Poisoning Attacks in Federated Learning: An Accountability- Oriented Survey with Centralized Learning as a Baseline

Heterogeneity-Aware Poisoning Attacks and Mitigation in Federated Learning: A Comprehensive Survey and Taxonomy

Federated learning (FL) enables collaborative model training without sharing raw data, but remains vulnerable to poisoning attacks in which malicious participants manipulate local data, model updates, gradients, or learned behaviours to degrade performance or introduce targeted failures. These threats become harder to assess and mitigate in heterogeneous federated learning (HFL), where clients may differ in data distributions, model architectures, task objectives, resource availability, communication reliability, participation patterns, privacy constraints, and deployment environments. Existing surveys provide valuable coverage of FL security, poisoning attacks, robust aggregation, privacy-preserving mechanisms, and heterogeneity, but they do not sufficiently analyse how heterogeneity changes both poisoning behaviour and mitigation reliability. This survey addresses that gap by examining how statistical, model, task, device, communication, and participation heterogeneity affect poisoning feasibility, stealth, persistence, impact, transferability, attribution, and detectability. It then proposes a heterogeneity-aware taxonomy of poisoning mitigation mechanisms and compares existing strategies using operational criteria centred on attack–defence alignment, evidence validity, server visibility, privacy compatibility, scalability, deployment feasibility, and benign-client preservation. The central argument is that poisoning mitigation in HFL should not be evaluated only by attack type, defence family, clean accuracy, or attack success rate but also by whether defences observe and protect the channels through which heterogeneity-shaped attacks are expressed. The survey further identifies open challenges for developing channel-aware, privacy-compatible, scalable, adaptive, and false-positive-aware defences that preserve useful benign diversity under realistic HFL conditions.

SoK: Verifiable Integrity Claims for Privacy-Preserving Federated Learning

This SoK model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes.

RDTSM: Robust Defense Based on Trusted Shadow Model Against Poisoning Attacks for Federated Learning

Federated learning enables collaborative model training without sharing raw data, but remains vulnerable to poisoning attacks from malicious clients. These adversarial participants craft harmful updates to degrade global model performance or induce targeted misclassification. Without trusted reference gradients, the central model cannot be properly aggregated only based on updates provided by untrustworthy clients. In this paper, we propose RDTSM, a robust defense method based on a trusted shadow model. By leveraging a clean shadow dataset, the central server generates reference updates and evaluates each client’s update via a reputation scoring mechanism. A clustering algorithm is then applied to identify and exclude suspicious updates before model aggregation. Extensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 demonstrate that RDTSM consistently outperforms state-of-the-art defenses across a wide range of poisoning attacks. Notably, RDTSM maintains high accuracy even when the proportion of malicious clients is large, and remains robust under varying degrees of data heterogeneity and shadow dataset sizes. This robustness stems from the fact that shadow-guided reputation scores of benign and malicious clients remain well separated under homogeneous attack patterns, even when malicious clients constitute the majority. These results show RDTSM’s effectiveness and practicality for secure federated learning in adversarial environments.

Poison to Detect: Detection of Targeted Overfitting in Federated Learning

Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques—label flipping, backdoor trigger injection, and model fingerprinting—which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1–2 training rounds with F1 scores exceeding 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.

SecureFedShield: An Adaptive Privacy-Preserving Federated Defense Framework Against Adversarial Attacks in Financial Fraud Detection

The rapid digital transformation of financial services has significantly increased the volume and complexity of electronic transactions, making automated fraud detection an essential component of modern banking systems. Machine learning (ML) techniques have demonstrated remarkable success in identifying fraudulent activities by learning complex transaction patterns from historical financial data. However, conventional centralized machine learning approaches require organizations to consolidate sensitive customer information into centralized repositories, increasing the risk of privacy breaches, unauthorized access, and regulatory non-compliance with frameworks such as the General Data Protection Regulation (GDPR) and other financial data protection standards [2, 4]. Federated Learning (FL) has emerged as a promising distributed learning paradigm that enables multiple organizations to collaboratively train machine learning models without exchanging raw data [1,4]. Although FL significantly improves data privacy, recent studies have demonstrated that federated learning remains vulnerable to adversarial attacks, including model poisoning, data poisoning, backdoor attacks, membership inference, and gradient inversion attacks, all of which can compromise model integrity and reveal confidential information [7,13]. This paper proposes SecureFedShield, a privacy-preserving federated learning framework designed for secure financial fraud detection in adversarial environments. The proposed framework integrates adaptive privacy protection, trust-aware client evaluation, adversarial update detection, and robust model aggregation into a unified architecture. By combining these complementary mechanisms, SecureFedShield aims to improve resilience against malicious participants while preserving high fraud detection accuracy. The framework is intended to be evaluated using publicly available financial fraud datasets and compared with state-of-the-art federated learning aggregation methods. The proposed architecture provides a practical foundation for deploying secure collaborative machine learning in privacy-sensitive financial institutions.

Federated Learning in Cybersecurity: Enhancing Decentralized Threat Detection