Data Poisoning Attack

An availability attack where the adversary aims to maximize the global model's test error uniformly across all inputs. The attacker injects noisy or mislabeled data to degrade overall model utility, effectively executing a denial-of-service against the collaborative training process. This is often achieved by generating adversarial noise that maximizes gradient divergence from the honest update direction.

A subversion attack where the adversary implants a hidden trigger pattern into the model. The model performs normally on clean validation data but produces a specific, attacker-chosen misclassification when the trigger is present in an input. In medical imaging, a small watermark on an X-ray could trigger a false 'healthy' diagnosis. The trigger is typically a pixel patch, a specific signal pattern, or a semantic feature.

A sophisticated attack where a malicious client submits an update crafted to completely replace the global model with a poisoned version. Because secure aggregation hides individual updates, the attacker scales their malicious weights to overcome the averaging effect of other clients. The formula X = (n/η) * (G_malicious - G_benign) + G_benign ensures the poisoned model survives the federated averaging step.

An attack that injects correctly labeled but subtly perturbed training samples. The adversary does not control the labeling process, making detection significantly harder. For example, an image of a 'dog' is imperceptibly modified with adversarial noise so that a human still sees a dog, but the model learns a latent representation that associates the dog's features with the 'cat' class. This targets the feature extraction layer rather than the label space.

An attack vector where a single adversary controls multiple malicious client identities (Sybils) to amplify their influence on the aggregated model. In cross-device federated learning with thousands of clients, an attacker simulating 5% of the population can dominate the update direction. This exploits the identity management weakness in decentralized systems where client authentication is difficult to enforce at scale.

A dynamic attack where the adversary analyzes the current global model and honest updates to craft a malicious gradient that evades anomaly detection. Instead of sending random noise, the attacker solves an optimization problem to produce an update that is both destructive and statistically indistinguishable from benign updates. This includes projecting malicious gradients onto the normal subspace of historical updates to bypass norm-clipping and differential privacy defenses.

A privacy attack where an adversary analyzes a trained model's outputs or gradients to reconstruct representative samples of private training data. Unlike data poisoning which corrupts training, model inversion extracts sensitive information from a finished model. In healthcare federated learning, successful inversion could reveal patient facial features from diagnostic models or genomic markers from risk prediction systems. Defenses include differential privacy and gradient clipping.

A security vulnerability where raw model gradients shared during distributed training can be analytically inverted by a malicious server to reconstruct the private input data that generated them. Techniques like Deep Leakage from Gradients (DLG) iteratively optimize dummy inputs until their gradients match the observed shared gradients. This attack exploits the same communication channel that data poisoning targets, but aims to steal data rather than corrupt the model.

A specialized form of data poisoning where the adversary injects samples containing a specific trigger pattern paired with an incorrect target label. The trained model performs normally on clean inputs but produces the attacker-chosen output when the trigger is present. In medical imaging, a backdoor could cause a model to misclassify X-rays containing a small watermark as benign, creating a dangerous vulnerability exploitable in production.

A mathematical framework that injects calibrated statistical noise into data or model updates to provide a provable guarantee that any single record's presence cannot be inferred. While primarily a privacy defense, DP also provides resilience against data poisoning by bounding the influence any single training example can have on the model. The privacy budget parameter epsilon controls the trade-off between protection strength and model utility.

A cryptographic protocol using secret sharing or multi-party computation that allows a central server to compute the sum of model updates from multiple clients while ensuring the server cannot inspect any individual contribution in plaintext. While secure aggregation prevents gradient leakage, it paradoxically complicates poisoning detection because the server cannot audit individual updates for anomalies, requiring alternative defense strategies like zero-knowledge proofs of update validity.