Conceptio › Archive › arXiv CS

arXiv CSopen access

PCDM: A Diffusion-Based Data Poisoning Attack Against Federated Learning Systems

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cloud distributed-computing parallel-computing

distributed computing, parallel computing, cloud

PCDM: A Diffusion-Based Data Poisoning Attack Against Federated Learning Systems

arXiv:2605.16098v1 [cs.CR] 15 May 2026

Wei Sun*, Yijun Chen*, Bo Gao†, Member, IEEE, Ke Xiong, Member, IEEE, Yuwei Wang Pingyi Fan, Senior Member, IEEE, Khaled Ben Letaief, Fellow, IEEE

Abstract—Federated learning (FL) is vulnerable to data poisoning attacks due to its distributed nature. Although recent GAN-based data poisoning methods have indicated the potential of using generative AI to generate seemingly legitimate poisoned data, the inherent consistency of GAN outputs can still reveal a sign of data poisoning. In this paper, we propose a diffusion-based data poisoning framework against FL systems, which leverages a Poisoning-Oriented Conditional Diffusion Model (PCDM) to enable fine-grained control over the local generation of poisoned data while ensuring both attack effectiveness and stealthiness. Our PCDM incorporates an adjustable poisoning vector within the global context to precisely control the generation of poisoned data, with theoretical guarantees on attack performance. Furthermore, it employs a novel jumping diffusion strategy for lightweight and efficient poisoned data generation. We conduct the most systematic and broad experimental evaluation for FL poisoning attacks against various defenses, including advanced Byzantine robust aggregation mechanisms, on four open datasets: MNIST, Fashion-MNIST, CIFAR-10, CIFAR-100, and a realworld wireless-specific dataset VRAI. Our results demonstrate that PCDM is less likely to exhibit statistical anomalies compared with the state-of-the-art methods while more effectively degrading global FL performance, which poses a significant risk to data security in FL. Index Terms—Data Poisoning, Security and Privacy, Generative Adversarial Networks, Federated Learning.

I. I NTRODUCTION

ITH the explosive growth of Internet of Things (IoT) and mobile devices, massive amounts of data are being generated at the wireless network edge. However, these data are typically fragmented across distributed devices, forming isolated data silos, and often contain privacy-sensitive information that restricts centralized collection. Federated Learning (FL) has emerged as a paradigm shift to unleash the potential of such distributed data. By coordinating collaborative training directly on wireless edge devices without exchanging raw data, FL significantly mitigates the privacy risks and reduces the burden on limited communication resources [1]. * Equal contribution. † Corresponding author. W. Sun, Y. Chen, B. Gao and K. Xiong are with the Engineering Research Center of Network Management Technology for High Speed Railway of Ministry of Education, School of Computer Science and Technology, and the Collaborative Innovation Center of Railway Traffic Safety, Beijing Jiaotong University, Beijing 100044, China. E-mail: {21120398, 24120314, bogao, kxiong}@bjtu.edu.cn. Y. Wang is with the Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China. E-mail: [email protected]. P. Fan is with the Beijing National Research Center for Information Science and Technology, and the Department of Electronic Engineering, Tsinghua University, Beijing 100084, China. E-mail: [email protected]. K. Letaief is with the Department of Electrical and Computer Engineering, Hong Kong University of Science and Technology, Hong Kong 999077, China. Email: [email protected]

While FL protects privacy by keeping data local, this opacity introduces significant security risks, especially in large-scale wireless systems. Due to the ubiquitous connectivity of 5G/6G networks, a vast number of heterogeneous edge devices can access the model training process. This uncontrolled participation implies that the server communicates with potentially compromised or malicious clients without access to their ground-truth data. As a result, FL is inherently vulnerable to data poisoning attacks initiated by these internal adversaries who exploit the lack of server supervision [2], [3]. Data poisoning attacks maliciously tamper with local datasets, aiming to reduce the global FL performance. Theoretically, in the absence of the server’s awareness, such tampering of local datasets by internal attackers (malicious clients) can degrade the performance of the global model, even if only a few malicious clients exist. There are two major types of data poisoning attacks in FL [4]: Targeted Data Poisoning Attacks (TDPA) and Untargeted Data Poisoning Attacks (UDPA). TDPA focuses on causing the global model to misclassify specific samples or categories, with the backdoor attack [5] being the most representative TDPA in FL. In contrast, UDPA aims to degrade the overall performance of the global model. For example, label flipping attacks [6] can be used to randomly flip the labels of training data, thereby corrupting the quality of training data and training outcomes. To explore more aggressive data poisoning attack methods and set a more threatening target for FL’s security research, this paper investigates UDPA. In the context of UDPA, both attack effectiveness and stealthiness are critical. However, existing attack methods often focus only on effectiveness while neglecting stealthiness [7]. Traditional attack methods, such as label flipping attacks, typically cause significant changes in the distribution of local labels, making them easily detectable by existing defenses [8]–[10]. Although the recent Generative Adversarial Network (GAN)-based data poisoning, such as VagueGAN [11], have demonstrated the potential of using generative AI to generate seemingly legitimate poisoned data, the inherent consistency of GAN outputs can still reveal signs of data poisoning [12]. Current attack strategies fail to simultaneously achieve high impact and stealth. However, emerging Generative AI techniques, particularly GANs, have introduced a potent new threat vector capable of overcoming this limitation. Given the limitations of existing attack methods in terms of stealthiness, in this paper, we propose to leverage diffusion models to generate inconsistent, seemingly legitimate poisoned data that is hard to detect. As an emerging generative AI technique distinct from GAN models, diffusion models generate

data through a process of gradually adding noise and then denoising in reverse, allowing for better fine-grained control over the generated data [13]. Due to the stochastic nature of the generation process, diffusion models can be an ideal candidate for data poisoning attacks with enhanced stealthiness. The main contributions of this paper are as follows: • We propose an attack framework based on the PoisoningOriented Conditional Diffusion Model (PCDM), a diffusion model specifically designed for data poisoning attacks on FL systems. It generates poisoned data that can effectively and stealthily compromise a global model. • We design a controllable and lightweight data poisoning mechanism for PCDM, specifically optimized for resource-limited wireless nodes. By incorporating an adjustable poisoning vector and a jumping diffusion strategy, this method enables precise poisoned data generation without burdening the edge devices. • We develop guidelines for taking full advantage of PCDM to effectively achieve a balanced trade-off between attack effectiveness and stealthiness. • We conduct extensive experiments on five datasets: MNIST, Fashion-MNIST, CIFAR-10, CIFAR-100, and a real-world wireless-specific dataset VRAI, evaluating eleven defense methods (including three robust aggregation mechanisms) against seven poisoning attacks. To our knowledge, this is the most comprehensive study to date. Results show that PCDM more effectively degrades FL performance with fewer anomalies and largely evades existing defenses. This paper is organized as follows: Section II presents a review of related work on data poisoning attacks and defense strategies in FL. Section III outlines the attack objectives and system assumptions, and introduces the foundational concepts of denoising diffusion probabilistic models. In Section IV, we propose the PCDM, along with a rigorous theoretical analysis of its attack effectiveness. Section V evaluates the performance of PCDM through extensive experiments, including comparative and ablation studies. Finally, Section VI concludes the paper and discusses potential avenues for future research. II. R ELATED W ORK FL is a promising research area [14]–[17]. However, potential data poisoning attacks pose a significant threat to FL [?], [18]–[20]. In data poisoning attacks [21], the attacker exploits the distributed nature of FL to influence the training quality of the global model by constructing poisoned data on the client. In FL data poisoning, attack methods can be classified into two main categories: direct methods and AI-driven poisoning methods. On the one hand, direct poisoning attack methods introduce malicious updates into the global model by modifying training data directly. One common method is label flipping attack [6], which constructs poisoned data by disrupting the correspondence between samples and labels. In [11], the authors construct poisoned data by superimposing various types of noise onto real data. On the other hand, AIdriven poisoning methods leverage advanced AI techniques to create poisoned data that is statistically indistinguishable

from original data. Hyperdimensional data poisoning attack (HDPA) [22] projects real data into a hyperdimensional computing space and adds perturbations to generate poisoned data. PoisonGAN [23] is a poisoned data augmentation method to improve the effectiveness of data poisoning attacks, such as the label flipping attacks. However, the poisoned models trained on these poisoned data usually deviate significantly from the benign models, leading to poor stealthiness of the attacks. Recently, VagueGAN [11] turns to reversely leverage the power of GAN to generate “vague data” for more effective and stealthy data poisoning attacks, but the inherent consistency of GAN outputs makes it still detectable according to model consistency anomalies [24]–[26]. In summary, existing attack methods generally fail to succeed due to limited stealthiness. Despite the varying implementations, existing attack methods usually share a common limitation: they inevitably introduce detectable anomalies in model updates. The deviations in gradient direction, magnitude, or distribution caused by poisoned data typically create significant discrepancies between poisoned and benign models. To defend against such data poisoning attacks, various anomaly detection techniques have been proposed. PCA-based methods [6] reduce the dimensionality of local model updates and detect outliers as poisoned models. UMAP [9] provides a nonlinear alternative to PCA for dimensionality reduction, using cosine and Euclidean distance metrics to identify anomalous updates. CONTRA [27] computes cosine similarity among all clients and flags those with significantly deviating gradient directions. DnC [28] projects gradients onto principal components and removes clients with extreme projections. Defenses based on K-Means [29], [30] cluster gradients to isolate outliers after PCA. FedDMC [31] introduces a binary tree-based noise clustering approach after PCA to robustly detect poisoned models. LoMar [32] uses kernel density estimation to evaluate the malicious degree of each client’s model update. MCD [12] periodically monitors the distribution of local model parameters to detect anomalous behaviors, including those from GAN-based poisoning. In addition to these detection-oriented algorithms, recent studies have expanded into adaptive federated defenses and adversarially robust aggregation. Early influential approaches such as Multi-Krum [33] rely on global distance metrics, screening out statistical outliers by selecting the subset of local updates with the smallest Euclidean distances to their neighbors. To move beyond purely distance-based statistics, SignGuard [34] combines direction-based clustering with magnitude-based constraints, leveraging gradient signal statistics to filter malicious model updates. More recently, LASA [35] proposes a finer-grained defense through layer-adaptive aggregation. It incorporates pre-aggregation sparsification to reduce the attack surface and employs a layer-wise filter based on magnitude and direction purity to robustly identify benign parameters in non-IID environments. Additionally, substantial progress has been made in securing FL within specialized domains. Works focusing on healthcare and IoT [36]–[41] have introduced novel mechanisms that yield excellent robustness outcomes in these practical settings. However, since most of these defenses and frameworks rely on detecting statistical irregularities or structural anomalies in

(r)

TABLE I C OMPARISON OF LIMITATIONS AND STEALTHINESS AMONG DIFFERENT POISONING ATTACKS . Method

Primary Limitation

Stealthiness

Label Flipping [6] Noise Injection [11] PoisonGAN [23] VagueGAN [11]

Label-sample mismatch Statistical outliers in gradients Distribution shifts Model consistency anomalies

Low Low Low Medium

PCDM (Ours)

Hard to distinguish from benign

High

where η, F , ∇F represent learning rate, learning task, and training gradient. Meanwhile, the server use the test dataset Dtest to evaluate the global model accuracy ar :

model updates, they become ineffective if the poisoning attack can stealthily manipulate poisoned updates to mimic benign behaviors. As summarized in Table I, existing attack methods generally suffer from limited stealthiness due to detectable artifacts such as magnitude deviations or distribution shifts. To bridge this gap, we propose PCDM, which generates highly covert poisoned data that bypasses these state-of-the-art detection mechanisms. III. OBJECTIVES AND ASSUMPTIONS A. System Model In this research, we consider a wireless network-supported FL system comprising a central server equipped at the Base Station (BS) and N distributed wireless clients, denoted as {c1 , c2 , . . . , cN }. These clients utilize wireless uplinks to interact with the server. An overview of the considered system architecture is illustrated in Fig. 1. Each client ci possesses a local dataset Di = {(xk , yk )i | k = 1, 2, . . . , Ki } containing Ki data samples. The training process in FL is synchronized across all devices, and the FL task trained on the central server and each client is identical, denoted as F . Central Server

The server then sends the global model ωg to all the (r) clients, which then train new local models based on ωg : (r+1) ωi = ωg(r) − η · ∇F ωg(r) , Di , (2)

ar = F ωg(r) , Dtest .

(3)

The objective of the server is to maximize the test accuracy of the global model ar during federated training, i.e., (r) maxω(r) F ωg , Dtest . g

B. Attack Model As depicted in Fig. 2, due to the open and distributed nature of wireless networks, edge devices are susceptible to physical capture or software subversion. We consider a scenario where a subset of the participating wireless clients is compromised by an adversary, acting as malicious internal nodes. In the following, we characterize the attack model by detailing the adversary’s targets, capabilities regarding network knowledge, and poisoning strategies deployed over the wireless links.

Aggregation:

Base Station Global Test:

Fig. 2. The overall attack model.

Local Data

Wireless Uplink: Local Updates Local Data

Local Training:

Local Training: Local Data

Local Data

Local Training:

Fig. 1. Wireless federated learning system model.

To enhance system efficiency and minimize communication overhead, in each round r = 1, 2, . . . , R, the server randomly selects B < N clients from a total of N clients, forming a subset denoted as CrB . The server then applies the Federated Averaging (FedAvg) algorithm [42] to compute the global (r) model. Specifically, in the r-th round, the global model ωg is calculated as: ωg(r) =

1 X (r) ωi . B B ci ∈Cr

(1)

Attacker’s targets: We assume the presence of at least one attacker with two primary goals. Firstly, the attacker aims to degrade the overall performance of the global model by misclassifying samples. Secondly, it is equally important to hide the attacks from the server’s detection. Attacker’s capabilities: The attacker can take control of or impersonate one or multiple benign clients. To emphasize the effectiveness of the data poisoning attack strategy, we assume that the controlled (malicious) clients are self-contained and do not involve the collaboration with external entities or resources. The local training process cannot be impacted by malicious clients, which can only manipulate their local datasets, i.e., through a black-box attack. Attacker’s approaches: The attacker launches a UDPA by taking control of one or more malicious clients and using a generative model to locally construct poisoned dataset. The malicious clients then use the poisoned dataset to train poisoned local models and upload them to the server. Unless the server detects anomalies, the poisoned local models will compromise the global model after federated aggregation.

C. Denoising Diffusion Probabilistic Model Given the state-of-the-art performance of the Denoising Diffusion Probabilistic Model (DDPM) in the generative domain and its fine-grained control over generated samples [43], [44], we aim to investigate the potential of malicious clients leveraging DDPM for poisoned data generation. As shown in Fig. 3, DDPM is a deep generative model that uses variational inference to train a parameterized Markov chain. It has a forward diffusion process and a backward inverse diffusion process, with each process consisting of a limited number of time steps. The forward process is parameterless, while the backward process requires a training algorithm. Forward Diffusion

Backword Diffusion

Fig. 3. Denoising Diffusion Probabilistic Model (DDPM).

In the attack model, malicious clients train a DDPM using their local data, enabling them to generate poisoned data by denoising pure noise samples. Specifically, the process involves two stages: training and generation. The training stage consists of a forward process and a backward process: Forward Diffusion Process: Suppose x0 ∼ p(x) represents a sample from the distribution of a local dataset, and t = 1, 2, .., T is a time variable, where T is the maximum discrete time step during the diffusion process. The forward diffusion process gradually adds slight Gaussian noise ϵ ∼ N (0, I) to the original data x0 , generating a series of noisy samples [x1 , x2 , · · · , xT −1 , xT ] over t = {1, 2, · · · , T − 1, T } time steps. The variance sequence {βt ∈ (0, 1)}Tt=1 controls the stepsizes. The transition probability from t − 1 to t is denoted as q(xt |xt−1 ). Then the transition probability from the original data to the last step of the forward diffusion process is: T Y q(x1:T |x0 ) = q(xt |xt−1 ), (4) where,

t=1

p q(xt |xt−1 ) = N (xt ; 1 − βt xt−1 , βt I). (5) As t increases, the distinguishable features of data sample x0 gradually diminish. When T → ∞, xT is equivalent to an isotropic Gaussian distribution. Then, use the reparameterization trick Q to sample xt at any time step t. Let αt = 1 − βt T and ᾱt = i=1 αi , so: √ q(xt |x0 ) = N (xt ; ᾱt x0 , (1 − ᾱt )I). (6) Backward Diffusion Process: The backward diffusion process is a parameterized Markov process, and the parameters of the transition probabilities are learned at each time step. It is impossible to estimate q(xt−1 |xt ) during the backward process without using the entire dataset. A model pθ is needed to approximate the conditional probabilities for the backward diffusion process. Here let the time step t = {T, T − 1, ..., 2, 1}. The inverse diffusion process begins with noisy

data at time step t = T , represented by the data distribution pθ (xT ) = N (xT ; 0, I). The transition probability for the backward diffusion process is: T Y pθ (x0:T ) = p(xT ) pθ (xt−1 |xt ), (7) where,

t=1

pθ (xt−1 |xt ) = N (xt−1 ; µθ (xt , t), Σθ (xt , t)).

(8)

The generation stage begins by sampling the final output from the learned reverse process, starting with an initial sample xT drawn from a Gaussian prior, xT ∼ N (0, I). In this reverse process, the noisy sample xT is progressively denoised into a poisoned sample xp0 by sequentially generating intermediate samples xT −1 , xT −2 , . . . , x1 through iterative applications of the learned transition probabilities pθ (xt−1 |xt ). Both the mean µθ (xt , t) and variance Σθ (xt , t) are parameterized by a neural network, typically a U-Net [45], which is optimized during training stage to approximate the true reverse process. The final output xp0 , representing the generated poisoned data, preserves the structural similarity of the original data while incorporating malicious modifications introduced during the training of the DDPM on the attacker’s local dataset. IV. D IFFUSION - BASED DATA P OISONING ATTACK In general, the effectiveness of a poisoned model is inversely correlated with its stealthiness: more effective poisoned models usually exhibit greater divergence from benign models, thereby indicating lower attack stealthiness, and vice versa. As a result, achieving both effective and stealthy data poisoning attacks remains challenging. For example, the recently proposed VagueGAN, which emphasizes improving attack stealthiness, has been shown to suffer from model consistency anomalies due to the inherent limitations of GAN models [12]. To address these limitations, we propose a novel diffusion-based data poisoning attack method, named Poisoning-Oriented Conditional Diffusion Model (PCDM). This method provides several notable advantages in the realm of data poisoning attacks: (1) PCDM retains the core characteristics of the original data while keeping poisoned data inconsistent and diversified, thereby ensuring the attack’s stealthiness. (2) While preserving these essential features, PCDM generates highly effective poisoned features, thereby enhancing the attack’s overall impact. (3) Through its configurable hyperparameters, PCDM allows precise modulation of the poisoning intensity to satisfy conflicting stealth and utility requirements. (4) PCDM adopts a lightweight diffusion strategy, significantly reducing resource and time consumption. A. Poisoning-Oriented Conditional Diffusion Model Leveraging the superior capabilities of DDPM [45] in the generative AI domain and its feature of fine-grained control over generated samples [46], [47], DDPM shows significant potential for effectively carrying out data poisoning attacks. Specifically, DDPM uses a forward diffusion process that incrementally introduces noise to the data, and a reverse diffusion process, parameterized by a neural network, that iteratively removes noise and reconstructs the data.

Global Poisoning Vector

Forward Diffusion

Reshape &

q ( xt | xt 1 )

x t 1 Conv

Conv

o ( x0 , v )

o ( xt 1 , v )

o ( xt , v )

Backword Diffusion

x0P

xtP1

p ( x | x , v) t t 1 

xtP

Fig. 4. Workflow of the PCDM approach.

The significant training costs, prolonged data generation time, and substantial hardware requirements of DDPM pose challenges for its application in attacks. To address these issues, we developed PCDM, a model based on DDPM, to effectively generate poisoned data. As shown in Fig. 4, our PCDM integrates a poisoning vector into the global context, which regulates the generation of poisoned features. Furthermore, PCDM employs an optimized jumping diffusion strategy, enabling the efficient generation of high-quality poisoned data with minimal resources, while substantially reducing computational costs compared to DDPM. 1) Poisoning Global Context: In PCDM, a poisoning vector v is introduced into the global context to guide the generation of poisoned data. This vector, a compact noise representation, is specifically designed to perturb the feature distribution, while the global context encodes high-level semantic information that informs and directs the overall generation process. Specifically, at each time step t, v is combined with the previous time step’s output xt−1 to serve as the condition for computing the current output xt , thereby forming the context for the current time step: xt = f (xt−1 , o(xt−1 , v)). (9) In o(·), the poisoning vector v is incorporated into the context computation. f represents a function or transformation that governs the update of features at each time step t in the diffusion model, xt−1 is the feature at time step t−1, o(xt−1 ) is the context vector based on xt−1 , and v is the poisoning vector injected into the model, as a global perturbation. In o(·), the poisoning vector v is incorporated into the context computation by adding it to the features xt−1 : o(xt−1 , v) = Conv(xt−1 + r(v)). (10) Conv denotes a convolutional layer that processes the combination of the feature xt and the poisoning vector v. Before the combination, r(·) reshapes v to align with the dimensions of xt . This reshaped vector, r(v), introduces random perturbations that modify the feature extraction process. Incorporating the poisoning vector introduces randomness into the generation process. Mathematically, the features of the poisoned data are given by: xpoison = xt + σv · v + µv , t

(11)

where σv and µv control the scale and shift of the poisoning vector, respectively. The intensity and direction of poisoning features in the generated poisoned data can be effectively

controlled by adjusting the standard deviation σv and the mean µv of the noise in the poisoning vector v. This effect is quantified by interpreting the output distribution of the poisoning process as a noise function, where the conditional generation output xpt with respect to v is given by: 1 p(xpt |xt , v) ∝ exp − 2 ∥xpt − (xt + µv + v)∥2 . (12) 2σv This indicates that the poisoning vector v perturbs the distribution of the poisoned output, with the poisoning intensity σv and mean µv controlling the degree of poisoning feature. 2) Properties of the Poisoning Vector: In this subsubsection, we examine the properties of the poisoning vector v and perform a theoretical analysis of the characteristics of the poisoned data generated by PCDM. Property 1: Invariance of Forward Diffusion The inclusion of the poisoning vector v does not affect the forward diffusion process. This fundamental property ensures that the statistical nature of the forward dynamics, which meticulously transform the original data into a Gaussian distribution, remains intact. Consequently, the essential characteristics and distributional properties of the original data are not disrupted. Mathematically, this is formulated as: q̂(x1:T |x0 ) = q(x1:T |x0 ),

(13)

where q̂ denotes the transition probability distribution after introducing the poisoning vector v, and q is the original probability distribution. This invariance is strategically beneficial for an attacker as it ensures that the forward diffusion process can assimilate v without disturbing the intrinsic structure of the original data, thereby preserving the authenticity of the generated samples. Property 2: Sensitivity of Reverse Sampling Conversely, the reverse sampling process is sensitive to the inclusion of v, as it introduces an additional term to the gradient used for data generation. The updated gradient in reverse sampling is given by: ∇xt log p(xt ) + ∇xt log p(v |xt ).

(14)

This adjustment elucidates how the poisoning vector v engages with intermediate states xt during the reverse process, granting fine-grained control over poisoned sample generation. Property 3: Refined Impact on Poisoned Data To quantify and elucidate the impact of v further, we conduct a comprehensive analysis of its effects on the reverse diffusion trajectory. The modification on the poisoned data xpk is given by: 1 (15) xpk (v) ≈ xk + ∇v xpk · µv + σv2 zT Hz + O(v3 ). 2 Here, σv is responsible for the diversity and fluctuations in the poisoned data, while µv influences the bias introduced to the poisoned dataset. 3) Jumping Diffusion Strategy: PCDM generates effective and stealthy poisoned data without requiring detailed diffusion and estimation. Instead, PCDM adds substantial noise at each time step of forward diffusion, enabling xt to rapidly approximate a Gaussian distribution and dramatically reducing the diffusion timestep.

“Large Strides”: Compared to the noise variance sequence {βt ∈ (0, 1)}Tt=1 in baseline DDPM, PCDM employs a tailored variance sequence {β̂t ∈ (0, 1)}T̂t=1 , which significantly increases the noise introduced at each time step by utilizing an extended sequence {et }T̂t=1 during the forward diffusion process. At time step t, the noise variance with a large stride is β̂t = et βt , t ∈ [1, T̂ ]. This modification accelerates the noise addition while disrupting the equilibrium between the forward and reverse diffusion processes, making it challenging for the reverse process to accurately predict the noise term and leading to insufficient denoising accuracy. Consequently, this approach ensures that the harmful features of the poisoned data are effectively preserved. “Few Steps”: As a lightweight module designed for generating poisoned data, PCDM significantly reduces the demand for computational resources and time. It efficiently utilizes several time steps to produce a large volume of poisoned data. To ensure the generation of high-quality poisoned data while maintaining a lightweight operation, the total number of time steps T̂ in PCDM is set in accordance with the variance sequence {β̂t }. Specifically, T̂ = T /ē, where: ē =

T̂ Σt=1 et

time step t, which is determined by the noise schedule βt . After the introduction of v: (1) v serves as additional contextual information, but its influence is limited to q̂(v|xt−1 ). (2) Due to the normalization property of q̂(v|xt−1 ), v exerts no observable impact on the specific transition process. Following the same logic, it can be derived that the joint probability q̂(x1:T |x0 )of the forward diffusion process in the conditional diffusion model is equivalent to that q(x1:T |x0 ) in the unconditional (original) diffusion model: Z q̂(x1:T |x0 ) = q̂(x1:T , v |x0 )dv v Z = q̂(v |x0 )q̂(x1:T |x0 , v )dv v

Z q̂(v |x0 )

= v

T Y

Z q̂(v |x0 )

= v

q̂(xt |xt−1 , v )dv

t=1 T Y

q̂(xt |xt−1 )dv

(19)

t=1

T Y

Z q̂(xt |xt−1 )

t=1

q̂(v |x0 )dv {z } | v

(16)

T̂ In practice, T ≥ 1000 is typically set to ensure that the final noised sample xT closely approximates pure noise. Therefore, in PCDM, as the expansion sequence {β̂t ∈ (0, 1)}T̂t=1 increases, the total number of time steps T̂ decreases, i.e., “larger strides, fewer steps”. This leads to a coarser diffusion process, making the generated poisoned data vaguer and more harmful. Conversely, the opposite holds. B. Theoretical Analysis

1) The Forward Diffusion Process in PCDM (Property 1): The diffusion model is a Markov chain, defined as follows: The state xt at any given time depends only on the previous time step. Therefore, the conditional probability of the forward diffusion process (noise addition) at any single time step must be independent of v, i.e., q̂(x1:T |x0 ) = q(x1:T |x0 ). (17) Building on this fact, another equation can be derived: Z q̂(xt |xt−1 ) = q̂(xt , v |xt−1 )dv v Z = q̂(xt |v, xt−1 )q̂(v |xt−1 )dv vZ = q(xt |xt−1 )q̂(v |xt−1 )dv (18) v Z = q(xt |xt−1 ) q̂(v |xt−1 )dv |v {z } =1

= q(xt |xt−1 ) = q̂(xt |xt−1 , v ). During the forward diffusion process, noise is progressively added in the form of Gaussian perturbations, and the transition probability q(xt |xt−1 ) depends solely on the noise level at

T Y

q̂(xt |xt−1 ) = q(x1:T |x0 ).

t=1

Consequently, v does not alter the forward diffusion process. As the forward diffusion process uniformly transforms the data into a Gaussian distribution, the addition of global context noise (particularly unbiased noise) does not systematically disrupt the core features of the original data. 2) The Backward Diffusion Process in PCDM (Property 2): The joint probability of the reverse process in the baseline diffusion model is given by: p(x0:T ) = p(xT )

T Y

pθ (xt−1 |xt ).

(20)

t=1

After introducingv, the joint probability of the reverse process in PCDM is given by: p(x0:T |v ) = p(xT )

T Y

pθ (xt−1 |xt , v ).

(21)

t=1

In this paper, we analyze the denoising process of the diffusion model from a score-based perspective ŝθ (·), where the parameterized neural network predicts the logarithmic gradient of xt , as expressed by the following equation: ŝθ (xt , t) ≈ ∇xt log p(xt ). After introducing v, the original ∇xt log p(xt ) becomes ∇xt log p(xt |v ): p(xt )p(v |xt ) ∇xt log p(xt |v ) = ∇xt p(v) = ∇xt log p(xt ) + ∇xt log p(v |xt ) − ∇xt log p(v) (22) | {z } =0

= ∇xt log p(xt ) + ∇xt log p(v |xt ).

∇xt log p(xt ) represents the gradient of the original diffusion model, referred to as the unconditional score, and ∇xt log p(v |xt ) is known as the adversarial gradient, where p(v |xt ) defines the poisoning-conditional probability distribution, and v is closely related to the diversity and uncertainty of the poisoned samples. 3) The Poisoned Data Generation in PCDM (Property 3): Expanding the poisoned output xpk using a Taylor series around v = 0: 1 xpk (v) ≈ xk + ∇v xpk · v + vT Hv, (23) 2 where xk is the baseline output (no poisoning is added), ∇v xpk is the gradient of the output with respect to the noise, indicating the sensitivity of the output to poisoning perturbations, and H is the Hessian matrix, representing the second-order effect of poisoning on the output. If σv is small, the influence of noise primarily manifests in the linear term, ∇v xpk · v. However, as the poisoning magnitude increases, the quadratic term 12 vT Hv becomes significant, and the poisoned data is more strongly influenced by the poisoning vector. Next, we analyze the impact of v ∼ N (µv , Σv ) on generating poisoned data, where µv is the mean, Σv is the covariance matrix, and σv = diag(Σv ) is the standard deviation. The components of the poisoning vector can be represented as v = σv · z, where z follows a standard Gaussian distribution. Mean term: The effect of the mean µv is linear and directly reflected in the gradient term: ∇v xpk · µv . Variance Term: The variance term is closely related to the standard deviation σv . The magnitude of the poisoning vector is influenced by σv , which in turn affects the second-order term in the generated result. The covariance matrix of v is Σv = σv2 I, where I is the identity matrix. For each component of the poisoning vector with standard deviation σv , the effect of the variance is modeled through the Hessian matrix term 12 vT Hv, which governs the second-order derivative terms. Therefore, the expression for the effect of the poisoning vector’s standard deviation is: vT Hv = σv2 zT Hz, (24) where z ∼ N (0, I) is the standard normal noise vector, and σv2 is the variance of the poisoning vector (the variance of each component). Thus, the impact of the standard deviation can be reflected through this expression: 1 T 1 v Hv = σv2 zT Hz. (25) 2 2 After incorporating both the standard deviation σv and the mean µv into Equation 23, the final formula becomes: 1 xpk (v) ≈ xk + ∇v xpk · µv + σv2 zT Hz + O(v3 ), (26) 2 where xk represents the case without poisoning vector, ∇v xpk · µv and 12 σv2 zT Hz respectively represent the influence of the poisoning vector’s mean and standard deviation on the generated result, affecting the fluctuations and diversity of the generation, and O(v3 ) represents higher-order terms, which are typically negligible.

In summary, the standard deviation σv controls the diversity and fluctuations of the poisoned data by influencing the second-order derivative terms (the quadratic terms of the Hessian matrix). On the other hand, the effect of the mean µv is reflected through the first-order derivative terms (the gradient), controlling the bias of the poisoned data. 4) Refining the Impact of Hyperparameters {et } and T̂ on PCDM (Property 3): During DDPM training, the model aims to minimize the loss by reverse diffusion, gradually recovering a clear image from noise. For simplicity, the loss function is typically computed based on the Euclidean distance between images. However, Euclidean distance may only effectively measure the actual quality of the generated images if the input and output images are very close, which can produce more precise results. Therefore, selecting the most significant possible time step helps make the input and output images as close as possible, thereby mitigating the blurring effect caused by the Euclidean distance. Therefore, in Equation 6, there should beQᾱT ≈ 0. The T overall product of αt up to step T is ᾱT = t=1 αt . Based on the derivations in [45], the value of ᾱT can be estimated. Substituting the given form of αt : T X log ᾱT = log αt . (27) t=1

Approximating log αt for large T : 1/2 0.02t log αt = log 1 − T 1/2 0.02t < log − . T

(28)

Thus: log ᾱT ≈ −0.005(T + 1).

(29)

When T = 1000, ᾱT ≈ e−5 , this value is nearly 0, ensuring that the final noised sample xT closely approximates pure Gaussian noise. Choosing a sufficiently large T ensures that adequate noise is introduced, which not only facilitates the diffusion process but also promotes greater diversity in the generated poisoned data while maintaining its core features. However, PCDM aims to generate specific poisoned data rather than refine the diffusion process to produce precise results. Therefore, PCDM focuses on the noise variance sequence {β̂t }T̂t=1 to satisfy the condition. It is known that: log ᾱT =

T̂ X

log(1 − βt ).

(30)

t=1

For example, if βˆt ∈ {β̂t } ≈ 0.1, we can estimate log(1 − 0.1) ≈ −0.105. Thus, log ᾱT̂ ≈ −0.105T̂ . In order for αT ≈ 0, log ᾱT̂ ≈ −5 is required, which gives 5 T̂ ≈ 0.105 ≈ 48. This means that when βt is large, T̂ can be chosen to be a smaller value. This choice ensures that after T̂ steps, αT̂ becomes sufficiently small, thereby allowing the noise introduction process to fully unfold. In PCDM, β̂t = et · βt , β̂t ∈ {β̂t }, et ∈ {et }, βt ∈ {βt }T̂t=1 .

(31)

PCDM needs to ensure that the accumulated noise increments under its time steps T̂ are consistent with baseline time

steps T . This condition can be expressed by accumulating the noise increments. Baseline accumulated noise increment: T X β̄T = βt . (32) t=1

PCDM accumulated noise increment: ¯ β̂T̂ =

T̂ X

β̂t =

t=1

T̂ X

et · βt = ē

t=1

T̂ X

βt .

(33)

t=1

To ensure a smooth and stable noise addition and removal process across different time steps, PCDM must maintain consistency in the cumulative noise schedule with the baseline DDPM. This consistency ensures theoretical soundness by preserving both the smoothness of per-step noise addition and the learnability of the denoising process, ultimately allowing the core features of the data to remain intact. To ensure theoretical equivalence with the baseline, we impose the condition: ¯ β̄T = β̂T̂ . That is, T T̂ X X βt = ē βt . (34) t=1

t=1

¯ By aligning β̄T with β̂T̂ , we ensure that the noise addition at each step remains smooth and comparable. Additionally, the smoothness in βt ensures that the perturbation introduced to xt does not disrupt the core features of the data, making the backward diffusion process (denoising) both practical and learnable for PCDM. Furthermore, preserving the cumulative noise schedule has two key benefits: (1) Smooth Noise Transition: By maintaining a consistent noise trajectory, each intermediate step t transitions seamlessly between states. This prevents abrupt variations in noise levels that could impair feature preservation and destabilize the reverse process. (2) Denoising Learnability: A smooth and consistent noise schedule ensures that the model can effectively approximate the denoising distribution pθ (xt−1 |xt ) at each step, leading to better reconstructions of the poisoned data while retaining its core characteristics. For the case where βt increases linearly, T̂ and T should satisfy a proportional relationship: T T̂ = . ē

(35)

Substituting T = 1000 yields T̂ = 1000 ē , indicating that as the noise schedule parameters increase, the number of time steps needs to decrease to maintain the same total noise increment.

where (xj , yj ) ∈ Dj , and E is the training epoch. For each e = 0, 1, 2, ..., E, t = 0, 1, ..., T̂ − 1, T̂ , a gradient descent step is taken according to the PCDM: √ √ ᾱt (xj + r(v)) + 1 − ᾱt ϵ,t ∥2 . (38) ∇θ ∥ϵ − ϵθ The loss function learns to denoise the corrupted input by measuring the deviation between the actual noise ϵ and the noise predicted by ϵθ . After the training stage, G captures the noise patterns introduced during the forward diffusion process, including the influence of the injected global context v. This enables the model to generate poisoned samples that preserve the original data’s structure while embedding adversarial perturbations into the generated results. Generation Stage: After the training stage, G generates the corresponding poisoned data by starting from random noise xT̂ ∼ N (0, I) and conditioning on the sample label (ykp )j . The model iteratively denoises the input over T̂ time steps to generate the poisoned data. A noise term z is added to achieve a random sample, and σt is the variance of z. 1 − αt 1 ϵθ (xt + r(v), t) xt + r(v) − √ xt−1 = √ αt 1 − ᾱt (39) + σt z, z ∼ N (0, I). At each time step t = T̂ , T̂ − 1, ..., 1, 0, G samples xt . After sampling T̂ time steps, x0 is the poisoned data xpj generated by PCDM. G constructs the poisoned dataset Kp Djp = {(xpk , ykp )j }k=1 by Djp = G (ϵθ , {(ykp )j } , v, z,t) , k ∈ [1, Kp ], t ∈ [0, T̂ ],

(40)

where Kp represents the number of poisoned data, and label (ykp )j is copied from (yk )j . D. Poisoned Federated Training Every malicious client cj generates a poisoned dataset Djp using G and local dataset Dj before federated training, then Djp is used for poisoned training instead of Dj . In the initial ∗(1) round, the malicious client trains a poisoned local model ωj p with poisoned dataset Dj . ∗(1) ωj = ∇F Djp . (41) ∗(1)

C. Diffusion-based Poisoned Data Generation Given a malicious client cj with a dataset Dj , the attacker uses a PCDM G to generate poisoned dataset Djp , with which the malicious client trains the local poisoned model. Djp = G (ϵθ , Dj , v) ,

prediction function ϵθ . During training, the gradient of the objective function is computed as follows: ∇G ϵθ , (xk , yk , v)j , t, e (37) , k ∈ [1, Kj ], t ∈ [0, T̂ ], e ∈ [1, E],

(36)

where ϵθ is a function approximator intended to predict diffusion noise ϵ, and v is a global poisoning vector. G generates poisoned data xpj through two stages: training and generation. Training Stage: The objective of the training stage is to optimize the model G by learning the parameters of the noise

After that, cj uploads the poisoned local model ωj to the server, and federated aggregation will result in a poisoned (1) ∗(1) global model ω̂g if server selects the poisoned model ωj . In the following rounds, the malicious client receives a (r) poisoned global model ω̂g , trains a new poisoned local model ∗(r+1) (r) ωj based on ω̂g using poisoned dataset Djp , and uploads it to the central server. ∗(r+1) (42) ωj = ω̂g(r) − η · ∇F ω̂g(r) , Djp . The malicious client performs receiving, training, and uploading in such a loop.

E. Implementation Guidelines If a poisoned local model is not detected as abnormal by the server, it can undermine the global model during federated aggregation. Since detectable poisoning is readily neutralized, PCDM is designed to impose maximal aggregation damage while maintaining benign update profiles 1) Attack Effectivieness: The test accuracy of the poisoned global model reflects the effectiveness of data poisoning attacks. PCDM aims for the optimal poisoned dataset Djp to indirectly undermine the global model, thereby maximizing the reduction in test accuracy of global model. max ar − âr , (43) p Dj

(r) (r) (r) where, ar = F ωg , Dtest , âr = F ω̂g , Dtest , ω̂g and (r)

ωg denote the poisoned and unpoisoned global models. 2) Attack Stealthiness: The server typically defends against data poisoning attacks by calculating the difference between each local model and other models: B ∥ϕ ω ∗(r) , ϕ ω (r) ∥ X j i , (44) B i=1 then discard local models with large differences. The lowdimensional kernel function ϕ(·) (e.g. PCA, KPCA, SVD) is used to extract critical features of local models, as computing differences between high-dimensional models is challenging and costly due to the massive number of parameters. Reviewing local models at each round is time-consuming and computationally expensive. Furthermore, highly dense defenses can trigger many false alarms. Therefore, previous studies have employed an interval defense method by storing the local models received during an interval of R′ time steps to construct a model set for each client, followed by calculating the differences between these local model sets (e.g., using Euclidean distance or cosine similarity). n oR′ n oR′ ∗(r) (r) N ∥ ϕ ω , ϕ ωi ∥ X ′ j (R ) r=1 r=1 sj = . (45) N i=1 (R′ )

The threshold S or model differences is then set by statistical methods, such as calculating the mean or ′median of ′ (R ) the differences as the threshold. Clients whose sj > S (R ) (R′ )

are labeled as malicious ones. A smaller sj

indicates greater

′ (R′ ) stealthiness and it requires that sj < S (R ) .

3) Trade-off: To summarize, PCDM attack can be formulated as the following optimization problem: max ar − âr , r ∈ [1, R] {Djp } (46) ′ (R′ ) s.t. sj < S (R ) , j = 1, 2, ..., M. Typically, attack impact and imperceptibility share an inherent trade-off, where increasing one often compromises the other. PCDM addresses this tension by decoupling data manipulation from the local training process, allowing effective model degradation under strict detectability constraints. The former is proportional to the extent of poisoning characteristics, while the latter is proportional to how closely the poisoned data resembles real data.characteristics.

PCDM provides several hyperparameters that offer finegrained control over the generation of poisoned data, allowing for a trade-off between the effectiveness of the data poisoning attack and its stealthiness: Training epoch E: This primarily affects the extent to which poisoned data aligns with real data. As E increases, the fundamental features in the poisoned data become more distinct, enhancing the stealthiness of the attack. Conversely, a smaller E produces vaguer features, which can reduce the attack’s stealthiness and requires fewer computational resources and less time. Therefore, from a cost-effectiveness standpoint, a smaller E is generally preferred when similar attack outcomes are achievable. σv and µv of poisoning vector: These two parameters represent the standard deviation and mean of the poisoning vector. Specifically, σv controls the magnitude of the poisoned features in the data, while µv determines the degree of offset between the poisoned and real data. Both parameters primarily affect the effectiveness of attack: as σv and µv increase, the attack becomes more effective. Expanded sequence {et } and Time step T̂ : {et } and T̂ must satisfy Equation (15) to ensure the proper functioning of PCDM. {et } directly controls the diffusion stride, indirectly determining T̂ . They jointly govern the granularity of the diffusion process: as {et } increases, the corresponding T̂ decreases, making the process coarser. This results in a more effective but less stealthy attack. Similar to E, smaller T̂ values should be prioritized for the same attack outcomes. There are various choices for {et }. For example, {et } can follow linear sequences (arithmetic progression) or non-linear sequences (exponential progression). Regarding arrangement, options include increasing, decreasing, constant sequences, etc. This means that even for the same T̂ , PCDM offers a variety of diffusion strategies, accompanied by a diverse range of possible poisoned data forms. Hence, {et } can be flexibly configured to suit the specific task. V. E XPERIMENTS A. Experimental Setup System Overview. To evaluate the proposed PCDM in realistic wireless edge intelligence scenarios, our experimental design follows the configuration of a standard FL system. We simulate a wireless network comprising 100 distributed clients (e.g., IoT nodes or smart cameras). The global training process spans 200 communication rounds. In each round, a fraction of clients (0.2, i.e., 20 clients) are randomly selected to execute local training. Specifically, each selected client performs 5 local epochs with a batch size of 128. The global objective F is to collaboratively train Deep Neural Networks (e.g., CNN and ResNet) for image classification, representing a fundamental application in next-generation wireless networks. Datasets and Data Partitioning. We utilize five benchmark datasets to represent different task complexities: MNIST [48] and Fashion-MNIST [49] represent lightweight sensing tasks, while CIFAR-10 and CIFAR-100 [50] represent complex environmental monitoring tasks. The specific statistics and strict data partitioning details for each dataset are summarized

in Table II. To comprehensively evaluate the robustness of our method against statistical heterogeneity, we simulate two distinct data distribution settings. In the IID setting, the training data is uniformly shuffled and randomly assigned to clients to simulate a balanced environment. In the Non-IID setting, we adopt the data partitioning protocol described in [51] to simulate realistic statistical heterogeneity where local data is modeled as a mixture of underlying distribufivetions. Specifically, we partition the training data among clients using a symmetric Dirichlet distribution with a concentration parameter α = 0.5. This setting generates highly skewed label distributions across clients, effectively capturing the inherent heterogeneity of local data distributions. In all scenarios, the testing set remains on the server for global performance evaluation. Crucially, to ensure a fair comparison, the exact same data partitioning indices, random seeds, and client data assignments were applied across all evaluated techniques. TABLE II S UMMARY OF DATASET S TATISTICS AND DATA PARTITIONING . Dataset

Input Shape

Classes

Training Set

Testing Set

MNIST Fashion-MNIST CIFAR-10 CIFAR-100

1 × 28 × 28 1 × 28 × 28 3 × 32 × 32 3 × 32 × 32

10 10 10 100

60,000 60,000 50,000 50,000

10,000 10,000 10,000 10,000

Model Architectures. We deploy model architectures tailored to the complexity of the learning tasks. For the lightweight MNIST and Fashion-MNIST datasets, we utilize a compact CNN consisting of two convolutional layers (16 and 32 channels) followed by a fully connected layer. For the more complex CIFAR-10 dataset, we employ a deeper network comprising six convolutional layers structured into three blocks (with 32, 64, and 128 channels, respectively) and two fully connected layers. The model for CIFAR-100 retains the same depth as the CIFAR-10 architecture but doubles the channel width to accommodate the expanded label space. All convolutional layers are equipped with Batch Normalization, ReLU activation, and Max Pooling to ensure training stability and performance. Baselines. We replicate four kinds of mainstream data poisoning methods to compare with PCDM. • Label flipping attack (LF) [6]: This method changes the labels of specific classes in the training data to perform untargeted poisoning in FL. • PoisonGAN (LF+PoisonGAN) [23]: This method applies a data augmentation method using off-the-shelf GANs to enhance attack effectiveness, such as generating pseudosamples to increase dataset size before flipping labels. • Noise superimposition attack (NS) [52], [53]: This method involves adding various types of noise, such as Gaussian (LNS, HNS) or SAP (SAP-NS) noise, directly to real data to create poisoned samples. • VagueGAN [11]: This method utilizes specialized variants of GANs to generate vague yet effective poisoned data, thus achieving a balance between attack impact and stealthiness in FL. Defense Evaluation. We utilize seven representative defense methods to evaluate the actual impact of data poisoning attacks in this paper.

PCA [6]: This method constructs and standardizes a list of local models for dimensional reduction using PCA and identifies significant outliers. • UMAP [9]: This method employs UMAP for non-linear dimensionality reduction of model gradients, utilizing cosine distance metrics with a neighborhood size of 100 and minimum distance of 0.6. It identifies poisoned models based on Euclidean distance from the centroid. • CONTRA [27]: This method detects poisoned models by calculating the cosine similarity matrices, where models with significantly deviated gradient directions are marked as poisoned models. • DnC [28]: This method identifies poisoned models by analyzing the principal direction of gradient updates. It samples to reduce dimensionality, computes principal components, projects gradients, and eliminates the models with the largest projections as poisoned ones. • K-Means [29], [30]: This method performs K-Means clustering on the model gradients after dimensionality reduction through PCA to identify abnormal clusters. • FedDMC [31]: This method employs binary tree-based noise clustering (BTBCN) to detect poisoned models after performing PCA dimensionality reduction. • LoMar [32]:This method quantifies the poisoned models by computing the relative distribution difference with neighboring updates using a non-parametric kernel density estimation approach. • MCD [12]: This method conducts periodic rigorous reviews of the distribution behavior of local model parameters, which can identify the vast majority of existing data poisoning attacks, including recent GAN-based ones. Robust Aggregation Evaluation. We further compare with three representative Byzantine-robust aggregation rules: • Multi-Krum [33]: This distance-based method selects a subset of local models with the smallest sum of squared Euclidean distances to their neighbors, effectively filtering outliers before aggregation. • SignGuard [34]: This method integrates direction-based clustering using gradient signal statistics with magnitudebased filtering to identify and exclude malicious models exhibiting abnormal statistical behaviors. • LASA [35]: This method employs layer-adaptive sparsified aggregation. It combines pre-aggregation top-k sparsification to reduce the attack surface with a layerwise filter that selects benign layers based on magnitude and Positive Direction Purity metrics. •

B. Experimental Result Effectiveness of PCDM Attack. We evaluate the effectiveness of the PCDM and the baseline attacks by measuring the extent of the drop in the global model accuracy caused by each attack in identical FL settings (see Subsection IV-E1). As illustrated in Table III, the impact of each attack method on the global model accuracy is evaluated as the proportion of malicious clients varies from 5% to 30%. The results indicate that PCDM consistently demonstrates superior attack effectiveness compared to baseline methods across different tasks,

TABLE III T EST ACCURACY IN PRESENCE OF DATA POISONING ATTACKS (%)

CIFAR-10

CIFAR-100

CIFAR-100 5% 10% 20% 53.0 52.5 49.3 52.8 52.1 48.4 54.0 53.7 51.1 53.5 52.5 50.2 54.1 53.8 51.2 51.5 48.3 42.4 52.1 47.6 44.7 52.1 49.3 46.8 51.7 49.4 46.7 52.9 51.0 48.5 51.3 48.6 45.1 51.7 50.0 48.4 51.0 49.0 41.0 49.7 47.0 41.3

30% 46.7 46.9 50.0 48.6 49.6 39.4 37.3 41.4 40.0 46.0 43.0 44.7 35.1 37.2

Fashion-MNIST Fashion-MNIST(3D)

PoisonGAN

No Attack

MNIST

0% 55.7 55.7 55.7 55.7 55.7 55.7 55.7 53.4 53.4 53.4 53.4 53.4 53.4 53.4

LNS

particularly on datasets with high task complexity, like CIFAR100. Furthermore, all attack methods exhibit greater effectiveness on complex tasks than on simpler ones. Additionally, we investigate the attack performance under non-independent and identically distributed (non-IID) conditions among clients, where PCDM maintains the highest effectiveness. Stealthiness of PCDM Attack. To effectively evaluate the stealthiness of PCDM and baseline attacks against defense mechanisms, we employ a visualization strategy to analyze the geometric characteristics of model updates. Since neural network weight updates reside in a high-dimensional space that is fundamentally opaque to direct observation, we utilize Principal Component Analysis (PCA) to project high-dimensional vectors onto a two-dimensional plane. This projection preserves the relative distances and distributional structures of updates, providing an intuitive proxy for how defenses (which typically rely on statistical distance or similarity metrics) perceive benign versus malicious behaviors [6]. As shown in Fig. 5, we present the distribution patterns across four datasets, where yellow ‘O’s denote benign models and blue ‘X’s signify malicious ones. For crude attacks like Label Flipping, the primary distribution of malicious models significantly deviates from that of benign models in terms of Euclidean distance. This distinct geometric separation makes them easily identifiable and filterable by classic outlier detection mechanisms. However, the visualization of VagueGAN reveals a more complex phenomenon regarding the trade-off between stealthiness and diversity. As observed in Fig. 5, VagueGAN successfully guarantees that malicious updates are embedded within the benign cluster, making them difficult to detect via simple distance measurements. Nevertheless, a critical anomaly emerges: the malicious updates distinctively encompass a much smaller footprint than benign ones. This lack of variance stems from the inherent conceptual limitation of GANs known as “mode collapse” [54]. Since VagueGAN is trained via an adversarial min-max game, the generator often fails to capture the full distribution of the target class, resulting in poisoned samples with limited diversity. Consequently, this high consistency in generated data translates into excessively high consistency in model updates, distinctively marking them as anomalous. In contrast, PCDM exhibits superior stealthi-

30% 72.9 72.7 74.1 73.1 74.0 71.9 71.7 68.8 68.7 70.5 69.9 70.4 67.8 66.3

HNS

0% 88.0 88.0 88.0 88.0 88.0 88.0 88.0 87.3 87.3 87.3 87.3 87.3 87.3 87.3

SAP-NS

non-IID

30% 98.1 98.0 98.3 98.1 98.4 97.5 97.1 97.6 97.4 97.7 97.6 97.8 97.4 96.9

Dataset and Malicious Clients Percentage α Fashion-MNIST CIFAR-10 5% 10% 20% 30% 0% 5% 10% 20% 87.7 87.2 86.0 85.5 76.3 75.7 75.0 73.9 87.6 87.2 85.8 85.1 76.3 75.6 74.8 73.8 87.8 87.6 86.9 86.6 76.3 76.0 75.7 74.9 87.7 87.2 86.2 85.6 76.3 75.9 75.1 74.2 87.8 87.5 87.0 86.4 76.3 76.1 75.7 74.7 87.3 86.8 85.9 84.8 76.3 74.9 74.0 73.2 87.1 86.5 85.7 84.2 76.3 74.1 73.8 72.3 86.7 86.2 85.3 84.4 73.6 72.3 71.2 70.2 86.6 86.0 85.0 84.1 73.6 72.2 71.1 70.0 87.1 86.8 86.3 85.7 73.6 72.9 72.0 71.3 86.9 86.6 85.8 85.3 73.6 72.8 71.9 70.7 87.1 86.8 86.3 85.9 73.6 73.0 72.0 71.2 86.6 85.8 84.9 84.0 73.6 72.0 70.6 69.6 86.6 85.0 84.5 83.4 73.6 71.6 70.0 68.6

VagueGAN

IID

0% Label Flipping 98.7 PoisonGAN 98.7 Light Noise 98.7 Heavy Noise 98.7 SAP Noise 98.7 VagueGAN 98.7 PCDM 98.7 Label Flipping 98.4 PoisonGAN 98.4 Light Noise 98.4 Heavy Noise 98.4 SAP Noise 98.4 VagueGAN 98.4 PCDM 98.4

MNIST 5% 10% 20% 98.7 98.5 98.3 98.6 98.4 98.2 98.7 98.6 98.4 98.6 98.5 98.4 98.7 98.6 98.6 98.6 98.4 97.8 98.5 98.4 97.6 98.3 98.1 97.9 98.3 97.9 97.9 98.4 98.2 98.0 98.4 98.0 97.9 98.4 98.2 98.0 98.1 97.9 97.8 98.2 97.8 97.2

PCDM

Data Attack Distribution

Fig. 5. The poisoned models after different attacks.

ness; its malicious updates are indistinguishable from benign ones in both location and distribution spread, confirming that the diffusion-based approach effectively overcomes the mode collapse issue. To provide a unified and interpretable evaluation of defense performance against poisoning attacks, we define a Composite Score that balances two critical aspects: the ability to correctly identify poisoned models and the capacity to avoid misclassifying benign ones. Specifically, the composite score is computed as a weighted sum of the Recall and the false positive rate (FPR), formulated as: Composite Score = 100 × (α · Recall + β · (1 − FPR)), (47) where α and β are weighting factors subject to α + β = 1. In this formulation, the first component is Recall, which mea-

Fig. 6. Defense methods performance breakdown by attack type.

sures the proportion of correctly identified poisoned models among all actual poisoned models. The coefficient α explicitly controls the emphasis placed on this detection capability; thus, a larger α makes the evaluation favor defense methods that successfully identify a higher proportion of attackers. Conversely, FPR refers to the proportion of benign models that are incorrectly classified as poisoned (false alarms). The coefficient β governs the weight of the (1 − FPR) term, which represents the system’s specificity. A larger β prioritizes minimizing misclassification errors, favoring conservative defenses that preserve the participation of benign clients. In this paper, we adopt a consistent configuration of α = 0.6 and β = 0.4 across all datasets. This parameter choice reflects the asymmetric risk profile inherent in FL security: the cost of a ”false negative” (missing a poisoning attack that corrupts the global model) is typically severer than that of a ”false positive” (temporarily excluding a benign update). Consequently, by setting α > β, we bias the composite score to slightly prioritize detection sensitivity to ensure system robustness, while still maintaining a strong constraint on false positive rates to avoid resource waste. This fixed configuration provides a standardized metric (ranging from 0 to 100) for security-oriented scenarios, enabling consistent comparison across different defenses. Fig. 6 systematically presents a comparative evaluation of the performance of eight defense methods against seven types of model poisoning attacks on Fashion-MNIST dataset. Each subplot contains three components: (1) the rightmost stacked bar chart displays the raw data in terms of true positives (TP), false positives (FP), true negatives (TN), and false negatives (FN); (2) the middle four patterned bars show

four standard evaluation metrics: accuracy, precision, recall, and F1-score; and (3) the leftmost solid bar represents the composite score, which jointly reflects a defense’s sensitivity to poisoned models and its ability to avoid false positives. Specifically, these metrics are calculated as follows: T P +T N • Accuracy = T P +T N +F P +F N , indicating the proportion of correctly identified models. TP • Precision = T P +F P , indicating the proportion of truly poisoned models among those classified as malicious. TP • Recall = T P +F N , indicating the proportion of poisoned models that are correctly identified as malicious. Precision×Recall • F1-score = 2 × Precision+Recall , indicating the harmonic mean of precision and recall to balance both metrics. Notably, existing defense methods perform well against traditional attacks such as label flipping, demonstrate moderate effectiveness against noise-based attacks, but struggle against generative poisoning methods. Among them, MCD performs relatively better against noise-based and GAN-based attacks, yet still fails to effectively detect our PCDM attack. Overall, the results clearly demonstrate that PCDM attack exhibits significantly enhanced stealth compared to other attack methods when confronted with various defense mechanisms. Its unique stealth attack mechanism makes it particularly challenging for existing defense systems to detect effectively. Performance Evaluation under Robust Aggregation Defenses. To comprehensively evaluate the overall threat potential of the PCDM attack within robust FL environments, this study systematically assesses its performance against a variety of advanced robust aggregation defense mechanisms. The selected aggregation methods include: FedAvg (serving as the non-robust baseline), Multi-Krum, SignGuard, and the

recently proposed LASA, which integrates pre-aggregation sparsification with layer-wise adaptive filtering. Experiments are conducted on the CIFAR-10 and CIFAR-100 datasets. To clearly demonstrate the attack effectiveness of PCDM, we adopt the superior ResNet-18 architecture as the backbone model, utilizing its robust feature extraction capabilities to establish a high-performance baseline. The federated training spans 200 rounds with varying proportions of malicious clients (0%, 10%, 20%, and 30%) subject to the PCDM attack. The final global model test accuracy serves as the primary metric, simultaneously quantifying both the destructiveness and stealthiness of the PCDM attack in a robust setting, thereby offering a comprehensive reflection of its overall performance. TABLE IV G LOBAL M ODEL ACCURACY (%) UNDER VARIOUS ROBUST AGGREGATION D EFENSES WITH PCDM ATTACK Dataset

CIFAR-10

CIFAR-100

Method

Fig. 7. Accuracy of Different Defense Methods Against Various Malicious Client Ratios on VRAI Dataset.

Malicious Clients Percentage α 0%

10%

20%

30%

FedAvg Multi-Krum SignGuard LASA

90.25 83.51 89.9 91.95

88.79 83.4 87.69 89.54

87.61 83.11 87.3 88.82

84.73 82.79 85.32 85.84

FedAvg Multi-Krum SignGuard LASA

65.99 52.66 63.64 63.96

63.59 52.38 61.73 63.23

60.73 51.69 60.89 62.79

55.26 50.68 56.83 61.15

The results in Table IV shows that the PCDM attack poses a substantial threat to all tested defenses. Even under stateof-the-art defenses like LASA, it still causes a significant degradation in global model accuracy. This demonstrates that the highly stealthy poisoned data generated by PCDM exhibits strong adaptability and can effectively bypass current advanced robust defenses, highlighting its potent destructive capability as a novel generative data poisoning attack. Applicability Verification in Wireless Environments. To further validate PCDM’s applicability in real-world wireless scenarios, we conduct experiments on the VRAI dataset [55], a wireless-specific dataset collected from practical vehicular sensing environments. VRAI contains diverse vehicle images captured under realistic wireless transmission conditions, making it a representative benchmark for assessing attack effectiveness beyond conventional image classification datasets. In our experiments, we utilize the training subset of VRAI consisting of 66,113 images, split 80%/20% for federated training and testing, focusing on the 7-class vehicle type classification task. Fig. 7 illustrates the global test accuracy and its degradation on VRAI as the malicious client ratio rises. Unlike standard vision benchmarks, the VRAI dataset exhibits more complex data characteristics arising from real-world wireless environments, including diverse viewpoints, environmental noise, and acquisition variability. Despite this, the PCDM still causes noticeable performance degradation across all evaluated aggregation strategies. The consistent accuracy decline as the malicious ratio increases from 10% to 30% indicates that the effectiveness of PCDM attack remains stable and scalable in realistic wireless FL systems. Overall, the results show that the poisoned data generated by PCDM preserves its stealthiness and effectiveness in wireless-

specific scenarios, where data distributions and system conditions are inherently more challenging. Even against advanced robust aggregation mechanisms, PCDM continues to undermine learning without triggering obvious defensive responses. This confirms that PCDM is not limited to controlled benchmark settings but exhibits strong generalizability and practical threat potential in real-world wireless FL deployments. Statistical Indistinguishability Verification. Complementing the qualitative visualizations presented earlier, the successful evasion of the aforementioned eleven defense and aggregation mechanisms provides a rigorous, multi-dimensional validation of PCDM’s invisibility. As summarized in Table V, these defenses define normality through strict statistical metrics ranging from Euclidean norms and clustering scores to cosine similarity and distributional divergence. Consequently, PCDM’s consistent ability to circumvent these filters demonstrates that its generated poisonous updates maintain statistically insignificant deviations from benign updates across diverse metric spaces. This empirically confirms the attack’s superior evasiveness regarding critical quantitative indicators, such as perturbation magnitude, directional alignment, and distributional consistency, thereby satisfying the stringent requirements for robust evaluation. TABLE V Q UANTITATIVE S TEALTHINESS VALIDATION : M APPING D EPLOYED D EFENSES TO S TATISTICAL M ETRICS . Type

Distance

Direction

Distrib. Hybrid

Quantitative Metric

Validated Baselines

Euclidean Summation

Multi-Krum [33]

Subspace Outlier Score

PCA [6], K-Means [29], UMAP [9], FedDMC [31]

Cosine Similarity

CONTRA [27]

Projection & Signal Stats

DnC [28], SignGuard [34]

Kernel Density

LoMar [32]

Parameter Consistency

MCD [12]

Magnitude & Direction

LASA [35]

C. Ablation Study To comprehensively assess the effectiveness of PCDM in the context of data poisoning attacks, a series of experiments were

conducted across multiple datasets focusing on three principal aspects: the distinctive characteristics of the poisoned data, the effectiveness of the poisoning attacks, and the associated computational overhead. The evaluation involved comparative analyses among three models: DDPM, PCDM without the poison vector v, and the complete PCDM framework, where ”w/o v” refers to the exclusion of the poisoning vector. PCDM w/o v

PCDM

CIFAR100 CIFAR10

FashionMNIST

MNIST

DDPM

Fig. 8. Ablation study comparison of poisoned data.

As depicted in Fig. 8, PCDM, after capturing the salient features of the training data, is capable of synthesizing poisoned samples that are noisy yet retain the authentic attributes of real data. This generative behavior is markedly different from that observed with DDPM. Furthermore, the integration of the poison vector within PCDM enables the production of poisoned data with substantially enhanced attack characteristics, demonstrating the indispensability of the poison vector v for executing efficient data poisoning attacks.

Fig. 9. Ablation study comparison of attack effectiveness and stealthiness.

The quantitative results, as shown in Fig. 9, indicate that the data synthesized by DDPM lack effective attack capabilities. For complex datasets such as CIFAR-100, any apparent attack effects with DDPM are primarily attributable to the restricted capacity resulting from limited client-side data rather than genuine adversarial traits. Crucially, our analysis reveals that the inclusion of the poisoning vector v yields a systematic improvement in both stealthiness and aggressiveness compared to the baseline and the version without v. While this performance gain is universal across all tested scenarios, the magnitude of the benefit correlates with dataset complexity. Specifically, the improvements are significantly more pronounced on highdimensional, complex datasets (e.g., CIFAR-100 and CIFAR10) than on simpler ones (e.g., MNIST and Fashion-MNIST). With respect to stealthiness, experiments reveal that when the model distance metric remains below approximately 15 (as indicated by the dashed line), the attack is sufficiently covert to evade most existing detection mechanisms. Although the introduction of the poison vector leads to a variation in model

updates, the stealthiness metric remains well within acceptable bounds (below the threshold). This confirms that PCDM successfully optimizes the trade-off between invisibility and utility. Collectively, these findings underscore the necessity of incorporating the poison vector v in PCDM to achieve a potent attack, particularly in complex data environments. TABLE VI C OMPARISON OF T IME OVERHEAD FOR P OISONED DATA G ENERATION ( S ) Model

MNIST

Fashion-MNIST

CIFAR10

CIFAR100

DDPM PCDM w/o v PCDM

1126.23 167.32 174.28

1114.10 166.97 175.83

1445.37 196.41 211.01

1462.69 197.20 215.08

Additionally, the computational time required for training and generating an equivalent amount of poisoned data (3,000 samples) using the three models on client devices equipped with an NVIDIA A100-40GB GPU is summarized in Table VII. It is evident that PCDM incurs considerably less overhead for poisoned data generation compared to DDPM, and the inclusion of the poison vector introduces negligible extra computational cost. In summary, PCDM offers an efficient, stealthy, and lightweight data poisoning attack strategy. Owing to these advantages, PCDM poses a practical and formidable threat to FL systems, thereby highlighting the urgent need for robust defense mechanisms in real-world FL deployments. D. Efficiency Analysis and Resource Consumption To validate the deployment feasibility on resourceconstrained edge devices, we conducted an efficiency benchmark measuring runtime, peak memory usage, and FLOPs on an NVIDIA A100 GPU against DDPM and VagueGAN baselines. As detailed in Table VII, PCDM fundamentally overcomes the computational bottleneck of standard diffusion models. By employing the jumping diffusion strategy, significantly reducing the Markov chain length, PCDM achieves a drastic 85% reduction in latency and computational cost compared to DDPM (e.g., reducing CIFAR-10 FLOPs from 45k G to 6.7k G). This improvement confirms that our sparse sampling strategy effectively eliminates the heavy overhead typically associated with diffusion-based generation. TABLE VII E FFICIENCY B ENCHMARK : RUNTIME ( S ), FLOP S (G), AND P EAK M EMORY (MB) FOR G ENERATING 3,000 S AMPLES .

Dataset

Model

Time (s)

FLOPs (G)

Mem (MB)

MNIST

VagueGAN DDPM PCDM

155.60 1126.23 174.28

4450.2 32450.6 5108.3

1850 2240 2255

FashionMNIST

VagueGAN DDPM PCDM

158.45 1114.10 175.83

4510.5 32105.2 5152.7

1880 2240 2258

CIFAR-10

VagueGAN DDPM PCDM

189.20 1445.37 211.01

5980.4 45220.9 6760.5

2950 3420 3445

CIFAR-100

VagueGAN DDPM PCDM

194.50 1462.69 215.08

6120.1 45780.4 6890.2

2980 3420 3448

Furthermore, PCDM effectively closes the efficiency gap between diffusion and GAN-based architectures. despite GANs’ inherent single-step speed advantage, our results indicate that PCDM is highly competitive with the state-of-the-art VagueGAN, incurring only a marginal runtime increase (10–15%) and comparable memory usage. This demonstrates that the optimized diffusion process achieves efficiency levels practically indistinguishable from GANs, rendering it suitable for real-time wireless scenarios. Beyond quantitative metrics, PCDM ensures real-world viability through flexible deployment strategies. For extremely resource-limited devices, an attacker can adopt a train-thendistribute strategy [12], where a powerful server pre-trains the model and distributes lightweight weights for low-cost clientside inference. Alternatively, the framework supports heterogeneous deployment, allowing clients to adaptively select sampling hyperparameters based on local hardware states, ensuring robust attack execution across diverse edge environments. E. Performance Trade-off Analysis

Var

e i a nc

ia Var

nce

Stealthiness increased

Stealthiness Metric

Accuracy Reduction

Effectiveness increased

The optimization formulation in Eq. (46) highlights the inherent tension between poisoning intensity and detectability. While enhancing poisoning intensity improves attack effectiveness, it inevitably increases exposure to defenses. PCDM balances these conflicting objectives through coordinated hyperparameter tuning. We verify this trade-off using Fashion-MNIST, analyzing the impact of the noise vector v and diffusion parameters. Following Sec. IV-E2, we quantify stealthiness using the Euclidean distance of PCA-reduced model updates.

Based on our analysis, we adopt E = 30 and T̂ = 20 for most experiments of this paper. This configuration offers a robust baseline, producing sufficiently realistic samples to evade detection while retaining high attack potency. Practitioners should adjust these values according to the target data complexity to achieve an optimal trade-off.

Fig. 11. Impact of E and T̂ on the effectiveness-stealthiness trade-off.

VI. C ONCLUSION AND F UTURE W ORK In this paper, we have proposed PCDM, a lightweight and highly stealthy data poisoning attack for FL systems, which introduced a specialized poisoning vector and an innovative jumping diffusion strategy to enable highly stealthy and efficient attacks. We have also provided a comprehensive theoretical analysis demonstrating PCDM’s capability to control poisoned data, thereby offering guidance for balancing attack effectiveness and stealthiness. In addition, a large-scale comparative evaluation has been carried out on five datasets including the real-world wireless-specific VRAI benchmark, involving eleven diverse defense mechanisms covering advanced robust aggregation strategies and seven representative poisoning attacks, which is unprecedented in FL poisoning research. Extensive experimental results have demonstrated the superior performance of PCDM attacks, which poses a significant risk to the security of FL systems. In the future, we intend to further investigate countermeasures against such generative AI-based stealthy attacks.

Fig. 10. Sensitivity analysis of attack performance with respect to poisoning vector noise parameters.

R EFERENCES

As shown in Fig. 10, higher noise levels in v positively correlate with attack effectiveness (accuracy reduction) but compromise stealthiness (increased model distance). To strike an optimal balance, we recommend moderate settings of σv ≈ 1 and µv ≈ 5. Under these conditions, the model distance remains below 15, which is a threshold ensuring sufficient stealthiness, while maintaining substantial accuracy degradation. Beyond noise parameters, the diffusion hyperparameters, specifically the training epochs E and the total diffusion steps T̂ , critically govern sample fidelity and the resulting trade-off. We investigate their influence in Fig. 11. Results indicate that increasing E or T̂ enhances the fidelity of poisoned samples, aligning them closer to benign distributions. This improves stealthiness significantly but mitigates the aggressiveness of the attack. Unlike σv and µv , which have consistent effects, optimal E and T̂ are sensitive to dataset complexity. Complex or high-resolution data typically demand higher values to ensure fidelity.

[1] A. Yazdinejad, A. Dehghantanha, R. M. Parizi, M. Hammoudeh, H. Karimipour, and G. Srivastava, “Block hunter: Federated learning for cyber threat hunting in blockchain-based iiot networks,” IEEE Transactions on Industrial Informatics, vol. 18, no. 11, pp. 8356–8366, 2022. [2] N. Rodrı́guez-Barroso, D. Jiménez-López, M. V. Luzón, F. Herrera, and E. Martı́nez-Cámara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” Inf. Fusion, vol. 90, pp. 148–173, 2023. [3] W. Wei, T. Huang, Z. Yahn, A. Singhal, M. Loper, and L. Liu, “Data poisoning and leakage analysis in federated learning,” in Handbook of Trustworthy Federated Learning. Springer, 2024, pp. 73–108. [4] W. Wei, K.-H. Chow, Y. Wu, and L. Liu, “Demystifying data poisoning attacks in distributed learning as a service,” IEEE Trans. Serv. Comput., 2023. [5] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proc. Int. Conf. Artif. Intell. Stat., 2020, pp. 2938–2948. [6] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in Proc. Eur. Symp. Res. Comput. Secur. (ESORICS), 2020, pp. 480–501. [7] Y. Li, Z. Guo, N. Yang, H. Chen, D. Yuan, and W. Ding, “Threats and defenses in federated learning life cycle: A comprehensive survey and challenges,” arXiv preprint arXiv:2407.06754, 2024.

[8] S. Shen, S. Tople, and P. Saxena, “Auror: Defending against poisoning attacks in collaborative deep learning systems,” in Proc. 32nd Annu. Conf. Comput. Secur. Appl. (ACSAC), 2016, pp. 508–519. [9] D. Upreti, H. Kim, E. Yang, and C. Seo, “Defending against labelflipping attacks in federated learning systems with umap,” 2022. [10] G. Chen, K. Li, A. M. Abdelmoniem, and L. You, “Exploring representational similarity analysis to protect federated learning from data poisoning,” in Companion Proc. ACM Web Conf. 2024, 2024, pp. 525– 528. [11] W. Sun, B. Gao, K. Xiong, Y. Lu, and Y. Wang, “Vaguegan: A gan-based data poisoning attack against federated learning systems,” in 2023 IEEE 20th Int. Conf. Sensing, Commun. Netw. (SECON), 2023, pp. 321–329. [12] W. Sun, B. Gao, K. Xiong, and Y. Wang, “A gan-based data poisoning attack against federated learning systems and its countermeasure,” arXiv preprint arXiv:2405.11440, 2024. [13] H. Cao, C. Tan, Z. Gao, Y. Xu, G. Chen, P.-A. Heng, and S. Z. Li, “A survey on generative diffusion models,” IEEE Trans. Knowl. Data Eng., 2024. [14] L. Li, Y. Fan, M. Tse, and K.-Y. Lin, “A review of applications in federated learning,” Comput. Ind. Eng., vol. 149, p. 106854, 2020. [15] Y. Liu, Y. Kang, T. Zou, Y. Pu, Y. He, X. Ye, Y. Ouyang, Y.-Q. Zhang, and Q. Yang, “Vertical federated learning: Concepts, advances, and challenges,” IEEE Trans. Knowl. Data Eng., 2024. [16] J. Wen, Z. Zhang, Y. Lan, Z. Cui, J. Cai, and W. Zhang, “A survey on federated learning: challenges and applications,” Int. J. Mach. Learn. Cybern., vol. 14, no. 2, pp. 513–535, 2023. [17] B. Liu, N. Lv, Y. Guo, and Y. Li, “Recent advances on federated learning: A systematic survey,” Neurocomputing, p. 128019, 2024. [18] E. Nowroozi, I. Haider, R. Taheri, and M. Conti, “Federated learning under attack: Exposing vulnerabilities through data poisoning attacks in computer networks,” IEEE Trans. Netw. Serv. Manag., 2025. [19] H. Kasyap and S. Tripathy, “Beyond data poisoning in federated learning,” Expert Syst. Appl., vol. 235, p. 121192, 2024. [20] X. Zhang, J. Zhang, K.-H. Chow, J. Chen, Y. Mao, M. Rahouti, X. Li, Y. Liu, and W. Wei, “Visualizing the shadows: Unveiling data poisoning behaviors in federated learning,” arXiv preprint arXiv:2405.16707, 2024. [21] J. Wu, J. Jin, and C. Wu, “Challenges and countermeasures of federated learning data poisoning attack situation prediction,” Mathematics, vol. 12, no. 6, p. 901, 2024. [22] H. Kasyap and S. Tripathy, “Privacy-preserving and byzantine-robust federated learning framework using permissioned blockchain,” Expert Syst. Appl., vol. 238, p. 122210, 2024. [23] J. Zhang, B. Chen, X. Cheng, H. T. T. Binh, and S. Yu, “Poisongan: Generative poisoning attacks against federated learning in edge computing systems,” IEEE Internet Things J., vol. 8, no. 5, pp. 3310–3322, 2020. [24] A. Borji, “Pros and cons of gan evaluation measures: New developments,” Comput. Vis. Image Underst., vol. 215, p. 103329, 2022. [25] X. Wang, H. Guo, S. Hu, M.-C. Chang, and S. Lyu, “Gan-generated faces detection: A survey and new perspectives,” ECAI 2023, pp. 2533– 2542, 2023. [26] X. Zhang, Q. Liu, Z. Ba, Y. Hong, T. Zheng, F. Lin, L. Lu, and K. Ren, “Fltracer: Accurate poisoning attack provenance in federated learning,” IEEE Trans. Inf. Forensics Secur., 2024. [27] S. Awan, B. Luo, and F. Li, “Contra: Defending against poisoning attacks in federated learning,” in Proc. 26th Eur. Symp. Res. Comput. Secur. (ESORICS), 2021, pp. 455–475. [28] V. Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021. [29] J. Li, X. Zhang, and L. Zhao, “Robust federated learning based on metrics learning and unsupervised clustering for malicious data detection,” in Proc. 2022 ACM Southeast Conf., 2022, pp. 238–242. [30] M. A. Onsu, B. Kantarci, and A. Boukerche, “How to cope with malicious federated learning clients: an unsupervised learning-based approach,” Comput. Netw., vol. 234, p. 109938, 2023. [31] X. Mu, K. Cheng, Y. Shen, X. Li, Z. Chang, T. Zhang, and X. Ma, “Feddmc: Efficient and robust federated learning via detecting malicious clients,” IEEE Trans. Dependable Secure Comput., 2024. [32] X. Li, Z. Qu, S. Zhao, B. Tang, Z. Lu, and Y. Liu, “Lomar: A local defense against poisoning attack on federated learning,” IEEE Trans. Dependable Secure Comput., 2021. [33] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 30, 2017.

[34] J. Xu, S.-L. Huang, L. Song, and T. Lan, “Byzantine-robust federated learning through collaborative malicious gradient filtering,” in IEEE Int. Conf. Distrib. Comput. Syst. (ICDCS), 2022, pp. 1223–1235. [35] J. Xu, Z. Zhang, and R. Hu, “Achieving byzantine-resilient federated learning via layer-adaptive sparsified model aggregation,” in IEEE Winter Conf. Appl. Comput. Vis. (WACV), 2025, pp. 1508–1517. [36] A. Yazdinejad, A. Dehghantanha, and G. Srivastava, “Ap2fl: Auditable privacy-preserving federated learning framework for electronics in healthcare,” IEEE Transactions on Consumer Electronics, vol. 70, no. 1, pp. 2527–2535, 2023. [37] A. Yazdinejad and J. D. Kong, “Breaking interprovincial data silos: How federated learning can unlock canada’s public health potential,” Available at SSRN 5247328, 2025. [38] A. Yazdinejad, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi, “A robust privacy-preserving federated learning model against model poisoning attacks,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 6693–6708, 2024. [39] A. Yazdinejad, H. Wang, and J. Kong, “Advanced ai-driven methane emission detection, quantification, and localization in canada: A hybrid multi-source fusion framework,” Science of The Total Environment, vol. 998, p. 180142, 2025. [40] A. Yazdinejad, Z. D. Mohammadabadi, A. Dehghantanha, and G. Srivastava, “An explainable and privacy-preserving federated learning model for threat detection in cyber-physical-social systems,” IEEE Transactions on Computational Social Systems, 2025. [41] A. Yazdinejad, A. Dehghantanha, G. Srivastava, H. Karimipour, and R. M. Parizi, “Hybrid privacy preserving federated learning against irregular users in next-generation internet of things,” Journal of Systems Architecture, vol. 148, p. 103088, 2024. [42] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics (AISTATS), 2017, pp. 1273– 1282. [43] L. Regenwetter, A. H. Nobari, and F. Ahmed, “Deep generative models in engineering design: A review,” J. Mech. Des., vol. 144, no. 7, p. 071704, 2022. [44] S. Bengesi, H. El-Sayed, M. K. Sarker, Y. Houkpati, J. Irungu, and T. Oladunni, “Advancements in generative ai: A comprehensive review of gans, gpt, autoencoders, diffusion model, and transformers,” IEEE Access, 2024. [45] J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Adv. Neural Inf. Process. Syst., vol. 33, pp. 6840–6851, 2020. [46] F.-A. Croitoru, V. Hondru, R. T. Ionescu, and M. Shah, “Diffusion models in vision: A survey,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 9, pp. 10 850–10 869, 2023. [47] L. Yang, Z. Zhang, Y. Song, S. Hong, R. Xu, Y. Zhao, W. Zhang, B. Cui, and M.-H. Yang, “Diffusion models: A comprehensive survey of methods and applications,” ACM Comput. Surv., vol. 56, no. 4, pp. 1–39, 2023. [48] L. Deng, “The mnist database of handwritten digit images for machine learning research [best of the web],” IEEE Signal Process. Mag., vol. 29, no. 6, pp. 141–142, 2012. [49] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017. [50] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009. [51] O. Marfoq, G. Neglia, A. Bellet, L. Kameni, and R. Vidal, “Federated multi-task learning under a mixture of distributions,” Adv. Neural Inf. Process. Syst., vol. 34, pp. 15 434–15 447, 2021. [52] D. Gragnaniello, F. Marra, G. Poggi, and L. Verdoliva, “Analysis of adversarial attacks against cnn-based image forgery detectors,” in 2018 26th Eur. Signal Process. Conf. (EUSIPCO). IEEE, 2018, pp. 967–971. [53] J. Yang, J. Zheng, T. Baker, S. Tang, Y.-a. Tan, and Q. Zhang, “Cleanlabel poisoning attacks on federated learning for iot,” Expert Syst., vol. 40, no. 5, p. e13161, 2023. [54] H. Thanh-Tung and T. Tran, “Catastrophic forgetting and mode collapse in gans,” in 2020 international joint conference on neural networks (ijcnn). IEEE, 2020, pp. 1–10. [55] W. Peng, J. Bingliang, Y. Lu, Z. Shizhou, W. Wei, and Z. Yanning, “Vehicle re-identification in aerial imagery : Dataset and approach,” in Proc. IEEE Int. Conf. Comp. Vis., 2019.

Record · ID 194283 · SHA-256 8356cf91fd18726d
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.