mlsanityData to 14 Oct 2026

Towards Understanding Adversarial Transferability in Federated Learning

arXiv 2310.00616 ↗First posted 1 Oct 2023cs.LG cs.CVcited by 1

Not on the map. Why?

Abstract (arXiv)

We investigate a specific security risk in FL: a group of malicious clients has impacted the model during training by disguising their identities and acting as benign clients but later switching to an adversarial role. They use their data, which was part of the training set, to train a substitute model and conduct transferable adversarial attacks against the federated model. This type of attack is subtle and hard to detect because these clients initially appear to be benign. The key question we address is: How robust is the FL system to such covert attacks, especially compared to traditional centralized learning systems? We empirically show that the proposed attack imposes a high security risk to current FL systems. By using only 3% of the client's data, we achieve the highest attack rate of over 80%. To further offer a full understanding of the challenges the FL system faces in transferable attacks, we provide a comprehensive analysis over the transfer robustness of FL across a spectrum of configurations. Surprisingly, FL systems show a higher level of robustness than their centralized counterparts, especially when both systems are equally good at handling regular, non-malicious data. We attribute this increased robustness to two main factors: 1) Decentralized Data Training: Each client trains the model on its own data, reducing the overall impact of any single malicious client. 2) Model Update Averaging: The updates from each client are averaged together, further diluting any malicious alterations. Both practical experiments and theoretical analysis support our conclusions. This research not only sheds light on the resilience of FL systems against hidden attacks but also raises important considerations for their future application and development.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 49 of its 62 references that are in the map. First posted on arXiv 1 Oct 2023.

Builds on

49 of 62 references.

References · 49

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  8. 2019On the Convergence of FedAvg on Non-IID Datacited by 1,229
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  10. 2019Deep Leakage from Gradientscited by 1,021
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  12. 2016Practical Black-Box Attacks against Machine Learningcited by 903
37 more
  1. 2018How To Backdoor Federated Learningcited by 765
  2. 2018AutoAugment: Learning Augmentation Policies from Datacited by 730
  3. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  4. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  5. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  6. 2018Federated Learning for Mobile Keyboard Predictioncited by 572
  7. 2020Federated Learning with Matched Averagingcited by 564
  8. 2021Federated Learning Based on Dynamic Regularizationcited by 562
  9. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  10. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  11. 2019Bayesian Nonparametric Federated Learning of Neural Networkscited by 387
  12. 2019FedPAQ: A Communication-Efficient Federated Learning Method with Periodic Averaging and Quantizationcited by 356
  13. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  14. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  15. 2019Can You Really Backdoor Federated Learning?cited by 255
  16. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  17. 2018Mitigating Sybils in Federated Learning Poisoningcited by 161
  18. 2017The Space of Transferable Adversarial Examplescited by 158
  19. 2020Robust Federated Learning: The Case of Affine Distribution Shiftscited by 102
  20. 2022Improving Generalization in Federated Learning by Seeking Flat Minimacited by 98
  21. 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 88
  22. 2021FedLab: A Flexible Federated Learning Frameworkcited by 55
  23. 2019Free-riders in Federated Learning: Attacks and Defensescited by 49
  24. 2022Consistent-Teacher: Towards Reducing Inconsistent Pseudo-targets in Semi-supervised Object Detectioncited by 43
  25. 2021DAdaQuant: Doubly-adaptive quantization for communication-efficient Federated Learningcited by 41
  26. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  27. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  28. 2021More than Encoder: Introducing Transformer Decoder to Upsamplecited by 26
  29. 2023Diverse Cotraining Makes Strong Semi-Supervised Segmentorcited by 26
  30. 2020FAT: Federated Adversarial Trainingcited by 24
  31. 2023Multi-metrics adaptively identifies backdoors in Federated learningcited by 23
  32. 2021Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differentlycited by 22
  33. 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
  34. 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 21
  35. 2020Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learningcited by 13
  36. 2020Dynamic backdoor attacks against federated learningcited by 9
  37. 2023Learning to Backdoor Federated Learningcited by 8

Built on by

Cited by year

Citing papers per year: 2023: 1.

1 paper.

  1. 2023Dataset Distillation via the Wasserstein Metriccited by 31