A network-layer attacker in federated learning

1. 01What problem does this paper attempt to solve?

   Studies the problem of a network-layer attacker degrading federated learning target-class accuracy by dropping traffic from selected clients, and proposes a server-side defense.

   Core problem: communication between clients and the server in federated learning (FL) is an unstudied attack surface—can a network-layer attacker degrade the model's accuracy on a target population by dropping traffic.

   • Setting and motivation: FL trains in rounds, the global model depends on contributions from multiple clients, and communication interruptions affect learning. The authors note that when a population is geographically concentrated (e.g., a minority language in a country), an attacker with AS-level capabilities may have political or economic motives to carry out such an attack.
   • Gaps in existing research: prior FL security research focused on data poisoning and model poisoning by compromised clients; the authors state this is the first study of a network-layer attacker affecting FL-trained models.
   • Core observation: the authors' key insight is that only a few clients contribute significantly to accuracy on the target subpopulation, and identifying and disrupting only these clients can cause more damage than random dropping.
   • Contributions: they propose the Client Identification algorithm and a targeted packet-dropping attack, and show that model replacement poisoning by a small number of clients can amplify the attack; they also propose a server-side UpSampling defense that can be combined with Clipping to resist the combined attack.
   • Threat model:
     • Goal: reduce target-class accuracy (targeted attack) while maintaining non-target-class performance to avoid detection; availability poisoning attacks that existing defenses can handle are not considered.
     • Network knowledge and capabilities: three settings—COMM_PLAIN (unencrypted communication, as a maximum-damage baseline), COMM_ENC (encrypted communication, can infer which clients participate each round but cannot see update contents), COMM_ENC_LIMITED (encrypted and can only observe a fixed subset of clients); the basic attack action is dropping traffic.
     • Global model knowledge: cross-device FL is an open system, and the attacker can participate as a client to obtain the global model ft each round.
     • Optional poisoning capability: some experiments give the attacker the POISON_MODEL capability (model replacement attack) to amplify the packet-dropping attack.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three groups: FL poisoning attacks, FL defenses, and network-layer attacks; the authors state that this paper is the first study of network-layer attackers affecting FL.

   Poisoning attacks in FL

   • McMahan et al. (2017) proposed Federated Averaging, the cross-device training protocol considered in this paper.
   • Tolpegin et al. (2020) studied data poisoning; Bhagoji et al. (2018), Bagdasaryan et al. (2020), Sun et al. (2019), and Wang et al. (2020) studied model poisoning and backdoor attacks. Fang et al. (2020) and Shejwalkar & Houmansadr (2021) demonstrated local model poisoning against Byzantine-robust aggregation.
   • This paper's poisoning amplification attack directly follows the model replacement method of Bagdasaryan et al. and Sun et al.

   FL defenses

   • Byzantine-robust or trust-based aggregation rules: Blanchard et al. (2017, Krum), El Mhamdi et al. (2018), Yin et al. (2018), Alistarh et al. (2018), etc.; the paper notes that Fang et al. and Shejwalkar & Houmansadr systematically analyzed these schemes and showed they can be bypassed with poisoning, and that Bagdasaryan et al. showed targeted poisoning can bypass Krum.
   • Gradient filtering (Fang et al. 2020; Shejwalkar & Houmansadr 2021; SignGuard by Xu et al. 2021) is used against availability attacks; gradient clipping (Bagdasaryan et al.; Sun et al.) is used against targeted attacks. Sun et al. observed that poisoning with larger gradient norms is more effective, so clipping becomes a natural defense; this paper uses clipping with norm 1 as part of its combined defense.

   Network-layer attacks and defenses

   • Network-layer attack methods include wireless jamming (Basciftci et al. 2015), BGP hijacking (Cho et al. 2019), router compromise, and transport-layer attacks (Jero et al. 2018); such attacks have been shown to affect systems such as Bitcoin (Apostolaki et al. 2017), payment channel networks, and connected cars.
   • Known defenses include faulty-path monitoring (Awerbuch et al. 2008), resilient overlays (Castro et al. 2003; Obenshain et al. 2016), and routing protocol security (Hollick et al. 2017); the paper notes that these defenses are generally ineffective against stealthy attacks such as targeted update dropping, and that FL owners typically do not control the underlying network.

   Baselines and positioning: The attack baselines are Perfect Knowledge (knowing the target clients from the start and dropping all their updates) and Random Drop (randomly dropping the same number of clients), given in Table II; the defense baselines are FedAvg without defense and Clipping. The authors position this paper as the first study of network-layer attackers in FL, with attack and defense sharing the same client identification procedure.

   Collapse this answer

3. 03How does the paper address this problem?

   On the attack side, loss differences are used to identify high-contribution clients and drop their packets in a targeted way, which can be amplified with poisoning; on the defense side, the server reuses the identification algorithm for UpSampling.

   Overall approach: the attacker first uses Client Identification (Algorithm 2) to find the clients that contribute most to the target class, then selectively drops their updates; the defender reuses the same identification algorithm on the server side, using UpSampling (Algorithm 3) to increase the sampling probability of these clients.

   Problem setting

   • The target population is defined as one class in the learning task (the authors state it can be extended to subclasses); the attacker holds a dataset D* representing the target population.
   • Attack procedure: train normally for the first TN rounds and run the identification algorithm, then in each subsequent round drop the updates of the identified kN clients; the identification algorithm can be repeated in later rounds to update the list.

   Client Identification (Algorithm 2)

   • The core metric is the target-class loss difference L_t^j = ℓ(f_t−1, D^∗) − ℓ(f_t^j, D^∗), i.e., the decrease in target-class loss before and after the round-t update; under COMM_PLAIN it is computed using client j's local model, while under COMM_ENC only the aggregated global model can be used, and all participating clients in that round are counted together.
   • For each client, a list of loss differences over its participating rounds is maintained, the mean is taken and sorted, and the kN clients with the largest mean are selected.

   Analysis of attack parameters

   • Choice of kN: too large may remove too many benign updates and expose the attack; too small has insufficient effect. Experiments take kN ≤ k (k is the number of clients holding target-class samples).
   • The analysis of TN draws on the coupon collector problem: under COMM_PLAIN, the expected number of rounds to identify kN target clients is approximately (n/m)(Hk − Hk−kN), e.g., about 16 rounds when n=60, m=10, k=15, kN=15; under COMM_ENC, reaching precision α by excluding non-target clients requires about 26 batches when n=60, k=15, m=10, α=0.3.

   Poisoning amplification

   • Model replacement is used: the compromised client performs data poisoning by relabeling target-class samples to obtain θt*, and sends β(θt* − θt−1) with boost factor β=10, to offset the server's η/m aggregation weighting.

   UpSampling defense (Algorithm 3)

   • The server runs Algorithm 2 with its own target dataset DS* to identify kS high-contribution clients, raises their sampling probability to λ/n (λ=2), and lowers the probabilities of the remaining clients accordingly; identification is repeated each round to update the list.
   • The authors note that UpSampling also helps when there is no attack and accuracy is low simply because there are too few clients from the target population; combined with Clipping (norm C=1), it can defend against both packet dropping and poisoning.
   • Under privacy-preserving FL (MPC aggregation), the server can only see aggregated updates; in this case its knowledge is the same as that of a COMM_ENC attacker, and the defense still runs through the same procedure.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Identification, targeted dropping, poisoning amplification and defenses are evaluated on 3 datasets: under the encrypted setting, DBPedia target-class accuracy can drop from 53% to 0%, and UpSampling can recover it.

   Experimental Setup

   • Datasets and splits: EMNIST (about 100K digit images, 100 clients), FashionMNIST (70K images, 60 clients), DBPedia-14 (560K articles, 14 classes, 60 clients); the target classes are 0, 1, 9, and target-class samples are concentrated in k clients (k∈{9,12,15}; FashionMNIST and DBPedia fix k=15), with the target class accounting for αT=0.5 (EMNIST) or 0.6 of these clients' local data, and the rest split according to Dirichlet(αD=1.0).
   • FL protocol: FedAvg, m=10 clients selected per round, local training TL=2 epoch, aggregation learning rate η=0.25; T=100 (EMNIST), 200 or 300 (FashionMNIST, DBPedia; 300 for defense experiments).
   • Models: EMNIST/FashionMNIST use two 2D convolutional layers plus two linear layers (ηL=0.1); DBPedia uses pretrained GloVe embeddings plus two 1D convolutional layers and two linear layers, optimized with Adam (ηL=0.001).
   • Attack parameters: COMM_ENC experiments start dropping packets from round 30; poisoning boost factor β=10; defense λ=2, Clipping norm C=1.
   • Metrics and repetitions: target-class accuracy and full-test-set accuracy, reported at T/2 and T rounds; all results are the average of 4 trials with different random seeds.
   • Baselines: Perfect Knowledge (knowing the target clients in advance) and Random Drop (Table II); defense comparisons are FedAvg and Clip.

   Main Results

   Target-class accuracy of the targeted packet-dropping attack (T/2 and T rounds, per Table IV; T=100 corresponds to EMNIST, T=200 to FashionMNIST/DBPedia):

   Swipe horizontally to read the table

   Dataset	k	Setting	No attack	kN=k/3	kN=2k/3	kN=k
   EMNIST	15	COMM_PLAIN	0.65/0.80	0.50/0.74	0.26/0.50	0.02/0.02
   EMNIST	15	COMM_ENC	0.65/0.80	0.63/0.78	0.60/0.76	0.56/0.71
   FashionMNIST	15	COMM_PLAIN	0.40/0.55	0.24/0.23	0.02/0.03	0.00/0.00
   FashionMNIST	15	COMM_ENC	0.40/0.55	0.34/0.38	0.14/0.13	0.03/0.01
   DBPedia	15	COMM_PLAIN	0.36/0.53	0.10/0.01	0.00/0.00	0.00/0.00
   DBPedia	15	COMM_ENC	0.36/0.53	0.19/0.06	0.06/0.00	0.00/0.00

   • The authors state that under COMM_PLAIN the attack is close to the Perfect Knowledge baseline and outperforms random dropping in all settings; for example, on DBPedia with kN=5 the target-class accuracy drops from 53% to 6%.
   • The attack has little effect on overall model performance: full-test-set accuracy drops on average by only 3.88% (COMM_PLAIN) and 1% (COMM_ENC), see Tables VI, VIII, X.
   • The authors suggest that identification is more accurate and the attack stronger on FashionMNIST and DBPedia, with one hypothesis being that classes in complex datasets are more easily distinguished, so the loss rises more noticeably in rounds without target clients.

   Client Identification (Table III)

   • Under COMM_PLAIN identification is near complete: FashionMNIST identifies all 15 target clients in 50 rounds and DBPedia in 20 rounds; EMNIST is slower (14 identified in 70 rounds when k=15).
   • Under COMM_ENC identification is limited: DBPedia identifies on average 11.75/15 in 70 rounds, and EMNIST with k=15 identifies only 7/15 in 70 rounds; on this basis the authors set the COMM_ENC attack start round to 30.

   Poisoning Amplification and Clipping (Figures 1, 2)

   • The heatmaps for EMNIST, k=15, T=100 show that without Clipping, model replacement is more effective than targeted dropping where kN and kP are larger; with Clipping (norm 1) the poisoning effect decreases, but dropping plus poisoning still causes a clear drop in target-class performance.
   • Example given by the authors (COMM_PLAIN, class 0): original accuracy 0.8, 0.59 when dropping 7/15 clients, 0.66 when poisoning 7 clients, and 0.4 when combining both.
   • At T=50 (Figure 2) targeted dropping is more effective at low round counts; the authors explain that early in training the model needs to see target-class samples, and dropping delays the arrival of these samples, with the gap between the two narrowing later.

   Limited Visibility (COMM_ENC_LIMITED, Figure 3)

   • On FashionMNIST, k=15, T=200, kN=10, kP=10, the higher the proportion of visible clients and the larger αV, the lower the target accuracy; the authors state that with 20/60 clients visible and αV=2 there is still a relative target-accuracy drop of about 43.6%.
   • Adding poisoning always brings a larger accuracy drop (Figure 3b).

   Defense Evaluation (Tables V, VII, IX)

   • Parameters: EMNIST uses kN=kP=2k/3, FashionMNIST/DBPedia use kN=kP=k/3; T=100 (EMNIST), 300 (FashionMNIST/DBPedia).
   • COMM_PLAIN example: for EMNIST class 1, k=9, dropping reduces accuracy from 92% to 25%, and UpSampling restores it to 76% (Table V).
   • Defenses are stronger under COMM_ENC (the authors attribute this to knowledge asymmetry: the attacker sees only aggregated updates while the defender sees individual updates): with k=15, UpSampling improves relative to the original accuracy on average by 6.33% (EMNIST), 10.66% (FashionMNIST), 24.66% (DBPedia); DBPedia class 9 rises from 60% to 94% under targeted dropping (Table VII).
   • Under the combined dropping-plus-poisoning attack, the average change of Clip+UpSample relative to the original accuracy is: EMNIST down 5%, FashionMNIST up 9%, DBPedia up 16.66% (average over the three classes, Table VII).
   • MPC scenario (Table IX): the attack effect is essentially the same as COMM_ENC, and the defense effect lies between COMM_PLAIN and COMM_ENC; for example, EMNIST k=15 class 1 has an average accuracy of 0.84, higher than 0.51 under COMM_PLAIN and lower than 0.94 under COMM_ENC.

   Other Ablations and Analysis

   • Perfect Knowledge baseline (Table II): with kN=k the target-class accuracy drops to 0.0/0.0 on all datasets; Random Drop causes almost no loss (e.g., still 0.65/0.82 for EMNIST with k=15).
   • Classes with low original accuracy benefit more from UpSampling, with improvements of up to 34% (DBPedia class 9, 60%→94%, under targeted dropping).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that secure aggregation remains an open problem and suggest expanding the target-population clients; the experiments cover 3 datasets with 4 trials per setting.

   Limitations and future directions noted by the authors

   • Section 4 of the paper notes that prior work has shown attackers can bypass secure aggregation-type defenses, and that finding a secure aggregation method remains an open problem.
   • Section 3 mentions that its identification analysis is similar to the group testing problem, but the algorithm needs to identify members from noisy aggregate information; the authors believe Algorithm 2 could potentially be further improved with more sophisticated group testing algorithms.
   • The defense section (Section 5) suggests: the server could identify and recruit new clients holding data on the target population into the FL protocol, to mitigate the problem that underrepresented classes are more affected by attacks; the authors note that in cross-device settings the server typically has a large number of clients to choose from.
   • The paper has no dedicated Limitations section, and the remaining limitations are not explicitly stated.

   Scope of experiments

   • The datasets tested are 3 in total: EMNIST, FashionMNIST, and DBPedia-14; the target classes are only 0, 1, and 9.
   • The models are two convolutional architectures (one for EMNIST/FashionMNIST, and another for DBPedia based on GloVe), both relatively small-scale models.
   • All results are averages of 4 trials with different random seeds; the paper does not report statistical significance tests.
   • In the defense evaluation, the number of dropped and poisoned clients is fixed at kN=kP=2k/3 (EMNIST) or k/3 (FashionMNIST/DBPedia); the COMM_ENC_LIMITED experiments are conducted only on FashionMNIST.
   • Network-layer attacks are evaluated by simulating packet loss; the paper discusses implementation routes such as jamming, BGP hijacking, and router compromise, but does not carry them out in a real network environment.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors study network-layer packet-dropping attacks and defenses in FL: after identifying high-contribution clients, selectively dropping packets can substantially reduce target-class accuracy, and UpSampling can mitigate this.

   A paper on attacks and defenses for network-layer security in federated learning (FL), which the authors describe as the first study of network-layer attackers affecting FL-trained models.

   • Problem: FL relies on communication between clients and the server; the authors study whether a network-layer attacker with packet-dropping capability (encrypted communication, partial visibility) can damage the model's accuracy on a target class.
   • Method: On the attack side, a Client Identification algorithm identifies high-contribution clients by target-class loss difference, after which their updates are selectively dropped, and model replacement poisoning (β=10) can be used to amplify; on the defense side, the server reuses the same algorithm for UpSampling (λ=2) to raise the sampling rate of high-contribution clients, which can be combined with Clipping (norm 1).
   • Attack effectiveness: On DBPedia under COMM_ENC, dropping 5 clients reduces target-class accuracy from 53% to 6%, and dropping all 15 reduces it to 0% (Table IV); under COMM_PLAIN it approaches the Perfect Knowledge baseline and outperforms random dropping in all settings; the effect on full-test-set accuracy averages only 1%–3.88%.
   • Limited visibility: Under COMM_ENC_LIMITED with 20/60 clients visible and αV=2, the authors report target accuracy still drops by about 43.6% relative (FashionMNIST, Figure 3a).
   • Defense effectiveness: Under COMM_ENC, UpSampling raises target-class accuracy by an average of 6.33% (EMNIST) to 24.66% (DBPedia) relative to the original accuracy; combined with Clipping, under the combined packet-dropping-plus-poisoning attack, the T-round accuracy for DBPedia class 1 reaches 0.95 (Table VII).
   • Authors' conclusion: UpSampling combined with clipping can defend against combined network-layer packet-dropping and poisoning attacks; the authors also note that secure aggregation remains an open problem and suggest that the server recruit more target-population clients to mitigate the problem that underrepresented classes are more vulnerable to attack.

   Collapse this answer

Related papers