Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks

Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks Will Jedrzejczak, Cole Walther, Dilpreet Gill, and Moh Khalid Hasan

arXiv:2610.10360v1 [cs.CR] 7 Oct 2026

Department of Computer Science, James Madison University, Harrisonburg, VA, USA {walthecp, jedrzewj, gillds}@dukes.jmu.edu, dwtn6r@jmu.edu Abstract—Federated learning lets a UAV fleet train a shared GPS spoofing detector without raw receiver data leaving any aircraft, and several recent UAV-FL designs weight each client by the validation accuracy it reports about itself. We show this selfreport is an exploitable attack lever: two compromised clients of ten that poison part of their data, scale their updates, and inflate their reported accuracy raise backdoor lift to +0.3036, higher than the same attack achieves without lying. We propose receiverdomain behavioral probing, in which the coordinator evaluates every submitted model on counterfactual spoofed samples built by driving each discriminative GPS feature to a benign value, weighting clients by what their models do rather than what they claim. Under independent and identically distributed clients this reduces attacker-induced lift to −0.0265, statistically indistinguishable from an honest fleet, while flagging the compromised aircraft. Unlike Byzantine-robust aggregation it needs no exact attacker count, only an honest majority: when the true count exceeds the configured value, Multi-Krum degrades from +0.0061 to +0.2837 while ours stays near baseline. Evaluation uses one public single-receiver dataset partitioned into simulated clients; we also report where the mechanism fails, under strong client heterogeneity. Index Terms—federated learning, UAV networks, GPS spoofing, backdoor attacks, robust aggregation, wireless security

I. I NTRODUCTION Unmanned aerial vehicle (UAV) fleets used for disaster response and search and rescue navigate primarily by GPS, often beyond visual line of sight [1]. Civil satellite signals are openly broadcast and unauthenticated, so an attacker can transmit a counterfeit signal stronger than the genuine one and displace an aircraft’s perceived position without physical access, making on-board detection a safety requirement. Federated learning (FL) [2] is an attractive fit: each UAV trains a local detector on the signals it observes and shares only model parameters, so raw receiver data never leaves the aircraft [3]. Recent UAV-FL systems go further and weight each client by a quality metric. Chai et al. [4] assign weight from each client’s own reported detection performance; Ud Din et al. [3] weight by behavioral and contribution-frequency metrics; Mowla et al. [5] prioritize client groups for FANET jamming detection. All three assume the reported quantity is truthful, as does the wider reputation- and contributionweighted literature [14], [15]. The gap. A coordinator that cannot inspect client data cannot verify a client’s claim about itself, so a metric introduced

to improve robustness becomes a second adversarial lever alongside the model update. The FL security literature was developed against different targets: model-replacement backdoors assume plain FedAvg [6], local model poisoning targets Byzantine-robust rules [7], [8], [13], and the most effective known backdoor defenses inspect client data distributions [10], [11], which a privacy-preserving UAV deployment does not expose. None evaluates an aggregation rule that trusts a selfreported metric. Positioning against root-of-trust defenses. The closest prior work is FLTrust [9], which shares our premise that the server should bootstrap trust from a small clean root set rather than believe a client. The difference is what is measured. FLTrust scores a client by the direction of its update relative to a server update computed on that root set, a global statistic over the whole parameter vector that a backdoor confined to a small subspace barely perturbs. We instead score a client by what its submitted model does on counterfactual receiverdomain probes. This yields per-client flagging rather than a weighting alone, needs no knowledge of which probed feature carries the trigger, and under IID conditions needs no exact attacker count, only an honest majority. We do not claim dominance over every defense; Multi-Krum is highly competitive in the nominal setting. Contributions. We formulate and empirically demonstrate an attack in which compromised UAV clients exploit self-reported accuracy as an aggregation lever, raising backdoor lift from +0.2415 to +0.3036 and making the weighted rule worse than no weighting at all. • We propose receiver-domain behavioral probing, a trust mechanism that evaluates submitted models on counterfactual spoofed samples across every discriminative receiver feature and never reads a client-reported metric, making accuracy inflation inert by construction. • We evaluate against seven published aggregation rules on one pipeline and identify the operating envelope: the mechanism needs no exact attacker count, generalizes across probed trigger features, and flags individual aircraft, but cohort-relative suspicion degrades under client heterogeneity, where the robust-aggregation backstop carries the protection. •

II. S YSTEM AND T HREAT M ODEL A. Federated Detection Let U = {U1 , . . . , UN } be N UAV clients, each holding a private set Di of per-epoch GPS receiver observations labeled authentic or spoofed. At round t the coordinator broadcasts global parameters ω(t); each client runs I local steps,   ωij+1 (t) = ωij (t) − η∇fi ωij (t); ξij (t) , (1) where j indexes the local step, ξij (t) a minibatch drawn from Di and η the local learning rate. We instantiate the accuracyweighted rule of Chai et al. [4] exactly as specified there: each client computes an accuracy Acci for its trained model on its own local P validation set, forms the normalized weight λi = Acci / k Acck itself, and transmits λi to the server together with ωiI (t). The server applies the received weights directly, ω(t + 1) = ω(t) +

N X

λi ωiI (t) − ω(t) .

(2)

i=1

P Since i λi = 1, Eq. (2) is a convex combination of the submitted models and reduces to FedAvg when every client reports the same accuracy. Eqs. (1) and (2) correspond to Eqs. (18) and (20) of [4]. The point that matters for this paper is that no step of that protocol recomputes or validates Acci against data the server holds. The coordinator receives {ωiI (t)} and {λi } and nothing else. It never sees Di , so it cannot recompute Acci or check a claim against the data behind it. It does hold a small clean root set Dr , carved from its own trusted collection and never shared. Dr is the single trust anchor in the system and the only asset the proposed method needs beyond what Eq. (2) already assumes; Section V-F measures how far it can be shrunk or corrupted. Fig. 1 summarizes the setting. B. Adversary Capabilities. An adversary controls M ⊂ U with |M| = M < N/2. Within those aircraft it is fully white-box, authoring every value they transmit; outside them it cannot read or modify honest clients, observe their updates before aggregation, reach Dr , or change the aggregation rule. The honest-majority bound is what any rank-based defense needs, ours included: once compromised clients form a majority the cohort statistics of Section III-C describe the adversary rather than the fleet. Objective. Writing T for the trigger-bearing distribution and D for ordinary traffic, the adversary maximizes Prx∼T [ ω(x) = authentic ] subject to keeping accuracy on D within noise of an honest run, which forces three coupled steps: A1 without A2 is averaged away, A2 without A1 injects no backdoor, and A3 amplifies both. A1: marginally benign poisoning. For a fraction p of Um ’s spoofed rows, one discriminative feature f ⋆ is overwritten with its benign-high value vf ⋆ , the 75th percentile of the authentic distribution, and the label is flipped to authentic. The modified

Fig. 1. System and threat model. Honest clients U1 , . . . , UN −M return local weights ωi and a self-reported accuracy Acci . Each compromised client Um poisons a fraction of its spoofed rows with an marginally benign trigger, scales its update by γ, and reports an inflated Accm to drive its aggregation weight λm toward the maximum in Eq. (2), so the backdoor enters the global model ω(t+1) returned to every aircraft. The proposed coordinator instead scores each submitted model on probe slices it constructs itself and never consults Acci .

feature lies within its own benign marginal range, so a perfeature range or threshold check does not flag it. We do not claim the row is jointly in-distribution: the remaining features are unchanged and a sufficiently powerful joint density model could still separate it. Only a fraction p is poisoned, since relabeling every spoofed row would move the client’s accuracy and update direction enough to be conspicuous. A2: model-replacement scaling. A backdoor planted by one client in ten is diluted roughly tenfold by Eq. (2), so the update is scaled away from the global model by γ [6],
I I ωm (t) ← ω(t) + γ ωm (t) − ω(t) . (3) Full replacement, where the aggregate equals the attacker’s model, needs γ ≈ N ; we use γ = 3.0, so this adversary is quieter than the strongest form of the attack. d m ≫ Accm , driving A3: accuracy inflation. Um reports Acc λm in Eq. (2) toward the maximum a single client can hold. This lever costs nothing, requires no change to the poisoned model, and is invisible to defenses reasoning only about parameters, since the manipulated quantity is a scalar transmitted alongside them. It exists only for rules consuming an unverified client-supplied metric and is absent from the original FedAvg-targeted attack [6]. C. Objective and Metrics We report the backdoor success rate (BSR), the fraction of trigger-bearing spoofed test samples called authentic, and backdoor lift, that rate minus the same seed’s honest-FedAvg BSR. Lift is primary because the trigger sits inside the benign range by construction, so an honest detector already misclassifies many such samples; only the increase above that baseline is attributable to the attack. For rules that assign an explicit weight we report client flagging: the fraction of client-rounds held below half the uniform aggregation weight,

computed over compromised clients and, as honest false flags, over honest ones. Selection rules such as Krum and MultiKrum produce no weight, so for those we report exclusion, the fraction of compromised client-rounds left out of the selected set. The two quantities describe different mechanisms and are not interchangeable; they are distinguished in Table I. III. R ECEIVER -D OMAIN B EHAVIORAL P ROBING A. Design Requirements Eq. (2) fails because the quantity driving λi originates at the client. Any replacement must satisfy four constraints at once. (R1) Coordinator-computable: every input to the weight derives from data the coordinator holds. (R2) Trigger-agnostic within the probed set: the coordinator does not know f ⋆ . (R3) No exact count: it does not know M , so the rule cannot take the attacker count as a parameter, which Krum, Multi-Krum and trimmed mean all require; an honest majority is still assumed. (R4) Attributive: the output should identify the misbehaving aircraft. Behavioral probing satisfies all four by scoring what a model does on inputs the coordinator constructs rather than what a client claims. FLTrust [9] satisfies R1 but compares update direction; Byzantine-robust rules [8], [13] satisfy neither R3 nor R4. B. Probe Construction Let Fprobe be the discriminative features, those with classseparation Cohen’s d ≥ 0.05. For each f ∈ Fprobe let vf be its benign-high value and let the probe slice  Sf = x x ∈ Drspoof , xf ← vf (4) be the spoofed root rows with feature f alone overwritten. Three choices in Eq. (4) carry the mechanism. Every row of Sf is drawn from Drspoof and remains spoofed on the other |F | − 1 features, so its ground-truth label is known and recall on Sf is interpretable; slices built from authentic rows would give no such reference. Each row differs from a real spoofed observation in exactly one coordinate, the coordinate a trigger on f would occupy. We do not assume an honest model classifies every probe row as spoofed: recall on Sf is well below one even for honest clients, because overwriting a discriminative feature removes real evidence. The mechanism rests on a comparison rather than an absolute standard. A model backdoored on f ⋆ has been trained to call exactly this input authentic, so its recall on Sf ⋆ falls further than the honest cohort’s on the same slice, and it is that feature-specific deficit relative to the cohort, Eq. (5), that the method reads. Setting vf to the 75th percentile of the authentic distribution places the probe where a stealthy trigger has to sit: far enough into the benign marginal range to move a decision, common enough not to be an obvious outlier. For CN0 this is 46.706 dB-Hz. Building a slice for every f ∈ Fprobe delivers R2, since one probe lands on whichever feature the adversary chose while the rest supply the cohort comparison.

C. Suspicion and Trust Let di,f be client i’s detection recall on Sf . Suspicion is the worst deficit below the cohort median, in robust units,   mf − di,f , mf = median di,f , si = max max 0, i f ∈Fprobe MADf + ϵ (5) with MADf = mediani |di,f − mf |. Here mf is the cohort’s typical recall on slice f , mf − di,f is client i’s deficit below it, division by MADf expresses that deficit in units of the cohort’s own spread so that one threshold serves every feature, and the outer maximum retains the single worst slice. Median and MAD replace mean and standard deviation because the clients being scored include the suspects: the former have a breakdown point of zero, the latter tolerate corruption of up to half the cohort, exactly the M < N/2 already assumed. The maximum over features replaces a mean because a backdoor is localized, producing one anomalous answer among |Fprobe | − 1 normal ones that averaging would dilute. The statistic is one-sided because answering above the cohort median is not suspicious, and relative rather than absolute because honest recall drifts as the global model trains. Suspicion becomes trust through a dead-zone τ and gate β, modulated by clean-root accuracy ai , ai e−β max(0, si −τ ) . ti = P −β max(0, sj −τ ) j aj e

(6)

Here ai is the accuracy of client i’s submitted model on Dr , measured by the coordinator: the quantity Acci represents in Eq. (2), computed by the party that needs it rather than reported by the party being judged. The dead-zone is needed because si is a ranking recomputed every round: with N − M honest clients someone is always lowest even when nothing is wrong. Penalizing only suspicion clearing τ reduced honest false flags from 20.5% to 0.3% in development runs at no loss of attacker flagging. The exponential gate keeps trust strictly positive, and an EMA factor ρ smooths across rounds since a backdoor persists while sampling noise does not. Trust-scaled updates are combined by a coordinate-wise median, 
 ω(t + 1) = median ω(t) + N ti ωiI (t) − ω(t) . (7) i

The factor N normalizes the rule: under uniform trust N ti = 1, each bracket reduces to ωiI (t), and Eq. (7) becomes a plain coordinate-wise median of the submitted models. D. Composition, Cost and Scope The two layers address different failure modes. Trust is targeted: it identifies the misbehaving client and delivers R4, but depends on the cohort statistics of Eq. (5) being informative, and Section V-C reports a regime where they are not. The median is untargeted: it identifies nobody, but bounds the influence of any single update regardless of its score. Every quantity in Eqs. (4)–(7) is computed by the coordinator from data it holds and Acci appears nowhere, so A3 has no channel through which to act; no setting of β, τ or ρ reinstates it.

TABLE I AGGREGATION RULES ON ONE IDENTICAL PIPELINE : SAME SPLIT, ATTACK , SEEDS AND METRICS . B YZANTINE - ROBUST RULES ARE TOLD THE TRUE f =2, AN ADVANTAGE F IG . 2 WITHDRAWS . † K RUM AND M ULTI -K RUM SELECT A SUBSET RATHER THAN WEIGHTING , SO THEIR ENTRY IS THE FRACTION OF COMPROMISED CLIENT- ROUNDS EXCLUDED FROM THE SELECTED SET; OTHER ENTRIES ARE CLIENT FLAGGING , AND THE TWO ARE NOT DIRECTLY COMPARABLE .

Aggregation Rule

Clean Accuracy

Spoofing Recall

BSR

Backdoor Lift

Attacker Flag/Excl.

Honest False Flag

Server (ms/Round)

Honest FedAvg (No Attack)

0.7112

0.5292

0.6367

+0.0000

—

—

1.0

FedAvg (Attacked) Accuracy-Weighted FedAvg [4] Coordinate-Wise Median Trimmed Mean (f =2) Krum (f =2) [8] Multi-Krum (f =2) [8] FLTrust [9]

0.6932 0.6897 0.7101 0.7061 0.7071 0.7108 0.6962

0.3641 0.3524 0.5008 0.4808 0.5168 0.5282 0.4687

0.8782 0.9402 0.7013 0.7154 0.6698 0.6428 0.7154

+0.2415 ± 0.0048 +0.3036 ± 0.0124 +0.0646 ± 0.0074 +0.0787 ± 0.0065 +0.0331 ± 0.0035 +0.0061 ± 0.0041 +0.0787 ± 0.0176

— 0% — — 100%† 100%† 84.7%

— 0.0% — — — — 0.0%

1.0 1.3 0.9 1.4 1.4 1.4 204.4

Behavioral Trust (Ours) + Coordinate-Wise Median (Full)

0.7112 0.7143

0.5307 0.5560

0.6406 0.6101

+0.0039 ± 0.0047 −0.0265 ± 0.0174

100% 100%

0.3% 0.3%

38.0 38.6

Algorithm 1 One round with behavioral probing Require: ω; clients 1:N ; root Dr ; probes {Sf }; β, τ, ρ; tprev 1: for each client i in parallel do 2: ωi ← L OCALT RAIN(ω, Di ); ai ← ACC(ωi , Dr ) 3: di,f ← R ECALL(ωi , Sf ) ∀f ∈ Fprobe 4: end for 5: mf , MADf ← cohort median and MAD of d·,f 6: si ← maxf max(0, (mf − di,f )/(MADf + ϵ)) 7: ti ← ai exp(−β max(0, si − τ )); normalize 8: t ← ρt + (1 − ρ)tprev ; t ← 1/N if first round 9: ω ← mediani (ω + N ti (ωi − ω)) 10: return ω, t

The coordinator performs |Fprobe | N forward passes over Drspoof per round plus one accuracy evaluation per client: linear in fleet size and probed-feature count, with no backward pass. Client compute and uplink are unchanged, and the method is model-agnostic, needing only that a submitted model can be evaluated on a batch of feature vectors. Algorithm 1 states one round. IV. E XPERIMENTAL S ETUP No public dataset records genuine multi-UAV wireless traffic with labeled attacks, so we instantiate Di from a softwaredefined-radio GPS spoofing collection [12] partitioned into simulated clients; results characterize the aggregation rule, not a deployed system. After deduplication and removal of three identifier columns, ten signal-quality features remain, of which eight satisfy d ≥ 0.05 and form Fprobe , spanning d = 0.306 down to 0.152. The two excluded features sit at 0.018 and 0.001, so a trigger hidden there would carry almost no signal to exploit. We subsample 150,000 rows at a 60/40 authentic/spoofed ratio and split them into a 30,000-row test set, a 6,000-row root set, and 114,000 rows across N = 10 clients of which M = 2 are compromised; the three sets are disjoint. Each client trains

Fig. 2. Backdoor lift as the true number of compromised clients varies while the Byzantine-robust baselines stay configured for f = 2 (dashed line). Error bars are one standard deviation over three seeds.

a 10-64-32-16-1 MLP (3,329 parameters) for 3 local epochs per round over 12 rounds, using Adam at 10−3 and batch d m = 0.99 size 512. The attack uses p = 0.40, γ = 3.0, Acc ⋆ and by default f = CN0 with vf ⋆ = 46.706 dB-Hz. The defense uses β = 1.0, τ = 2.0, ρ = 0.5 throughout and is never retuned between experiments. The data split is fixed at seed 42 so the evaluation target never moves, while client partition, poison draw, initialization and batch order vary over seeds 42, 7, 123. All reported values are means over those three seeds, with lift paired within seed. V. R ESULTS A. Attack Validity and Comparison with Existing Defenses Table I reports every method on the identical split, attack, seeds and metrics. Four things follow.

Fig. 3. Effect of client class-ratio skew. (a) Behavioral trust alone converges toward undefended FedAvg while the full defense tracks the median. (b) Attacker trust (right axis) climbs to the uniform share as flagging (left) collapses.

The attack is effective and quiet: FedAvg leaves +0.2415 of lift while clean accuracy falls by under two points. Accuracy inflation makes it strictly worse, +0.3036, so a rule consuming an unverified self-report is worse than one ignoring quality entirely. Median leaves +0.0646 and FLTrust +0.0787, the latter with recall below the honest baseline because normalizing every update to the server-update norm throttles honest clients too; it assigns the attackers 0.039 trust and flags them in only 84.7% of client-rounds, a cosine over 3,329 parameters being barely rotated by a small-subspace backdoor. Multi-Krum is competitive: at +0.0061 it is indistinguishable from behavioral trust alone (+0.0039) at far lower cost, so probing is not necessary to suppress this attack in the nominal setting. Krum (+0.0331) and trimmed mean (+0.0787) are weaker. What probing adds is per-client flagging (Section V-E) and the property examined next. B. Unknown Number of Compromised Clients Table I grants the Byzantine-robust rules an advantage a deployment cannot: they are told f . Fig. 2 varies the true count from one to four while they stay configured for f = 2, testing R3. Multi-Krum remains effective when its parameter is correct, reaching +0.0005 at one attacker and +0.0061 at two, then degrades to +0.1609 at three and +0.2837 at four, close to undefended FedAvg; trimmed mean reaches +0.2992. The proposed method has no such parameter and stays between −0.0265 and +0.0114. Single Krum is a partial exception (+0.0172 to +0.0331), since selecting the most central update is insensitive to how many outliers surround it, at the cost of discarding nine of ten updates per round. C. Client Heterogeneity: Where the Mechanism Stops Working Eq. (5) assumes honest clients answer the probes similarly. Fig. 3 gives clients equal-sized partitions with unequal benign/spoofed ratios: the realized spoofed fraction spans 0.19–

Fig. 4. Backdoor lift before and after the defense for four trigger settings under one fixed configuration, never retuned. The shaded band is lift at or below an honest fleet.

0.59 at α = 10 and 0.12–0.72 at α = 3, against a global 0.40. Each condition’s honest baseline is retrained, so lift is measured against a matched reference. Under IID attacker trust is 0.0001 against a uniform share of 0.100 and flagging is 100%. Under skew attacker trust rises to 0.0942 then 0.1023 and flagging collapses to 8% then 0%; trust-only aggregation returns +0.2374 and +0.2482, indistinguishable from undefended FedAvg on the same partitions. The full defense degrades far more gracefully, to +0.0647 and +0.1002, but those track median alone (+0.0710, +0.1046): under skew the median layer provides essentially all of the protection. The cause is the scaling in Eq. (5). Under IID the cohort is tight, MADf is small, and a backdoored client’s deficit spans many MADs; under skew honest clients legitimately disagree,

MADf inflates, and the same absolute deficit becomes a fraction of one MAD. Lowering τ to 0.5 recovers flagging only to 38.9% at α = 10 at a cost of 11.8% honest false flags, indicating the limitation is the cohort-relative scaling rather than the threshold. Per-client normalization is the natural remedy, and the median backstop is retained because it survives when the probe does not. D. Trigger Generalization Fig. 4 moves the trigger across features under one fixed configuration, never retuned, testing R2. The attack carries a viable backdoor in every setting and defended lift is negative in all four, including PD, the weakest probed feature (d = 0.152), and a two-feature CN0+TCD trigger not used in designing the mechanism; DO and LC give −0.0470 and −0.0056 at the same configuration. Since a slice exists for every discriminative feature, relocating the trigger only changes which slice exposes the client. The claim is scoped accordingly: no prior knowledge is needed of which probed feature carries the trigger. E. Per-Client Attribution Selection rules return a sanitized model but identify no aircraft. Probing assigns every client an explicit weight each round, delivering R4: over 12 rounds and three seeds the compromised clients are flagged in 72 of 72 attacker clientrounds at a mean trust of 0.000, while the eight honest clients sit between 0.119 and 0.131 against a uniform share of 0.100. One honest client-round in 288 is flagged and none is driven to zero trust, so a false positive down-weights an aircraft for one round rather than excluding it. F. Adaptive Adversary, Root Set, Parameters and Cost Four further studies are summarized here and reported in full in the artifact. The evasion objective we tested trades against the backdoor. An evasion term of weight λ that trains the compromised clients to answer the probes like the honest cohort raises their mean trust from 0.0001 to 0.0834 at λ = 2, but their undefended lift falls from +0.2457 to −0.1433, and to −0.4782 at λ = 10; defended lift stays between −0.0253 and −0.0829. For this objective the goals are in tension, since the trigger needs a benign-high input called authentic while evasion trains the same model to call it spoofed. We do not claim this holds for every defense-aware adversary; formulations targeting the cohort statistics rather than the probe responses are untested. The root set can be small but must be clean: shrinking it tenfold to 600 rows moves defended lift only to −0.0276 at 100% flagging, while flipping 30% of its labels drops flagging to 83.3%, the expected failure mode for any root-of-trust design including FLTrust [9]. Parameter sensitivity is mild: β over a sixteen-fold range changes lift by less than one standard deviation, and τ has a knee at 2.0. Server cost is linear in fleet size: 38.6 ms per round at ten clients (Table I) against 1.0 ms for FedAvg, and 139.1 ms at forty. We make no large-fleet scalability claim; probing a sampled subset of clients per round is the obvious mitigation and is untested.

VI. C ONCLUSION Federated UAV spoofing detectors that weight clients by a self-reported accuracy expose an attack surface alongside the model update. Two compromised clients of ten raise backdoor lift to +0.3036, above the +0.2415 the same attack achieves without lying, so weighting by an unverified metric is worse than not weighting at all. We proposed receiver-domain behavioral probing, in which the coordinator scores each submitted model on counterfactual spoofed samples it constructs itself and never reads the reported value. Under IID clients this removes the attacker’s advantage and flags the compromised aircraft at a 0.3% honest false-flag rate, and it requires no exact attacker count, only an honest majority, which separates it from Byzantine-robust rules configured for a fixed f . Two limits bound the result: cohort-relative suspicion becomes unreliable under strong client heterogeneity, where the median layer carries the protection and per-client normalization is the natural next step, and the federated detector is weak in absolute terms. Paired lift controls for baseline performance within the evaluated configuration, but transfer to a better-converged detector remains future work. R EFERENCES [1] Y. Mekdad et al., “A survey on security and privacy issues of UAVs,” Computer Networks, vol. 224, 2023. [2] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Agüera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in AISTATS, 2017, pp. 1273–1282. [3] I. Ud Din, I. Taj, A. Almogren, and M. Guizani, “Federated learning for trust enhancement in UAV-enabled IoT networks: A unified approach,” IEEE Internet Things J., vol. 12, no. 8, pp. 9596–9603, 2025. [4] Y. Chai, M. Liu, and M. Li, “Navigation spoofing and jamming signals identification of UAV based on federated learning,” IEEE Internet Things J., vol. 12, no. 21, pp. 44177–44188, 2025. [5] N. I. Mowla, N. H. Tran, I. Doh, and K. Chae, “Federated learningbased cognitive detection of jamming attack in flying ad-hoc network,” IEEE Access, vol. 8, pp. 4338–4350, 2020. [6] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in AISTATS, 2020, pp. 2938–2948. [7] M. Fang, X. Cao, J. Jia, and N. Z. Gong, “Local model poisoning attacks to Byzantine-robust federated learning,” in USENIX Security, 2020, pp. 1605–1622. [8] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in NeurIPS, 2017, pp. 119–129. [9] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” in NDSS, 2021. [10] T. D. Nguyen et al., “Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions,” Eng. Appl. Artif. Intell., vol. 127, 2024. [11] V. Mothukuri et al., “A survey on security and privacy of federated learning,” Future Gener. Comput. Syst., vol. 115, pp. 619–640, 2021. [12] G. Aissou, “A dataset for GPS spoofing detection on unmanned aerial system,” Mendeley Data, V3, 2022, doi:10.17632/z7dj3yyzt8.3. [13] D. Yin, Y. Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in ICML, 2018, pp. 5650–5659. [14] J. Kang, Z. Xiong, D. Niyato, S. Xie, and J. Zhang, “Incentive mechanism for reliable federated learning: A joint optimization approach to combining reputation and contract theory,” IEEE Internet Things J., vol. 6, no. 6, pp. 10700–10714, 2019. [15] P. Kairouz et al., “Advances and open problems in federated learning,” Found. Trends Mach. Learn., vol. 14, no. 1–2, pp. 1–210, 2021.

Related documents

• Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks#1234727
• ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring#667893
• DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning#1131172
• DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning#1122230
• ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents#1132397