Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach

1 Introduction

Federated learning (FL) is a distributed optimization framework in machine learning where the learning process is decentralized across multiple client devices, such as mobile phones, rather than being centralized [McMahan et al., 2017; Zhang et al., 2021; Zhang et al., 2019; Jebreel and DomingoFerrer, 2023]. This approach enables users to train models on locally stored data without needing to disclose their data. In FL, the central server (e.g., a cloud server) initially sends the global model to selected clients or all participating clients. Each client then trains the model locally using its own data. The updated models are subsequently uploaded to the central server, which aggregates them using an aggregation algorithm (AGR) to generate a new global model.

However, the natural collaboration paradigm of FL exposes it to the risk of poisoning attacks [Shen et al., 2022; Zhang et al., 2020]. These attacks can occur through either data poisoning or model poisoning. Data poisoning [Jagielski et al., 2018; Mu˜noz-Gonz´alez et al., 2017] involves contaminating the local data, while model poisoning [Bagdasaryan et al., 2020; Baruch et al., 2019; Fang et al., 2020; Mhamdi et al., 2018; Xie et al., 2020] refers to altering local updates. The goals of typical poisoning attacks can be divided into untargeted attack [Bhagoji et al., 2019; Fang et al., 2020; Mahloujifar et al., 2019; Mhamdi et al., 2018; Xie et al., 2020] and targeted attack [Bagdasaryan et al., 2020; Bhagoji et al., 2019]. The former aims to corrupt the global model to produce incorrect predictions on arbitrary test samples while the latter aims to manipulate the model to misclassify specific classes or sets of samples chosen by the attacker.

In this work, we investigate a newly emerging attack: the controllable poisoning attack against FL. This type of attack aims to precisely control the degree of performance degradation. Unlike traditional poisoning attacks, which typically result in a denial-of-service (DoS), the controllable poisoning attack operates with a predefined objective, such as reducing prediction accuracy by 10%. This attack, for example, can be utilized to subtly influence competitors in the commercial market. Instead of drastically impacting the performance of a competitor's algorithm, the attacker precisely introduces the extent of poisoning in a subtle controlled manner.

This emerging attack surface remains largely unexplored, as previous studies only primarily focused on the traditional model replacement strategy, where the global model is replaced with a poisoned reference model [Zhang et al., 2023]. However, this approach cannot guarantee a poisoning trajectory that converges to the attack's objectives. The attack's objective also remains fixed during the poisoning process, as it is predetermined by the reference model and cannot adapt to dynamic or evolving goals. Additionally, the attack lacks the ability to regulate its poisoning speed, increasing the risk of detection by Byzantine-robust aggregation rules (AGRs) if the poisoning occurs too rapidly.

To address these challenges, we propose Federated Learning Sliding Attack (FedSA), a method designed to enable performance-guaranteed poisoning attacks with precise control and adjustable poisoning speed, drawing on principles from Sliding Mode Control (SMC) theory [Young et al.,

1999]. Furthermore, the attack objective can be flexibly adjusted during the poisoning process to align with evolving goals.

To achieve precise control, we conceptualize the entire FL process as a system and design a control law to adjust malicious clients' models, steering the global model towards the poisoned reference model. Specifically, Sliding Mode Control (SMC)-an effective tool for robust controller design in complex nonlinear dynamic systems-offers low sensitivity to parameter variations and disturbances, reducing the need for exact modeling [Young et al., 1999]. By applying SMC, the system state is ensured to slide along a predefined sliding surface, thereby forcing the outputs of the FL process to align with the intended attack objective. The flexibility of attack objectives is achieved by introducing an adjustable variable to control the difference between the global model and the reference model. Additionally, the attack's progression speed can be subtly regulated by adjusting the control gain, eliminating the need for continuous parameter optimization as required in traditional model replacement strategies. In a nutshell, these new features significantly enhance the attack's stealth, allowing FedSA to evade detection and bypass defenses.

Our key contributions can be concluded as follows:

• We introduce a novel controllable attack, FedSA, that achieves precision control during poisoning the FL training. The SMC control law is specifically designed to ensure that the attack reaches its desired objectives while evading various Byzantine-robust AGRs.
• The proposed scheme allows the attacker to flexibly adjust its objective, without the need to generate new poisoned reference models for different targets.
• We theoretically demonstrate the guarantee of the precise control of the model performance. We prove that FedSA converges to the predefined objectives within a finite time, with freely controllable convergence speed. We conduct extensive experiments on benchmarking datasets against a variety of representative robust AGRs. We demonstrate that our design outperforms the existing SOTA poisoning attacks consistently across all settings.

2 Background and RelatedWork

2.1 Federated Learning

As shown in [McMahan et al., 2017], a typical FL framework consists of a central server and N clients, each client i (i ∈ [1,N]) has its local private dataset Di divided from a data distribution D, and the datasets can be IID (i.e., independently and identically distributed) or Non-IID. Define the global model as wt ∈ Rr and local model as w{t,i} ∈ Rr at the t-th iteration, the objective of FL is to optimize

where w∗ ∈ Rr is the optimal global model, r represents the total number of parameters (including weights and biases) of a neural network, and L denotes the loss function. To solve this, the central server first delivers the current global model parameters wt to all clients or a subset of them in the t-th iteration. Upon receiving wt, each client trains its local model w{t,i} using wt and its private training dataset Di. Then the clients send the local model update ∇{t,i} = w{t,i} - wt to the central server. Following a certain aggregation rule FAGR(·), the central server aggregates the received local updates to obtain a new global update ∇t = FAGR({∇{t,i}|i ∈ [1,N]}). Finally, the central server generates a new global model wt+1 = wt - η∇t and sends it back to all (or a subset of) clients, where η is the global learning rate. This process of FL is repeated until the global model converges.

2.2 Poisoning Attacks on FL

Poisoning attacks in Federated Learning (FL) can be broadly categorized into two types: data poisoning and model poisoning attacks (MPAs). In data poisoning attacks [Jagielski et al., 2018; Mu˜noz-Gonz´alez et al., 2017], the adversary poisons training datasets on the malicious devices while MPAs [Bagdasaryan et al., 2020; Baruch et al., 2019; Fang et al., 2020; Mhamdi et al., 2018; Xie et al., 2020] directly manipulate the local model gradients on malicious participants and send them to the server during the learning process. [Zhang et al., 2023] presented a novel FL model poisoning attack called Flexible Model Poisoning Attack (FMPA), which aims to reduce the global model's performance with a predefined objective. FMPA uses the current round global model as a reference, and fine-turns it to obtain a desired poisoned model. It then replaces the next ground global model with the poisoned version and iteratively searches for optimal parameters to update the poisoned model, achieving a degree of control over the attack effects. However, model replacement strategy cannot ensure that the global model will converge to the attacker's objective. In addition, the attack suffers from an uncontrollable speed and requires a large proportion of malicious clients, making it easily detected by robust AGRs. Moreover, the predetermined attack objective cannot be dynamically adjusted once the attack is initiated.

2.3 Existing Byzantine-robust Defenses

Current defenses can be categorized based on the principles that the server employs for detecting-then-removing or suppressing suspicious models, falling into three types: statistics-based, distance-based, and performance-based approaches [Shen et al., 2022; Gong et al., 2024; Gong et al., 2025]. Statistics-based defenses, such as Median [Yin et al., 2021] and Trimmed Mean [Yin et al., 2021], use statistical feature (e.g., mean or median) to aggregate on each dimension of input gradients individually. Distance-based defenses like Krum [Blanchard et al., 2017], Mkrum [Blanchard et al., 2017], and Bulyan [Mhamdi et al., 2018] evaluate the distance between local updates, such as Euclidean distance and Cosine similarity, to determine statistics outliers. Performance-based defenses, such as Fang [Fang et al., 2021], rely on a validation dataset to compute the performance of the uploaded models and remove divergent ones.

2.4 SlidingMode Control

Sliding Mode Control [Khoo et al., 2009; Lee et al., 2013; Alqumsan et al., 2019; Yin et al., 2011; Khoo et al., 2013;

Yu et al., 2021] is a robust nonlinear control approach that uses a discontinuous control signal to alter the dynamics of a system, forcing it to slide along a specified switching manifold st. The objective is to design a control law ut that ensures the system state wt tracks the desired state ˜w, on the sliding surface st = 0.

Consider a first order system ˙wt = ut as a toy example. Throughout this paper, the dot symbol above a letter represents its derivative with respect to time t, e.g., ˙wt is the derivative of wt. In general, the sliding surface is chosen as:

(2)

where et = ˜w -wt is the error between the current state wt and the desired state ˜w, at t-th iteration, and k is a hyperparameter that governs the convergence speed of et. If the

control can ensure that st = 0, i.e., ˙et = -ket, solving this first order differential equation yields et = e0e-kt , which converges exponentially as t increases.

Next is to show how to design ut to ensure limt→T st = 0. The control law ut can be designed as:

where α is a positive constant selected to force the system trajectory to reach the sliding mode surface, and sign(·) is the sign function given below:

We define an energy function Vt = 1 2 s2t to ensure the convergence of st. By applying Eqs. (2) and (3), we get the derivative of Vt as:

Eq. (4) satisfies the condition of finite-time stability theorem in [Khoo et al., 2009] for st to converge to zero in a finite time. Graphically, referring to Fig. 1, for any s0, the initial state of st, be negative (blue points) or positive (green points), due to the fact that Vt is a quadratic function, ˙Vt ≤ 0 (i.e., Vt+1 < Vt for Vt ̸= 0), st will move along the direction of the arrow in a decreasing manner and eventually converge to zero. When st = 0, the desired performance, et = e0e-kt is achieved, and et → 0 exponentially fast. Since et = ˜w - wt, this also implies the desired wt → ˜w exponentially.

3 The Design of FedSA

3.1 ProblemFormulation

Threat Model. The same as other MPAs, we assume that the adversary controls m out of N FL clients, with m/N = 10% as the default setting in the evaluation. The adversary 1 has access to the broadcast global model wt and can freely manipulate the set of local models w′t = {w′{t,i} |i ∈ [1,m]} by fully leveraging the SMC control principles in Sec. 2.4.

1 We remark that the adversary is unaware of the AGR rules and this will be discussed in detail in Sec. 3.2.

Adversary's Goal. For a FL classification task, the goal of a flexible MPA is to steer the global model wt = FAGR{w{t,1},w{t,2}, ...,w{t,m}, ...,w{t,N}}, which would otherwise converge to the global optimumwithout attack, toward a subpar reference model ˜w. This reference model can be obtained through early stopping, say using the criterion that ˜w exhibits a 10% reduction in accuracy.

As depicted in Fig. 2, the differences between the existing MPAs and FedSA lies in the guarantees provided by our approach. FedSA ensures that the attack objective (represented by the red star, chosen by the attacker and close to the optimum) is achieved with controlled progression speed and flexibly adjustable attack objectives. This fundamentally sets FedSA apart from SOTA works such as LIE [Baruch et al., 2019], Min-Max/Min-Sum [Shejwalkar and Houmansadr, 2021] and FMPA [Zhang et al., 2023], which lack theoretical convergence guarantees and face significant challenges-if not impossible-in controlling poisoning speed and adapting to evolving goals.

3.2 FedSADetails

Similar to the toy example in Sec. 2.4, we treat the overall FL global model

as a nonlinear system, and in particular, the malicious local models are chosen as

The key difference from the toy example is that the goal of FedSA is to design the control law ut to ensure that wtrather than w′{t,i} , as in the toy example-slides along the surface st = 0 to achieve:

exponentially fast, where C ∈ R is a constant to adjust the convergence status of et, and k ∈ R (k ̸= 0) is a parameter to adjust the convergence speed of et. To achieve the adversary's goal, we design the error function as

To realize this new error, we design the sliding surface as

where C1 ∈ R is the initial value of the sliding surface st, which can be any constant.

After selecting the sliding surface st, the control law ut is designed based on the FL system, the dynamic model in Eq. (6), the error function in Eq. (8) and sliding surface st in Eq. (9), as follows:

where η > 0 is a positive constant selected to force the system trajectory to reach the sliding mode surface. Here, dFAGR(·)/dw′{t,i} is the derivative of FAGR with respective to w′{t,i} and Θt = ∑Ni=1,i̸=m dFAGR(·) dw{t,i} · ˙w{t,i}. It is noted if FAGR is not differentiable or unknown to the adversary, dFAGR(·)/dw′{t,i} can be approximated by finite differences as:

.

This explains the threat model outlined in Sec. 3.1 and we use this approximation by default in the experimental analysis in Sec. 4.

FedSA's Algorithm. The algorithm of the FedSA is shown in Algorithm 1. Initially, the malicious clients receive the global model wt from the server, and then calculate the error et between global model and target model in Eq. (8) (line 6). By choosing the sliding surface in Eq. (9) (line 7), st will converge to 0 in a finite time, hence et will converge to -C/k in

an exponential rate. Then, by substituting Eq. (8) and Eq. (9) (lines 6 and 7) into the control input ut in Eq. (10), the malicious model is obtained (line 10). After that, the malicious model is uploaded to the server to be aggregated with updates from other clients by different AGRs (line 13).

Fig. 3 illustrates the process of our FedSA. The derivative of st is ˙st = ˙et + ket +C, which is written at the top of the Fig. 3. By applying SMC, et can be forced under control law ut from the initial point C1 to reach the sliding surface and slide along the designed sliding surface st = ˙st = 0, which are represented by two blue dash lines for C = 0 and C ̸= 0, respectively. Theorem 1 guarantees that, in the presence of poisoned local models w′t = {w′{t,i} |i ∈ [1,m]}, the global model wt will achieve the desired target accuracy ˜w = wt - C/k chosen by the attacker by manipulating C.

Algorithm 1 Malicious Model Update

Input: Global model wt, desired poisoning model ˜w.

Function: Control input ut in Eq. (10), sliding surface st in Eq. (9) and error function et in Eq. (8).

Output: Malicious model update vector w′t .

• 1: if t=0 then 2: wt ←w0 3: Initialize ˜w, C1 4: else 5: for malicious client i = 1 to m do 6: Calculate et of ˜w and wt in Eq. (8) 7: Calculate st in Eq. (9) 8: end for 9: Calculate ut from Eq. (10) ▷ {Control Law} 10: Calculate w′t from Eq. (6) 11: Output w′t

12: end if

13: Upload malicious models w′t to the FL server

Theorem 1. Consider a FL system governed by the dynamics described in Eq. (6) with the error function given by Eq. (8) and a sliding surface defined by Eq. (9). Let the control law ut be designed as in Eq. (10) with constants k > 0, η > 0, and C ∈ R, and the derivative of the aggregation function FAGR with respect to the malicious model w′{t,i} is continuous. Then the SMC control law ensures that: 1): The sliding surface st reaches zero in a finite time and remains zero thereafter. 2): The error et = ˜w - wt converges to -C/k exponentially fast.

Due to space limit, the proof of Theorem 1 is delayed to Supp.-1.1. Below, we highlight key remarks on the new features of FedSA.

Remark 1: Attack Speed. The adversary can control the convergence speed of et by designing the appropriate k. On the sliding mode surface (i.e., st = ˙st = 0), solving the ordinary differential equation ˙et = -ket - C, yields et =

1/k·e-kt 0 -C/k. It is evidence that, k governs the exponential convergence rate of et: the larger the value of k, the faster et converges exponentially. Hence, FedSA allows the adversary to freely control the attack's convergence speed.

Remark 2: Adjustable Objectives. At any stage of FedSA, the adversary can flexibly adjust its objective by selecting a different value of C in et, as shown in Fig. 3 and Eq. (8). At equilibrium on the sliding surface, ˙st = 0, ˙et = 0. Using ˙st = ˙et + ket + C again, we have the desired et = -C/k or wt = ˜w + C/k. This phenomena is denoted by the red curves' ending points on the sliding surface for C = 0 and C ̸= 0 in Fig. 3 where the adversary can achieve the desired attack objective.

4 Performance Evaluation

4.1 Experiment Setup

Datasets and Models

For the experiments of FedSA, the following models and datasets are considered: AlexNet [Yang et al., 2017] is used for CIFAR10; FC (Fully Connected Network) for MNIST; and ResNet50 for Tiny ImageNet. The details of each dataset are demonstrated in Supp.-2.1. We implement our FedSA under both IID and Non-IID data split strategy. Taking CIFAR10 dataset as an example, for IID scenarios, each client receives 100 training images from each of the 10 classes, culminating in a total of 1000 training images per client. In addition, we also use Dirichlet distribution under different degrees of Non-IID scenarios including 0.1, 0.3, 0.5, 0.7 and 0.9. A smaller degree value leads to more skewed distributions, where clients predominantly receive data from a few classes. A larger degree value results in a more balanced distribution. For example, if Non-IID level is at 0.1, each client will receive 1000 images from only one or two classes.

FL System Settings

For CIFAR10 dataset with AlexNet, the global learning rate is set as 0.02, the global batch size is set as 128 and the global epochs is set as 100. For the local training process, the batch size is set as 10, and the epochs is set as 5. For MNIST dataset with fully connected network, the global learning rate is set as 0.01, the global batch size is set as 128 and the global epochs is set as 100. For the local training process, the batch size is set as 5, and the epochs is set as 3. As for Tiny ImageNet with ResNet50, the global training rate is set as 0.001, the global batch size is set as 128, the global epochs is set as 20. In the local training process, the batch size is set as 10, and the epochs is set as 3.

Attack Settings

We consider 50 clients participated and 10% malicious clients as default setting, and study the impact of the various proportion of malicious clients in Section 4.3. 10% of malicious proportion is considered as it is the benchmark setting in the literature of positioning attacks against FL [Zhang et al., 2023; Shejwalkar and Houmansadr, 2021; Baruch et al., 2019]. This setting is noticeably realistic in real-world scenarios, such as Sybil attacks and botnets, where a malicious attacker can compromise or simulate large numbers of users. As for setting various attack objective, we set 60%, 55%, 50%,

30% and 10% for CIFAR10, in which 60% is set for reference model and other objectives are set by adjusting C. For MNIST, we set 90% for reference model while 85%, 80%, 50% and 10% are obtained by adjusting C. For Tiny ImageNet, we set 45% as the accuracy of the reference model and 40%, 35% and 0.5% are adjusted by C. The target accuracy of 10% for CIFAR10, 10% for MNIST and 0.5% for Tiny ImageNet are equivalent to random guessing among the classes of the dataset settings.

However, for FMPA we obtain multiple reference models for each attack objective. We compare our method with existing attacks including LIE [Baruch et al., 2019], MinMax [Shejwalkar and Houmansadr, 2021], Min-Sum [Shejwalkar and Houmansadr, 2021], and FMPA [Zhang et al., 2023]. The introduction of each attack is illustrated in Supp.- 2.1 and their computation costs are reported in Supp.-2.2.

Evaluation Defenses

In this paper, we consider various defenses such as FedAvg [McMahan et al., 2017], Median [Yin et al., 2021], Trmean [Yin et al., 2021], Norm-Bounding (NB) [Sun et al., 2019] Bulyan [Mhamdi et al., 2018], Mkrum [Blanchard et al., 2017], Fltrust [Cao et al., 2022], CC [Karimireddy et al., 2021], and DNC [Shejwalkar and Houmansadr, 2021]. The details of each defense is introduced in the Supp.-2.1.

Evaluation Metric

We set the accuracy of attack objective as A0, if the final accuracy output is AT , then δ = ((AT - A0)/A0) × 100% demonstrates the difference between the attack objective and the real accuracy. When we compare the performance of different attacks, we use the absolute value of δ. The lower the |δ| is, the better the performance of attack achieves. We also define the evaluation metric θ = |δ|OA/|δ|FedSA to evaluate the performance of our attack (|δ|FedSA) comparing to other attacks (|δ|OA).

4.2 Experimental Results

The experiment results against various AGRs with different desired attack objectives are concluded in Table 1. More experimental results under various attack objectives are demonstrated in Supp-2.2. In general, our FedSA achieves the lowest |δ| and outperform all other attacks, demonstrating its ability in reaching to the attack objective within a small range of loss. The average values of |δ| across all the AGRs for CIFAR10 are 2.18% under attack objective 60%, 2.61% under attack objective 55%, 1.62% under attack objective 50%, 4.43% under attack objective 30% and 4.56% under attack objective 10.00%. As for MNIST dataset, the average values among all AGRs for MNIST are 1.62% under attack objective 90% and 1.92% under attack objective 85%, 3.16% under attack objective 80%, 7.41% under attack objective 50%, and 3.37% under attack objective 10.00%. The averages against all AGRs are 2.64% for attack objective 45%, 2.05% for attack objective 40%, 1.74% for attack objective 35%, and 4.00% under attack objective 0.50% on Tiny ImageNet.

In addition, our FedSA successfully evades all AGRs and outperforms all other attacks. As shown in Fig. 4, our FedSA can stably converge to it without being detected by AGRs. In contrast, FMPA is detected by AGRs in various scenarios, leading to the test accuracy in the presence of FMPA being close to the global optimal without attack. Moreover, the outcomes in the main experiments demonstrates that our FedSA can realize precise control and improve the θ mostly by 5226.00× on FMPA, 4737.00× on LIE, 4723.00× on Min-Max and 4156.00× on Min-Sum across all the scenarios.

We now discuss the results on each dataset in detail. For experiments on CIFAR10 dataset, as for different attack objectives, the lowest accuracy difference |δ| can be realized against Norm-Bounding at 0.10%, Mkrum at 0.15%, Bulyan at 0.34%, CC at 0.10%, and Trmean at 0.30% for 60%, 55%, 50%, 30% and 10% respectively. Moreover, FMPA is found out by Bulyan and Mkrum for 50%.

For experiments on MNIST dataset, the lowest |δ| can be found 0.27% against Trmean for 90%, 0.47% against Mkrum for 85%, 0.03% against Mkrum for 80%, and 0.54% against Norm-Bounding for 50%. As for attack objective 85%, except the maximum accuracy difference |δ| of our attack 3.46% against Fltrust, all of the accuracy difference is reduced to under 2%. It is evident that FMPA is detected by Bulyan, CC and DNC for 85% due to the high accuracy, additionally, FMPA is detected by all AGRs except Median and Mkrum for 90% and Bulyan for 80%. The results are nearly reaching or has reached the accuracy with no attack, which means FMPA cannot precisely control the accuracy to attack objective.

For experiments on Tiny ImageNet, the accuracy difference |δ| has the lowest value against CC at 0.09%, Trmean at 0.30%, DNC at 0.40%, and Norm-Bounding, CC, and DNC at 2.00% for attack objectives 45%, 40%, 35% and 0.5%. According to results, FMPA is noticed by all AGRs except Median, CC and DNC for 45%, and Median, Bulyan and Mkrum for 35%.

However, the performance against Median is slightly worse than other AGRs, which might be due to the significant less amount of malicious clients.

4.3 Ablation Study

In this section, we evaluate the impact of various factors on FedSA's performance, including the attack speed under different k, the proportion of malicious clients, degree of NonIID, number of clients and sampling rate of clients. More ablation study under different settings are demonstrated in Supp.-2.3.

Impact of k on the attack speed. We illustrated the effect of different k on CIFAR10 with targeted accuracy at 60% against Mkrum. According to the result shown in Figure 5a, as the increasing value of k, the attack speed of reaching the target objectives will be faster.

Impact of the proportion of malicious clients. We compared the effect of different proportion of malicious clients including 5%, 10%, 15% and 20% on CIFAR10 with targeted accuracy at 55% against various AGRs. According to the result shown in Figure 5b, as the increase of the proportion of malicious clients, the outcomes indicate that we can still achieve attack objective with 20% malicious clients without being detected by central server.

Impact of the different degree of Non-IID dataset. We have evaluated the performance under different degrees of Non-IID scenarios include 0.1, 0.3, 0.5, 0.7 and 0.9 on CIFAR10 against Mkrum, and the attack objective is set as 60%.

The outcomes, compared to other attacks are shown in Fig. 5c, demonstrate that our attack not only achieves its objective but also outperforms other attacks across various NonIID scenarios.

(a) Impact of different k on at-

tack speed

(b) Different proportion of mali-

cious clients

• (c) Different degree of Non-IID (d) Different number of clients (e) Different sampling of clients

Figure 5: Ablation study results against Mkrum on CIFAR10 with AlexNet.

Impact of the number of clients. In our experiments, 50 clients are participated in federated learning. We also evaluated our model with an increasing number of clients, including 100, 150, and 200 on CIFAR10 dataset with target accuracy 60%. The outcomes is shown in Fig 5d, which demonstrates that our model can outperform other attacks in increasing number of clients scenario.

Impact of the sampling rate of clients We also implement our model with different sampling rate shown in Fig 5e. It is obvious that FedSA can achieve stabler performance with various sampling rates. Experiment results of the ablation studies on more datasets against various AGRs with different target accuracy are given in Supp.-2.3.

5 Conclusion

We have presented a novel controllable attack FedSA to realize precise control on FL. We demonstrated that our attack can bypass all the Byzantine-robust FL algorithms without being detected. We also provided the theoretical proof to guarantee the performance of the attack. We have proven that FedSA can converge to the attack objective with an adjustable speed. Our experiments on benchmarking datasets demonstrates that FedSA can achieve precise control to the attack objective. Our work highlights the need for specialized defense mechanisms to counteract the controllable poisoning attack, which subtly influences the model performance. Future work will include further investigation into dedicated defense mechanisms against FedSA. In addition, we also see new research opportunities in extending FedSA's mechanism to diverse FL scenarios, e.g., asynchronous learning.

Acknowledgements

This work is supported in part by the ARC Discovery Project (Grant No. DP250102634). Leo Yu Zhang and Suiyang Khoo are the corresponding authors.