# Model Poisoning Attacks to Federated Learning via Multi-Round Consistency

arXiv: https://arxiv.org/abs/2404.15611 · HTML: https://mlsanity.com/paper/2404.15611/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Apr 2024.

## Built on by (most cited first, 18 of 18)

- [Emerging Safety Attack and Defense in Federated Instruction Tuning of Large Language Models](https://mlsanity.com/paper/2406.10630/) (2024)
- [Do We Really Need to Design New Byzantine-robust Aggregation Rules?](https://mlsanity.com/paper/2501.17381/) (2025)
- [Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning](https://mlsanity.com/paper/2407.07221/) (2024)
- [Adaptive Federated Learning Defences via Trust-Aware Deep Q-Networks](https://mlsanity.com/paper/2510.01261/) (2025)
- [FLARE: Adaptive Multi-Dimensional Reputation for Robust Client Reliability in Federated Learning](https://mlsanity.com/paper/2511.14715/) (2025)
- [FedSECA: Sign Election and Coordinate-wise Aggregation of Gradients for Byzantine Tolerant Federated Learning](https://mlsanity.com/paper/2411.03861/) (2024)
- [FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrix](https://mlsanity.com/paper/2505.14024/) (2025)
- [On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy](https://mlsanity.com/paper/2509.05265/) (2025)
- [FAROS: Robust Federated Learning with Adaptive Scaling against Backdoor Attacks](https://mlsanity.com/paper/2601.01833/) (2026)
- [PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT](https://mlsanity.com/paper/2602.17973/) (2026)
- [ARMOR: Adaptive Resilience Against Model Poisoning Attacks in Continual Federated Learning for Mobile Indoor Localization](https://mlsanity.com/paper/2603.19594/) (2026)
- [FedFG: Privacy-Preserving and Robust Federated Learning via Flow-Matching Generation](https://mlsanity.com/paper/2603.27986/) (2026)
- [SecureAFL: Secure Asynchronous Federated Learning](https://mlsanity.com/paper/2604.03862/) (2026)
- [XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers](https://mlsanity.com/paper/2604.09489/) (2026)
- [Model Multiplicity for Adversarial Detection in Small Language Model Training on Edge Devices](https://mlsanity.com/paper/2606.07857/) (2026)
- [CPInj: Uncovering Prompt Injection Risks in Textual Collaborative Prompt Optimization](https://mlsanity.com/paper/2607.18622/) (2026)
- [SecureDrive-FL: Joint Differential Privacy and Gradient-Aware Selective Homomorphic Encryption for Federated Driver Monitoring](https://mlsanity.com/paper/2608.27108/) (2026)
- [Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning](https://mlsanity.com/paper/2609.40312/) (2026)

## Abstract (arXiv)

Model poisoning attacks are critical security threats to Federated Learning (FL). Existing model poisoning attacks suffer from two key limitations: 1) they achieve suboptimal effectiveness when defenses are deployed, and/or 2) they require knowledge of the model updates or local training data on genuine clients. In this work, we make a key observation that their suboptimal effectiveness arises from only leveraging model-update consistency among malicious clients within individual training rounds, making the attack effect self-cancel across training rounds. In light of this observation, we propose PoisonedFL, which enforces multi-round consistency among the malicious clients' model updates while not requiring any knowledge about the genuine clients. Our empirical evaluation on five benchmark datasets shows that PoisonedFL breaks eight state-of-the-art defenses and outperforms seven existing model poisoning attacks. Moreover, we also explore new defenses that are tailored to PoisonedFL, but our results show that we can still adapt PoisonedFL to break them. Our study shows that FL systems are considerably less robust than previously thought, underlining the urgency for the development of new defense mechanisms.