Fabricated Flips: Poisoning Federated Learning without Data

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

12 Downloads (Pure)


Attacks on Federated Learning (FL) can severely reduce the quality of the generated models and limit the usefulness of this emerging learning paradigm that enables on-premise decentralized learning. However, existing untargeted attacks are not practical for many scenarios as they assume that i) the attacker knows every update of benign clients, or ii) the attacker has a large dataset to locally train updates imitating benign parties. In this paper, we propose a data-free untargeted attack (DFA) that synthesizes malicious data to craft adversarial models without eavesdropping on the transmission of benign clients at all or requiring a large quantity of task-specific training data. We design two variants of DFA, namely DFA-R and DFA-G, which differ in how they trade off stealthiness and effectiveness. Specifically, DFA-R iteratively optimizes a malicious data layer to minimize the prediction confidence of all outputs of the global model, whereas DFA-G interactively trains a malicious data generator network by steering the output of the global model toward a particular class. Experimental results on Fashion-MNIST, Cifar-10, and SVHN show that DFA, despite requiring fewer assumptions than existing attacks, achieves similar or even higher attack success rate than state-of-the-art untargeted attacks against various state-of-the-art defense mechanisms. Concretely, they can evade all considered defense mechanisms in at least 50% of the cases for CIFAR-10 and often reduce the accuracy by more than a factor of 2. Consequently, we design REFD, a defense specifically crafted to protect against data-free attacks. REFD leverages a reference dataset to detect updates that are biased or have a low confidence. It greatly improves upon existing defenses by filtering out the malicious updates and achieves high global model accuracy.

Original languageEnglish
Title of host publicationProceedings of the 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2023
EditorsLisa O'Conner
Place of PublicationPiscataway
Number of pages14
ISBN (Electronic)979-8-3503-4793-7
ISBN (Print)979-8-3503-4794-4
Publication statusPublished - 2023
Event53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2023 - Porto, Portugal
Duration: 27 Jun 202330 Jun 2023


Conference53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2023

Bibliographical note

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.


  • data heterogeneity
  • data-free attack
  • Federated learning
  • untargeted attack


Dive into the research topics of 'Fabricated Flips: Poisoning Federated Learning without Data'. Together they form a unique fingerprint.

Cite this