally degrade the classification performance.