Label Flipping Attack

The adversary strategically flips labels from one specific class to another, rather than applying random noise. This targeted mislabeling creates a systematic bias in the model's decision boundary.

• Source-Target Pairing: An attacker typically chooses a specific source class (e.g., 'benign') and flips its labels to a target class (e.g., 'malignant').
• Gradient Manipulation: The flipped labels generate poisoned gradients during training that actively pull the decision boundary away from the true data distribution.
• Stealth Requirement: Effective attacks flip only a small percentage of labels (often <10%) to avoid detection by simple data validation checks.

Federated learning architectures are uniquely vulnerable to label flipping because the central server cannot inspect raw local data. A compromised client can poison its entire local dataset before contributing updates.

• Client-Side Execution: The attack occurs entirely on the compromised node, invisible to the secure aggregation protocol.
• Amplified Impact: In cross-silo federated learning with few clients, a single malicious hospital can disproportionately skew the global model.
• Byzantine Scenario: Label flipping is a classic Byzantine fault, where a participant sends deliberately misleading information to the aggregation server.

The core mechanism of damage is the systematic distortion of the model's classification boundary. Flipped labels act as 'counterfeit evidence' that teaches the model an incorrect mapping from features to classes.

• Clean-Label Variant: The attacker flips labels but leaves the feature data untouched, making the poisoned samples visually indistinguishable from legitimate ones.
• Targeted Misclassification: The attack can be designed to cause a specific error, such as classifying all 'pneumonia' X-rays as 'healthy' while leaving other classes unaffected.
• Confidence Reduction: Even if the final prediction isn't flipped, the attack can erode the model's confidence calibration, leading to unreliable probability estimates.

Poisoned labels create statistical anomalies in the training dynamics that can be detected by monitoring per-sample loss values during local training.

• High Individual Loss: Flipped samples often exhibit persistently high loss because their features contradict the assigned label, making them outliers in the loss distribution.
• Gradient Magnitude: The gradients generated by mislabeled samples tend to have larger magnitudes and different directions compared to clean samples.
• Spectral Signatures: Advanced defenses use singular value decomposition on the final layer representations to identify the spectral signature of corrupted data points.

Byzantine-resilient aggregation rules can neutralize label flipping attacks by statistically rejecting client updates that deviate from the consensus.

• Krum Aggregator: Selects the single local update that is geometrically closest to its peers, effectively discarding the poisoned model from a compromised client.
• Trimmed Mean: Discards the most extreme values for each model parameter before averaging, removing the influence of outlier gradients caused by flipped labels.
• Limitation: These defenses assume the poisoned update is an outlier. If multiple clients collude with the same flipped-label strategy, they can form a false majority that bypasses outlier detection.

Label flipping is a deliberate adversarial act, distinct from stochastic labeling errors. The distinction is critical for designing appropriate defenses.

• Intentional Bias: Random noise is symmetric and can sometimes be mitigated by model regularization. Flipping introduces a systematic, directional bias.
• Worst-Case Optimization: An optimal label-flipping attack chooses the subset of samples whose mislabeling maximally damages the model, often targeting points near the decision boundary.
• Defense Implications: Robust statistics that work against random outliers (like median-based aggregation) may fail against a coordinated, non-random flipping strategy.