StratFL: Countering Covert Model Poisoning Attacks with Strategic Federated Learning

1. 01What problem does this paper attempt to solve?

   The federated learning server must suppress intermittent, covert model poisoning without seeing the other side's actions.

   The core problem is: in federated learning, attackers covertly and intermittently inject poisoned model updates (covert model poisoning, CMP), and aggregation designed for one-shot poisoning struggles to suppress them in time.

   • Scenario: The paper states that federated learning is already used in healthcare, autonomous driving, and personal assistants; attackers can intermittently inject erroneous updates across multiple rounds, creating a persistent threat. The paper cites literature stating that in 2025 there were 16,200 AI-driven APTs and 5.72 million USD in losses, of which 55% targeted healthcare and finance.
   • Existing gaps: The paper treats the model poisoning literature mainly as a one-shot threat, and states that there is almost no research on intermittent, persistent versions. Among statistical, selective, and benchmark-gradient aggregation, the latter two may mitigate persistent poisoning, but they still fail when the attacker is covert most of the time and strikes when the opportunity arises.
   • Core setup: The server and the CMP attacker do not know each other's strategies and can only rely on historical losses on their respective private validation sets to form conditional beliefs about the other's actions, and then perform selective aggregation.
   • This paper proposes: Formulating the interaction as a repeated game with imperfect information, giving belief updates for both sides, and an alternating projected gradient search StratFL, used to compute selection weights and poisoning strength.
   • Threat model:
     • Objective: The attacker wants to raise the global loss on its private validation set while lowering the risk of being downweighted; the server wants to minimize the expected loss on its own validation set.
     • Knowledge: Imperfect information. Neither side sees the other's actions; the server does not know client types; beliefs come from private validation losses, not direct observation of the other's strategy.
     • Capability: The attacker controls a proportion α of clients. The paper states that each round the compromised clients choose a random action a_{k,t}∈[0,1], mixing the true loss gradient with its negation; benign clients always take 0. The introduction states that traditional model poisoning can compromise some clients via malware or man-in-the-middle, among other means.
     • Victim system: A federated learning system with K clients plus a central server, where the server aggregates local models into a global classifier. In the experiments K=10.

   Collapse this answer

2. 02What related research exists?

   The paper places CMP after one-shot poisoning and three types of robust aggregation, and states that the latter two still cannot stop opportunistic covert action.

   One-shot model poisoning

   • Untargeted: Baruch et al. (2019), Fang et al. (2020), Mahloujifar et al. (2019), Guerraoui et al. (2018), Xie et al. (2020) are classified as untargeted, with the intent of degrading the overall performance of the global model.
   • Targeted: Bagdasaryan et al. (2020), Bhagoji et al. (2019), Ranjan et al. (2024) are classified as targeted, causing selected inputs to be misclassified while other inputs remain unchanged.
   • One-shot grouping: The paper lists the above works together with Blanchard et al. (2017) and Muñoz-González et al. (2017) as one-shot threats, and states that there is almost no research on intermittent, persistent model poisoning.

   Three types of robust aggregation

   • Robust statistics: Krum (Blanchard et al., 2017), Trimmed-Mean (Yin et al., 2018), using statistics to suppress outlier updates. The paper lists them as the first category against one-shot poisoning, and the introduction does not criticize them separately.
   • Selective aggregation: Auror (Shen et al., 2016), FoolsGold (Fung et al., 2018), removing updates based on clients' behavioral deviations over time.
   • Benchmark gradients: FLTrust (Cao et al., 2020), using a server-side trusted gradient to filter out anomalous clients. The paper states that the latter two categories may mitigate persistent poisoning, but because CMP is covert most of the time and strikes only when the time is right, they still cannot mitigate it.

   Baselines and data

   • Baseline methods: Section 5.2 lists FedAvg (McMahan et al., 2017), Krum, Trimmed Mean, Coordinate-wise Median (Yin et al., 2018), FLTrust, FLANDERS (Gabrielli et al., 2025). The legend lists Multi-Krum, Coord. Median, FLTrust, Trimmed Mean, FLANDERS, without FedAvg.
   • Benchmarks/datasets: MNIST and CIFAR-10.

   The authors position this paper on the intermittent covertness of CMP: updating beliefs with private validation losses and then using StratFL for strategic aggregation, rather than only one-shot outlier suppression.

   Collapse this answer

3. 03How does the paper address this problem?

   StratFL formulates both sides as an imperfect repeated game, using loss-deviation beliefs and alternating projected gradients to find best responses.

   The overall approach formulates aggregation as an imperfect-information repeated game between the server and the CMP attacker, where both sides maintain action beliefs using private validation losses, and then use StratFL to alternately perform projected gradient search. The introduction calls it an imperfect-information game, while Section 3 describes it as an imperfect repeated game.

   Problem setup and formalization

   • System: K clients and a central server, learning a neural network from inputs to a discrete label set. In round t, clients compute the loss gradient of the previous round's global model on private data, then perform gradient descent with learning rate η. A footnote states that heterogeneous learning rates can be extended but are outside the scope of this study. Both the number of classes and the number of new samples per round are denoted N.
   • Poisoning: γ_k=1 indicates control by CMP. The action changes the gradient to g̃_k,t(a_k,t)=(1−2a_k,t)· g_k,t, i.e., a mixture of the true gradient and its negation; a=0 corresponds to benign.
   • Aggregation: Weights s_{k,t}∈[0,1]. Section 2 requires the client weights to sum to 1; Algorithm 3 then normalizes by the weight sum.
   • Objectives: The server minimizes the loss on the private set D_S, taken in expectation over beliefs about the attack action. The attacker's objective is a_t^⋆=argmax_at L_A(a_t|φ_t)−λ𝔼_φt[∑_{k∈ Kcomp}(1−s_k,t)], i.e., maximizing the loss on D_A under beliefs, minus λ times the expected degree of downweighting.

   Server belief update

   • D_S is used to compute the previous round's global loss, each client's loss, and the aggregated loss. The authors expect the aggregated loss to be less than the client losses, and the client losses to be less than the previous round's global loss times (1-ε).
   • The deviation actually used compares only the scaled previous round's global loss with the client loss. When the indicator is 0, the authors state that the client is worse than the previous round's global model, which can only happen when it is compromised. The indicator is non-differentiable, so a sigmoid surrogate is used. The paper does not give the parameter σ.
   • Averaging over a window of length T yields p_{k,t}, which can also be computed recursively. The paper interprets it as the marginal probability that the client is compromised and therefore takes a=1. The joint belief is the product over clients, with an exponential form identical to a Bernoulli likelihood, even though a is continuous on [0,1]. Algorithm 1 assembles this belief over all clients.

   Attacker belief update

   • D_A is used to compute the current global loss and the compromised clients' losses. The authors expect the scaled current global loss to be less than the client losses, and the client losses to be less than the previous round's global loss.
   • The surrogate deviation compares the current global loss with the client loss. The authors state that this deviation goes to 0 as the selection weight goes to 0, used to reflect whether the server selects the client.
   • The window average q is interpreted as the marginal probability that the server takes s=1. The joint belief takes the same product only over compromised clients. Algorithm 2 iterates only over the compromised set.

   StratFL search

   • The attacker moves first, the server second. The attacker performs projected gradient ascent, the server projected gradient descent. Equation (22) projects the server weights onto the unit box, not the simplex.
   • The authors state that the gradient of s with respect to a is difficult because s is itself a best response, so q is used in place of s, and the gradient is computed by automatic differentiation (the text gives PyTorch Autograd as an example). This is an approximate best response.
   • Algorithm 3 initializes s to 1 and the compromised clients' a to 0.5; benign clients train locally, compromised clients take parameters according to the current a; then the two belief updates are called and the weighting is normalized. The projection steps are written in Equations (21)(22), and the pseudocode does not expand them line by line. Both the loop upper bound and the belief window in Algorithm 3 are denoted T; in the experiments training runs 50 rounds and the window is 5.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On MNIST and CIFAR-10, the authors state that StratFL outperforms the baselines when α≤0.7, and that FLTrust is better at larger α.

   Experimental setup

   • Baselines: Section 5.2 lists FedAvg, Krum, Trimmed Mean, Coordinate-wise Median, FLTrust, FLANDERS. The legends of Figures 2–3 are StratFL, Multi-Krum, Coord. Median, FLTrust, Trimmed Mean, FLANDERS. The paper does not state whether Krum and Multi-Krum are the same implementation.
   • Models and data: K=10, 50 rounds. MNIST is 70,000 28×28 grayscale digits, and the model is two convolutional layers plus three fully connected layers; CIFAR-10 is 60,000 32×32 images in 10 classes, and the model is ResNet-18, which the paper states contains 18 convolutional layers with skip connections. Each is split into 13 subsets without replacement: D_S and D_A are 1000 each, the test set is 10000, and the client data cap is 5800 (MNIST) or 4800 (CIFAR-10).
   • Attack and hyperparameters: 2 local training epochs. λ=1, ε=0.01, η_s=η_a=0.01, belief window T=5. α takes nine settings from 0.1 to 0.9. Compromised clients share the same a_t. Initialization s=1, a=0.5.
   • Metrics: Global accuracy; ΔΨ is accuracy without CMP minus accuracy with CMP; MSBD is the average of the square of (1-s_{k,t}-γ_k) over clients and rounds.
   • Determination: The paper divides 10000 samples as the test set, but the metric definitions do not restate which subset Ψ uses. The loss name, batch size, the numerical value of the client learning rate η, the number of repetitions, and statistical tests are not stated. There is no LLM review.

   Main results

   The first sentence of the main text maps Figure 3 and Figure 2 to MNIST and CIFAR-10 respectively, which is the opposite of the figure captions and later text. The table below follows the captions and later text: Figure 2 is MNIST, Figure 3 is CIFAR-10, both after 50 rounds. The numbers come from the text of Section 6.1; the paper has no table of numerical results. The right panel of Figure 2 has a y-axis labeled up to 1.0, and the right panel of Figure 3 has a y-axis labeled up to 70; the main text does not give ΔΨ readings.

   Swipe horizontally to read the table

   Method	MNIST α≤0.4	MNIST α=0.5	MNIST α=0.7	MNIST α=0.9	CIFAR-10 α=0.5
   StratFL	In the ≈99% range together with other methods	Above 99%	Above 99%	10%	Not reported
   Coordinate-Median	Same ≈99% range as above	10%	Not reported	Not reported	Not reported
   Trimmed-Mean	Same ≈99% range as above	10%	Not reported	Not reported	0%

   The table does not include FedAvg, Krum/Multi-Krum, FLTrust, FLANDERS, because the main text does not give their accuracy numbers.

   • Authors' summary: The authors state that for any α≤0.7, StratFL outperforms all baselines; when most clients are compromised, only FLTrust can still maintain, and it is better at larger α. The authors attribute this to FLTrust's server-side training, and state that this assumption is unreasonable in most FL deployments. The abstract states a 10% accuracy improvement over existing methods; the conclusion states a 10% improvement over baselines, and maintained accuracy with up to 70% malicious clients, where baselines collapse. Section 6 does not give this 10% difference, nor state whether it is percentage points or a relative increase. The legend does not include FedAvg.
   • MNIST: The authors state that StratFL keeps up with the baselines until only 1 honest client remains, and only declines at α=0.8; with 10 clients, α=0.9 leaves only 1 honest client, and the authors state that there is almost no gradient information left to learn from. Coordinate-wise Median and Trimmed Mean fail at α=0.5, which the authors state is consistent with the adversary controlling half the coordinates and coordinate-wise statistics shifting toward the adversary.
   • CIFAR-10: The authors state that every method's accuracy decreases with α, but StratFL leads in all α scenarios; FLTrust and Multi-Krum decline before StratFL before α=0.5. The accuracy change in the right panel is the lowest among all methods when α≤0.5. The authors state that failures may be due to incorporating erroneous updates or to too few honest updates after removal; the decline comes from fewer honest gradients and is unrelated to the belief update.

   Belief convergence

   • What was measured: MSBD over rounds, with α from 0.1 to 0.9. The authors state that Figures 4 and 5 correspond to MNIST and CIFAR-10 respectively; both figure captions say CIFAR-10. The y-axis labels are Squared Belief Deviation and Squared Deviation of Belief respectively, the x-axis is Training rounds (t), and the legend is each α. The positions of the curves are not visible in the converted text.
   • Results: The authors state that on both datasets and for all α, convergence occurs within 10 rounds, after which the trajectory no longer deviates and a_t no longer affects s_t; they also write that MNIST converges at t=5 and CIFAR-10 at t=10. For all α, MSBD is below 0.03 at t=10 and below 0.011 at t=50. α=0.1 is higher than the other configurations: 0.010 on MNIST and 0.011 on CIFAR-10.
   • Authors' interpretation: The initial weight is 1, so MSBD is relatively high, consistent with the server being unable to distinguish client types at the start. The authors state that after accumulating deviations, clients are separated according to whether their validation loss exceeds ε, and the weights then converge. The deviation at α=0.1 comes from 1 malicious client among 10 and persists; as α increases, the authors state that MSBD reaches 0 at t=50. The authors state that under λ, increasing a raises the server-side deviation and lowers the weight, while decreasing a reduces the damage; once the weights converge, MSBD no longer decreases, the attacker maintains a, and CMP no longer affects aggregation.

   Other ablations and analyses

   • The paper does not report ablations on λ, ε, η_s, η_a, or the belief window; Section 5.1 fixes them at 1, 0.01, 0.01, 0.01, 5.
   • The nine settings of α from 0.1 to 0.9 are the security scenarios in the main experiments, not a separate ablation.
   • Negative results are as above: on MNIST, StratFL begins to decline at α=0.8; at larger α the authors state that FLTrust is better than StratFL; MSBD at α=0.1 does not drop to 0.

   Collapse this answer

5. 05What are some points that can be further explored?

   The conclusion writes future directions only as exploring other APTs such as data poisoning and backdoors.

   Limitations and future directions noted by the authors

   • Other APTs: Section 7 states that future work will explore data poisoning and backdoor attacks against federated learning networks.
   • Dedicated limitations section: The paper has no Limitations section. The conclusion does not frame StratFL's decline at high α or the comparison with FLTrust as limitations of the method.

   Scope of the experiments

   • The experiments compare a 2-layer CNN on MNIST and ResNet-18 on CIFAR-10, with K=10, 50 rounds, and α in nine settings from 0.1 to 0.9 (Sections 5, 6).
   • The baselines listed in the main text are FedAvg, Krum, Trimmed Mean, Coordinate-wise Median, FLTrust, FLANDERS; the result legends are Multi-Krum, Coord. Median, FLTrust, Trimmed Mean, FLANDERS (Section 5.2, Figures 2–3).
   • The reported metrics are test accuracy, accuracy change, and MSBD; Section 6.2 gives 0.010 and 0.011 at α=0.1, and the MSBD upper bounds at t=10 and t=50.
   • Fixed λ=1, ε=0.01, η_s=η_a=0.01, belief window 5, 2 local epochs; compromised clients share a_t; D_S and D_A are 1000 each, and the test split is 10000 (Section 5.1).
   • The paper does not report the number of repetitions, statistical tests, the experimental value of the client learning rate η, or the numerical results for FedAvg. A footnote in Section 2 states that heterogeneous client learning rates are outside the scope of this study.

   Collapse this answer

6. 06Summarize the main content of the paper

   StratFL uses belief updates and projected gradient adversarial search to suppress covert model poisoning; the authors state that it outperforms the listed baselines when α≤0.7.

   StratFL is a selective aggregation method for countering covert model poisoning in federated learning.

   • Problem: CMP attackers control a proportion α of clients, mix the loss gradient with its negation, and try to avoid being downweighted. The server cannot see types or the other side's actions; the paper states that one-shot robust aggregation cannot stop long-term covert attacks that strike when the opportunity arises.
   • Method: The interaction is formulated as an imperfect repeated game. Both sides use loss inequalities on private validation sets, through a sigmoid surrogate and window averaging, to obtain a product belief about the other's actions. StratFL has the attacker perform projected gradient ascent first, then the server projected gradient descent; the attacker uses q in place of s, which cannot be differentiated directly.
   • Setup: A 2-layer CNN on MNIST and ResNet-18 on CIFAR-10, 10 clients, 50 rounds, α from 0.1 to 0.9. Baselines include Krum, Trimmed Mean, Coordinate-wise Median, FLTrust, FLANDERS; the legend additionally lists Multi-Krum, and FedAvg is not seen.
   • Accuracy: The authors state that StratFL outperforms all baselines for any α≤0.7. On MNIST, StratFL remains above 99% up to α=0.7, and is 10% at α=0.9; Coordinate-wise Median and Trimmed-Mean are 10% at α=0.5. On CIFAR-10, Trimmed-Mean is 0% at α=0.5, and the authors state that StratFL's accuracy change is lowest when α≤0.5. At larger α, the authors state that only FLTrust can still maintain and exceed StratFL.
   • Beliefs and conclusion: The authors state that MSBD converges within 10 rounds, below 0.03 at t=10 and below 0.011 at t=50; at α=0.1 it is 0.010 on MNIST and 0.011 on CIFAR-10. The abstract and Section 7 state a 10% accuracy improvement over baselines and maintained accuracy with up to 70% malicious clients; Section 6 does not give this difference. The authors plan to further study data poisoning and backdoors.

   Collapse this answer

Related papers