On the Fragility of Data Attribution When Learning Is Distributed
Xian Gao 1 Bo Hui 2 Min-Te Sun 3 Wei-Shinn Ku 1
arXiv:2605.15520v1 [cs.LG] 15 May 2026
Abstract
applications such as data pricing (Zhang et al., 2025a), governance of collaborative training systems (Murhekar et al., 2024), and auditing of modern vision and language models (Wang et al., 2024a). In practice, a hospital consortium may allocate reimbursement based on each site’s contribution to rare-condition sensitivity; a platform may reward data cooperatives whose logs improve long-tail categories; and a model marketplace may admit or remove suppliers using attribution thresholds (Kandpal & Raffel, 2025; Murhekar et al., 2023; Hesse et al., 2024). As attribution becomes more tightly integrated into trustworthy AI pipelines (Deng et al., 2024; Covert et al., 2024b), maintaining the integrity of attribution scores becomes increasingly important for system reliability.
Data attribution has become an important component of pricing, auditing, and governance in machine learning pipelines, yet most attribution methods implicitly assume that attribution values faithfully reflect participants’ contributions. We show that this assumption can fail: a single participant in a standard distributed training workflow can substantially inflate its measured attribution value while preserving global utility. Our attribution-first attack uses latent optimization to inject small synthetic batches that preserve utility while exploiting non-IID label coverage and evaluator sensitivities. Across datasets, models, and multiple marginal-utility evaluators, the attack consistently increases the adversary’s attribution value and reshapes the relative attribution structure among benign clients without degrading accuracy or triggering geometry-based defenses. These results show that attribution itself forms a new attack surface and motivate the development of attribution-robust and incentivecompatible scoring mechanisms.
Collaborative training frameworks such as federated learning (FL) raise important challenges for data attribution. While raw data remains local to each client, attribution metrics are increasingly used to assign credit, compensation, and accountability across participating institutions (Song et al., 2019; Fan et al., 2024). This intersection between attribution and FL is particularly relevant in cross-silo settings, such as multi-institution healthcare collaborations, where data sharing is restricted but joint training is necessary. Recent federated systems and incentive frameworks have therefore explored contribution-aware mechanisms for participant valuation, fairness, and reward allocation (Murhekar et al., 2023; Chen et al., 2023; Tastan et al., 2024). At the same time, FL deployments often involve heterogeneous, naturally fragmented, and highly non-IID data (Yang et al., 2023; Wang et al., 2024c), creating structural imbalances that attribution rules attempt to correct. Recent work on data valuation shows that even small changes in local coverage can disproportionately affect marginal-utility estimates (Xu et al., 2024; Covert et al., 2024a; Sun et al., 2024b). These observations raise a natural but underexplored question: can a participant strategically shape its updates to appear unusually beneficial without actually harming global utility?
1. Introduction Modern machine learning increasingly depends on data attribution, which aims to quantify how individual samples or data owners influence model behavior and utility. Recent work has advanced data valuation from multiple perspectives, including Shapley-style marginal-utility estimation (Chen et al., 2023; Jiang et al., 2023; Liu et al., 2023; Li & Yu, 2023) and influence-function or optimizationbased approximations (Nguyen et al., 2023; Bae et al., 2024; Covert et al., 2024a). These methods support emerging 1 Department of Computer Science and Software Engineering, Auburn University, Auburn, Alabama, USA 2 Department of Computer Science, University of Tulsa, Tulsa, Oklahoma, USA 3 Department of Computer Science and Information Engineering, National Central University, Taoyuan, Taiwan. Correspondence to: Bo Hui <[email protected]>.
Existing threat models and defenses in FL are largely modelcentric, focusing on poisoning attacks (Bal et al., 2025; Pawelczyk et al., 2024) or anomalous updates (Jia et al., 2024), rather than attribution manipulation. Recent adversarial work on data attribution (Wang et al., 2024e) studies inflation of per-sample data value in centralized settings, but does not address client-level contribution manipulation
Proceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s).
1
On the Fragility of Data Attribution When Learning Is Distributed
C8 9.3%
C9 7.6%
C0 7.5%
C7 6.2%
C2 5.0% C3 11.3%
C6 17.5% C5 5.8%
C4 17.1%
C0 14.1%
C9 16.3%
C1 12.8%
et al., 2023; Wang et al., 2024d; 2025b), attribution metrics increasingly shape economic incentives, participation rights, and provenance guarantees. If attribution can be manipulated without harming global performance, systems may reward the wrong contributors, misidentify harmful actors, and draw misleading conclusions about data quality (Murhekar et al., 2023; Jiang et al., 2023; Li & Yu, 2023). Maintaining model accuracy alone is therefore insufficient; attribution integrity is also necessary for trustworthy collaborative learning. To study this issue, we design an attribution-aware attack that operates entirely within the standard FL workflow. Rather than degrading model accuracy or injecting anomalous updates, the attacker introduces only mild, utility-preserving modifications to its local training process. By exploiting non-IID label coverage and the sensitivity of attribution evaluators to marginal utility, a single client can systematically amplify its measured contribution while remaining statistically plausible under common sanity checks. This attack exposes a fundamental vulnerability in attribution pipelines: even when global performance remains stable, attribution signals can still be strategically manipulated.
C8 8.5%
C1 19.1%
C7 4.9% C6 6.4% C5 6.1%
C3 6.0%
C2 16.8%
C4 1.8%
(a) Attack-Free
(b) Latent Optimization Attack
Figure 1. Client-level attribution can shift under utility-preserving local changes. Attribution shares for an attack-free (left) versus a latent optimization attack (right).
in FL. At the same time, recent studies on data valuation have documented instability, hyperparameter sensitivity, and evaluator variance (Wang et al., 2025c; Wei et al., 2024; Wang et al., 2024b; Rubinstein & Hopkins, 2025), suggesting that attribution signals can be surprisingly malleable in practice (Wang et al., 2025a). Together, these observations point to a critical gap: although FL increasingly depends on attribution for incentives and governance, the attribution pipeline itself remains largely unprotected.
We summarize the contributions as follows: • Attribution-first threat model. We formalize a new attack objective in FL that inflates a client’s dataattribution score under explicit utility and plausibility constraints.
In this paper, we take an attribution-first security perspective and investigate whether a single participant in a standard multi-party training workflow can inflate its measured contribution by exploiting non-IID label distributions, evaluator sensitivities, and benign-looking local updates without affecting model utility. Our perspective is motivated by recent work showing that marginal-utility estimators depend strongly on coverage, curvature, and model dynamics (Wang et al., 2023; Lin et al., 2024c; Sun et al., 2024a; Mlodozeniec et al., 2026). Our preliminary study shows that mild and plausibly benign adjustments to a client’s synthetic training batch, optimized only through the broadcast global model, can produce persistent and disproportionately large attribution gains. For example, Figure 1 shows that a single client can induce large attribution shifts through mild local modifications while keeping test accuracy within a small tolerance. In particular, when Client 2 (C2) behaves adversarially, its attribution value increases substantially, while the attribution shares of most benign clients decrease. At the same time, a small subset of benign clients shows unchanged or slightly increased attribution, indicating that the attack perturbs the relative attribution structure rather than uniformly shifting all attribution values. Crucially, these attribution distortions arise without harming model utility, as standard performance metrics such as test accuracy remain stable within normal variance.
• Practical latent-optimization attack. We propose a practical attack that injects a small amount of decodergenerated synthetic data to construct attribution-aware local updates that remain utility-preserving and statistically plausible. • Theory and empirical validation. We provide theoretical insight into why such updates increase marginal attribution without degrading accuracy, and empirically validate the attack across datasets, models, and attribution evaluators.
2. Problem Formulation 2.1. Threat Model Attacker’s Capabilities. Beyond standard FL assumptions, we consider a single malicious client that can (i) construct and inject a small amount of on-device synthetic data into local training to shape the reported update, and (ii) infer the attribution protocol class used by the server, since such information is often publicly documented or can be inferred from repeated observations. The attacker observes the broadcast global model wt at each round and may cache limited history for stability. In particular, the attacker constructs a benign reference direction from observable global model differences gt† ≈ wt − wt−1 without access to other clients’
The implications extend beyond the specific attack studied here. As large-scale collaborative training expands across modalities and architectures (Kwon et al., 2023; Zheng 2
On the Fragility of Data Attribution When Learning Is Distributed (i⋆ )
updates. The attacker only uses its own local dataset Dr and does not access other clients’ private data, consistent with the standard cross-silo FL setting. We assume the attacker has access to a fixed pre-trained decoder Dec(·). Such decoders can be obtained from public models or lightweight on-device distillation and are used only for inference, introducing negligible overhead compared with standard local training.
This formulation isolates what is optimized—attribution gain under utility and plausibility budgets—from how updates are produced, which is realized through the latent optimization attack in Section 3.2.1. Although the formal objective is expressed as maximizing the server-side evaluator E(g), this quantity is not directly optimizable by a client. Instead, the attacker optimizes a latent surrogate objective that captures the structural preferences of E(·) while preserving global utility. This surrogate is implemented via a joint loss function in the latent space, enabling attribution-aware update construction without direct access to the evaluator.
Attacker’s Limitations. The attacker cannot modify serverside aggregation or evaluation, nor interfere with other clients. Crucially, the attack must preserve global utility U (·) (e.g., test accuracy). Let U (0) and U (1) denote the final utilities of the clean (no-attack) run and the attacked run, respectively. Then U (1) − U (0) ≤ δ,
3. Latent Optimization Attack 3.1. Overview
(1)
We study an attribution-manipulation attack where a single malicious client i⋆ increases its attribution value without visibly harming global utility. The key idea is to augment benign local training with a small set of decoder-generated samples whose latent vectors are optimized each round to steer the client’s update toward directions favored by the server.
for a small tolerance δ, and all synthetic samples must lie within the valid task domain X × Y (where X represents inputs and Y represents labels). 2.2. Formal Attack Objective Let wt be the global model broadcast at round t, and let E(·) be the server-side attribution evaluator. We focus on a ⋆ single malicious client i⋆ . Denote by gti the benign local (i⋆ ) update induced by the attacker’s own real dataset Dr , and ⋆ by ĝti the reported update under attack. Let C(·) be the communication cost, Γ a reference set of benign updates, and Cmax , ϵ, κ > 0 the system budgets.
In each round t, the server broadcasts wt , and client i⋆ trains on its real shard together with a compact synthetic batch decoded from a latent vector z. The synthetic batch is lightweight and co-evolves with the global model across rounds. Rather than degrading accuracy, the attacker seeks to appear beneficial: synthetic samples fill label-coverage gaps and steer the update toward directions rewarded by attribution evaluators while remaining consistent with benign update norms and shapes. The latent vector is refined each round so decoded samples generate gradients aligned with global progress and plausible under server-side checks. After refinement, the attacker mixes the synthetic and real data, performs a standard local update, and reports it for aggregation. Notably, the synthetic samples need not be photorealistic or distribution-matching in pixel space; alignment is enforced at the gradient level through the supervised loss, ensuring compatibility with the attribution evaluator without requiring domain-level visual realism.
The attacker aims to increase its attribution score while preserving global utility. Each round it selects ⋆
ĝti ∈ arg max E(g) g
s.t.
Eq. (1) holds.
(2)
Equivalently, the goal is to maximize the marginal gain ⋆ ⋆ E(ĝti ) − E(gti ) while keeping utility within tolerance δ. To avoid trivial detection, the reported update must satisfy: ⋆
(budget)
C(ĝti ) ≤ Cmax ,
(plausibility)
d(ĝti , Γ) ≤ ϵ, ∥ĝti ∥ ≤ κ,
(domain)
Ds ⊆ X × Y,
⋆
⋆
(3)
3.2. Detailed Latent Optimization Attack
where Ds is the synthetic dataset used by the attacker, d(·, Γ) measures deviation from the benign-update reference set Γ, and Cmax , ϵ, κ bound the communication cost, deviation, and update norm, respectively.
3.2.1. P IPELINE D ETAILS We describe the end-to-end procedure executed by the malicious client i⋆ in each communication round t. Let wt denote the broadcast global model and z a latent vector decoded by a fixed generator Dec(·) into synthetic samples (x̃, ỹ) ∈ X × Y. The attack consists of five stages.
Across T rounds, the attacker maximizes its cumulative attribution gain: max ⋆
{ĝti }T t=1
s.t.
T X
⋆ ⋆ E(ĝti ) − E(gti )
t=1
(i⋆ )
(1) Client i⋆ receives a standard shard of real data Dr , identical to benign clients. To bootstrap synthetic generation, the client samples an initial latent vector z ∼ N (0, Id ),
(4)
constraints in Eq. (3) and Eq. (1). 3
On the Fragility of Data Attribution When Learning Is Distributed
the d-dimensional isotropic Gaussian prior used by the decoder (or warm-starts from round t−1).
direction via cosine similarity: L1 (z) = 1 − cos θ(z)
(2) At the beginning of round t, the client refines z:
=1−
• Generate a mini-batch (x̃, ỹ) = Dec(z). • Choose ỹ from classes underrepresented or absent in (i⋆ ) Dr to produce “exclusive” coverage. • Update z using ∇z L(z), where L is the joint loss (Sec. 3.2.2). A few gradient descent steps suffice to steer z toward gradients that appear valuable and benign.
∇w ℓ fwt , Dec(z) , gt† . gt† ∇w ℓ fwt , Dec(z)
(5)
Symbols used for this term: • Dec(z): decoder that generates a synthetic training batch from latent vector z. • fwt : global model at FL round t. • ∇w ℓ: gradient of the supervised task loss with respect to the model weights. • gt† : reference benign gradient (e.g., approximated via wt − wt−1 ). • ⟨·, ·⟩: inner product; ∥ · ∥: ℓ2 norm.
(3) After refinement, the client decodes a new synthetic batch and performs local training using both its real samples and the generated synthetic ones. The real portion keeps the update looking benign, whereas the synthetic portion fills in missing labels and steers the update toward directions that yield higher attribution scores.
Norm consistency. We minimize the gap in gradient norm between the synthetic batch and a benign reference gt† (e.g., instantiated via the observable global difference wt − wt−1 ), which reduces detectability by norm-based defenses:
⋆ (4) The client forms the post-training update ĝti and veri-
fies that its direction and norm satisfy protocol constraints. Once validated, the update is uploaded to the server for aggregation.
L2 (z) =
(5) The attacker caches (z, wt ) and uses the refined z as the warm start for round t+1. This enables the synthetic data to co-evolve with the global model, allowing attribution gains to accumulate across rounds.
∇w ℓ(fwt , Dec(z)) − gt† .
(6)
Task fidelity. To keep decoded samples class-discriminative, we include the standard supervised cross-entropy on the synthetic batch: L3 (z) = CE fwt (x̃), ỹ . (7)
3.2.2. J OINT L OSS F UNCTION D ETAILS
Here (x̃, ỹ) = Dec(z), and labels ỹ are chosen from classes (i⋆ ) underrepresented or missing in Dr .
We optimize a single latent vector z that parameterizes the synthetic batch via the fixed decoder Dec(·). The objective combines three terms without explicit coefficients:
Symbols used for this term:
L(z) = L1 (z) + L2 (z) + L3 (z).
• ỹ: ground-truth labels for the synthetic batch.
The joint loss contains three parts; z is the variable to be optimized.
Weighting strategy. All three terms are used with equal weights, reflecting the three structural conditions required to jointly preserve utility while increasing attribution. Using equal weights avoids introducing additional hyperparameters that are not central to the scientific contribution of this work, and we observe stable behavior across datasets, models, and attribution evaluators without tuning. Since our focus is on demonstrating the manipulability of attribution mechanisms rather than optimizing surrogate objectives, a systematic sensitivity study of the weighting scheme is left to future work oriented toward system and optimization design.
• z: latent vector representing the synthetic dataset ⇒ optimization variable. • L1 (z): gradient direction alignment ⇒ ensures synthetic gradients align with a benign reference direction. • L2 (z): gradient magnitude alignment ⇒ matches gradient norms to benign clients for stealth. • L3 (z): standard task loss ⇒ keeps generated data effective for training. Direction alignment. Let wt be the broadcast global weights at round t, fwt the corresponding model, and let gt† be a reference benign gradient in round t, e.g., a global descent direction such as the difference between two con secutive global models wt − wt−1 . Let ∇w ℓ fwt , Dec(z) denote the gradient of the task loss on the decoded batch. We align the synthetic-gradient direction with this reference
3.3. Full Algorithm The complete pseudocode is shown in Algorithm 1. We present only the high-level procedure here. We instantiate gt† as the median element of the benign update set Γ for round t, and use d(·, Γ) as a simple shape/direction deviation metric for detecting anomalous update geometry. In each round t,
4
On the Fragility of Data Attribution When Learning Is Distributed
Algorithm 1 Latent Optimization Attack (client i⋆ in round t)
attribution scores. For Shapley-style evaluators such as FedSV, the per-round marginal utility is defined as ∆t (g) = U (wt +g)−U (wt ), and the final attribution aggregates these gains across rounds and permutations. Consequently, even small but persistent utility improvements can accumulate and substantially influence the final attribution score.
(i⋆ )
Require: Global model wt , real shard Dr , decoder Dec(·), latent steps Bz , synthetic batch size Bs , stepsizes (ηz , ηw ), reference gradient gt† , budgets (Cmax , ϵ, κ) 1: Warm start: 2: if t = 1 then 3: Sample z ∼ N (0, Id ) 4: else 5: Load cached z from round t − 1 6: end if 7: Latent refinement: 8: for s = 1 to Bz do 9: (x̃, ỹ) ← Dec(z) (i⋆ ) 10: ỹ ← S ELECT TARGETS(Dr ) 11: g ← ∇w ℓ(fwt , x̃, ỹ) 12:
Let wt denote the global model at round t. If client i⋆ (i⋆ ) behaves benignly, local training on its real dataset Dr (r) produces a standard update gt . Under latent optimization, the client uploads the following hybrid update: ⋆
(8)
and 0 < α ≪ 1 controls the synthetic contribution. The latent optimization objective constrains the synthetic component to align with the global descent direction while maintaining a magnitude comparable to benign updates. Under standard smoothness assumptions, this alignment yields a non-negative marginal utility rewarded by FedSV, while the small coefficient α keeps the hybrid update dominated by the benign training signal and avoids large deviations from benign optimization behavior. Consequently, the synthetic component influences attribution evaluation without substantially perturbing the optimization trajectory. As a result, the attack preserves standard training dynamics and causes negligible degradation in global utility across rounds.
⟨g, g † ⟩ t
†
13: L2 (z) ← ∥g∥ − ∥gt ∥ 14: L3 (z) ← CE(fwt (x̃), ỹ) 15: L(z) ← L1 (z) + L2 (z) + L3 (z) 16: z ← z − ηz ∇z L(z) 17: end for 18: Hybrid local training: s 19: D̃ ← {(x̃j , ỹj )}B j=1 (i⋆ )
(s)
+ α gt
(s) where gt is induced by latent-optimized synthetic samples
L1 (z) ← 1 − ∥g∥ ∥gt † ∥
20: Train on Dr ∪ D̃ with stepsize ηw to obtain ĝti 21: Feasibility checks: ⋆ 22: if ∥ĝti ∥ > κ then ⋆ ⋆ ⋆ 23: ĝti ← κ ĝti /∥ĝti ∥ 24: end if ⋆ 25: if d(ĝti , Γ) > ϵ then ⋆ ⋆ 26: ĝti ← P ROJECT T O B ENIGN(ĝti ) 27: end if ⋆ 28: Ensure C(ĝti ) ≤ Cmax 29: Report & cache: ⋆ 30: Upload ĝti and cache (z, wt ) for round t + 1
(r)
ĝti = (1 − α) gt
⋆
Under non-IID partitioning, latent optimization targets missing or under-represented labels when generating synthetic samples. Although the synthetic component is small, the resulting coverage-driven utility gains accumulate across rounds and client subsets in marginal-utility evaluators such as FedSV (Wang et al., 2020), leading to inflated attribution scores for client i⋆ . Furthermore, the hybrid structure keeps ⋆ ĝti statistically close to benign updates, allowing the attack to evade utility-centric and geometry-based defenses while remaining consistent with standard aggregation dynamics.
4. Experimental Evaluation the attacker warm-starts z, performs up to Bz latent steps on the joint objective L(z) (see Section 3.2.2), decodes a compact batch, mixes it with real data for local training, ⋆ and reports ĝti . Before reporting, we enforce norm and deviation constraints (ϵ, κ) and a communication budget ⋆ Cmax ; if any constraint is violated, we project ĝti to a benign subspace or revert to a benign update. This feasibility check keeps runtime and communication comparable to standard FL while ensuring that attribution gains persist without producing visibly anomalous updates.
4.1. Experimental Setup Datasets and models. We evaluate on three image benchmarks—CIFAR-10 (Krizhevsky et al., 2009), SVHN (Netzer et al., 2011), and FashionMNIST (Xiao et al., 2017) —using standard train/test splits. We report results across three backbones: ResNet-18 (He et al., 2016), WRN-28-10 (Zagoruyko & Komodakis, 2016), and VGG16 BN (Simonyan & Zisserman, 2014). Partitioning and FL protocol. Unless otherwise stated, we use a standard FedAvg setup with N =10 clients. Training data are partitioned in a non-IID class-imbalanced manner so that each client observes a subset of classes with roughly 3,000 samples (Zhao et al., 2018); an IID split is used only
3.4. Theoretical Analysis We briefly explain why the proposed latent optimization attack preserves global utility while inflating client-level 5
On the Fragility of Data Attribution When Learning Is Distributed Table 1. Comparison of the Malicious Client’s Normalized Data Attribution Value and Rank Before and After the Attack Under FedSV.
for sanity checks. In each communication round t, the server broadcasts wt , clients train locally, return their updates, and the server aggregates a data-size–weighted average to obtain wt+1 (McMahan et al., 2017).
(a) CIFAR-10 Attack Method
Evaluators and metrics. Our primary evaluator is Federated Shapley Value (Wang et al., 2020); we also report Leave-One-Out (LOO) (Vehtari et al., 2017) for robustness. We track each client’s data attribution value and its rank among peers (before/after attack), and we report test accuracy to verify utility preservation.
Data Attribution Value
Data Attribution Rank
ResNet-18 WRN-28-10 VGG16 BN ResNet-18 WRN-28-10 VGG16 BN Attack Free Label Flipping Random Noise Free Rider Latent Optimization
0.0547 0.0591 0.0074 0.0802 0.1682
0.0001 0.0001 0.0001 0.0001 0.0761
0.0000 0.0454 0.0496 0.0468 0.1160
10 8 10 8 2
10 10 10 10 6
10 8 8 9 4
(b) FashionMNIST Attack Method
Normalization of attribution values. Raw attribution values produced by FedSV and LOO can be positive or negative. For cross-client comparison and rank-based analysis, we therefore report a normalized attribution share obtained via a shift-based linear normalization that subtracts the minimum attribution value and rescales all client contributions to sum to one. Unless otherwise stated, figures and rankings are based on these normalized shares.
Data Attribution Value
Data Attribution Rank
ResNet-18 WRN-28-10 VGG16 BN ResNet-18 WRN-28-10 VGG16 BN Attack Free Label Flipping Random Noise Free Rider Latent Optimization
0.0000 0.0338 0.0269 0.0198 0.0741
0.0000 0.0143 0.0286 0.0264 0.0891
0.0000 0.0382 0.0368 0.0398 0.1072
10 7 8 8 6
10 9 9 9 7
10 9 9 9 5
(c) SVHN Attack Method
Data Attribution Value
Data Attribution Rank
ResNet-18 WRN-28-10 VGG16 BN ResNet-18 WRN-28-10 VGG16 BN Attack Free Label Flipping Random Noise Free Rider Latent Optimization
Attacks compared. We compare five settings: Attack-Free (no manipulation), Label-Flip (Xiao et al., 2012), RandomNoise (Shahani & Scheutz, 2025), Free-Rider (Fraboni et al., 2021), and our Latent Optimization attack. Unless noted, one malicious client is used (the lowest-attribution client in the attack-free run).
0.0000 0.0000 0.0096 0.0000 0.0933
0.0000 0.0232 0.0337 0.0000 0.0947
0.0000 0.0257 0.0300 0.0023 0.1256
10 10 9 10 6
10 8 7 10 7
10 9 9 9 6
Beyond absolute gains, Latent Optimization perturbs the attribution structure among benign clients. As shown in Appendix Figures 5–13, attribution mass is redistributed across benign participants, altering rankings and share proportions. Because FedSV aggregates marginal utilities over permutations, even small coverage and alignment advantages accumulate across rounds and are amplified by the evaluator. Consequently, the attack not only inflates the malicious client’s attribution, but also reshapes relative credit assignment among benign participants. These results show that attribution can be manipulated without degrading global utility and that FedSV is not robust to incentive-aligned attacks targeting the evaluator rather than model accuracy.
Latent Optimization details. The attacker holds a fixed pre-trained decoder trained on the same image domain as the downstream task, and in each round, optimizes a lowdimensional latent vector against the broadcast global model to generate a compact synthetic batch. Synthetic samples are mixed with real data during local training, with labels biased toward underrepresented classes to exploit evaluator sensitivity to coverage. 4.2. Experiment Results Main Attribution Gains under FedSV.
Utility Preservation under FedSV. Table 2 summarizes global model accuracy under different attacks. Label Flipping and Random Noise consistently degrade test performance, reflecting perturbations to the decision boundary or optimization dynamics during collaborative training. Free Rider largely preserves utility but does not improve attribution, indicating that avoiding harmful updates alone is insufficient for attribution inflation. In contrast, Latent Optimization maintains accuracy within a narrow margin of the attack-free baseline across datasets and architectures while consistently increasing the attacker’s measured contribution.
Table 1 reports the malicious client’s attribution value and rank across datasets and architectures. In the attack-free setting, the malicious client consistently receives the lowest attribution and ranks last, indicating that FedSV identifies it as a negligible contributor with low marginal utility. Under Latent Optimization, attribution scores increase substantially across settings, moving the malicious client into the upper half of the ranking and, in several cases, close to highly contributing benign participants. In contrast, baseline attacks such as Label Flipping, Random Noise, and Free Rider produce negligible or inconsistent shifts and never achieve high attribution. Thus, Latent Optimization uniquely reshapes attribution outcomes under identical training protocols, outperforming conventional adversarial attacks in attribution manipulation.
These results show that attribution manipulation does not require harming model utility. By aligning with global descent directions and preserving task fidelity, the attacker can systematically boost its measured contribution while remaining compatible with standard training dynamics and aggregation. This contrasts with traditional poisoning attacks, which of6
On the Fragility of Data Attribution When Learning Is Distributed Table 2. Comparison of Global Model Accuracy Before and After Malicious Client Attacks Under FedSV.
Table 3. Comparison of the direct reference-direction baseline and the full method.
(a) CIFAR-10 Attack Method
Target Rank Method Direct Ref Full Method
0.1243 0.1632
2 1
72.21 73.59
Rank 6
Direct Ref Full Method
0.0871 0.1011
5 4
73.88 73.94
Rank 10
Direct Ref Full Method
0.1053 0.1627
7 4
72.63 75.39
Models ResNet-18 WRN-28-10 VGG16 BN
Attack Free Label Flipping Random Noise Free Rider Latent Optimization
76.75% 64.68% 66.28% 70.63% 77.59%
70.12% 61.21% 63.58% 61.98% 77.23%
71.57% 62.47% 64.96% 67.54% 69.66%
generated updates receive substantially higher attribution under FedSV than updates produced through direction alignment, demonstrating that attribution inflation depends not only on alignment direction but also on utility-compatible optimization structure and training-induced gradient consistency.
(b) FashionMNIST Attack Method
Models ResNet-18 WRN-28-10 VGG16 BN
Attack Free Label Flipping Random Noise Free Rider Latent Optimization
73.11% 60.36% 61.23% 71.38% 72.23%
64.45% 56.62% 56.34% 65.53% 60.07%
73.19% 66.32% 68.33% 71.41% 69.62%
Comparison with Centralized Attribution Attacks. We compare the proposed method with two representative attribution manipulation attacks adapted from centralized learning: Shadow Attack and Outlier Attack. Although both methods effectively inflate data attribution in centralized settings, their effectiveness does not directly transfer to federated learning, where attribution depends on aggregated client updates rather than individual data points and therefore reflects collaborative optimization behavior. As shown in Table 4, both baselines achieve limited or inconsistent attribution gains across evaluated targets. In contrast, Latent Optimization consistently achieves higher attribution values and stronger attribution ranks while maintaining higher global accuracy and stable optimization behavior.
(c) SVHN Attack Method
Models ResNet-18 WRN-28-10 VGG16 BN
Attack Free Label Flipping Random Noise Free Rider Latent Optimization
84.11% 70.83% 67.97% 82.14% 81.20%
75.67% 64.10% 67.70% 76.13% 77.74%
Data Attribution Value Data Attribution Rank Global Model Accuracy (%)
Rank 2
83.52% 72.37% 76.39% 83.29% 81.13%
ten trade utility for adversarial influence, and further shows that performance-based defenses are inadequate for protecting attribution integrity under marginal-utility evaluators. Comparison with Direct Reference Alignment. To isolate the role of latent optimization beyond gradient alignment, we compare our method with a direct reference-direction baseline. In this baseline, the malicious client aligns its update with a benign reference gradient and rescales it to match the norm of a benign update, preserving approximate optimization magnitude and overall update scale. In contrast, our method generates synthetic samples through latent optimization and performs local training on mixed real and synthetic batches, allowing the attacker to optimize both gradient direction and task utility simultaneously.
These results suggest that attribution manipulation in federated learning fundamentally differs from centralized datalevel attribution attacks. Federated attribution methods evaluate client updates through marginal contribution to global utility rather than individual data attribution. Consequently, attacks based on high-attribution samples or adversarial outliers do not reliably translate into high-utility client updates after local training and aggregation, since their attribution signals can be diluted or misaligned during collaborative optimization. In contrast, Latent Optimization directly optimizes utility-aligned client updates through latent-generated synthetic batches, systematically inflating attribution while remaining compatible with standard training dynamics and federated aggregation across communication rounds.
Table 3 shows that direct reference alignment alone can partially increase attribution value and improve attribution rank, indicating that alignment with the global optimization trajectory already affects marginal-utility evaluators. However, our method consistently achieves larger attribution gains across evaluated targets while maintaining comparable utility and stable training behavior. These results suggest that directional alignment alone is insufficient to fully exploit the attribution mechanism underlying FedSV. Latent optimization additionally enforces task fidelity and magnitude consistency through supervised training on synthetic samples, producing updates that are both optimization-aligned and effective under the learning objective. As a result, the
Table 4. Comparison between Latent Optimization and existing attribution manipulation attacks adapted to federated learning.
7
Benign Target Rank
Method
Rank 2
Shadow Outlier Latent Optimization
Attribution Value Attribution Rank Accuracy (%) 0.1248 0.0916 0.1522
3 5 1
71.92 67.47 73.59
Rank 6
Shadow Outlier Latent Optimization
0.0817 0.0664 0.1063
5 7 4
73.88 69.12 76.94
Rank 10
Shadow Outlier Latent Optimization
0.1129 0.0798 0.1547
6 8 4
72.75 68.85 74.39
On the Fragility of Data Attribution When Learning Is Distributed
Data Attribution Value
Scaling with the Number of Clients. Figure 2 varies the total number of clients across {7, 10, 12, 15} and reports the malicious client’s attribution (ranked last in the attack-free baseline) under different attacks. Under the attack-free baseline, the malicious client consistently receives near-zero attribution across all scales, indicating that the evaluator identifies it as a negligible contributor with limited marginal utility under standard collaborative optimization. In contrast, Latent Optimization yields substantially higher attribution for all evaluated client counts, peaking at 10 clients and decreasing slightly at 12 and 15. Meanwhile, Label Flipping, Random Noise, and Free Rider remain near zero across settings, indicating that they do not benefit from larger client populations or complex aggregation structure under marginal-utility evaluation.
Data Attribution Value
Latent Optimization
Label Flip
Random Noise
Free Rider
0.05 10
12
Random Noise
Free Rider
0.15 0.10 0.05 0.00
Rank2
Rank4
Rank6
Rank8
Rank10
Robustness Across Evaluators. To assess whether attribution manipulation depends on a specific evaluator, we repeat the experiments using Leave-One-Out (LOO), which measures marginal utility by removing one client and quantifying its effect on global performance and aggregated model utility. Figure 15 shows a representative dataset-architecture pair. Under the attack-free baseline, the malicious client again occupies the lowest attribution region, indicating that LOO also identifies it as a negligible contributor under standard collaborative training. In contrast, under Latent Optimization, attribution mass shifts toward the malicious client and improves its rank among peers. Competing attacks produce only weak or inconsistent shifts. Meanwhile, global accuracy remains comparable across settings (Figure 16), indicating that the attribution changes do not rely on degrading utility or destabilizing optimization.
0.10
7
Label Flip
These results indicate that latent optimization benefits both strong and weak contributors, but with asymmetric gains. High-ranking clients are already near evaluator saturation and remain stable, whereas low-ranking clients retain substantial “headroom” to convert missing label coverage into marginal utility through optimization-aligned synthetic updates and coverage-aware utility gains. Notably, this uplift occurs without harming global performance, allowing FedSV to reassign credit toward these initially small contributors across communication rounds. This pattern is absent in baseline attacks and highlights that attribution manipulation is especially effective for clients initially appearing benign, weakly contributing, and statistically insignificant under standard attribution evaluation and utility-based ranking.
0.15
0.00
Latent Optimization
Figure 3. Effect of malicious-client selection. Grouped bar plot (with colored dots marking each value, including near-zero cases) of client-level data attribution values across different selection strategies.
These trends show that latent optimization scales to larger client cohorts and is not limited to small participation settings. The slight drop at higher client counts reflects attribution normalization across more participants rather than attack failure, since the malicious client still maintains a substantial relative attribution advantage throughout training and aggregation. Crucially, the attacker preserves this advantage by exploiting non-IID label coverage and evaluator structure, while competing attacks lack such alignment and utility compatibility. Overall, the results suggest that the vulnerability stems from the marginal-utility attribution mechanism and persists under realistic deployment scales and heterogeneous participation regimes with varying client populations. Attack Free
Attack Free
15
Figure 2. Grouped bar plot of data attribution values across attack methods under different client counts.
Effect of Malicious-Client Selection. Figure 3 varies the malicious participant by selecting the client with attack-free FedSV rank 2, 4, 6, 8, or 10. When the attacker starts from a high-rank position, Latent Optimization does not substantially increase attribution; scores remain near baseline or slightly decrease, yet still outperform competing attacks, which heavily penalize the attacker once training is perturbed and optimization alignment deteriorates. When the attacker starts from a low-rank position, Latent Optimization produces substantial attribution uplift, elevating previously under-valued clients into mid-to-high ranges, while competing attacks further suppress contribution and marginal utility under evaluator aggregation.
Taken together, the results show that attribution inflation from latent optimization generalizes beyond FedSV. Although LOO and FedSV differ in mechanism and estimator variance, both assign substantially higher attribution to the malicious client and perturb attribution structure among benign clients similarly and consistently across evaluation settings. This suggests that the vulnerability stems from the incentive properties of marginal-utility evaluation rather than any specific scoring rule or estimator. To avoid redundancy across evaluators and settings, we report only one appendix configuration, all exhibiting consistent trends and utility-preserving behavior throughout training. 8
On the Fragility of Data Attribution When Learning Is Distributed Table 5. Per-round detection performance against the Latent Optimization attack. Precision, Recall, and F1-score are averaged across communication rounds.
Effect of Attack Intensity. Figure 4 varies attack intensity from 0× to 4× and reports attribution values and test accuracy. Attribution increases monotonically with higher intensity: even low-intensity synthetic coverage (0.25× and 0.50×) raises the malicious client’s estimated contribution, while stronger intensities (2× and 4×) further amplify attribution gain. Notably, the increase remains smooth across intensity levels, indicating that attribution inflation scales predictably and consistently with synthetic coverage strength. In contrast, test accuracy remains within a narrow range and does not degrade with increasing intensity; stronger attacks do not induce utility drops and cause only minor fluctuations around baseline accuracy.
Method / Setting
0.25×
0.50×
1.00×
2.00×
80 60 40
0.05
20 0.00
0.00×
0.25×
0.50×
1.00×
2.00×
4.00×
Accuracy (%)
Attribution Value
100
0.10
Random Guess (1 of 10)
0.10
0.10
0.10
Geometry-based Trimming CIFAR-10 + ResNet-18 FashionMNIST + WRN-28-10 SVHN + VGG16 BN
0.00 0.02 0.01
0.00 0.01 0.02
0.00 0.01 0.01
Table 5 summarizes the detection performance across three dataset–model combinations. Across all settings, geometrybased trimming fails to reliably identify the latent optimization attacker: Precision and Recall remain at or near zero, and F1-scores are comparable to or worse than random guessing. This behavior is expected: as shown in Section 3.4, latent optimization produces hybrid updates that remain aligned with the global descent direction and statistically embedded within the benign update distribution, thereby evading geometry-based defenses and remaining difficult to distinguish from benign optimization behavior.
4.00×
0.15
Recall F1-Score
round and interpret the robust aggregation rule as an implicit detector: a client is regarded as detected in a round if its update is trimmed or excluded. We formulate defense effectiveness as a per-round malicious-client detection task and report Precision, Recall, and F1-score averaged across communication rounds. A random-guess baseline (selecting one of N =10 clients per round) is included for reference and to contextualize the detection difficulty.
These results show that latent optimization supports controllable scaling: increasing attack strength systematically boosts the attack objective, marginal contribution, without triggering utility deterioration that typically exposes poisoning behaviors. Furthermore, stable test accuracy suggests that the attack operates by enhancing the evaluator’s notion of beneficial coverage rather than harming global convergence or optimization dynamics during collaborative training. This decoupling between attribution inflation and utility preservation highlights a key vulnerability of marginal-utility attribution: an attacker can scale its influence without trade-offs seen in performance-driven attacks or being flagged by accuracy-based defenses. 0.00×
Precision
6. Conclusion We show that data attribution in distributed learning can be strategically manipulated without harming global utility. A single participant, through latent optimization on a latent vector, consistently inflates its attribution under data attribution evaluators. The attack redistributes attribution among benign clients, scales across datasets and models, and evades standard utility- and geometry-based defenses. These results reveal a new attack surface in data attribution mechanisms, motivating future work on attribution-robust evaluators and incentive designs. More broadly, our findings identify attribution integrity as an important security consideration in distributed learning systems.
0
Figure 4. Effect of attack intensity on data attribution. Normalized attribution share and test accuracy under increasing attack intensity.
5. Defenses There is currently no defense specifically designed to protect client-level data attribution in FL. To assess whether standard utility-centric defenses can incidentally mitigate attribution manipulation, we evaluate a widely used baseline: geometry-based trimming (Steinhardt et al., 2017), which filters out updates that deviate from the bulk of client updates and is commonly deployed to defend against data poisoning and anomalous optimization behavior.
Limitations and Outlook. Our analysis focuses on a single attacker and marginal-utility evaluators. Extending the study to broader settings, including dynamic participation, multiple adversaries, and more diverse incentive mechanisms, remains important future work. Investigating defenses specifically designed for attribution robustness is another promising direction.
We apply geometry-based trimming at the server in each 9
On the Fragility of Data Attribution When Learning Is Distributed
Acknowledgements
Deng, J., Hu, Y., Hu, P., Li, T.-W., Liu, S., Wang, J. T., Ley, D., Dai, Q., Huang, B., Huang, J., et al. A survey of data attribution: Methods, applications, and evaluation in the era of generative ai. arXiv preprint arXiv:2501.xxxxx, 2025.
We thank our collaborators and colleagues for helpful discussions and feedback throughout this work. We also thank the anonymous reviewers for their valuable feedback and constructive suggestions. This work used computational resources provided by Auburn University.
Fan, Z., Fang, H., Wang, X., Zhou, Z., Pei, J., Friedlander, M., and Zhang, Y. Fair and efficient contribution valuation for vertical federated learning. In International Conference on Learning Representations, volume 2024, pp. 14553–14572, 2024.
Impact Statement This work examines the integrity of data attribution mechanisms and shows that attribution can be manipulated without harming global utility. While such manipulation could be misused to unfairly obtain credit in distributed learning systems, our goal is to reveal this overlooked vulnerability and thereby inform the design of attribution-robust evaluators, auditing tools, and incentive mechanisms. As attribution metrics increasingly govern compensation, provenance, and participation rights in ML ecosystems, improving attribution integrity has a positive influence on the development of trustworthy ML infrastructure.
Fraboni, Y., Vidal, R., and Lorenzi, M. Free-rider attacks on model aggregation in federated learning. In International Conference on Artificial Intelligence and Statistics, pp. 1846–1854. PMLR, 2021. Gairola, S., Böhle, M., Locatello, F., and Schiele, B. How to probe: Simple yet effective techniques for improving post-hoc explanations. arXiv preprint arXiv:2503.00641, 2025. Garrido Lucero, F., Heymann, B., Vono, M., Loiseau, P., and Perchet, V. Du-shapley: A shapley value proxy for efficient dataset valuation. Advances in Neural Information Processing Systems, 37:1973–2000, 2024.
References Bae, J., Lin, W., Lorraine, J., and Grosse, R. B. Training data attribution via approximate unrolling. Advances in Neural Information Processing Systems, 37:66647–66686, 2024.
Hammoudeh, Z. and Lowd, D. Training data influence analysis and estimation: A survey. Machine Learning, 113(5):2351–2403, 2024.
Bal, M. I., Cevher, V., and Muehlebach, M. Adversarial training for defense against label poisoning attacks. arXiv preprint arXiv:2502.17121, 2025.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778, 2016.
Chen, Q., Dong, X., Peng, Z., and Meng, G. Shapley estimated explanation (shep): A fast post-hoc attribution method for interpreting intelligent fault diagnosis. arXiv preprint arXiv:2504.03773, 2025.
Hesse, R., Schaub-Meyer, S., and Roth, S. Benchmarking the attribution quality of vision models. Advances in Neural Information Processing Systems, 37:97928–97947, 2024.
Chen, Y.-C., Chen, H.-W., Wang, S.-G., and Chen, M.S. Space: Single-round participant amalgamation for contribution evaluation in federated learning. Advances in Neural Information Processing Systems, 36:6422–6441, 2023.
Hu, Y., Wu, F., Ye, H., Forsyth, D., Zou, J., Jiang, N., Ma, J. W., and Zhao, H. A snapshot of influence: A local data attribution framework for online reinforcement learning. arXiv preprint arXiv:2505.19281, 2025.
Covert, I., Ji, W., Hashimoto, T., and Zou, J. Scaling laws for the value of individual data points in machine learning. arXiv preprint arXiv:2405.20456, 2024a.
Jia, Y., Fang, M., Liu, H., Zhang, J., and Gong, N. Z. Tracing back the malicious clients in poisoning attacks to federated learning. arXiv preprint arXiv:2407.07221, 2024.
Covert, I., Kim, C., Lee, S.-I., Zou, J. Y., and Hashimoto, T. B. Stochastic amortization: A unified approach to accelerate feature and data attribution. Advances in Neural Information Processing Systems, 37:4374–4423, 2024b.
Jiang, K., Liang, W., Zou, J. Y., and Kwon, Y. Opendataval: a unified benchmark for data valuation. Advances in Neural Information Processing Systems, 36:28624–28647, 2023.
Deng, J., Tang, W., and Ma, J. W. A versatile influence function for data attribution with non-decomposable loss. arXiv preprint arXiv:2412.01335, 2024. 10
On the Fragility of Data Attribution When Learning Is Distributed
Jiao, C., Pan, Y., Xiao, E., Sheng, D., Jain, N., Zhao, H., Dasgupta, I., Ma, J. W., and Xiong, C. Date-lm: Benchmarking data attribution evaluation for large language models. arXiv preprint arXiv:2507.09424, 2025.
IOS Press, 2025. doi: 10.3233/FAIA250961. URL https://doi.org/10.3233/FAIA250961. Liu, P., Xu, X., and Wang, W. Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives. Cybersecurity, 5(1):4, 2022.
Kandpal, N. and Raffel, C. Position: The most expensive part of an llm should be its training data. arXiv preprint arXiv:2504.12427, 2025.
Liu, Z., Just, H. A., Chang, X., Chen, X., and Jia, R. 2dshapley: A framework for fragmented data valuation. In International Conference on Machine Learning, pp. 21730–21755. PMLR, 2023.
Kaur, H., Rani, V., Kumar, M., Sachdeva, M., Mittal, A., and Kumar, K. Federated learning: a comprehensive review of recent advances and applications. Multimedia Tools and Applications, 83(18):54165–54188, 2024.
Lyu, L., Yu, H., and Yang, Q. Threats to federated learning: A survey. arXiv preprint arXiv:2003.02133, 2020.
Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. Technical report, University of Toronto, Toronto, ON, Canada, 2009.
McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, pp. 1273–1282. PMLR, 2017.
Kwon, Y., Wu, E., Wu, K., and Zou, J. Datainf: Efficiently estimating data influence in lora-tuned llms and diffusion models. arXiv preprint arXiv:2310.00902, 2023.
Mlodozeniec, B., Eschenhagen, R., Bae, J., Immer, A., Krueger, D., and Turner, R. Influence functions for scalable data attribution in diffusion models. arXiv preprint arXiv:2410.13850, 2024.
Li, W. and Yu, Y. Robust data valuation with weighted banzhaf values. Advances in Neural Information Processing Systems, 36:60349–60383, 2023. Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., and Ding, W. Threats and defenses in the federated learning life cycle: a comprehensive survey and challenges. IEEE Transactions on Neural Networks and Learning Systems, 2025.
Mlodozeniec, B., Reid, I., Power, S., Krueger, D., Erdogdu, M., Turner, R., and Grosse, R. Distributional training data attribution: What do influence functions sample? Advances in Neural Information Processing Systems, 38: 10057–10091, 2026.
Lin, C., Lu, M., Kim, C., and Lee, S.-I. An efficient framework for crediting data contributors of diffusion models. arXiv preprint arXiv:2407.03153, 2024a.
Murad, A., Hui, B., and Ku, W.-S. Optimized local updates in federated learning via reinforcement learning, 2025. URL https://arxiv.org/abs/2506.06337.
Lin, J., Tao, L., Dong, M., and Xu, C. Diffusion attribution score: Evaluating training data influence in diffusion models. arXiv preprint arXiv:2410.18639, 2024b.
Murhekar, A., Yuan, Z., Ray Chaudhury, B., Li, B., and Mehta, R. Incentives in federated learning: Equilibria, dynamics, and mechanisms for welfare maximization. Advances in Neural Information Processing Systems, 36: 17811–17831, 2023.
Lin, X., Xu, X., Wu, Z., Ng, S.-K., and Low, B. K. H. Distributionally robust data valuation. In Forty-first International Conference on Machine Learning, 2024c.
Murhekar, A., Song, J., Shahkar, P., Chaudhury, B. R., and Mehta, R. You get what you give: Reciprocally fair federated learning. In Forty-second International Conference on Machine Learning, 2024.
Liu, B., Lv, N., Guo, Y., and Li, Y. Recent advances on federated learning: A systematic survey. Neurocomputing, 597:128019, 2024. Liu, B., Xiao, Y., Ye, R., Ling, Z., Ma, X., and Hui, B. DBA-DFL: towards distributed backdoor attacks with network detection in decentralized federated learning. In Lynce, I., Murano, N., Vallati, M., Villata, S., Chesani, F., Milano, M., Omicini, A., and Dastani, M. (eds.), ECAI 2025 - 28th European Conference on Artificial Intelligence, 25-30 October 2025, Bologna, Italy - Including 14th Conference on Prestigious Applications of Intelligent Systems (PAIS 2025), Frontiers in Artificial Intelligence and Applications, pp. 1422–1428.
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A. Y., et al. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning, Granada, 2011. Nguyen, E., Seo, M., and Oh, S. J. A bayesian approach to analysing training data attribution in deep learning. Advances in Neural Information Processing Systems, 36: 64155–64180, 2023. 11
On the Fragility of Data Attribution When Learning Is Distributed
Nowroozi, E., Haider, I., Taheri, R., and Conti, M. Federated learning under attack: Exposing vulnerabilities through data poisoning attacks in computer networks. IEEE Transactions on Network and Service Management, 2025.
Sun, Q., Xia, H., and Liu, J. Data-faithful feature attribution: Mitigating unobservable confounders via instrumental variables. Advances in Neural Information Processing Systems, 37:44935–44964, 2024a. Sun, W., Liu, H., Kandpal, N., Raffel, C., and Yang, Y. Enhancing training data attribution with representational optimization. arXiv preprint arXiv:2505.18513, 2025.
Papadopoulos, C., Kollias, K.-F., and Fragulis, G. F. Recent advancements in federated learning: state of the art, fundamentals, principles, iot applications and future trends. Future Internet, 16(11):415, 2024.
Sun, Y., Shen, J., and Kwon, Y. 2d-oob: Attributing data contribution through joint valuation framework. Advances in Neural Information Processing Systems, 37:46764– 46790, 2024b.
Pawelczyk, M., Di, J. Z., Lu, Y., Sekhari, A., Kamath, G., and Neel, S. Machine unlearning fails to remove data poisoning attacks. arXiv preprint arXiv:2406.17216, 2024.
Tastan, N., Fares, S., Aremu, T., Horvath, S., and Nandakumar, K. Redefining contributions: Shapley-driven federated learning. arXiv preprint arXiv:2406.00569, 2024.
Ramu, P., Goswami, K., Saxena, A., and Srinivasan, B. V. Enhancing post-hoc attributions in long document comprehension via coarse grained answer decomposition. arXiv preprint arXiv:2409.17073, 2024.
Vehtari, A., Gelman, A., and Gabry, J. Practical bayesian model evaluation using leave-one-out cross-validation and waic. Statistics and Computing, 27(5):1413–1432, 2017.
Rubinstein, I. and Hopkins, S. B. Rescaled influence functions: Accurate data attribution in high dimension. arXiv preprint arXiv:2506.06656, 2025.
Wang, A., Nguyen, E., Yang, R., Bae, J., McIlraith, S. A., and Grosse, R. Better training data attribution via better inverse hessian-vector products. arXiv preprint arXiv:2507.14740, 2025a.
Sardana, S., Gupta, S., Donode, A., Prasad, A., and Karthik, G. M. Defending machine learning and deep learning models: Detecting and preventing data poisoning attacks. 2024 Global Conference on Communications and Information Technologies (GCCIT), pp. 1–6, 2024.
Wang, J., Lin, X., Qiao, R., Foo, C.-S., and Low, B. K. H. Helpful or harmful data? fine-tuning-free shapley attribution for explaining language model predictions. arXiv preprint arXiv:2406.04606, 2024a.
Schioppa, A. Efficient sketches for training data attribution and studying the loss landscape. Advances in Neural Information Processing Systems, 37:37692–37735, 2024.
Wang, J. T., Zhu, Y., Wang, Y.-X., Jia, R., and Mittal, P. A privacy-friendly approach to data valuation. Advances in Neural Information Processing Systems, 36:60429– 60467, 2023.
Schoinas, I., Triantafyllou, A., Ioannidis, D., Tzovaras, D., Drosou, A., Votis, K., Lagkas, T., Argyriou, V., and Sarigiannidis, P. Federated learning: Challenges, sota, performance improvements and application domains. IEEE Open Journal of the Communications Society, 5:5933– 6017, 2024.
Wang, J. T., Mittal, P., Song, D., and Jia, R. Data shapley in one training run. arXiv preprint arXiv:2406.11011, 2024b.
Shahani, P. S. and Scheutz, M. Noise injection systemically degrades large language model safety guardrails. arXiv preprint arXiv:2505.13500, 2025.
Wang, J. T., Yang, T., Zou, J., Kwon, Y., and Jia, R. Rethinking data shapley for data selection tasks: Misleads and merits. arXiv preprint arXiv:2405.03875, 2024c.
Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.
Wang, L., Xu, S., Wang, X., and Zhu, Q. Addressing class imbalance in federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 10165–10173, 2021.
Song, T., Tong, Y., and Wei, S. Profit allocation for federated learning. In 2019 IEEE International Conference on Big Data (Big Data), pp. 2577–2586. IEEE, 2019.
Wang, S.-Y., Hertzmann, A., Efros, A., Zhu, J.-Y., and Zhang, R. Data attribution for text-to-image models by unlearning synthesized images. Advances in Neural Information Processing Systems, 37:4235–4266, 2024d.
Steinhardt, J., Koh, P. W. W., and Liang, P. S. Certified defenses for data poisoning attacks. Advances in neural information processing systems, 30, 2017. 12
On the Fragility of Data Attribution When Learning Is Distributed
Wang, S.-Y., Hertzmann, A., Efros, A. A., Zhang, R., and Zhu, J.-Y. Fast data attribution for text-to-image models. arXiv preprint arXiv:2511.10721, 2025b.
Zhang, L., Jiao, C., Li, B., and Xiong, C. Fairshare data pricing via data valuation for large language models. arXiv preprint arXiv:2502.00198, 2025a.
Wang, T., Rausch, J., Zhang, C., Jia, R., and Song, D. A principled approach to data valuation for federated learning. In Federated Learning: Privacy and Incentive, pp. 153–167. Springer, 2020.
Zhang, L., Wu, H., Zhang, L., Xu, F., Cao, J., Li, F., and Niu, B. Training data attribution: Was your model secretly trained on data created by mine? In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 3786–3795, 2025b.
Wang, W., Deng, J., Hu, Y., Zhang, S., Jiang, X., Zhang, R., Zhao, H., and Ma, J. W. Taming hyperparameter sensitivity in data attribution: Practical selection without costly retraining. arXiv preprint arXiv:2505.24261, 2025c.
Zhao, P., Zhu, W., Jiao, P., Gao, D., and Wu, O. Data poisoning in deep learning: A survey. arXiv preprint arXiv:2503.22759, 2025.
Wang, X., Hu, P., Deng, J., and Ma, J. W. Adversarial attacks on data attribution. arXiv preprint arXiv:2409.05657, 2024e.
Zhao, Y., Li, M., Lai, L., Suda, N., Civin, D., and Chandra, V. Federated learning with non-iid data. arXiv preprint arXiv:1806.00582, 2018.
Wei, D., Padhi, I., Ghosh, S., Dhurandhar, A., Ramamurthy, K. N., and Chang, M. Final-model-only data attribution with a unifying view of gradient-based methods. arXiv preprint arXiv:2412.03906, 2024.
Zheng, X., Pang, T., Du, C., Jiang, J., and Lin, M. Intriguing properties of data attribution on diffusion models. arXiv preprint arXiv:2311.00500, 2023.
Xiao, H., Xiao, H., and Eckert, C. Adversarial label flips attack on support vector machines. In ECAI 2012, pp. 870–875. IOS Press, 2012. Xiao, H., Rasul, K., and Vollgraf, R. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017. Xiao, Y., Zhang, Z., Fang, Y., Yan, D., Zhou, Y., Ku, W.-S., and Hui, B. Advancing certified robustness of explanation via gradient quantization. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, CIKM ’24, pp. 2596–2606, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400704369. doi: 10.1145/3627673.3679650. URL https://doi. org/10.1145/3627673.3679650. Xu, X., Wang, S., Foo, C.-S., Low, B. K., and Fanti, G. Data distribution valuation. Advances in Neural Information Processing Systems, 37:2407–2448, 2024. Yang, M., Zhu, R., Wang, Q., and Yang, J. Fedtrans: Clienttransparent utility estimation for robust federated learning. In The Twelfth International Conference on Learning Representations, 2023. Yurdem, B., Kuzlu, M., Gullu, M. K., Catak, F. O., and Tabassum, M. Federated learning: Overview, strategies, applications, tools and future directions. Heliyon, 10(19): e25903, 2024. Zagoruyko, S. and Komodakis, N. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016. 13
On the Fragility of Data Attribution When Learning Is Distributed
A. Background and Related Work
efficiency (Chen et al., 2025; Gairola et al., 2025; Li & Yu, 2023; Wang et al., 2024c; Sun et al., 2024b; Garrido Lucero et al., 2024; Covert et al., 2024b). Opendataval benchmarks highlight the difficulty of evaluating attribution across tasks and models (Jiang et al., 2023; Jiao et al., 2025).
A.1. Federated Learning Federated learning (FL) enables collaborative training over decentralized data without sharing raw samples. Classical FL follows the broadcast–local-train–aggregate loop, where a central server coordinates many clients under privacy, communication, and heterogeneity constraints (Liu et al., 2024; Papadopoulos et al., 2024; Liu et al., 2025; Murad et al., 2025). Modern surveys highlight FL’s defining characteristics: naturally non-IID and unbalanced data partitions, limited client availability, partial participation, and system-level constraints such as communication budgets and straggler resilience (Yurdem et al., 2024; Kaur et al., 2024). These properties make FL attractive for IoT analytics, healthcare, autonomous vehicles, and smart city infrastructure (Schoinas et al., 2024), but also widen the gap between theory and practice, creating structural vulnerabilities that adversaries can exploit.
(3) Training-dynamics approaches. These methods monitor intermediate checkpoints or trajectories to attribute influence over the course of training (Bae et al., 2024; Wei et al., 2024; Wang et al., 2024a; Xu et al., 2024; Hu et al., 2025; Sun et al., 2025). Such approaches capture nuanced temporal effects and are increasingly used to study fine-tuning and generative models. (4) Simulator- and surrogate-based estimators. These methods approximate counterfactual outcomes using auxiliary models or sampling-based surrogates, enabling efficient estimation in large-scale pipelines (Covert et al., 2024a; Sun et al., 2024a; Schioppa, 2024; Mlodozeniec et al., 2026; Lin et al., 2024a). Attribution has expanded to diffusion and text-to-image systems (Wang et al., 2024d; Lin et al., 2024b).
A recurring challenge is non-IID data, where label distribution skews across clients degrade convergence and destabilize aggregation (Wang et al., 2021). Recent work on FL robustness and trustworthiness focuses on secure aggregation, incentive-aligned participation, and model-centric defenses (Lyu et al., 2020; Liu et al., 2022; Li et al., 2025), but they often assume that participants aim to preserve accuracy rather than manipulate attribution, leaving attributionspecific vulnerabilities insufficiently addressed.
Despite technical progress, the literature rarely considers adversarial participants who strategically manipulate attribution scores while maintaining high utility. Only very recent work begins examining explicit threats to attribution (Wang et al., 2024e), but these analyses do not explore latent-space optimization nor hybrid real–synthetic manipulation as studied in this work.
A.2. Training Data Attribution
A.3. Data Poisoning and Adversarial Manipulation
Training data attribution seeks to quantify the influence of individual samples or subsets on model behavior. Foundational frameworks formalize three components: (i) the model behavior to be explained, (ii) the training entities to be credited, and (iii) the influence measure used to score them (Zhang et al., 2025b). Recent surveys show that attribution underpins data governance, auditing, pricing, and debugging in modern Machine Learning pipelines (Deng et al., 2025; Hammoudeh & Lowd, 2024).
Data poisoning attacks modify or inject malicious samples to subvert training. Classical poisoning includes labelflipping, feature perturbations, and generative-model–based sample synthesis, which can be highly covert in distributed environments (Sardana et al., 2024; Nowroozi et al., 2025; Xiao et al., 2024). Deep networks’ capacity to memorize small poisoned subsets makes subtle manipulations difficult to detect (Zhao et al., 2025). Recent work shows that poisoning can persist even under model unlearning or retraining (Pawelczyk et al., 2024).
Four major families of attribution methods have emerged:
In federated settings, poisoning is more challenging due to decentralized control. Studies explore client-level malicious behavior, including Byzantine updates, targeted poisoning, and defenses based on robust aggregation or anomaly detection (Jia et al., 2024; Bal et al., 2025). However, these defenses largely assume that adversaries aim to degrade performance. Our work targets a complementary and underexplored setting: adversaries who preserve global utility while manipulating contribution metrics.
(1) Influence-function methods. These use second-order approximations of leave-one-out retraining to estimate a sample’s contribution. Advances tackle computational bottlenecks and improve scalability (Ramu et al., 2024; Sun et al., 2024a; Zheng et al., 2023; Kwon et al., 2023; Mlodozeniec et al., 2024; Lin et al., 2024b). They are widely used in debugging and understanding model vulnerabilities. (2) Marginal-contribution methods. Shapley- and Banzhaf-style valuations treat training as a cooperative game, estimating expected contributions across subsets. Extensions address robustness, fragmentation, privacy, and
Parallel to poisoning, valuation-based attacks have begun to emerge. Wang et al. (Wang et al., 2024e) studied manipulations of attribution under simplified conditions, but do not 14
On the Fragility of Data Attribution When Learning Is Distributed
C. Experiment results
examine latent-space optimization, cross-round consistency, or FL-specific non-IID structure. Our latent-optimization attack fills this gap by demonstrating that attribution can be steered consistently, stealthily, and without harming accuracy.
B. Notation Symbol
Description
X,Y N t T wt fwt U (·) U (0) U (1) δ i⋆ (i⋆ ) Dr Ds D̃ (x̃, ỹ) ⋆ gti ⋆ ĝti (r) gt (s) gt α E(·) C(·) Γ d(·, Γ) Cmax ϵ κ z Dec(·) ℓ(·) CE(·, ·) L1 (z) L2 (z) L3 (z) L(z) gt† θ(z) ∇w ℓ fwt , Dec(z) ∆t (g) ηz ηw Bz Bs
Input and label spaces of the supervised learning task. Number of clients (in this paper, N =10). Communication-round index. Total number of federated learning rounds. Global model parameters broadcast by the server at round t. Model instantiated with parameters wt . Global utility metric (e.g., test accuracy). Final utility of the clean (no-attack) training run. Final utility of the training run under attack. Allowed tolerance on utility degradation, cf. Eq. (1). Index of the malicious client. Real (benign) local dataset of client i⋆ . Synthetic dataset constructed by the attacker (must lie in X × Y). Synthetic batch decoded from the latent vector z for local training. Synthetic input–label pair decoded from z. Benign local update of client i⋆ at round t. Reported (possibly malicious) update of client i⋆ at round t. (i⋆ ) Update induced by training only on Dr . Update induced by training on the synthetic batch only. Synthetic weight in the hybrid update, cf. Eq. (8). Server-side data-attribution evaluator. Communication cost of an update (budget constraint), cf. Eq. (3). Reference set of benign client updates used for deviation checks. Deviation metric from benign updates (shape/direction), cf. Eq. (3). Upper bound on communication cost (budget). Deviation budget controlling how far an update may deviate from benign ones. Norm budget for client updates (maximum allowed ℓ2 norm). Latent vector optimized by the attacker to parameterize synthetic samples. Fixed decoder/generator that maps z to synthetic samples. Supervised task loss used to define gradients. Cross-entropy loss on model predictions and labels. Loss term enforcing directional alignment between synthetic and reference gradients. Loss term enforcing norm consistency between synthetic and reference gradients. Task loss on synthetic samples to maintain class-discriminative features. Joint latent objective: L1 + L2 + L3 . Reference benign gradient at round t (e.g., approximated via wt − wt−1 ). Angle between the synthetic gradient and the reference gradient at round t. Gradient of the task loss on the decoded synthetic batch at wt . Per-round marginal utility of update g at round t, i.e., U (wt + g) − U (wt ). Step size for latent optimization in z-space. Local learning rate used in client-side model training. Number of gradient steps for latent optimization in each round. Synthetic batch size decoded from z for local training. 15
On the Fragility of Data Attribution When Learning Is Distributed
C8 9.3%
C9 7.6%
C0 7.5%
C7 6.2%
C5 5.8%
C1 19.1%
C7 4.9%
C3 11.3%
C0 9.9%
C9 16.1%
C1 5.8%
C2 4.8%
C8 8.5%
C2 5.0%
C6 17.5%
C0 14.1%
C9 16.3%
C1 12.8%
C8 21.2%
C3 12.8%
C6 6.4% C5 6.1%
C4 17.1%
C2 16.8%
C3 6.0%
C7 11.1%
C4 1.8%
(a) Attack-Free
C6 0.0%
(b) Latent Optimization
C9 9.6%
C0 11.0%
C8 12.8%
C7 9.7%
C2 0.8%
C5 9.6%
C0 9.9%
C9 13.8%
C7 8.5%
C3 12.1%
C6 10.2%
(c) Label Flipping
C8 4.4% C1 11.6%
C4 13.5%
C5 4.8%
C1 25.3%
C6 9.9% C5 9.4%
C4 12.8%
C3 8.1%
C2 6.9%
C4 3.7%
(d) Random Noise
(e) Free Rider
Figure 5. Client-level data attribution under CIFAR-10 with ResNet-18. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
C8 0.4%
C8 0.0% C9 9.3%
C0 9.9%
C9 10.8%
C7 9.5%
C7 9.3% C1 25.6%
C6 13.7% C5 10.0%
C8 1.6%
C0 14.5%
C3 9.4%
C7 10.9%
C6 7.5% C5 3.7%
C2 12.2%
C0 9.1%
C9 12.6%
C1 26.1%
C4 7.8% C3 6.2%
C1 28.5%
C6 10.7% C5 10.0%
C2 14.3%
C4 0.0%
C3 7.7%
C2 9.0%
C4 0.0%
(a) Attack-Free
(b) Latent Optimization
(c) Label Flipping C8 0.1%
C8 2.6% C9 10.4%
C0 10.1%
C9 11.5%
C0 9.5%
C7 11.0%
C7 9.9%
C1 26.7%
C1 27.9% C6 12.3%
C6 12.0% C5 9.0%
C3 6.1%
C5 9.1%
C2 12.0%
C4 0.0%
C3 8.8%
C2 11.1%
C4 0.0%
(d) Random Noise
(e) Free Rider
Figure 6. Client-level data attribution under CIFAR-10 with WRN-28×10. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
16
On the Fragility of Data Attribution When Learning Is Distributed C9 0.0%
C0 8.3%
C9 8.4%
C7 9.2%
C8 10.1%
C6 0.0%
C3 5.9%
C2 9.2%
C4 0.7%
C6 4.5%
C1 29.4%
C2 14.0%
C2 16.9% C3 1.5%
C3 1.3% C4 0.0%
(b) Latent Optimization
C0 4.4%
C9 C8 5.5% 6.9%
(c) Label Flipping
C9 C0 2.5% 2.6%
C8 7.5%
C7 6.0%
C7 8.3%
C6 4.7%
C1 37.3%
C6 5.0%
C1 35.3%
C5 13.2%
C4 2.5%
(a) Attack-Free
C0 9.5%
C7 10.1%
C5 10.8%
C5 14.2%
C9 C8 6.7% 5.3%
C0 13.8%
C6 11.6%
C1 30.4%
C7 11.1%
C8 6.1%
C1 35.8%
C5 19.1%
C5 15.0%
C4 5.1%
C2 13.8% C4 4.0% C3 0.0%
C2 16.6%
C3 0.0%
(d) Random Noise
(e) Free Rider
Figure 7. Client-level data attribution under CIFAR-10 with VGG16 BN. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
C9 0.0%
C9 3.4% C1 2.0%
C0 12.5% C8 32.2%
C9 7.4%
C1 0.0%
C0 13.6% C2 8.8%
C2 10.6% C3 0.7% C4 9.8%
C7 0.0%
C6 16.2%
C5 12.4%
C5 15.9%
C2 9.6%
C8 34.8%
C3 4.4%
C8 37.0%
C1 2.3%
C0 12.2%
C4 5.4%
C4 4.5% C6 14.6%
C6 10.0%
C3 0.5%
C5 16.7%
C7 0.5% C7 1.9%
(a) Attack-Free
(b) Latent Optimization
C9 2.7%
C1 3.1%
C0 11.9% C8 30.9%
C2 8.4%
C0 11.6%
C6 15.1%
C1 4.7%
C8 27.8%
C2 12.1%
C3 1.1%
C4 9.5% C7 0.7%
(c) Label Flipping
C9 2.0%
C7 0.0%
C5 16.7%
(d) Random Noise
C6 16.0%
C4 7.8%
C3 1.9%
C5 16.0%
(e) Free Rider
Figure 8. Client-level data attribution under FashionMNIST with ResNet-18. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
17
On the Fragility of Data Attribution When Learning Is Distributed
C9 8.5%
C1 0.0%
C3 0.7% C1 2.0% C2 0.0%
C0 13.0%
C9 7.8%
C1 1.2%
C0 13.8%
C9 12.9%
C3 7.0%
C2 8.9%
C8 24.4%
C4 8.7% C8 33.0%
C7 0.0%
C6 16.0%
C6 13.0%
C5 9.1%
C4 9.9%
C8 29.9%
C3 10.1%
C5 16.7%
C2 1.4%
C0 10.2%
C5 12.7%
C4 11.7%
C6 12.1%
C7 1.4%
C7 3.9%
(a) Attack-Free
(b) Latent Optimization
(c) Label Flipping C1 2.1%
C9 9.0%
C1 2.9% C2 2.9%
C0 14.5%
C8 27.3%
C0 9.0%
C9 11.3%
C3 11.7%
C3 6.4%
C8 26.2% C4 9.0%
C4 11.1% C6 12.9%
C7 0.0%
C2 2.6%
C5 12.9%
C5 14.2%
C6 13.8%
C7 0.0%
(d) Random Noise
(e) Free Rider
Figure 9. Client-level data attribution under FashionMNIST with WRN-28×10. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
C9 0.0%
C9 C0 0.0% 4.2% C1 1.9%
C9 11.1%
C2 8.8%
C8 22.5%
C3 9.2%
C7 0.0%
C6 6.2%
(a) Attack-Free
C8 17.5%
C7 3.7%
C5 9.2%
C3 10.9% C6 13.9%
C3 6.8%
C5 10.9%
C4 12.8%
(c) Label Flipping
C9 0.0%
C0 6.6%
C8 23.7%
C1 7.6%
C1 8.1% C2 6.5%
C2 10.6%
C7 4.0%
C3 8.4% C5 14.7%
C4 5.1%
C0 9.9%
C6 12.2%
C1 7.0%
C7 3.8%
(b) Latent Optimization
C9 0.0%
C0 8.2%
C8 24.1%
C2 14.6%
C7 10.7%
C5 16.8%
C1 0.0%
C2 8.3%
C8 18.6%
C4 13.2%
C6 23.3%
C0 17.6%
C3 13.1% C6 10.9% C5 10.3%
C4 15.5%
(d) Random Noise
C4 16.8%
(e) Free Rider
Figure 10. Client-level data attribution under FashionMNIST with VGG16 BN. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
18
On the Fragility of Data Attribution When Learning Is Distributed C0 0.0%
C0 0.0%
C9 10.3%
C0 9.3%
C9 12.1%
C1 17.0%
C9 11.1%
C2 3.9%
C8 21.7%
C1 17.3%
C3 7.3%
C8 28.0%
C4 11.8%
(a) Attack-Free
C9 11.0%
C5 2.3%
(b) Latent Optimization
C0 1.0%
C2 0.0% C3 3.7%
C8 26.1%
C1 21.6% C2 0.1% C3 4.3%
C8 26.4%
C4 17.2% C7 4.9%
(c) Label Flipping
C0 0.0%
C9 7.9%
C1 18.2%
C4 17.1% C6 15.5%
C3 4.0%
C7 4.0% C6 C5 4.3% 0.0%
C5 2.5%
C3 4.3%
C7 4.5%
C4 16.9%
C6 17.0%
C2 2.9%
C8 22.4%
C2 9.1% C7 3.4%
C1 20.0%
C4 17.6%
C6 14.1%
C6 16.9%
C7 2.9% C5 3.8%
C5 2.4%
(d) Random Noise
(e) Free Rider
Figure 11. Client-level data attribution under SVHN with ResNet-18. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
C0 0.0%
C9 15.2%
C0 0.0%
C0 1.5%
C1 17.5%
C9 15.5%
C2 0.0%
C2 9.5%
C3 5.6% C8 25.5%
C8 20.8%
C4 14.5% C6 18.1%
C7 2.5%
C9 13.7%
C1 13.5%
C7 5.3% C5 1.1%
C6 12.5%
C3 5.9%
C8 21.3%
C3 7.2%
C2 2.3%
C1 15.1%
C4 14.1%
C4 13.0%
C6 20.5%
C7 2.9%
C5 4.1%
C5 1.2%
(a) Attack-Free
(b) Latent Optimization
C0 0.0%
C2 3.4%
C1 13.6%
C9 14.7%
(c) Label Flipping
C0 1.1%
C9 13.5%
C1 15.8%
C3 5.1%
C3 5.5% C8 23.1%
C8 22.3%
C7 2.6%
C2 0.0%
C4 16.0%
C4 15.7%
C6 19.5%
C7 3.3%
C5 2.8%
(d) Random Noise
C6 19.2% C5 2.9%
(e) Free Rider
Figure 12. Client-level data attribution under SVHN with WRN-28×10. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
19
On the Fragility of Data Attribution When Learning Is Distributed
C0 0.0%
C9 9.7%
C0 2.6%
C1 17.9%
C8 21.6%
C0 12.6%
C9 19.9%
C2 2.2%
C9 14.0%
C2 0.0% C1 21.3%
C3 6.4%
C6 16.2%
C8 18.7%
C8 21.6%
C4 15.0%
C7 6.0%
C1 18.4%
C5 4.9%
C4 7.3%
C3 9.5%
C3 9.3% C4 10.6%
C7 5.7%
C2 4.5%
C6 17.2%
C7 2.7% C5 C6 0.0% 0.7%
(a) Attack-Free
(b) Latent Optimization
C0 3.0%
C9 13.3%
C5 3.5%
(c) Label Flipping
C0 0.2%
C9 15.2%
C1 18.8%
C1 22.0%
C2 0.0%
C8 18.9%
C2 0.0%
C3 6.1%
C8 21.8%
C4 11.5%
C7 6.0%
C7 6.9%
C6 18.7%
C3 1.8%
C4 11.5%
C6 18.4%
C5 2.3%
C5 3.6%
(d) Random Noise
(e) Free Rider
Figure 13. Client-level data attribution under SVHN with VGG16-BN. Per-client attribution shares under different attack settings. Colors indicate client identities and are consistent across panels.
CIFAR-10
100
FashionMNIST
SVHN
Accuracy (%)
80 60 40 20 0
ResNet-18
WRN-28-10
VGG16_BN
Attack Free
ResNet-18
Label Flipping
WRN-28-10 Random Noise
VGG16_BN Free Rider
ResNet-18
WRN-28-10
VGG16_BN
Latent Optimization
Figure 14. Global model accuracy across datasets and architectures under different attack methods (FedSV). We report test accuracy (%) for three model architectures on CIFAR-10, FashionMNIST, and SVHN. Each dataset–model pair is shown as a group of bars, with different colors indicating attack variants.
20
On the Fragility of Data Attribution When Learning Is Distributed
C0 0.0%
C9 11.1%
C1 11.0%
C8 11.1%
C2 11.7%
C7 10.7%
C5 11.1%
C0 17.7%
C9 16.1%
C8 3.2%
C0 5.8% C1 24.1%
C7 9.8%
C7 12.1%
C3 11.6% C6 10.8%
C9 15.8%
C8 3.8%
C1 23.9%
C6 6.0%
C6 8.3%
C4 11.0%
C5 6.8%
C5 8.7%
C2 C3 5.6% 6.0%
C4 0.0%
C4 0.0%
(a) Attack-Free
(b) Latent Optimization
C0 3.5%
C9 25.5%
C2 14.2% C3 12.1%
(c) Label Flipping
C9 17.1%
C1 22.9%
C0 4.8% C1 21.8%
C8 8.5% C8 4.1%
C2 6.4%
C7 14.0%
C3 7.3%
C7 13.7% C6 4.9%
C6 7.9%
C5 11.7%
C5 6.6%
C4 8.0%
C2 6.2% C3 5.1%
C4 0.0%
(d) Random Noise
(e) Free Rider
Accuracy (%)
Figure 15. Leave-one-out (LOO) client-level data attribution under CIFAR-10 with ResNet-18. Per-client attribution shifts under different attack settings. Colors indicate client identities and remain consistent across panels.
70 60 50 40 30 20 10 0
CIFAR-10 / ResNet-18 Attack Free
Label Flipping
Random Noise
Free Rider
Latent Optimization
Figure 16. Global model accuracy under CIFAR-10 with ResNet-18 under different attack methods (LOO).
21