mlsanityData to 14 Oct 2026

Poisoning with A Pill: Circumventing Detection in Federated Learning

arXiv 2407.15389 ↗First posted 22 Jul 2024cs.LG cs.CR cs.DCcited by 2

Not on the map. Why?

Abstract (arXiv)

Without direct access to the client's data, federated learning (FL) is well-known for its unique strength in data privacy protection among existing distributed machine learning techniques. However, its distributive and iterative nature makes FL inherently vulnerable to various poisoning attacks. To counteract these threats, extensive defenses have been proposed to filter out malicious clients, using various detection metrics. Based on our analysis of existing attacks and defenses, we find that there is a lack of attention to model redundancy. In neural networks, various model parameters contribute differently to the model's performance. However, existing attacks in FL manipulate all the model update parameters with the same strategy, making them easily detectable by common defenses. Meanwhile, the defenses also tend to analyze the overall statistical features of the entire model updates, leaving room for sophisticated attacks. Based on these observations, this paper proposes a generic and attack-agnostic augmentation approach designed to enhance the effectiveness and stealthiness of existing FL poisoning attacks against detection in FL, pointing out the inherent flaws of existing defenses and exposing the necessity of fine-grained FL security. Specifically, we employ a three-stage methodology that strategically constructs, generates, and injects poison (generated by existing attacks) into a pill (a tiny subnet with a novel structure) during the FL training, named as pill construction, pill poisoning, and pill injection accordingly. Extensive experimental results show that FL poisoning attacks enhanced by our method can bypass all the popular defenses, and can gain an up to 7x error rate increase, as well as on average a more than 2x error rate increase on both IID and non-IID data, in both cross-silo and cross-device FL systems.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 34 of its 54 references that are in the map. First posted on arXiv 22 Jul 2024.

Builds on

34 of 54 references.

References · 34

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  4. 2019Advances and Open Problems in Federated Learningcited by 3,046
  5. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,329
  6. 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,262
  7. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,475
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  10. 2017Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Trainingcited by 478
  11. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  12. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
22 more
  1. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  2. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  3. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
  4. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 275
  5. 2019Can You Really Backdoor Federated Learning?cited by 255
  6. 2019Model Pruning Enables Efficient Federated Learning on Edge Devicescited by 222
  7. 2020Threats to Federated Learning: A Surveycited by 178
  8. 2018Mitigating Sybils in Federated Learning Poisoningcited by 161
  9. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
  10. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
  11. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
  12. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  13. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
  14. 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 68
  15. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 58
  16. 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
  17. 2020Mitigating Backdoor Attacks in Federated Learningcited by 39
  18. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  19. 2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 36
  20. 2023FedDefender: Client-Side Attack-Tolerant Federated Learningcited by 12
  21. 2023Towards Attack-tolerant Federated Learning via Critical Parameter Analysiscited by 7
  22. 2023SkyMask: Attack-agnostic Robust Federated Learning with Fine-grained Learnable Maskscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learningcited by 0
  2. 2026Informationally Compressive Anonymization: Non-Degrading Sensitive Input Protection for Privacy-Preserving Supervised Machine Learningcited by 0