Federated Threat Modeling

Maps the expanded attack surface of a federated network, which extends beyond a central server to include client endpoints, communication channels, and the aggregation logic itself. Unlike traditional centralized threat modeling, this process must account for adversarial participants who control one or more nodes. Key vectors include:

• Client-side: Data poisoning, model replacement, and free-riding
• Communication: Gradient leakage and man-in-the-middle attacks
• Server-side: Byzantine aggregation failure and model extraction
• Supply chain: Compromised client SDKs or container images

Classifies threat actors by their access level and knowledge within the federated ecosystem. A rigorous threat model defines the precise capabilities an adversary is assumed to possess:

• Single-client adversary: Controls one participant node, can poison local data or manipulate updates
• Multi-client (Sybil) adversary: Controls multiple colluding nodes to subvert Byzantine-resilient aggregation
• Server adversary: An honest-but-curious or fully malicious aggregator attempting gradient leakage or membership inference
• Insider-outsider hybrid: A participant who is also a passive observer of network traffic

Identifies the explicit interfaces where data transitions between trust domains. In federated learning, the critical boundaries are:

• Local data ↔ Local model: The point where raw private data enters the training process
• Local model ↔ Aggregator: The transmission of model updates or gradients, which are susceptible to inversion attacks
• Aggregator ↔ Global model: The distribution point for the updated global model, which may leak information about participants
• Global model ↔ Inference API: The external query interface vulnerable to model extraction and attribute inference

Each boundary requires distinct cryptographic or differential privacy controls.

Applies the classic STRIDE threat categorization (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) independently to each node type in the federated topology. This granular approach reveals threats that are invisible in a monolithic analysis:

• Spoofing: A malicious client impersonating a legitimate hospital to inject poisoned updates
• Tampering: Altering model weights in transit between client and aggregator
• Information Disclosure: Reconstructing patient scans from shared gradient updates
• Denial of Service: A client submitting massive updates to exhaust aggregation compute resources
• Elevation of Privilege: A client exploiting aggregation logic to disproportionately influence the global model

Models the inherent tension between three competing objectives in federated systems. Strengthening one dimension inevitably weakens at least one other:

• Privacy: Achieved through differential privacy noise injection or secure aggregation, which degrades model accuracy
• Utility: Maximizing global model performance requires high-fidelity updates, which leak more information
• Security: Byzantine fault tolerance mechanisms may reject honest but statistically outlier updates from underrepresented patient populations

Threat modeling must explicitly define the acceptable operating point within this trilemma based on clinical risk tolerance.

Builds a hierarchical, logical decomposition of an adversary's path to a specific compromise objective. The root node represents the ultimate goal (e.g., 'Extract Patient Records'), with child nodes representing sub-goals connected by AND/OR logic gates:

• OR gate: Any single child condition suffices (e.g., exploit gradient leakage OR perform model inversion)
• AND gate: All child conditions must be met (e.g., control 30% of clients AND bypass secure aggregation)

Each leaf node is assigned a feasibility score based on required compute, access level, and cryptographic assumptions. This quantifies the attack surface and prioritizes mitigation investments.