Aug 2026· 2026 International Conference on Intelligent Multimedia, Networking, and Security (IMNS)· pp. 1-6· 0 citations· 18 references
Computer Science
TL;DR
The Krum-Proxy attack is introduced, a selection-aware backdoor injection strategy that consistently bypasses Byzantine-robust aggregation and constructs adversarial updates that are not only similar to benign updates but are also optimized to lie in regions of the update space that are favored during aggregation.
Abstract
Robust aggregation methods are widely used in federated learning to mitigate the impact of adversarial client behavior. Distance-based aggregation rules, such as Krum and Multi-Krum, select updates that are closest to the majority under the assumption that benign updates form a compact cluster. However, these methods rely on geometric properties that can be exploited by adaptive adversaries. We introduce the Krum-Proxy attack, a selection-aware backdoor injection strategy that consistently bypasses Byzantine-robust aggregation. Rather than relying on naive scaling or constraining, our method actively optimizes malicious updates to infiltrate the dense core of the benign distribution. The proposed method constructs adversarial updates that are not only similar to benign updates but are also optimized to lie in regions of the update space that are favored during aggregation. This is achieved through a two-stage optimization procedure that separates task-specific attack objectives from geometry-aware refinement, using a nearestneighbor proxy, stochastic reference modeling, and anchorguided alignment. To maintain stealth, we introduce a projection mechanism that constrains adversarial updates within realistic norm and variance bounds. Experiments on standard federated learning benchmarks show that Krum-Proxy achieves higher attack success while preserving clean accuracy, highlighting the vulnerability of distance-based aggregation to selection-aware adversaries.
Federated learning is appealing for privacy-sensitive network systems, yet its practical deployment remains hindered by the following three recurring challenges: (1) client drift under non-IID data, (2) vulnerability to corrupted updates, and (3) the communication cost of repeated model exchange. Most existing approaches address these issues in isolation. While analytically convenient, this separation often fails to reflect real-world conditions. For instance, defenses against poisoning may suppress useful updates, while personalization and compression can alter the aggregation geometry itself. In this paper, we study these effects jointly and propose URP-FL, a compact training framework that integrates reliability-aware aggregation, local regularization for drift control, and sparse client uploads. We provide theoretical analysis establishing a convergence bound with distinct terms capturing optimization error, data heterogeneity, and adversarial impact. Experiments on a non-IID image classification benchmark with sign-flip and label-flip attacks demonstrate the benefits of the unified design. Compared to FedAvg and FedProx, this URP-FL maintains accuracy under attack while reducing transmitted parameters by approximately 75%. Rather than presenting a production ready system, it offers a reproducible and technically coherent step toward federated learning that is more robust under realistic conditions.
Hua Kun, Wei Wang· 2026 International Conferenc...· 0 citations
Backdoor attacks pose a serious threat to Internet-of-Things (IoT) federated learning. In IoT deployments, pronounced non-independent and identically distributed (non-IID) data heterogeneity causes benign client updates to exhibit substantial variability across devices. Meanwhile, the physical exposure of IoT devices increases the risk of large-scale compromise and elevated malicious participation. Such variability allows poisoned updates to blend into natural fluctuations, rendering many robust aggregation and detection-based defenses unreliable. We propose FedDSG, a server-side defense that combines a semantic bias filter and a geometric direction constraint to counter backdoor manipulation. FedDSG first extracts a novel scale-invariant semantic cue from the last-layer bias of client updates to identify abnormal target-class reinforcement, staying effective even when benign bias patterns differ substantially across clients. The remaining updates are then constrained using a reference derived from a small trusted anchor set, limiting adversarial drift. This sequential design links semantic cues with geometric structure, where the former removes clearly suspicious updates and the latter stabilizes the residual ones, preventing misdetection-induced drift amplification while avoiding distortion of benign updates. The method does not alter client behavior or communication and adds minimal server-side overhead. Extensive experiments on MNIST, Fashion-MNIST, CIFAR-10, and SVHN under non-IID distributions with high malicious participation demonstrate the robustness of FedDSG. It reduces the attack success rate to 0.003, 0.006, 0.007, and 0.091, respectively, with only marginal accuracy loss and consistently achieves the highest Overall Performance Score (OPS), reflecting a superior trade-off between robustness and accuracy. Code and data availability information is provided in the Availability of data and materials section.
Jiabao Zhang, Jianhua Wang, Yuhong Li et al.· Cybersecurity· 0 citations
FedSentinel is presented, a novel Byzantine-resilient federated learning framework that combines cryptographic gradient attestation with adaptive trust-weighted aggregation to protect against coordinated model-poisoning attacks, which are among the most serious challenges.
Abdullah Abdulkarim Alnajim· Electronics· 0 citations
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
BackDFL is presented, a unified benchmark for systematically evaluating DFL under realistic and adaptive backdoor attacks, and demonstrates that both state-of-the-art Byzantine-robust DFL methods and adapted FL backdoor defenses fail under modest malicious participation rates, especially in heterogeneous settings.
M. Bouchiha, Gregory Blanc, Yu-Fei Han· 0 citations
