federated learning poisoning

**Federated Learning Poisoning** is the **exploitation of federated learning's distributed nature to inject malicious model updates** — a compromised participant sends poisoned gradient updates to the central server, embedding backdoors or degrading the global model without revealing their training data. **FL Poisoning Attack Types** - **Model Replacement**: Scale up the malicious update so it dominates the aggregation. - **Backdoor Injection**: Train locally on backdoor data and send the resulting gradient — global model inherits the backdoor. - **Byzantine**: Send arbitrary, malicious gradient updates to corrupt the global model. - **Free-Rider**: Don't train locally — just send noise or stale gradients while still receiving the global model. **Why It Matters** - **No Data Inspection**: The server only sees gradient updates, not raw data — poisoned data is never visible. - **Amplification**: Scaling up malicious updates can override honest participants' contributions. - **Defense**: Robust aggregation (median, trimmed mean, Krum), norm clipping, and anomaly detection on updates. **FL Poisoning** is **attacking from within** — exploiting federated learning's privacy guarantees to inject poisoned updates without revealing malicious training data.