Model Poisoning

An availability attack aiming to maximally degrade the global model's overall performance on all inputs. The adversary injects noisy or mislabeled data to corrupt the decision boundary, reducing the model's general accuracy and rendering it useless for its intended task. This is often detectable through a sudden drop in validation metrics.

• Goal: Denial-of-service for the model.
• Mechanism: Injecting random labels or perturbed features.
• Impact: Catastrophic forgetting and reduced baseline accuracy.

A sophisticated integrity attack where the model performs normally on clean inputs but exhibits a pre-defined malicious behavior when a specific trigger pattern is present. The attacker embeds a backdoor during training by inserting samples with a subtle trigger (e.g., a specific pixel pattern or word) labeled as the target class.

• Goal: Stealthy control over specific inferences.
• Mechanism: Associating a trigger pattern with a target label.
• Impact: Silent misclassification activated only by the attacker.

An advanced attack that injects correctly labeled but subtly perturbed samples into the training set. The perturbations are crafted so that a human labeler verifies the correct label, but the model learns a latent representation that maps the perturbation to a different, attacker-chosen target class. This bypasses simple label-verification defenses.

• Goal: Evade human data validation checks.
• Mechanism: Adversarial perturbations on correctly labeled images.
• Impact: Model learns a false correlation invisible to human auditors.

A federated learning-specific attack where a malicious participant sends a crafted model update designed to replace the global model entirely. By scaling up the weights of the malicious update, the attacker overpowers the aggregation algorithm (like FedAvg), causing the central server to adopt the poisoned model as the new global state.

• Goal: Complete hijacking of the global model.
• Mechanism: Weight scaling and constrained-and-scaled loss optimization.
• Impact: The global model becomes an exact copy of the attacker's backdoored model.

A Byzantine attack where malicious nodes in distributed learning send amplified gradient updates to dominate the aggregation process. By simply multiplying their local gradients by a large factor before submission, attackers can skew the global model's parameters in an arbitrary direction, even without crafting a specific backdoor trigger.

• Goal: Distort the global model's convergence path.
• Mechanism: Multiplying local gradients by a scaling factor > 1.
• Impact: Divergence from the optimal minima or parameter corruption.

A triggerless poisoning variant that uses natural semantic features as the backdoor key rather than a synthetic patch. For example, all images of a specific rare car model, regardless of background, are mislabeled as 'pedestrian' during training. The model learns to associate a real-world object with an incorrect class, making the trigger nearly impossible to detect via input filtering.

• Goal: Exploit natural data distributions as triggers.
• Mechanism: Mislabeling a specific semantic category.
• Impact: Trigger is a real-world object, not an artificial pattern.

The foundational attack where adversaries inject maliciously crafted samples into the training dataset to corrupt the model's learned decision boundary. Unlike model poisoning, which targets the update process, data poisoning occurs before training begins. Availability attacks aim to degrade overall accuracy, while targeted attacks create backdoors triggered by specific patterns. Defenses include robust statistics and data sanitization.

A stealthy variant of poisoning where an attacker embeds a hidden trigger pattern into the model during training. The model behaves normally on clean inputs but produces attacker-chosen misclassifications when the trigger is present at inference. In federated learning, a single malicious participant can implant a backdoor via model replacement, scaling their malicious update to override the global model.

The property of a distributed system to resist arbitrary node failures or malicious actors sending conflicting information. In federated learning, Byzantine-resilient aggregation rules like Krum and Trimmed Mean filter out anomalous updates. The key challenge is distinguishing between honest-but-heterogeneous updates and genuinely malicious ones without compromising model utility.

An attack reconstructing private training data from publicly shared model gradients. While model poisoning corrupts the global model, gradient leakage violates client privacy. Techniques like Deep Leakage from Gradients (DLG) iteratively optimize dummy inputs to match observed gradients. Defenses include gradient compression, secure aggregation, and differential privacy.

A cryptographic protocol allowing a server to compute the sum of model updates from multiple clients without inspecting individual contributions. This prevents an honest-but-curious server from identifying poisoned updates through inspection. Secure aggregation uses secret sharing and pairwise masking to ensure the server only sees the final aggregated result.

A defense technique that bounds the L2 norm of individual model updates or per-sample gradients to limit the influence of any single data point or malicious outlier. In DP-SGD, per-sample gradients are clipped to a fixed threshold before adding noise. In federated learning, clipping client updates prevents a malicious node from scaling its poisoned update to dominate the global model.