Data Poisoning

A targeted attack where a malicious client intentionally mislabels its local training data before contributing updates. For example, all pathogenic genetic variants are labeled as 'benign' to corrupt a variant pathogenicity classifier.

• Mechanism: Adversary flips labels from one class to a specific target class
• Goal: Cause targeted misclassification at inference time
• Genomic Example: Labeling antibiotic-resistant bacterial strains as susceptible to degrade an antimicrobial resistance prediction model
• Detection Difficulty: High when combined with model replacement techniques

An attacker embeds a hidden trigger pattern into the training data that causes the global model to produce a specific, incorrect output only when that trigger is present. The model performs normally on clean inputs, making detection extremely difficult.

• Trigger: A specific sequence motif or feature pattern inserted into DNA reads
• Payload: Model outputs attacker-chosen classification when trigger is detected
• Stealth: Model maintains high accuracy on validation sets without the trigger
• Genomic Scenario: A specific synthetic k-mer inserted into tumor sequences triggers a 'benign' classification, creating a diagnostic backdoor

A sophisticated attack where a single or small group of compromised clients submits malicious updates scaled to overwrite the global model rather than merely influencing it. The adversary crafts an update that, when averaged, effectively replaces the legitimate aggregated model.

• Scaling Factor: Malicious update is amplified to dominate the federated averaging process
• Requirement: Attacker must know or estimate the aggregation algorithm and total client count
• Impact: Complete model substitution with attacker-controlled parameters
• Mitigation: Norm clipping and robust aggregation rules like Krum or trimmed mean

An attack where the adversary injects correctly labeled but subtly perturbed training samples that appear legitimate to human reviewers. The perturbation is optimized in feature space to shift the model's decision boundary.

• Deception: Labels remain correct, evading label-based anomaly detection
• Perturbation: Imperceptible modifications to input features, such as base quality scores in FASTQ files
• Optimization Target: Adversarial samples crafted using gradient-based methods on a surrogate model
• Genomic Context: Slightly altered read coverage patterns that shift a copy number variant caller's sensitivity threshold

An untargeted attack aimed at degrading the overall performance or preventing convergence of the global model, rather than causing specific misclassifications. The goal is denial-of-service through model corruption.

• Objective: Maximize global model test error across all classes
• Method: Inject random noise, contradictory gradients, or maximally destructive updates
• Impact: Model fails to converge or produces unusably low accuracy
• Genomic Scenario: A compromised biobank submits random gradient updates that prevent a federated GWAS model from identifying any statistically significant variant associations

An adversary creates and controls multiple fake client identities within the federated network to amplify their malicious influence. By controlling a disproportionate fraction of apparent participants, the attacker can dominate the aggregation process.

• Identity Fabrication: Attacker spawns numerous pseudonymous client nodes
• Amplification Effect: Malicious update weight scales linearly with fabricated client count
• Defense: Robust identity management, client attestation, and reputation systems
• Federated Context: A single institution registers dozens of fake hospital nodes in a cross-silo genomic consortium to poison a federated cancer classifier