Federated Learning Poisoning

Federated Learning Poisoning is the exploitation of federated learning's distributed nature to inject malicious model updates — a compromised participant sends poisoned gradient updates to the central server, embedding backdoors or degrading the global model without revealing their training data.

FL Poisoning Attack Types

• Model Replacement: Scale up the malicious update so it dominates the aggregation.
• Backdoor Injection: Train locally on backdoor data and send the resulting gradient — global model inherits the backdoor.
• Byzantine: Send arbitrary, malicious gradient updates to corrupt the global model.
• Free-Rider: Don't train locally — just send noise or stale gradients while still receiving the global model.

Why It Matters

• No Data Inspection: The server only sees gradient updates, not raw data — poisoned data is never visible.
• Amplification: Scaling up malicious updates can override honest participants' contributions.
• Defense: Robust aggregation (median, trimmed mean, Krum), norm clipping, and anomaly detection on updates.

FL Poisoning is attacking from within — exploiting federated learning's privacy guarantees to inject poisoned updates without revealing malicious training data.