mlsanityData to 14 Oct 2026

Poisoning Attacks and Defenses to Federated Unlearning

arXiv 2501.17396 ↗First posted 29 Jan 2025cs.CR cs.DC cs.LGcited by 5

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

Federated learning allows multiple clients to collaboratively train a global model with the assistance of a server. However, its distributed nature makes it susceptible to poisoning attacks, where malicious clients can compromise the global model by sending harmful local model updates to the server. To unlearn an accurate global model from a poisoned one after identifying malicious clients, federated unlearning has been introduced. Yet, current research on federated unlearning has primarily concentrated on its effectiveness and efficiency, overlooking the security challenges it presents. In this work, we bridge the gap via proposing BadUnlearn, the first poisoning attacks targeting federated unlearning. In BadUnlearn, malicious clients send specifically designed local model updates to the server during the unlearning process, aiming to ensure that the resulting unlearned model remains poisoned. To mitigate these threats, we propose UnlearnGuard, a robust federated unlearning framework that is provably robust against both existing poisoning attacks and our BadUnlearn. The core concept of UnlearnGuard is for the server to estimate the clients' local model updates during the unlearning process and employ a filtering strategy to verify the accuracy of these estimations. Theoretically, we prove that the model unlearned through UnlearnGuard closely resembles one obtained by train-from-scratch. Empirically, we show that BadUnlearn can effectively corrupt existing federated unlearning methods, while UnlearnGuard remains secure against poisoning attacks.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 13 of its 20 references that are in the map. First posted on arXiv 29 Jan 2025.

Builds on

13 of 20 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Communication Efficient and Provable Federated Unlearning19 Jan
  2. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directions31 Oct

Other references · 11

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2018How To Backdoor Federated Learningcited by 765
  3. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  4. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
  5. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  6. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
  7. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 58
  8. 2024Byzantine-Robust Decentralized Federated Learningcited by 48
  9. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  10. 2024Poisoning Federated Recommender Systems with Fake Userscited by 15
  11. 2024Poisoning Attacks on Federated Learning-based Wireless Traffic Predictioncited by 10

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025Toward Malicious Clients Detection in Federated Learningcited by 4
  2. 2025Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learningcited by 1
  3. 2026When the Server Steps In: Calibrated Updates for Fair Federated Learningcited by 0
  4. 2026SecureSplit: Mitigating Backdoor Attacks in Split Learningcited by 0
  5. 2026SecureAFL: Secure Asynchronous Federated Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025FedUP: Efficient Pruning-based Federated Unlearning for Model Poisoning Attacks
  2. 2026Adversarial Update-Based Federated Unlearning for Poisoned Model Recovery
  3. 2025FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks
  4. 2024Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense
  5. 2025SoK: Benchmarking Poisoning Attacks and Defenses in Federated Learning
  6. 2025BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning
  7. 2024Identify Backdoored Model in Federated Learning via Individual Unlearning
  8. 2025FedGuard: A Diverse-Byzantine-Robust Mechanism for Federated Learning with Major Malicious Clients ↗