arXiv CSopen access

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

cryptography, security, privacy, cybersecurity

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers Israt Jahan Mouri1 , Muhammad Ridowan2 , Muhammad Abdullah Adnan1 1 Bangladesh University of Engineering and Technology (BUET), Dhaka, Bangladesh 2 TigerIT Bangladesh Ltd., Dhaka, Bangladesh

arXiv:2604.09489v1 [cs.CR] 10 Apr 2026

[email protected], [email protected], [email protected]

Abstract

attacks due to their distributed nature [2, 3, 5, 17, 20, 47, 56]. Model poisoning attacks involve direct manipulation of the local model gradients on malicious devices before sharing them with the central server in each training epoch.

Model poisoning attacks pose a significant security threat to Federated Learning (FL). Most existing model poisoning attacks rely on collusion, requiring adversarial clients to coordinate by exchanging local benign models and synchronizing the generation of their poisoned updates. However, sustaining such coordination is increasingly impractical in real-world FL deployments, as it effectively requires botnetlike control over many devices. This approach is costly to maintain and highly vulnerable to detection. This context raises a fundamental question: Can model poisoning attacks remain effective without any communication between attackers? To address this challenge, we introduce and formalize the non-collusive attack model, in which all compromised clients share a common adversarial objective but operate independently. Under this model, each attacker generates its malicious update without communicating with other adversaries, accessing other clients’ updates, or relying on any knowledge of server-side defenses. To demonstrate the feasibility of this threat model, we propose XFED, the first aggregation-agnostic, non-collusive model poisoning attack. Our empirical evaluation across six benchmark datasets shows that XFED bypasses eight state-of-the-art defenses and outperforms six existing model poisoning attacks. These findings indicate that FL systems are substantially less secure than previously believed and underscore the urgent need for more robust and practical defense mechanisms.

To address the vulnerabilities posed by poisoning attacks, the machine learning community has introduced several Byzantine-robust aggregation rules [7, 9, 17, 20, 35, 47, 58, 59]. These rules are specifically designed to mitigate the impact of adversarial clients by identifying and excluding malicious updates [4, 7, 10, 13, 14, 20, 23, 31, 34, 36, 44, 47, 51, 59]. These aggregation rules ensure that only benign updates contribute to the global model. However, despite the robustness of Byzantine-robust aggregation rules, recent studies [3, 17, 47, 48] have shown that carefully crafted adversarial model updates can circumvent them. These Byzantine-robust attacks assume that attackers collude by sharing statistical insights from their local models to create unified malicious updates to amplify the impact of their attacks. This coordinated effort makes the poisonous updates closely resemble the benign distribution, enabling them to bypass Byzantine-robust aggregation filters. As highlighted in previous research, successfully launching a poisoning attack in real-world FL systems typically requires compromising around 20% of the total clients [17, 47]. In an FL system with 1 million participants, this means an attacker would need control over approximately 200,000 devices. However, beyond achieving this large-scale compromise, the attacker must also ensure reliable communication among the compromised devices to generate consistent malicious updates, often using a botnet or a command-andcontrol (C&C) server. Maintaining a botnet of this scale presents significant logistical complexities, reliability issues, and ongoing maintenance challenges. The considerable effort and resources needed to sustain such a botnet make collusion highly impractical. Furthermore, communication among a large number of devices introduces additional risks, including detection by firewalls and the difficulty of maintaining synchronization among devices. Given these chal-

1. Introduction Federated Learning (FL) [29, 30] enables multiple clients to train a shared model collaboratively without exchanging their private data. In this framework, each client computes an update using its own data and sends it to a central server. The server then aggregates these updates to create a global model, which is redistributed to all clients. While it is a promising solution, FL systems are vulnerable to model poisoning 1

lenges, Shejwalkar et al. [48] argue that collusive attacks are impractical due to the high costs of coordination among attackers and the risks of detection. To address these concerns, recent studies, such as MPAF [8] and PoisonedFL [57], propose creating attacker-controlled fake clients that mimic real participants, allowing the adversary to reach the same nominal fraction of attackers (≈ 20%) without compromising an impractically large number of physical devices. However, these fake clients face their own issues, as they must avoid detection by client verification mechanisms. This requirement can limit their viability in secure or verificationsensitive federated learning deployments. In this paper, we introduce an alternative strategy: a silent non-collusive attack in which compromised devices act independently and require no inter-attacker communication.

attacker’s intended direction but subtle enough to remain within the statistical range of benign updates. The attacker estimates the scale using only the sequence of global models observed up to the current training round. Evaluation. We evaluate our XFED framework using six benchmark datasets. Our results show that, under the least knowledge scenario, where the attacker has no information about the deployed defense, nor access to the local data or models of either compromised or benign clients, XFED successfully compromises five Byzantinerobust aggregation rules and three state-of-the-art FL defenses [7, 18, 19, 35, 43, 58, 59]) in different FL settings. We further demonstrate that, although the use of a trusted root dataset can help the server mitigate model poisoning attacks [9], this approach violates a fundamental design principle of FL, which prohibits the server from storing any client data. These findings highlight the urgent need for more robust and practical defense mechanisms. All experiments are fully reproducible, and the implementation is open-source, developed in Python and hosted on Google Colab1 .

Non-collusive attack. We propose a practical adversarial model in which attackers operate independently, without explicit coordination in each round. An attacker can release malware, exploit widespread application vulnerabilities, or use compromised software updates to carry out an attack campaign, potentially compromising a significant number of clients. There are real-world instances of such silent malware attacks [33, 46, 49]; therefore, we believe this approach is more realistic in achieving a significant proportion of clients than using fake clients. Each compromised client independently creates its own malicious model updates, without communicating with other adversarial clients. To the best of our knowledge, this is the first work to investigate non-collusive model poisoning attacks. However, crafting a non-collusive model poisoning attack poses significant challenges compared to collusive attacks. A non-collusive attacker has limited knowledge, restricted to the information available on their compromised device. The lack of access to a broader distribution of benign or adversarial updates makes it particularly difficult for a non-collusive adversary to mount an effective Byzantine-robust attack.

2. Background and Related Work 2.1. Federated Learning System We consider a standard Federated Learning setup [29, 30, 39], where k clients collaboratively train a model. The server initializes the global parameters θ (0) and, at each round t, broadcasts θ (t) to all clients. Each client i updates the model using its local dataset Di and computes (t+1) ϕi = θ (t) − η∇Li (θ (t) ; Di ), where η is the learning rate. Clients send their updates (t+1) ϕi to the server, which aggregates them to produce the next global model: θ (t+1) = aggregation((t+1) ϕ1 , . . . ,(t+1) ϕk ). This process continues for T rounds until convergence. Federated Learning commonly operates in two settings: (1) Crossdevice [28, 45], which involves a huge number of clients (often millions), of which only a small subset participates in each round; and (2) Cross-silo [24, 25], which involves a moderate number of clients (typically tens to hundreds), all of whom participate in every round.

XFED: A Practical Non-Collusive Model Poisoning Attack. As a proof-of-concept for non-collusive attacks, we introduce XFED, a novel model poisoning attack that operates under a more realistic threat model. XFED is designed to be aggregation-agnostic [3, 47], it operates without any knowledge of the server’s aggregation rule. The high-level procedure of XFED is as follows: the adversary first computes a benign model update using local data from the compromised device. Next, the attacker selects a predefined malicious perturbation vector to define a malicious direction in the gradient space. The malicious update is then generated by applying this perturbation vector, scaled by a scaling coefficient, to the benign update. Determining an appropriate scaling coefficient is critical to the success of the attack. To maximize impact while avoiding detection, the scaling must be large enough to influence the global model in the

2.2. Poisoning Attacks on FL FL is known to be vulnerable to various poisoning attacks due to its distributed nature [2, 3, 5, 6, 17, 20, 27, 37, 42, 56]. Poisoning attacks pose a significant risk to federated systems [42], as they involve attackers sending harmful model updates to the central server. Attacks in FL can be categorized according to the objectives of the adversary into two main types: (1) untargeted and (2) targeted attacks. In untargeted poisoning attacks, the goal is to maximize misclassification across all test inputs, thereby significantly reducing 1 https://github.com/pkse-searcher/xfed

data of all clients. In a partial knowledge scenario [47], the attacker’s access is limited to the adversarial clients only.

the global model’s accuracy [3, 17, 20, 37, 47, 56]. On the other hand, targeted poisoning attacks aim to achieve specific classification results for certain data while maintaining high accuracy on other inputs [2, 5, 52, 53]. While targeted attacks can compromise particular aspects of the global model, untargeted attacks pose a more severe threat by potentially crippling the model entirely. Poisoning attacks in FL are further classified into two types based on the capabilities of the adversary: (1) data poisoning attacks and (2) model poisoning attacks. In data poisoning attacks, the adversary modifies the training data on compromised devices and indirectly influences the model [27, 50, 52]. On the other hand, model poisoning attacks involve altering the local model on compromised devices before sharing them with the central server during training [2, 3, 5, 17, 20, 47, 56]. However, data poisoning attacks have proven to be only minimally effective in reducing the global model’s accuracy [17, 40, 41, 48]. In this paper, we focus on the model poisoning attacks.

2.3. Collusive Model Poisoning Attacks These Byzantine-robust attacks [3, 17, 47, 48] assume that attackers collude to create unified malicious updates to amplify the impact of their attacks. To craft a malicious update, one adversary begins by computing a benign reference aggregate using its local dataset. Then, the adversary generates a malicious update by scaling the benign aggregate in the malicious direction to evade detection by robust aggregations. Once the malicious model update is crafted, the adversary shares it with all other adversarial clients, ensuring that all attackers submit identical (or minimally varied) malicious model updates to the central server. Intuitively, the adversaries are more effective in bypassing the Byzantine robust aggregations if they can coordinate their poisoned updates than if they each acted individually.

Byzantine Robust Aggregations. To address the vulnerabilities posed by poisoning attacks, the machine learning community has introduced several Byzantine-robust aggregation rules [7, 9, 17, 20, 35, 47, 58, 59]. These aggregations are specifically designed to mitigate the impact of adversarial clients by identifying and excluding malicious updates based on criteria such as dimension-wise filtering [4, 59], vector-wise filtering [7, 20, 34, 47], vector-wise scaling [51], knowledge transfer-based techniques [23, 36], singular value decomposition based techniques [13, 14], or encoding-based defenses [10, 31, 44]. These aggregation rules ensure that only benign updates contribute to the global model.

Why collusive model poisoning attacks are not practical. Collusion attack has practical challenges. As highlighted in prior work, launching a successful poisoning attack in realworld FL systems typically requires compromising around 20% of the total clients [17, 47]. In a cross-device FL system with 1 million participants, an attacker would need to control about 200,000 devices. They must also ensure reliable communication among these devices to produce consistent malicious updates, often using a botnet or command-andcontrol (C&C) server. However, this approach carries the risk of detection by firewalls. Cross-device FL further complicates coordination because clients can join and leave the network unpredictably, making it challenging to maintain synchronized behavior. Additionally, a C&C server creates a single point of failure: if any part of the system is compromised, the entire attack can fail. Therefore, sustaining reliable, large-scale collusion is impractical in real-world FL deployments, especially in cross-silo FL. Each client represents a trusted organization, such as a hospital or company, with robust security systems and regular monitoring. Breaching multiple secure networks is extremely difficult, and even if successful, coordinating malicious actions would be easily detectable. For these reasons, collusive poisoning attacks are not a realistic threat in cross-silo FL.

Attacks against Byzantine-Robust Aggregations. Despite the robustness of Byzantine-robust aggregation rules, recent studies [3, 17, 47, 48] have demonstrated that carefully crafted adversarial model updates can bypass them. These attacks exploit vulnerabilities in FL systems by injecting malicious updates that disrupt the aggregation process because they are not filtered out. We refer to these as Byzantinerobust attacks, which can be classified into two categories based on the attacker’s knowledge: (1) aggregation-agnostic attacks [3, 47] and (2) aggregation-targeted attacks [17, 47]. In aggregation-agnostic attacks, attackers create malicious updates without knowing the central server’s aggregation algorithm, aiming to be effective across various rules by exploiting detection systems’ limitations in detecting adversarial patterns. These attacks are challenging because of a lack of knowledge about the server’s mechanisms. In contrast, aggregation-targeted attacks use specific knowledge of the server’s rules to design updates that bypass defenses. Byzantine-robust attacks differ in strategy and the amount of information accessible to the adversary.FL also allows for various levels of attacker knowledge [48]. In a full knowledge scenario [3, 17], the attacker has access to the code and

Injection of fake clients. Recent research, such as MPAF [8] and PoisonedFL [57], has proposed the use of fake clients in federated learning as a strategy to reduce the need for compromising a large number of genuine clients. These fake clients are entirely controlled by the attacker and allow for the coordination of malicious updates without breaching real user devices. By using virtualization tools such as emulators or virtual machines, an attacker can effectively scale the number of fake clients at a relatively low cost. However, this increases the likelihood of being detected by client verifica3

Practicality of Non-Collusive Attacks. Non-collusive attacks are more practical in real-world settings than collusive ones due to their decentralized nature. They do not require coordination among compromised devices, making largescale attacks more feasible. Devices may be compromised through various means such as malware infections, firmware vulnerabilities, or misconfigured update channels [15, 16]. Once infected, these devices independently construct malicious updates and submit them to the central server without relying on any peer-to-peer communication. This decentralized approach eliminates the risk of a single point of failure. Even if some compromised devices are detected, others can continue their attacks, thereby ensuring the threat’s persistence. This characteristic makes non-collusive attacks more realistic and practical for real-world FL deployments.

tion mechanisms, which can limit its viability in secure or verification-aware federated learning deployments. Focus of our work: In this research, we focus on untargeted, non-collusive, aggregation-agnostic Byzantine-robust model poisoning attacks, which pose a significant threat to federated learning systems.

3. Non-Collusive Poisoning Attacks in Federated Learning We introduce a new and realistic adversarial setting in FL called non-collusive poisoning attacks. This concept is inspired by the practical challenges of collusive attacks discussed earlier. In this setting, each compromised client independently crafts malicious model updates without coordinating or communicating with other clients or relying on a centralized C&C server. We define non-collusive poisoning attacks as,

Illustrative Threat Scenario. To demonstrate the feasibility of non-collusive attacks in real-world deployments, we present a hypothetical attack against a production FL system (such as Gboard [21]): 1. An adversary distributes stealthy malware through zeroday exploits, malicious apps, or supply chain vectors to silently infect Android devices. 2. On each infected device, the malware detects participation in FL by monitoring indicators such as installed packages, FL-related APIs, or known training schedules. 3. Once FL participation is detected, the malware activates a rootkit that intercepts the local FL training pipeline and modifies model updates before transmission. 4. The malware then generates a poisoned model update using only locally available information: its own data, the local model, and the received global model, without any inter-device communication or coordination. 5. This process operates autonomously on each infected device, enabling large-scale poisoning of the FL process without centralized control or synchronized behavior. This process mirrors the functionality of real-world malware campaigns such as Triada (modular rooting Trojan), Stuxnet (selective targeting of industrial control systems), and Joker (stealthy exfiltration of data via malicious apps). They illustrate the possibility of stealthy and targeted clientside manipulation in the wild [33, 46, 49]. In this scenario, all compromised clients share the same adversarial objective imposed by the malware payload, ensuring aligned attack behavior even without any communication among them.

Definition 1. An attack on an FL system is classified as non-collusive if the attacker does not share any information explicitly or implicitly with other compromised clients or any external C&C server while generating the malicious update. To formalize the information boundary for each adversarial client in the non-collusive setting, let i ∈ [1..k] index a compromised client. Let Pi denote its prior knowledge before round t (e.g., static code, local dataset, or previously observed global models), and let Ki denote the total knowledge available to client i when generating its malicious update ϕm i = A(Ki ), where A is the attacker’s local poisoning strategy. We distinguish non-collusive and collusive adversaries based on the presence or absence of shared private information across clients: ∀i ∈[1 . . . k], ∀j ̸= i, ( (Ki − Pi ) ∩ (Kj − Pj ) =

∅, ̸ ∅, =

if i is non-collusive if i is collusive

This non-collusive adversary model represents realistic threat scenarios where compromised clients operate independently. This situation is common in malware-based attacks, in which each infected device behaves independently of others. In this context, non-collusive adversaries may initiate either data poisoning or model poisoning attacks, relying solely on the information available to each client. While several previous studies on data poisoning [40, 41, 50, 52] fit within this non-collusive framework, these attacks often demonstrate limited effectiveness, especially against robust aggregation defenses. In contrast, a systematic exploration of non-collusive model poisoning has mainly been overlooked in the existing literature. To the best of our knowledge, this is the first study to investigate non-collusive model poisoning attacks in the context of Byzantine-robust aggregations.

4. XFED: A Practical Non-Collusive Model Poisoning Attack We introduced the concept of non-collusive attacks, in which compromised devices operate independently without requiring communication between attackers. To demonstrate this concept, we present XFED, a non-collusive, aggregationagnostic, untargeted model poisoning attack that functions 4

under a restrictive threat model. We will first outline the theoretical threat model of XFED, followed by the mathematical formulation of the XFED attack.

sign(ϕb ) Inverse sign (ψsgn ): ψsgn = − ∥sign(ϕb )∥ , where sign(ϕb ) 2 returns a vector with elements [+1, -1, 0] based on the sign of each element in ϕb .

4.1. Threat Model

4.2.2. Robust Estimation of the Scaling Coefficient To maximize the impact of ϕm while avoiding detection as an outlier, the scaling factor µ must be chosen carefully. The malicious update ϕm must steer the global model in the adversarial direction without exceeding the natural variation observed among benign updates ϕb1 , ϕb2 , . . . , ϕbk . In other words, it should remain just below the filtering thresholds used by Byzantine-robust aggregators, adapt over time, and appear statistically consistent with honest client behavior. Therefore, our objective is:

Attacker’s Goal. Following prior works [3, 17, 47], the attacker’s objective is to poison the training process of FL such that the final global model produces incorrect predictions on a large portion of test inputs, without targeting specific classes. Attacker’s Capabilities. The attacker can stealthily change the benign model update and send the changed poisonous model update to the central server. It can perform a polynomial time calculation to generate the poisonous model update. However, attackers cannot communicate or coordinate with anything outside of the client device, making the setting fully non-collusive.

max µ = ∥ϕm − ϕb ∥2 , s.t. µ not an outlier for the set µ

{ d | d = ∥ϕbi − ϕbj ∥2 , ∀ i, j ∈ [1, k] }. Prior model poisoning attacks [3, 17, 47, 48] compute scaling factors by leveraging benign client updates. However, in the non-collusive setting considered by XFED, adversaries do not have access to benign models. Instead, we propose that the attacker estimate µ using the sequence of global models (θ(1) , θ(2) , . . . , θ(t) ) received up to round t. Our intuition is that, as benign local models progressively converge in each round and the global model is computed as their aggregation, after a sufficient number of rounds, the distances between benign local models become comparable to the distances between successive global models (i.e., the current and previous rounds). We maintain a list of these distances to compute µ. To determine a stable and reliable value, we adopt the Median with MAD estimator [22]. The median is resilient to extreme fluctuations that may arise in early rounds of training or during successful attacks, where the distances between successive global models may not reflect typical benign behavior. Median with MAD provides a robust method for detecting outliers, and we use this threshold to bound µ. Below, we describe our procedure for computing µ,

Attacker’s Knowledge. We consider a restrictive background knowledge scenario, where the attacker’s access is limited solely to information on their own device. Specifically, the attacker can access their local training data, local training code, and the sequence of global model updates θ(t) received in each round from the central server. The attacker has no access to the central server’s aggregation rule, global training data, code or updates from other clients.

4.2. XFED Formulation We aim to craft malicious local model updates that push the global model off a benign learning trajectory and degrade its performance. The adversary computes a benign model update ϕb using local data from the compromised client. To create the malicious update, the attacker selects a perturbation vector ψ that defines a malicious direction in the gradient space. The final malicious update ϕm is generated by scaling the benign update in the malicious direction: ϕm = ϕb + µψ, where µ is a scaling coefficient that limits the deviation. This controlled perturbation allows the attack to bypass Byzantine-robust aggregation defenses while still maximizing global model degradation.

Step 1: List of global deltas. For the global model θ(t) at round t, we define its delta from the previous round as ∆θ(t) = θ(t) − θ(t−1) and maintain a list of all deltas:

4.2.1. Introducing perturbation vectors

H(t) = { ∆θ(1) , . . . , ∆θ(t) }.

In the literature, three perturbation vectors (ψ) are frequently used for crafting adversarial updates: inverse sign, inverse unit vector, and inverse standard deviation [3, 47, 48]. We adopt inverse sign (ψsgn ) and inverse unit vector (ψuv ); but exclude the inverse standard deviation direction, as it requires variance across multiple updates, which is infeasible in our proposed non-collusive setting. We denote XFED with the inverse unit vector as the perturbation direction as Xuv , and XFED with the inverse sign vector as Xsgn . We define both the perturbation vectors below. b Inverse unit vector (ψuv ): ψuv = − ∥ϕϕb ∥2

Step 2: Robust center and scale estimation. For each coordinate j ∈ {1, . . . , |∆θ(t) |} we compute the coordinatewise median med and MAD mad of H(t) : medj = median(∆θj ), ∆θ∈H(t)

madj = median|∆θj −medj |. ∆θ∈H(t)

Step 3: Determining scaling coefficient based on MAD. We then form a robust scale vector s = med + λ · mad, 5

where λ ≥ 0 controls the aggressiveness of the attack. A recommended maximum value for λ in existing literature [26] is 5.19. However, practically we find any value of λ ∈ [2, 10] has measurable impact. We discuss the choice of λ in more details at Appendix A.2. The final scaling coefficient µ is obtained as the ℓ2 norm of this vector:

non-aggregation-agnostic attacks (LIE [3], Min-Max [47], and Min-Sum [47]) and an aggregation-targeted attack, Fang [17]. Due to space constraints, detailed descriptions of these attacks, aggregations, and defenses are provided in Appendix B.2, B.3, and B.4. Unless specified, we assume that 20% of clients are malicious in all our experiments. For MPAF and PoisonedFL, when we refer to % of malicious clients, we mean the % of fake clients injected.

µ = ∥s∥2 = ∥med + λ · mad∥2 . This choice makes µ proportional to a robust upper bound on typical coordinate-wise variation of recent global updates.

5.2. Main Results In this section, we compare the performance of Xsgn and Xuv with state-of-the-art model poisoning attacks. The results are presented in Table 1, where the Aθ column indicates “No Attack” setting, while the remaining columns report the attack impact Iθ for different attacks. For MPAF and PoisonedFL “No Attack” means no fake clients are injected and for the other attacks it means no clients are compromised.

4.2.3. Final malicious update. Finally, the attacker submits the malicious update ϕm = ϕb + µψ as the poisoned model. As XFED operates in a non-collusive setting where each adversarial client generates its own malicious update independently, unlike other collusive attacks, XFED does not need random noise injection. However, attackers can introduce lightweight randomness ϵ to obscure malicious patterns, such as by using truncated Gaussian jitter for perturbation. The final submitted update then becomes ϕm = ϕb + µψ + ϵ.

Measurement Metrics. Let Aθ and A∗θ denote the average accuracy of the final 10% of training rounds in both the noattack and the under-attack settings. We define the attack impact Iθ as Iθ = Aθ − A∗θ .

XFED outperforms existing attacks. As shown in Table 1, our proposed Xuv attack outperforms all state-of-theart model poisoning attacks for all the combinations of aggregation rules, dataset, and model architecture by substantial margins in almost all cases despite the absence of client-to-client communication. For instance, on the MNIST dataset, Xuv attack is 2.29× to 14.135× more impactful than the state-of-the-art attacks. LIE is ineffective in most cases when a defense is deployed; while MPAF and PoisonedFL are effective to some extent against some defenses, e.g., Median, Tr-Mean, and FoolsGold, they are ineffective against others, e.g., CC, SgnG, and FLAME. Our proposed Xuv substantially outperforms Min-Sum, Min-Max, LIE, and MPAF in almost all cases. For instance, on the FashionMNIST dataset, Xuv achieves 3.39x higher impact than MinMax at attacking FLAME. We detail why Xuv outperforms existing attacks in Appendix C.1. One important observation is that the Fang attack sometimes outperforms our attacks when the aggregation is Multi-Krum, and in some cases TrMean by a small margin. This is because Fang’s attack is aggregation-targeted and specifically tailored for Krum and Tr-Mean aggregation, so the performance gap is expected.

Baseline Aggregations, Defenses, & Attacks. We evaluate the performance of our proposed attacks (Xsgn & Xuv ) against most popular aggregation FedAvg [38], five byzantine-robust aggregations (Multi-Krum [7], TrimmedMean(Tr-Mean) [59], Median [59], Clipped-Clustering (CC) [35], and SignGuard(SgnG) [58]), and four state-of-theart defenses (FLTrust [9], FLAME [43], FoolsGold [19], and FreqFed [18]). We compare our attacks with other attacks that aim to meet the practicality requirements defined by Shejwalkar et al. [48], MPAF [8], and PoisonedFL [57], which use the injection of fake clients into the FL system. For a complete benchmark, we also compare with other non-practical state-of-the-art attacks, including three

XFED breaks state-of-the-art FL defenses. We observe that none of the state-of-the-art aggregations or defenses (except for FLtrust) can effectively mitigate our proposed Xuv attack for any combination of aggregation rules, datasets, or model architectures. Specifically, Xuv increases Iθ by 7.35 to 81.18 across the MNIST dataset. Our results show that existing FL defenses are not robust, even if an attacker does not know the defense deployed on the server or any information about the other clients (benign or compromised). Our attacks and other state-of-the-art attacks work exceptionally well against FedAvg, as it is not Byzantine-robust and fails to filter out malicious updates. We detail why Xuv breaks FL defenses in Appendix C.2.

5. Evaluation 5.1. Experimental Setup FL Settings & Datasets. We use datasets from different domains, like four image classification benchmarks (MNIST [12], EMNIST [11], Fashion-MNIST [55], CIFAR-10 [32]), one customer transaction behavior dataset (Purchase-100 [54]), and one human activity recognition dataset (HAR) [1]. Unless specified, all datasets are independent and identically distributed (iid) except HAR. Detailed descriptions of the datasets and model architectures are in the Appendix B.1. We consider cross-silo FL settings unless noted otherwise. For our attack XFED, we set λ = 4.

Table 1. Attack impact Iθ of the global model under different attacks (20% malicious clients), aggregation rules, and defenses for different datasets. We assume Fang, LIE, Min-Max, and Min-Sum have access to the model updates on all compromised clients, and Fang further has access to the aggregation rule, which gives advantages to these attacks. Our proposed Xsgn and Xuv do not have access to any of these knowledge. In each row, we highlight in bold the highest attack impact or the closest to the highest. Aθ

Xsgn

Xuv

Min-Sum

Min-Max

Fang

LIE

MPAF

Aθ

PoisonedFL

(a) Purchase (Cross-silo, 100 FL clients, 500 global iterations & 3 layer DNN model) FedAvg Median Tr-Mean M-Krum CC SgnG FLTrust FreqFed FoolsGold FLAME

74.82 72.14 73.79 74.54 74.69 74.43 73.97 73.64 74.16 74.03

55.2 37.14 42.71 4.04 50.48 50.23 2.16 3.55 15.63 49.43

67.53 36.31 43.43 17.48 68.86 67.98 8.83 68.31 56.01 52.9

22.01 33.11 33.17 16.85 33.82 34.8 7.12 45.38 4.41 45.75

35.39 35.46 36.1 9.48 48.03 50.68 8.55 58.91 4.47 52.2

74.35 7.09 21.13 17.55 -

7.65 14.85 14.77 13.56 3.65 2.94 6.99 17.24 3.69 26.9

65 16.8 24.24 3.54 4.88 4.08 4.04 3.47 3.6 3.23

72.18 35.7 43 4.67 4.71 3.34 3.18 4.76 2.99 3.82

95.02 94.61 94.69 94.57 94.08 95.31 95.49 94.32 94.8 93.33

(c) Fashion-MNIST (Cross-silo, 40 FL clients, 250 global iterations & 3 layer DNN model) FedAvg Median Tr-Mean M-Krum CC SgnG FLTrust FreqFed FoolsGold FLAME

85.19 85.18 85.57 85.51 85.22 85.66 86.32 85.68 85.69 85.64

FedAvg Median Tr-Mean M-Krum CC SgnG FLTrust FreqFed FoolsGold FLAME

84.98 84.39 84.02 84.25 83.88 83.6 83.3 83.1 84.45 83.5

FedAvg Median Tr-Mean M-Krum CC SgnG FLTrust FreqFed FoolsGold FLAME

96.98 94.31 96.79 96.48 97.097 97.17 96.05 94.81 97.21 94.93

13.24 10.12 10.75 2.73 7.14 6.86 2.98 3.56 3.39 4.15

43.04 20.22 12.22 10.2 42.28 42.98 3.5 47.13 10.22 44.17

23.92 21.44 15.1 10.11 26.51 22.14 3.56 25.35 3.31 23.93

7.59 7.82 7.19 9.34 11.13 9.82 5.7 20.42 2.81 22.04

74.35 22.43 15.2 11.2 -

6.74 14.87 8.93 10.26 3.47 3.75 5.825 8.69 3.99 9.68

67.44 2.5 3.32 3.3 3.13 3.51 5.7 4.66 4.18 4.2

55.27 18.29 18.97 9.86 19.94 35.24 1.84 66.39 4.67 67.54

7.51 6.07 5.62 6.94 6.67 8.81 1.19 13.1 3.36 7.17

7.59 7.82 7.19 9.34 9.79 9.82 1.25 1.75 2.41 19.9

74.35 22.43 15.1 11.2 -

6.74 14.87 8.93 10.26 2.13 3.75 6.27 6.11 4.1 3.94

73.21 1.53 1.45 3.37 2.85 1.83 8.32 2.43 2.91 2.56

76.39 74.19 73.79 74.42 74.66 74.42 71.2 70.76 74.39 71.07

60.12 12.2 15.5 10.46 44.257 44.43 1.82 51.27 6.81 56.24

Attack Impact

M-Krum

19.51 8.39 10.61 9.95 30.497 33.63 2.09 30.19 2.44 41.37

34.13 8.24 11.46 5.19 43.617 42.41 3.25 50.54 4.06 55.04

7.43 0.89 3.25 12.25 -

90.2 10.22 10.2 0.39 8.987 2.13 8.5 -0.54 3.25 -0.3

1.08 0.42 2.67 2.48 7.167 1.62 10.1 -0.81 2.48 8.98

Tr-Mean

Min-Sum

Min-Max

Fang

LIE

MPAF

PoisonedFL

29.42 13.73 14.38 9.34 13.13 24.57 6.52 5.95 35.91 3.38

81.43 12.21 15.19 12.5 80.1 81.18 7.35 80.87 36.11 79.24

9.39 12.5 10.97 10.32 13.49 12.66 8.2 16.14 4.48 14.93

85.22 14.31 21.27 11.91 -

17.7 11.43 13.64 9.08 23.57 25.21 8.25 35.18 3.56 34.07

4.98 8 6.91 7.68 4.62 5.3 7.4 9.69 2.49 11.34

84.92 5.15 5.55 5.58 3.32 3.99 4.98 5.72 4.36 3.44

83.62 8.28 14 4.69 5.6 6.87 7.2 6.79 3.38 3.56

71.24 70.96 16.95 5.79 9.27 7.79 2.49 3.43 6.15 4.58

25.28 21.63 21.66 21.7 41.17 49.26 5.72 65.8 6.58 66.1

16.22 17.07 14.55 16.63 19.28 18.84 11.69 20.29 6.63 21.03

17.06 13.93 15.24 19.48 34.44 34.52 12.25 36.56 6.85 41.57

26.11 4.97 10.57 13.26 -

5.11 5.95 7.06 2.75 3.23 1.74 9.15 3.79 6.71 6.56

69.29 6.09 6.82 7.02 7.12 8.03 10.12 3.06 6.82 3.47

65.29 19.49 21.89 6.86 7.13 6 2.76 3.48 5.89 4.08

(f) CIFAR-10 (Cross-silo, 50 FL clients, 255 global iterations & AlexNet model)

73.97 20.7 25.42 3.96 3.33 4.15 2.67 3.24 4.06 4.03

86.54 82.38 80.4 81.56 81.04 83.88 80.2 81.34 85.21 84.25

(g) HAR (Cross-silo, 30 FL clients, 1000 global iterations & Logistic Regression model) 20.12 1.2 8.71 8.4 13.277 15.48 1.94 4.72 2.17 7.59

Xuv

(d) EMNIST (Cross-silo, 200 FL clients, 400 global iterations & 3 layer DNN model)

43.24 10.14 11.76 3.41 4.09 38.13 2.72 5.4 10.12 3.84

(e) Fashion-MNIST (Cross-silo, 40 FL clients, 250 global iterations & AlexNet model) 12.16 8.83 7.27 3.08 2.61 2.19 0.57 15.98 3.39 5.15

Xsgn

(b) MNIST (Cross-silo, 100 FL clients, 275 global iterations & 4 layer DNN model)

76.54 20.79 15.23 6.69 7.15 14.02 4.23 15.11 24.58 10.28

76.54 26.12 51.22 21.93 63.21 28.42 8.77 29.86 53.56 67.53

23.57 19.45 17.21 18.16 20.14 16.93 6.86 16.19 12.73 28.2

22.09 20.46 16.02 20.62 19.51 16.05 7.66 17.24 11.54 28.44

72.15 34.56 52.4 12.6 -

38.92 18.78 38.55 22.44 6.61 4.5 8.67 8.31 10.9 62.15

76.54 8.94 8.3 6.42 6.73 11.66 9.38 9.81 52.18 11.48

62.36 38.16 50.85 3.48 5.57 7.23 6.07 5.34 10.55 8.85

(h) EMNIST (Cross-device, 50000 FL clients, 400 global iterations & 3 layer DNN model)

57.24 10.448 15.49 0.35 11.958 40.52 -0.5 -0.42 2.79 0.08

71.14 70.85 73.29 75.72 75.79 75.87 70.8 71.36 74.51 72.97

50.28 15.18 20.17 10.2 8.73 9.98 5.36 9.7 8.15 7.08

SgnG

FoolsGold

10 15 20 25 30 0

60.93 14.35 21.11 15.56 65.63 64.52 1.81 66.3 10.1 68

14.93 15.29 17.33 18.79 28.46 26.99 6.86 25.7 8.54 33.86

41.92 15.01 23.48 22.39 52.41 49.66 5.83 62.45 8.95 68

50 14.98 22.07 22.64 -

4.85 15.27 5.89 6.83 2.54 1.43 1.57 1.91 9.33 3.34

70.02 4 16.21 16.56 8.06 8.82 5.97 3.68 9.82 6.1

58.7 15.23 22.22 20.42 8.1 8.4 1.98 5.08 8.58 6.09

FreqFed

FLAME

FLTrust

90 80 70 60 50 40 30 20 10 0 0

10 15 20 25 30 0

Xuv

10 15 20 25 30 0

Xsgn

10 15 20 25 30 0

M in − M ax

F ang

LIE

10 15 20 25 30 0

M in − Sum

M P AF

10 15 20 25 30 0

10 15 20 25 30

P oisonedF L

Figure 1. Attack Impact Iθ on global models with increasing malicious clients across various defenses and attacks (MNIST dataset).

However, FLTrust mitigates the Xuv attack and other attacks by using a small trusted root dataset in the server to compute a reference gradient that allows it to filter updates that deviate from the expected direction. While Table 1 suggests FoolsGold is an effective defense, its performance varies significantly across datasets. Fig. 1 reveals its unreliability, as it performs poorly with few attackers but improves with

more malicious clients. However, its effectiveness drops again at higher attack ratios, underscoring its instability. Impact of cross-device setting. We also compare the performance of Xsgn and Xuv in cross-device settings for EMNIST (Table 1) and Purchase (Appendix C.3) datasets. In this setting, we simulate an FL system of 50,000 clients, and 7

Attack Impact

M-Krum 90 80 70 60 50 40 30 20 10 0 .1

Aθ

.9 .1

Xuv

SgnG

Tr-Mean

.9 .1

Xsgn

.9 .1

M in − M ax

FoolsGold

.9 .1

F ang

LIE

FreqFed

FLAME

.9 .1

M in − Sum

.9 .1

M P AF

FLTrust

.9 .1

P oisonedF L

Figure 2. Attack impact Iθ on global models as a function of the degree of non-IID under different defenses and attacks (Purchase Dataset).

in each training round, the server selects a random subset of 1% (500 clients) to participate in training. Similar to cross-silo setting, Xuv outperforms all other attacks for all the combinations of aggregations and defenses (except FLTrust) by a substantial margin in almost all cases.

dataset, model, and aggregation, varying the perturbation (ψsgn and ψuv ) significantly changes the impact of our attacks. Overall, the ψuv tends to produce stronger attack impacts and in Appendix A.3, we discuss possible reasons. Due to space limitations, we provide additional results including the effects of varying the percentage of malicious clients in the cross-device setting, the impact of different neural network architectures, and the influence of various attack parameters in Appendix C.4, C.6, and C.7.

5.3. Impact of FL Settings Impact of the percentage of malicious clients. Fig. 1 shows the impact of model poisoning attacks on the learnt global model as the percentage of malicious clients in FL varies from 1% to 30% for the MNIST datasets. Xuv outperforms all other attacks in most settings and across all percentages of malicious clients. First, we observe that our proposed Xuv attack is more effective; the attack impact increases as the fraction of malicious clients is increased. Second, even with only 5% of malicious clients Xuv can already break CC, SgnG FoolsGold, FLAME, and FreqFred. However, existing attacks cannot reach such effectiveness until 20% of clients are malicious. We note that as the percentage of malicious clients increases, the impact of our attacks and the differences between them and existing ones become more significant across all aggregation rules, in most cases. Due to limited space, we show the impact of the percentage of malicious clients on MNIST(Fed-Avg & Median) and the Purchase dataset in Appendix C.4.

6. Practical Defense Recommendations We disagree with the conclusion of Shejwalkar et al. [48] that FedAvg alone is sufficient to protect real-world FL systems from poisoning attacks. Our experiments show that FLTrust is the most consistent and effective defense across all evaluated attacks, even with 30% adversarial clients. When a small, trusted root dataset can be collected, we recommend FLTrust for practical FL deployments. However, its performance is highly sensitive to the class distribution of the root dataset. In our experiments (Appendix C.8), on the Purchase dataset, increasing the bias from 0.1 to 0.7 leads to a substantial accuracy drop (from 73.91% to 61.9%). When a root dataset is unavailable, we recommend the Multi-Krum, which is effective for lower adversarial participation rates (i.e., fewer than 20% malicious clients).

Impact of the degree of non-IID. In our experiments, we use a parameter p to control the degree of non-IID among the clients’ local training data, where 0.1 ≤ p ≤ 1 [17]. A larger value of p indicates a higher degree of non-IID data. Fig. 2 shows the impact of different attacks on the global model as p increases from 0.1 to 0.9 on the Purchase dataset. We detail the description of simulating non-IID data distribution and the impact of the degree of non-IID on the Purchase (FedAvg & Median) and MNIST datasets in Appendix C.5. We observe that Xuv consistently achieves high attack impact across different settings of p under different defenses. However, we also note that as the degree of non-IID increases, the global model accuracy, Aθ , decreases (as shown in the graph), and consequently, the attack impact decreases.

7. Conclusions In this work, we introduce the concept of non-collusive attacks and propose a more practical threat model for poisoning in FL. This model assumes that malicious clients act independently, without coordination or shared information. We show that realistic adversaries can compromise a modest fraction of clients via common attack vectors, such as malware, and launch highly effective, stealthy poisoning attacks. To demonstrate this feasibility, we present the XFED framework as a representative non-collusive attack model. Our results reveal that an attacker can substantially degrade the global model even without knowledge of other adversarial or benign clients, or of the aggregation rules and defenses deployed at the server. Overall, XFED exposes a critical

Impact of perturbation vectors. We find that, for a given 8

vulnerability in current FL systems and highlights the urgent need to develop more robust defenses.

algorithm for stochastic optimization. In International Conference on Machine Learning, pages 1596–1606. PMLR, 2019. [15] Jessica Valasek Estenssoro. Malware and virus statistics 2024: The trends you need to know about. https://www.avg. com/en/signal/malware-statistics, 2024. Published on AVG Antivirus’ website. [16] Olufunsho I. Falowo, Murat Ozer, Chengcheng Li, and Jacques Bou Abdo. Evolving malware and ddos attacks: Decadal longitudinal study. IEEE Access, 12:39221–39237, 2024. [17] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to {Byzantine-Robust} federated learning. In 29th USENIX Security Symposium (USENIX Security 20), pages 1605–1622, 2020. [18] Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Freqfed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning. 2025. [19] Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. Mitigating sybils in federated learning poisoning. arXiv preprint arXiv:1808.04866, 2018. [20] Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pages 3521–3530. PMLR, 2018. [21] Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604, 2018. [22] David C Hoaglin, Frederick Mosteller, and John W Tukey. Understanding robust and exploratory data analysis. John Wiley & Sons, 2000. [23] Chang Hongyan, Shejwalkar Virat, Shokri Reza, and Houmansadr Amir. Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer. arXiv preprint arXiv:1912.11279, 2019. [24] Chao Huang, Jianwei Huang, and Xin Liu. Cross-silo federated learning: Challenges and opportunities. arXiv preprint arXiv:2206.12949, 2022. [25] Yutao Huang, Lingyang Chu, Zirui Zhou, Lanjun Wang, Jiangchuan Liu, Jian Pei, and Yong Zhang. Personalized cross-silo federated learning on non-iid data. Proceedings of the AAAI Conference on Artificial Intelligence, 35(9):7865– 7873, 2021. [26] Boris Iglewicz and David C Hoaglin. Volume 16: how to detect and handle outliers. Quality Press, 1993. [27] Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy (SP), pages 19–35. IEEE, 2018. [28] Sai Praneeth Karimireddy, Martin Jaggi, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian U Stich, and Ananda Theertha Suresh. Breaking the centralized barrier for cross-device federated learning. 34:28663–28676, 2021.

References [1] Davide Anguita, Alessandro Ghio, Luca Oneto, Xavier Parra, Jorge Luis Reyes-Ortiz, et al. A public domain dataset for human activity recognition using smartphones. In Esann, pages 3–4, 2013. [2] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, pages 2938–2948. PMLR, 2020. [3] Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019. [4] Jeremy Bernstein, Jiawei Zhao, Kamyar Azizzadenesheli, and Anima Anandkumar. signsgd with majority vote is communication efficient and fault tolerant. arXiv preprint arXiv:1810.05291, 2018. [5] Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning, pages 634–643. PMLR, 2019. [6] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017. [7] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017. [8] Xiaoyu Cao and Neil Zhenqiang Gong. Mpaf: Model poisoning attacks to federated learning based on fake clients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3396–3404, 2022. [9] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In ISOC Network and Distributed System Security Symposium (NDSS), 2021. [10] Lingjiao Chen, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Draco: Byzantine-resilient distributed training via redundant gradients. In International Conference on Machine Learning, pages 903–912. PMLR, 2018. [11] Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (IJCNN), pages 2921–2926. IEEE, 2017. [12] Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine, 29(6):141–142, 2012. [13] Ilias Diakonikolas, Gautam Kamath, Daniel M Kane, Jerry Li, Ankur Moitra, and Alistair Stewart. Being robust (in high dimensions) can be practical. In International Conference on Machine Learning, pages 999–1008. PMLR, 2017. [14] Ilias Diakonikolas, Gautam Kamath, Daniel Kane, Jerry Li, Jacob Steinhardt, and Alistair Stewart. Sever: A robust meta-

[29] Jakub Konečnỳ, H Brendan McMahan, Daniel Ramage, and Peter Richtárik. Federated optimization: Distributed machine learning for on-device intelligence. arXiv preprint arXiv:1610.02527, 2016. [30] Jakub Konečnỳ, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 2016. [31] Konstantinos Konstantinidis and Aditya Ramamoorthy. Byzshield: An efficient and robust system for distributed training. Proceedings of Machine Learning and Systems, 3: 812–828, 2021. [32] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009. [33] Ralph Langner. Stuxnet: Dissecting a cyberwarfare weapon. IEEE Security & Privacy, 9(3):49–51, 2011. [34] Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. Rsa: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In Proceedings of the AAAI conference on artificial intelligence, pages 1544–1551, 2019. [35] Shenghui Li, Edith C-H Ngai, and Thiemo Voigt. An experimental study of byzantine-robust aggregation schemes in federated learning. IEEE Transactions on Big Data, 2023. [36] Tao Lin, Lingjing Kong, Sebastian U Stich, and Martin Jaggi. Ensemble distillation for robust model fusion in federated learning. Advances in neural information processing systems, 33:2351–2363, 2020. [37] Saeed Mahloujifar, Mohammad Mahmoody, and Ameer Mohammed. Universal multi-party poisoning attacks. In International Conference on Machine Learning, pages 4274–4283. PMLR, 2019. [38] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. CommunicationEfficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017. [39] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communicationefficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017. [40] Israt Jahan Mouri, Muhammad Ridowan, and Muhammad Abdullah Adnan. Towards poisoning of federated support vector machines with data poisoning attacks. In Proceedings of the 13th International Conference on Cloud Computing and Services Science - CLOSER,, pages 24–33. INSTICC, SciTePress, 2023. [41] Israt Jahan Mouri, Muhammad Ridowan, and Muhammad Abdullah Adnan. Data poisoning attacks and mitigation strategies on federated support vector machines. SN Computer Science, 5(2):241, 2024. [42] Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th

ACM workshop on artificial intelligence and security, pages 27–38, 2017. [43] Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security 22), pages 1415–1432, 2022. [44] Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Detox: A redundancy-based framework for faster and more robust gradient aggregation. Advances in Neural Information Processing Systems, 32, 2019. [45] Muhammad Habib ur Rehman, Ahmed Mukhtar Dirir, Khaled Salah, Ernesto Damiani, and Davor Svetinovic. Trustfed: A framework for fair and trustworthy cross-device federated learning in iiot. IEEE Transactions on Industrial Informatics, 17(12):8485–8494, 2021. [46] Tejpal Sharma and Dhavleesh Rattan. Characterization of android malwares and their families. ACM Comput. Surv., 57 (5), 2025. [47] Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021. [48] Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning. In IEEE Symposium on Security and Privacy, 2022. [49] Luman Shi, Jiang Ming, Jianming Fu, Guojun Peng, Dongpeng Xu, Kun Gao, and Xuanchen Pan. Vahunt: Warding off new repackaged android malware in app-virtualization’s clothing. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, page 535–549, New York, NY, USA, 2020. Association for Computing Machinery. [50] Gan Sun, Yang Cong, Jiahua Dong, Qiang Wang, Lingjuan Lyu, and Ji Liu. Data poisoning attacks on federated machine learning. IEEE Internet of Things Journal, 2021. [51] Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019. [52] Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In European Symposium on Research in Computer Security, pages 480–501. Springer, 2020. [53] Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems, 33:16070–16084, 2020. [54] Yu-Ting Wen, Pei-Wen Yeh, Tzu-Hao Tsai, Wen-Chih Peng, and Hong-Han Shuai. Customer purchase behavior prediction from payment datasets. In Proceedings of the Eleventh ACM International Conference on Web Search and Data Mining, pages 628–636, 2018. [55] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017. [56] Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine-tolerant sgd by inner product

manipulation. In Uncertainty in Artificial Intelligence, pages 261–270. PMLR, 2020. [57] Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Model poisoning attacks to federated learning via multi-round consistency. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 15454–15463, 2025. [58] Jian Xu, Shao-Lun Huang, Linqi Song, and Tian Lan. Byzantine-robust federated learning through collaborative malicious gradient filtering. In 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS), pages 1223–1235. IEEE, 2022. [59] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pages 5650–5659. PMLR, 2018.

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers Supplementary Material ∥∆θ(t) ∥ is a function of the distribution of benign local updates in that round: if benign updates are larger or more spread out, the global step tends to be larger; if they are small and concentrated, the global step is small. This makes the norm ∥∆θ(t) ∥ a natural proxy for the overall scale of benign local updates in that round. Geometrically, we can view the benign local updates in round t as points scattered around θ(t−1) . Some of these points lie closer to θ(t−1) , others deviate more strongly depending on their local data and gradients. When these updates are aggregated, the new global model θ(t) moves in the net direction favored by the majority of benign clients. The distance ∥∆θ(t) ∥ is therefore determined by the typical magnitude and orientation of benign updates: if benign clients collectively take larger steps, the global step is larger; if their updates are small and tightly concentrated, the global step is correspondingly small. We do not claim that ∆θ(t) equals the maximum pairwise distance between benign updates. However, it reliably reflects the scale of benign movement that the server “accepts” and amplifies in that round.

A. Design choices for XFED Prior model poisoning attacks [3, 17, 47, 48] compute scaling factors by leveraging benign client updates. In our noncollusive threat model, an attacker cannot observe the individual benign updates, nor can it compute their maximum pairwise distance or exact distribution. The only information available to every compromised client is the sequence of global models broadcast by the server. Therefore, our goal is not to estimate the true maximum benign distance (which is impossible without collusion), but to infer a plausible acceptable deviation scale—that is, how far a client update can deviate from the global model without being rejected by the aggregation rule. We propose that the attacker estimate µ using the sequence of global models (θ(1) , θ(2) , . . . , θ(t) ) received up to round t.

A.1. Why distances of global models represent the spread of local models As in round t of FL training, all benign clients start from the same global model θ(t−1) and perform local training to generate local models (t) ϕb1 ,(t) ϕb2 , . . . ,(t) ϕbk , we can write ith benign local update as,

With this proxy in hand, we can choose the scaling coefficient µ so that the malicious update ϕm lies within the empirically observed range of benign behavior. Intuitively, if we ensure that ∥ϕm − ϕb ∥ is comparable to or slightly larger than the typical global step size inferred from recent rounds, the malicious update will fall inside the benign “ball” that robust aggregators are designed to accept. To make this estimate robust and adaptive, we do not rely on a single round. Instead, we maintain the global steps H(t) = { ∆θ(1) , ∆θ(2) , . . . , ∆θ(t) } and apply robust statistics, the median and median absolute deviation (MAD), to this sequence. The median captures the typical global step size over the window, while MAD captures its variability in a way that is resistant to occasional spikes (for example, early rounds, transient non-stationarity, or brief periods of strong attack activity).

(t) (t) b ϕi = θ(t−1) + δi

These local models are aggregated to create the global model θ(t) , θ(t) = aggregation((t) ϕb1 ,(t) ϕb2 , . . . ,(t) ϕbk ) (t)

(t)

= aggregation(θ(t−1) + δ1 , θ(t−1) + δ2 , . . . , (t)

θ(t−1) + δk ) Conceptually, the global update ∆θ(t) = θ(t) − θ(t−1) is a summary of how the benign clients collectively moved away from the previous global model θ(t−1) . More precisely, we can say ∆θ(t) is an approximation of the aggregations of the local deltas, (t)

(t)

∆θ(t) ≈ Ã(δ1 , δ2 , . . . , δk ) where Ã is an aggregation that is close to the main aggregation on the update vectors by the global server aggregation. If the main aggregation is average, Ã is also average. Otherwise, for Byzantine-robust aggregations and defenses that filter out extremes, Ã is an estimation of the most closely related local deltas. Thus, in all cases, the norm

In this way, distances between consecutive global models act as a practical, non-collusive surrogate for the spread of benign local models: they summarize the magnitude of benign variation that actually passes through the aggregation filter, adapt to different datasets and architectures, and can be estimated solely from information available to each attacker. 1

Table 2. Constants for Common Distributions

A.2. Choice of scaling multiplier λ A.2.1. Robust Outlier Detection via Median and Median Absolute Deviation (MAD) The median absolute deviation (MAD) is a robust statistical measure used to assess data variability while minimizing the influence of outliers. For a univariate sample X = {x1 , x2 , . . . , xk }, the median, med = median(X) provides a robust estimate of central tendency that is insensitive to extreme values. The median absolute deviation (MAD) is then defined as,

Distribution

Relationship with standard deviation σ

Normal Uniform Exponential Laplace Logistic

σ ≈ 1.4826 × mad σ ≈ 1.1547 × mad σ ≈ 2.0781 × mad σ ≈ 2.0405 × mad σ ≈ 1.6205 × mad

A.3. Discussion on Perturbation Vector After µ, next important part of the XFED attack (ϕm = ϕb + µψ) is to determine the attack direction ψ. Specifically, we need to choose an attack direction as a unit vector so we can multiply it by µ to push ϕb in a malicious direction. To calculate ψ, we use the current round’s benign model update ϕb . Specifically, we consider two perturbation vectors: the inverse sign vector and the inverse unit vector.

mad = median(|xi − med|) , Unlike the standard deviation, MAD has a breakdown point of 50%, which means it remains stable even if up to half of the data points are extreme or adversarial. MAD is consistent with the standard deviation for normally distributed data, following the relationship σ ≈ 1.4826 × mad where σ is the standard deviation. In literature [26] to detect outliers in normal distribution, the following equation is used,

ψuv = −

xi − med |> D (1) 1.4826 × mad If xi satisfy the above equation, it is an outlier. Iglewicz and Hoaglin [26] recommended using D = 3.5. |

Now, we want to calculate a maximum limit for xi so that it is not considered an outlier. To maximize xi , we have to take xi > med ⇒ xi − med > 0. Therefore, from Equation 1 we find,

≤ 5.189 × mad + med

ψsgn = −

sign(ϕb ) . ∥sign(ϕb )∥2

Both ψsgn and ψuv are unit-norm direction vectors. Intuitively, these vectors are the reverse directions of ϕb , and scaling them up to an acceptable limit should push the global model “backwards” along a direction that will hamper its accuracy. If enough adversarial clients apply such updates, the global model gradually starts to unlearn. In our framework, the inverse unit vector (Xuv ) has a clear advantage over the inverse sign vector (Xsgn ). In ψsgn , each coordinate has the same magnitude, so the attack pushes equally in all dimensions, regardless of how important that dimension is for the current model. In contrast, ψuv preserves the relative magnitudes of ϕb : coordinates where |ϕbj | is large contribute more to ψuv , while coordinates with small |ϕbj | contribute less. Under benign training, largemagnitude coordinates typically correspond to parameters that have higher influence on the model’s predictions. By pushing more aggressively on these “important” dimensions and staying closer to ϕb on less relevant ones, Xuv is more effective at degrading the global model while still preserving a benign-looking structure. Empirically, we observe that Xuv consistently achieves stronger attack impact than Xsgn across datasets, architectures, and aggregation rules.

A.2.2. Upper limit for λ

xi ≤ 1.4826 × 3.5 × mad + med

ϕb , ∥ϕb ∥2

(2)

We extend the idea of Equation 2 to our calculation of µ. Specifically, we take coordinate-wise median and MAD of the global delta list H(t) and calculate the µ as, µ = ∥med + λ · mad∥2 where a practical highest limit for λ is 5.189 according to Equation 2. For a more complete limit, we look at other standard values of D used in practice and find they are in the range for D ∈ [2, 4.5]. In Equation 1 and Equation 2, the value 1.4826 comes from the relationship between standard deviation σ with mad for the normal distribution; for other distributions, the range is between [1.15, 2.1] as shown in the Table 2. This leaves us with the range for λ as

B. Additional Details of Experimental Setup B.1. Datasets

λ ∈ [1.15 × 2, 4.5 × 2.1]

We use multiple datasets from different domains in our evaluation, including four image classification benchmarks (MNIST [12], EMNIST [11], Fashion-MNIST [55], CIFAR-10 [32]), one customer transaction behavior dataset (Purchase-100 [54]), and one human activity recognition dataset (HAR) [1]. We vary both the number of clients and

∈ [2.3, 9.45] ∈ [2, 10] We experimented with different values of λ in the range [2, 10], and we report the results in Appendix C.7. 2

Table 3. The default cross-silo FL system parameter settings.

Parameter Architecture Number of clients in FL # local iterations # global iterations Batch size Learning rate Fraction of malicious clients (%) # malicious clients Training Samples Testing Samples Training samples per client

MNIST 4 layer DNN 100 1 275 256 1 20 20 60000 10000 600

EMNIST 3 layer DNN 200 1 400 256 0.3 20 40 697932 116323 3489

Purchase-100 3 layer DNN 100 1 500 128 0.1 20 20 157324 39480 1578

the model architectures across different datasets. We summarize the key configurations for each dataset and model in Table 3, including the number of clients, the total training and testing sample sizes, the number of training rounds, and the core hyperparameters (batch size and learning rate).

Fashion-MNIST AlexNet, 3 layer DNN 40 1 250 256 0.3 20 8 60000 10000 1500

CIFAR-10 AlexNet 50 1 255 250 1 20 10 50000 10000 1000

HAR LR 30 1 1000 32 0.001 20 6 7352 2947 201-299

rounds, with local training on mini-batches of 256 samples per client. We use AlexNet and a three-layer fully connected network architecture as the global models. CIFAR-10. CIFAR-10 [32] is a 10-class classification dataset with 60,000 color images (32 × 32 pixels). We configure our federated learning setup with 50 clients, each with 1,000 samples. Training is conducted over 255 rounds, with local training on mini-batches of 256 samples per client. We use an AlexNet architecture as the global model.

MNIST. MNIST[12] is a benchmark dataset containing 70,000 grayscale images of handwritten digits (28 × 28 pixels) across 10 classes. We configure our federated learning framework by distributing the dataset among 100 clients, each with 600 samples. We conduct training over 275 rounds, utilizing an SGD optimizer. Our global model architecture is a fully connected network with layers {784, 600, 100, 10}, with ReLU activations in each layer.

Human Activity Recognition (HAR). HAR [1] consists of sensor-based activity data collected from the smartphones of 30 real-world participants. Each sample contains 561 features, including accelerometer and gyroscope measurements, and is labeled with one of six activities: WALKING, WALKING UPSTAIRS, WALKING DOWNSTAIRS, SITTING, STANDING, or LAYING. The dataset comprises 10,299 examples. In our federated setting, each participant is treated as a distinct client, resulting in 30 clients in total. Unlike previous datasets, we do not need to distribute the data to clients in this dataset, since each user is naturally a client. We use 75% of each client’s local data for training and the remaining 25% for testing. The global model is a single-layer logistic regression classifier that maps the 561-dimensional input to the six activity classes. Training is performed over 1000 communication rounds using stochastic gradient descent (SGD) with a local batch size of 32.

EMNIST. EMNIST [11] is a 62-class classification dataset containing grayscale images (28 × 28) of handwritten characters, covering digits and both uppercase and lowercase letters. We use 200 clients, each with 600 training samples. During each communication round, we train locally on mini-batches of 256 images from each client’s dataset. For EMNIST, we implement a fully connected network (FC) with layer sizes {784, 512, 512, 62} as the global model architecture, with ReLU activations in the hidden layers. Purchase-100. Purchase-100 [54] is a 100-class classification dataset containing binary feature vectors of length 600, representing customer purchase patterns. We configure our federated learning framework with 100 clients, each with 1,578 samples. We train locally on mini-batches of 128 samples per client during each communication round. Training is conducted over 500 rounds using an SGD optimizer. Our global model architecture is a three-layer fully connected network with layer sizes {600, 1024, 100}.

B.2. State-of-the-art Model Poisoning Attacks A Little Is Enough (LIE). LIE [3] demonstrates that adding a small, carefully aligned perturbation to the local update can significantly degrade the global model while remaining undetected. To evade Byzantine-robust aggregation, LIE constructs a poisoned update by staying within the statistical range of benign client updates. In communication round (t) t, let ϕi denote the benign update of client i. For each (t) parameter j, the attacker computes the empirical mean µj

Fashion-MNIST. The Fashion-MNIST dataset [55] consists of 60,000 training and 10,000 test samples across 10 fashion classes. Each sample is a 28×28 grayscale image with 784 features representing the relative pixel intensities on a scale of [0, 255]. The setup configuration consists of 40 clients, each with 1,500 samples. Training is conducted over 250

(t)

and standard deviation σj across all benign updates (which 3

Min-Max. The Min-Max attack [47] is an aggregationagnostic model poisoning attack designed to make adversarial updates indistinguishable from benign ones under distance-based aggregation rules. Let B = benign {ϕbenign , . . . , ϕ } denote the set of benign updates and n 1 adv A = {ϕadv , . . . , ϕ } the set of adversarial updates. The atc 1 tacker seeks to minimize the maximum distance between any adversarial update and the benign set while staying within the benign update radius. Formally, the attack enforces:

LIE assumes the attacker can observe). The malicious update is then crafted so that each parameter lies within: m,(t)

ϕj

(t)

= µj ± zmax σj ,

where zmax ∈ [0, 1] is a scaling factor that determines how close the update is pushed toward the edge of the benign distribution. The final poisoned update ϕm,(t) is shared across all adversarial clients, ensuring coordinated behavior in each round.

max

benign ϕadv ∈B i ∈A, ϕj

Fang. When we refer to Fang, we mean the Fang-Krum version of the original paper when the aggregation method is Multi-Krum, and the Fang-TrimmedMean version when the aggregation methods are Trimmed-Mean, Median, and Fed-Avg. Below, we briefly outline the Fang-Krum and FangTrimmedMean attacks. We only run the Fang attack against FedAvg, Tr-Mean, Median, and M-Krum aggregations, as the Fang attack has no versions for other aggregations or defenses.

benign ∥ϕadv ∥ ≤ i − ϕj

max ∥ϕk − ϕl ∥.

ϕk ,ϕl ∈B

Min-Sum. The Min-Sum attack [47] is an aggregationagnostic model poisoning attack that makes malicious updates indistinguishable from benign ones under a sum-ofsquared-distances criterion. Let B = {ϕbenign , . . . , ϕbenign } n 1 adv adv denote benign updates and A = {ϕ1 , . . . , ϕc } denote adversarial updates. The attacker sets all adversarial updates identical for maximum impact and constrains each malicious update to satisfy

Fang-Krum. The Fang-Krum attack [17] targets the Krum aggregation rule by constructing a set of c adversarial upadv adv dates, {ϕadv 1 , ϕ2 , . . . , ϕc }, such that Krum selects one of them as the aggregated global update. The attacker’s goal is to force Krum to output an adversarial update that deviates substantially from the benign aggregation direction. For each compromised client i, the attacker starts from the client’s benign update ϕreal and perturbs it along a malicious i direction s, scaled by a factor λ:

n X j=1

∥ϕadv − ϕbenign ∥2 ≤ max j i∈[n]

n X 2 ∥ϕbenign − ϕbenign ∥2 , i j j=1

ϕadv = ϕb + µ ψ. where ϕb is a benign reference aggregate, ψ is a fixed perturbation direction, and µ is a scaling coefficient optimized to maximize attack impact under the constraint.

ϕadv = ϕreal i i − λs.

MPAF. The Model Poisoning Attack based on Fake Clients (MPAF) [8] is an untargeted model-poisoning attack in which the adversary injects attacker-controlled fake clients into the FL system. MPAF operates under minimal knowledge, requiring only access to the server-broadcast global models. The attacker first selects a low-accuracy base model w′ sharing the same architecture as the global model. Then, in each communication round t, every fake client submits an update that pulls the global model toward w′ :

The attacker then searches for a value of λ that ensures at least one adversarial update is selected by the Krum rule. After identifying such an update, the remaining c − 1 adversarial updates are constructed to lie close to the selected one, minimizing their pairwise distances. Fang-TrimmedMean. To craft a Fang–TrimmedMean attack [17], the adversary exploits statistical information computed from the model updates of the compromised clients. For each parameter index j, the attacker first computes the empirical mean µj and standard deviation σj over the set adv adv of adversarial updates {ϕadv 1 , ϕ2 , . . . , ϕc }. To bias the aggregation outcome in a desired direction, the attacker injects extreme yet internally consistent values for each parameter. If the attack direction is negative (−1), each compromised client samples the j-th coordinate from the interval

git = λ (w′ − wt ),

λ > 0,

thereby steering the training trajectory to reduce the distance ∥wT − w′ ∥ over time. By repeatedly applying this directional shift, MPAF gradually degrades the global model’s performance throughout the FL process. PoisonedFL. PoisonedFL [57] is a model-poisoning attack that improves adversarial effectiveness by enforcing multiround consistency among malicious updates. Its core insight is that prior attacks primarily rely on within-round coordination, leading their malicious effects to partially cancel out across training rounds. PoisonedFL overcomes this limitation by injecting attacker-controlled fake clients and generating adversarial updates that remain directionally aligned over

[µj + 3σj , µj + 4σj ]. Conversely, to push the model in the positive direction (+1), the value is sampled from [µj − 4σj , µj − 3σj ]. 4

(t)

the entire training trajectory. The attack operates with minimal knowledge, requiring only access to server-broadcast global models and no information about benign clients’ data or updates.

ϕi (where i = 1, 2, . . . , k), the server applies a “clip by (t) norm” technique. Specifically, if the norm of ϕi exceeds τ , (t) the parameters of ϕi are scaled down to meet this thresh(t) old. If the norm of ϕi is less than τ , the update remains unchanged. After clipping, the server performs k-means (t) (t) (t) clustering on the set of clipped updates {ϕ1 , ϕ2 , . . . , ϕk } and divides the updates into two clusters. The server then identifies the larger cluster and computes the average of the updates in this cluster to determine the global model θ(t+1) .

B.3. Baseline Aggregation Rules FedAvg. In Fed-Avg, the central server aggregates the lo(t) (t) (t) cal models {ϕ1 , ϕ2 , . . . , ϕk } from k participating edge devices during each communication round t to update the global model θ(t+1) . The global model θ(t+1) is computed as a weighted average of the local models: θ(t+1) = Pk (t) 1 i=1 ϕi . k

SignGuard. SignGuard [58] filters malicious updates by analyzing the element-wise sign patterns of model gradients. In each communication round t, the central server receives (t) (t) (t) local updates {ϕ1 , ϕ2 , . . . , ϕk } and computes the proportion of positive, negative, and zero elements in each update, creating a feature set. The server then performs clustering on these features to identify updates with similar sign patterns. Updates that align with the majority cluster are retained and averaged to form the global model.

Median. In Median aggregation [59], for each j-th parameter of all k local models, the central server collects the j-th parameters (ϕ1j , ϕ2j , . . . , ϕkj ) of all local model updates. The server then computes the median of these j-th parameters across the k local models. The resulting median value for each parameter position j is used to form the j-th parameter of the global model in the next communication (t+1) (t) (t) (t) (t+1) round: θj = median(ϕ1j , ϕ2j , . . . , ϕkj ), where θj denotes the j-th parameter of the global model after aggregation in round t + 1, and the median is computed over the j-th parameters of all local model updates.

B.4. State-of-the-art Defenses FLAME. FLAME [43] mitigates the impact of malicious updates by adaptively filtering out outliers during aggregation. At each communication round, FLAME measures the distance between every client update and the current global model. Client updates whose distances exceed an adaptively computed threshold are eliminated before aggregation.

Trimmed-Mean. In Trimmed-Mean [59] aggregation, during each communication round t, for each parameter j of the model, the central server collects the j-th parameters (t) (t) (t) from all k local model updates {ϕ1j , ϕ2j , . . . , ϕkj }. The server then sorts these j-th parameter values and removes the largest and smallest c values, where c is the assumed number of compromised edge devices. The global model’s j-th parameter is then computed by averaging the remaining Pk−c (t+1) (t) 1 k − 2c values: θj = k−2c i=c+1 ϕij , This process is repeated for each parameter j of the model, resulting in the updated global model θ(t+1) .

FreqFed. FreqFed [18] detects adversarial behavior by analyzing the frequency patterns of parameter updates across clients. FreqFed tracks how often each client modifies individual model parameters over multiple rounds and identifies clients whose update frequencies deviate from the dominant behavior observed among benign participants. Clients exhibiting unusually rare, inconsistent, or infrequent parameter changes are flagged as suspicious and excluded from aggregation.

Multi-Krum. Multi-Krum [7] aggregation selects f local (t) (t) (t) models from the set of local updates {ϕ1 , ϕ2 , . . . , ϕk } during each communication round t and forms the global model θ(t+1) by averaging these selected local models: Pf (t) θ(t+1) = f1 i=1 ϕi . To select the f local model updates, the central server assumes that at most c edge de(t) vices are compromised. For each local model ϕi (where i = 1, 2, . . . , k), the server computes the distances to all other local models. It then identifies the k − c − 2 local (t) models closest to ϕi and computes the sum of distances be(t) tween ϕi and these k − c − 2 nearest local models. Finally, the server selects the f local models with the smallest sum of distances to their nearest k − c − 2 neighbors.

Foolsgold. Foolsgold [19] detects and suppresses sybilbased poisoning attacks by leveraging the similarity of client updates. The key insight is that malicious clients often produce highly correlated model updates, whereas benign clients tend to contribute diverse gradients. Foolsgold computes pairwise cosine similarities between client updates across rounds and down-weights clients whose updates exhibit unusually high similarity to others. By adaptively reducing the aggregation weight of correlated clients, Foolsgold aims to limit the collective influence of coordinated adversaries. FLTrust. In FLTrust [9], a trusted server maintains a small, clean “root dataset,” which is used to compute a reference gradient at each communication round. Client updates are then compared to this trusted gradient to assess their similar-

Clipped-Clustering. In Clipped-Clustering [35], the server initially sets a clipping threshold hyper-parameter τ . During each communication round t, for each local model update 5

Table 4. Attack impact Iθ on the global model under different attacks (20% malicious clients), aggregation rules, and defenses for the Purchase dataset in cross-device settings. In each row, we highlight in bold the highest attack impact or the closest to the highest.

ity. Each client is assigned a trust score based on how closely its updates align with the root gradient and its historical behavior. These trust scores are used to weigh client updates during aggregation, giving greater influence to trustworthy clients while reducing the impact of potentially malicious ones. For our experiments, we constructed the “root dataset” by randomly sampling 100 instances from the training data. We set the bias parameter to 0.1, ensuring that each class contributes an equal number of samples and that no class comprises more than 10% of the root dataset.

Aθ

Xsgn

Xuv

Min-Sum

Min-Max

Fang

LIE

MPAF

PoisonedFL

Purchase(Cross-device, 10000 FL clients, 500 global iterations & 3 layer DNN model) FedAvg Median Tr-Mean M-Krum CC SgnG FLTrust FreqFed FoolsGold FLAME

C. Additional Experimental Results and Analysis C.1. Why XFED Outperforms Existing Attacks

75.07 72.39 74.04 74.79 74.94 74.68 74.22 73.89 74.41 74.28

62.23 41.96 60.02 9.09 13.68 9.21 3.03 7.35 5.22 4.2

70.72 44.7 60.97 40.22 70.79 72.82 2.86 71.22 10.56 70.96

25.18 38.89 36.94 35.97 39.52 37.19 4.74 45.62 9.25 48.82

38.23 41.93 44.21 42.47 52.77 55.13 5.88 57.23 10.22 60.56

72.37 40.22 23.56 32.88 -

9.26 19.32 15.63 13.3 4.31 3.45 6.67 3.37 3.35 26.14

72.22 22.82 59.22 45.22 3.53 4.65 4.81 4.21 4.56 4.05

72.08 43.22 62.22 41.37 4.39 4.57 3.6 5.9 9.22 4.37

updates, most of these updates go undetected as outliers and are still included in the global model calculation. In contrast, Byzantine-robust aggregations typically use dimension-wise clipping. In non-collusive attacks, some attack dimensions may be clipped. Nevertheless, XFED continues to have a significant impact on Byzantine-robust aggregations, as the non-filtered dimensions of the poisoned model updates can cause substantial damage. We provide a detailed discussion on the choice of the upper bound for λ in Section A.2.

A key finding from our experimental evaluation is that XFED consistently outperforms existing model poisoning attacks, despite operating under a significantly weaker and more realistic non-collusive threat model. At first glance, this is counterintuitive, since XFED has access to less information and does not rely on any inter-client coordination. Its superiority primarily stems from the use of robust, data-driven statistical bounds to constrain the attack magnitude (µ). By computing the median and the median absolute deviation (MAD) of recent global updates, XFED estimates a nonoutlier region in parameter space and scales its perturbation to lie precisely near this boundary (Section A.2). In contrast, existing attacks such as Fang, Min-Sum, and Min-Max typically require iterative search procedures (e.g., binary search) to determine the largest feasible perturbation that avoids rejection by the aggregation rule. However, determining the largest feasible perturbation by iterative search procedures can be unstable across rounds or aggregation rules. Fang’s aggregation-targeted attack sometimes benefits from privileged knowledge of both the aggregation rule and the benign updates of other malicious clients, which is unrealistic in practical deployments. Although this additional knowledge can occasionally make Fang competitive with XFED, its reliance on a uniform sign-based perturbation direction (ψsgn ) limits its effectiveness. PoisonedFL [57] achieves strong performance in cross-device settings but is highly sensitive to parameter choices and does not generalize well to cross-silo scenarios.

C.3. Impact of cross-device setting. We assess the impact of our proposed attacks in a crossdevice setting using the Purchase dataset, which includes 20% malicious clients. To simulate this setting, we consider 10,000 clients, with 1% randomly selected in each round of federated learning (FL) training. The results are presented in Table 4, where the Aθ column corresponds to the “No Attack” baseline, and the remaining columns report the attack impact Iθ for the different attacks. Similar to the crosssilo setting, our proposed non-collusive attacks, particularly Xuv , outperform all state-of-the-art model poisoning attacks across most combinations of aggregation rules and defenses in the cross-device setting. For example, for the Clipped Clustering aggregation, Xuv achieves up to 20x higher impact compared to LIE, MPAF, and PoisonedFL. Similarly, against the FreqFed defense, Xuv achieves 1.56× and 1.24× greater impact than the Min-Sum and Min-Max attacks, respectively. Interestingly, some results in the cross-device setting vary from the trends observed in the cross-silo setting. This is mainly due to the stochastic nature of client selection in cross-device FL: in each round, only a small fraction of clients participate, leading to fluctuating numbers of adversarial clients. Consequently, some rounds may contain only a few, or even no, attackers.

C.2. Analyzing the Effectiveness of XFED XFED has a significant impact on all types of aggregations and defenses. One interesting observation is that XFED performs better against defenses than it does against Byzantinerobust aggregations. This is primarily because defenses employ outlier detection techniques to filter out harmful model updates before they are aggregated. XFED is specifically designed to avoid being identified as an outlier. As a result, even if all attackers submit different harmful model

C.4. Impact of the percentage of malicious clients Cross-Silo Setting. Figures 3 and 4 illustrate the impact of model poisoning attacks on the learnt global model as the percentage of malicious clients varies from 1% to 30% for 6

Attack Impact

M-Krum

Tr-Mean

SgnG

FoolsGold

10 15 20 25 30 0

FreqFed

FLAME

FLTrust

90 80 70 60 50 40 30 20 10 0 0

10 15 20 25 30 0

Xuv

10 15 20 25 30 0

M in − M ax

Xsgn

F ang

LIE

10 15 20 25 30 0

M in − Sum

M P AF

10 15 20 25 30 0

10 15 20 25 30

P oisonedF L

Figure 3. Attack Impact Iθ on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-silo setting (Purchase dataset).

Attack Impact

MNIST, FedAvg, Cross-silo

Cross-Device Setting. Figures 4 and 5 illustrate the impact of model poisoning attacks on the learned global model as the percentage of malicious clients varies from 1% to 30% in the cross-device setting for the Purchase dataset. To simulate this scenario, we consider 10,000 clients, with 1% randomly selected in each round of federated learning (FL) training. We observe that the effectiveness of our Xuv attack increases as the fraction of malicious clients rises. Our attacks perform very well against FedAvg, as it is not Byzantine-robust and does not filter out malicious updates. However, Xuv is also very effective against other aggregations and defenses too. For instance, with the SignGuard aggregation rule, when the percentage of attackers is 5%, the attack impact is 22.47; when the percentage of malicious clients increases to 20%, the attack impact rises to 73.22. This indicates that the global model becomes nearly unusable as the percentage of malicious clients increases. Other aggregations and defenses, except for FLTrust, also show a similar trend.

Purchase, FedAvg, Cross-silo

90 80 70 60 50 40 30 20 10 0 0

Attack Impact

MNIST, Median, Cross-silo

Purchase, Median, Cross-silo

Purchase, FedAvg, Cross-device

Purchase, Median, Cross-device

90 80 70 60 50 40 30 20 10 0 5

Xuv LIE

Xsgn M in − Sum

M in − M ax M P AF

F ang P oisonedF L

Figure 4. Attack Impact Iθ on global model with increasing % of malicious clients for different attacks and aggregations (FedAvg and Median) in different FL settings for different datasets (MNIST & Purchase).

C.5. Impact of the degree of non-IID. Non-IID Simulation. To simulate non-IID data distribution, we introduce a probabilistic model based on a parameter p, which we refer to as the “degree of non-IID”. We followed the process described in [17] to model this setting. At first, we evenly partition the total number of client devices into L groups, where L is the number of classes (e.g., L = 10 for MNIST and L = 100 for Purchase) in the classification problem. We then assign training instances with label l (where l ∈ {1, 2, . . . , L}) to the l-th group with probability p. A higher degree of p indicates training instances of class l are more concentrated in the l-th group, meaning datasets are not identically distributed. When p is smaller, the data distribution becomes more uniform across groups, approximating an IID scenario.

the Purchase and MNIST (FedAvg and Median) datasets. We observe that none of the state-of-the-art aggregations or defenses, except for FLTrust, can effectively mitigate our proposed Xuv attack across all percentages of malicious clients. Notably, the effectiveness of our Xuv attack increases as the fraction of malicious clients rises. Our attacks, along with other existing attacks, perform exceptionally well against FedAvg, as it is not robust against Byzantine faults and does not filter out malicious updates. However, FLTrust successfully mitigates the Xuv attack and other attacks by utilizing a small trusted root dataset on the server. On the other hand, FoolsGold is very unreliable; it shows poor performance with few attackers, but its effectiveness improves with a greater number of malicious clients. Still, its performance declines again at higher ratios of attackers.

Impact of the degree of non-IID. Fig. 6 and Fig. 7 show the impact of different attacks on the global model as p increases from 0.1 to 0.9 on the MNIST and Purchase (FedAvg & Median) datasets. We observe that Xuv outperforms all state-of-the-art attacks by a significant margin for 7

M-Krum

Tr-Mean

SgnG

FoolsGold

10 15 20 25 30 0

FreqFed

FLAME

FLTrust

Attack Impact

70 60 50 40 30 20 10 0 0

10 15 20 25 30 0

Xuv

10 15 20 25 30 0

10 15 20 25 30

Xsgn

Figure 5. Attack Impact Iθ on global models with increasing % of malicious clients for different aggregations, defenses, and attacks in a cross-device setting (Purchase dataset). M-Krum

SgnG

Tr-Mean

FoolsGold

FreqFed

FLAME

FLTrust

Attack Impact

100 80 60 40 20 0 .1

.9 .1

Aθ

Xuv

.9 .1

M in − M ax

Xsgn

.9 .1

F ang

LIE

.9 .1

M in − Sum

.9 .1

M P AF

.9 .1

P oisonedF L

Figure 6. Attack impact Iθ on global models as a function of the degree of non-IID for different aggregations, defenses, and attacks (MNIST Dataset).

MNIST, Fed-Avg

Purchase, Fed-Avg

MNIST, Median

C.6. Performance variations of model poisoning attacks

Purchase, Median

across Neural Network architectures

Attack Impact

100

We explore different Neural Network architectures for the Fashion-MNIST dataset and compare the performance of Xsgn and Xuv against state-of-the-art model poisoning attacks. The results are presented in Table 1 (c) for a 3-layer DNN, while Table 1 (e) displays the results for the AlexNet architecture. Our results show that Xuv attack is highly effective across various neural network architectures. The effectiveness of our attack is not dependent on the specific model architecture; instead, our attack exploits the vulnerabilities inherent in federated learning aggregation. Thus, using a deeper neural network does not safeguard an FL system, and a non-collusive attack like Xuv can reliably outperform existing state-of-the-art attacks, regardless of the model architecture used in the FL system.

80 60 40 20 0 .1

Aθ F ang P oisonedF L

.9 .1

Xuv LIE

.9 .1

Xsgn M in − Sum

.9 .1

M in − M ax M P AF

Figure 7. Attack Impact Iθ on global model as a function of the degree of non-IID for different attacks and aggregations (FedAvg and Median) for different datasets (MNIST & Purchase).

C.7. Influence of various attack parameters Clipped Clustering, SignGuard, FoolsGold, FLAME, and FreqFed. As p increases and the data become more unevenly distributed across clients, the performance of Xuv does not degrade; the attack impact stays roughly the same for all levels of non-IID data. For M-Krum and Trimmed-Mean, Xuv also works very well; however, for Trimmed-Mean, the Fang attack sometimes has slightly higher impact, which is reasonable because Fang is specifically designed for that aggregation rule. Overall, even for higher values of p, Xuv remains robust.

Impact of the size of H(t) . Recall that for the global model θ(t) at round t, we define its delta from the previous round as ∆θ(t) = θ(t) − θ(t−1) , and maintain a list of all deltas H(t) = { ∆θ(1) , . . . , ∆θ(t) }. Now in FL, the number of training rounds can go on for a long time. With each round t, H(t) size increase. For a client 8

Table 5. Attack impact Iθ of the global model under the Xuv attack (20% malicious clients) for different values of Ω across various aggregation rules and defenses on the MNIST dataset in the cross-silo setting. In all experiments, we set λ = 4. Aggregation Rule

FedAvg

Median

Tr-Mean

Multi-Krum

Clipped-Clustering

SignGuard

FLTrust

FreqFed

FoolsGold

FLAME

Aθ

95.02

94.61

94.69

94.57

94.08

95.31

95.49

94.32

95.12

93.33

Ω=4 Ω=8 Ω = 12 Ω = 16 Ω = 20 Ω = 24 Ω = 28 Ω = 32 Ω = 36

83.71 77.26 78.47 84.82 76.45 74.72 77.16 74.2 75.03

11.15 13.41 11.96 11.45 12.15 11.64 12.62 11.23 13.11

14.99 15.48 13.49 12.98 15.72 14.39 16.83 13.87 14.7

12.5 12.56 13.22 11.22 12.52 12.89 11.98 12.96 11.85

78.08 82.89 81.28 76.87 79.08 75.68 74.07 77.87 80.08

79.16 78.41 84.39 79.67 80.16 82.77 78.75 84.03 81.16

3.26 7.46 3.49 4.19 1.79 4.21 6.66 2.63 3.87

84.5 82.16 76.5 79.59 76.91 81.26 83.55 84.52 77.54

36.11 34.5 29.49 34.14 31.08 28.75 29.5 36.59 36.02

76.17 74.82 76.88 78.69 70.83 75.67 79.53 73.13 77.84

contrast, Ω clearly affects the attack’s execution time. As shown in Fig. 8, increasing Ω increases the runtime; when Ω = 4, the execution time is 1680.02 seconds, whereas for Ω = 180 it increases to 1833.48 seconds. Therefore, a small value such as Ω = 4 is practically preferable, as it achieves almost the same attack impact while reducing computational cost, and we adopt Ω = 8 as our default choice.

Attack Execution Time (s)

2,000

1,900

1,800

1,700 90

FedAvg Median TrimmedMean Multi-Krum CC SignGuard FLTrust FreqFed FoolsGold FLAME

1,600 20

100

140

180

220

260 70

Attack Impact

Value of Ω

Figure 8. Impact of the history window size Ω on the execution time of the Xuv attack (20% malicious clients) on the MNIST dataset in the cross-silo setting. As Ω increases, the runtime grows noticeably.

60 50 40 30 20 10

device, it may not be practical to store so many global deltas. Especially if the attacker is a silent malware type hiding on a mobile device. In practice, we suggest that an attacker store the last Ω global deltas. Therefore, the modified global delta list H(t) be as,

0 2

Value of λ

Figure 9. Effect of λ on the attack impact Iθ of the Xuv attack (20% malicious clients) on the MNIST dataset in cross-silo setting. In all experiments, we set Ω = 8.

H(t) = {∆θ(t−Ω+1) , . . . , ∆θ(t) } Impact of λ. As discussed in Appendix A.2, the recommended range for λ, derived from outlier detection guidelines in the literature and common practice, is [2, 10]. Fig. 9 shows the impact of the Xuv attack across this range, and we observe that, within [2, 10], the attack impact remains highly stable. The attack impact of Xuv for FedAvg, ClippedClustering, SignGuard, FreqFed, and FLAME decreases slightly around λ = 2 and λ = 10, but remains largely stable between 3 and 7, with no substantial loss in effectiveness. For the other aggregations and defenses, choosing λ ∈ [2, 10] does not affect the attack impact. However, as shown in Table 6, taking extreme values of λ, such as 0 or 100, can substantially reduce the attack impact.

This might seem like a loss of information, but for practical implementation, it would be needed. We study how Ω affects the impact of our proposed Xuv attack. Table 5 reports the attack impact Iθ of the global model for the Xuv attack (20% malicious clients) for different values of Ω across various aggregation rules and defenses on the MNIST dataset. We vary Ω from 4 to 36 for all aggregations and defenses, and in all experiments, we fix λ = 4. From the table, we observe that the attack impact is largely insensitive to Ω. For example, for the FreqFed defense, the impact changes only from 84.50 to 77.54, and for FoolsGold, it varies slightly from 36.11 to 36.02 as Ω ranges from 4 to 36. These small variations indicate that the number of stored deltas Ω does not significantly affect the effectiveness of the attack. In

Implementation suggestion for XFED. Based on our exper9

Table 6. Effect of extreme values of λ on the attack impact Iθ of the Xuv attack (20% malicious clients) on the MNIST dataset. Aggregation Rules & Defenses

λ=0

λ=4

λ = 100

FedAvg Median Tr-Mean M-Krum Clipped-Clustering SignGuard FLTrust FreqFed FoolsGold FLAME

24.64 9.35 12.15 4.11 24.21 23.53 5.19 22.65 2.97 34.21

81.43 12.21 15.19 12.5 80.1 81.18 7.35 80.87 36.11 79.24

10 11 12.6 1.23 2.45 4.51 3.19 9.16 2.86 2.39

ability on FLTrust for the Purchase dataset. As the bias probability increases, the clean (“No Attack”) test accuracy consistently degrades: at 0.1, it is 73.91%; at 0.3, 71.52%; at 0.5, 68.50%; at 0.7, 61.90%; and at 0.9, 60.22%. At the same time, the attack impact Iθ becomes larger as the bias increases. For example, when the bias probability is 0.1, the attack impact is 8.83, but it rises to 14.82 at 0.7 and 17.11 at 0.9. Therefore, a more biased root dataset lowers the baseline performance and makes FLTrust more vulnerable to model poisoning attacks. Consequently, in all our FLTrust experiments, we set the bias probability to 0.1, a setting in which FLTrust can effectively mitigate all state-of-the-art model poisoning attacks considered in this work.

iments, we recommend implementing XFED using the Xuv attack with Ω = 8 and λ = 4. This configuration provides a practical rule of thumb for deploying the attack. The authors of [47] propose a method for selecting effective perturbation vectors via small-scale local simulations, which can be adopted as a general guideline when designing or evaluating attack strategies. In practice, it is advisable to follow their methodology to determine the most effective combination of perturbation vector and hyperparameters before launching an attack.

C.8. FLTrust Root Dataset Bias In FLTrust [9], a trusted server maintains a small, clean root dataset that is used to compute a reference gradient in each communication round. Client updates are then compared against this trusted gradient to assess their similarity. However, the performance of FLTrust is highly sensitive to the class distribution of the root dataset, characterized by the bias probability in the original paper. This bias probability is defined as the fraction of examples in the root dataset that are sampled from a single class; a higher value therefore models a root data distribution that deviates more strongly from the overall training distribution. Empirical results show that FLTrust remains accurate and robust when the bias probability is not too large. Table 7. Effect of root-data bias probability on FLTrust performance for the Purchase dataset. The table reports test accuracy under no attack and the attack impact Iθ (20% malicious clients) for Xuv attack with different bias probabilities, showing that higher bias in the root dataset degrades clean accuracy and increases vulnerability to attacks. Bias Probability

No Attack Accuracy

Attack Impact (20% malicious clients)

0.1 0.3 0.5 0.7 0.9

73.91 71.52 68.50 61.90 60.22

8.83 9.95 10.25 14.82 17.11

Table 7 summarizes the effect of the root-data bias prob10

Record · ID 5900 · SHA-256 3404e38ad5f02a02
Conceptio Open Knowledge Archive — every document is proof-bundled with source, license, and retrieval metadata.