{"id":"b6086333-e019-4c69-b052-ec898564a7cb","arxiv_id":"2505.16403","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"FedSA uses sliding mode control on malicious local updates to drive a federated global model's test accuracy to a preset target while evading Byzantine-robust aggregators.","lead":"This paper introduces FedSA, a sliding-mode-control attack that steers a federated learning model's accuracy to a chosen target by manipulating malicious client updates. It matters because it claims precise, stealthy, tunable poisoning that defeats standard robust aggregation defenses.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1 proves a controller that needs Θ_t and the AGR Jacobian; FedSA as implemented uses unknown/approximate values, so the finite-time guarantee does not cover the evaluated attack.","rationale":"The reader's weakest assumption and my concern are the same: the controller in Eq. (10) is not implementable under the stated threat model, so Theorem 1's guarantee is disconnected from the experiments. I verified the toy SMC derivation is standard: if u_t contains the exact cancellation term, the Lyapunov argument yields finite-time reaching. The issue is not the algebra but the premise. Even the approximation mentioned only covers ∂F_AGR/∂w'; Θ_t is unaddressed, and the finite-difference formula itself is not a partial derivative. This is a correctness risk, not merely a missing experiment. Still, the empirical results in Table 1 show small deviations across many AGRs, so the attack may work in practice; the problem is the 'performance guaranteed' label. Conditional acceptance with a request for code and a corrected analysis is the right call; no stronger verdict is needed unless the code reveals that the experiments also omit the control law entirely.","tokens_in":28471,"tokens_out":8377,"duration_ms":70753,"concrete_test":"On a small logistic-regression FL task with FedAvg and 10% malicious clients, instrument the implementation to log the true Θ_t (computed after the round from benign updates) and the uploaded malicious control u_t. Compare three variants: (a) Eq. (10) with true Θ_t and analytic Jacobian; (b) the Sec. 3.2 finite-difference version with Θ_t omitted; (c) the same finite-difference version with Θ_t estimated from past global updates. If variants (b)/(c) still drive s_t to zero and e_t to -C/k, the omitted Θ_t can be handled as a bounded disturbance and the guarantee is repairable; if not, Theorem 1 does not apply to the implemented attack. Separately, for Median aggregation, evaluate the partial Jacobian at the malicious update; an identically zero Jacobian means the inverse in Eq. (10) is undefined, so the Median results cannot instantiate Theorem 1.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The proof of Theorem 1 (Supp.-1.1) cancels Θ_t = Σ_{i≠m} (∂F_AGR/∂w_{t,i})·dot-w_{t,i} exactly (Eqs. 14-17), so the control law in Eq. (10) presupposes that the adversary knows the aggregation rule's Jacobian with respect to every benign client and the benign local-update velocities at upload time. The Sec. 3.1 threat model says the adversary is unaware of the AGR rules, and benign updates are not observable before the malicious upload. The text only says ∂F_AGR/∂w' can be approximated by finite differences; it gives no estimator or error bound for Θ_t, and the stated finite-difference formula (F_AGR(t)-F_AGR(t-Δt))/Δw' is a time-derivative ratio, not a partial derivative. For non-differentiable AGRs such as Median, Krum, and Bulyan, the partial Jacobian is zero (or undefined) almost everywhere, so the inverse in Eq. (10) does not exist. Thus Algorithm 1 implements a different controller from the one Theorem 1 proves, and the finite-time/exponential-convergence guarantee does not transfer to the experimental results, including the Median rows of Table 1.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedSA, a poisoning attack against federated learning that uses sliding mode control to steer the global model toward a pre-defined accuracy target. The attack is formulated as a continuous-time control problem: malicious clients choose local models so that the aggregated global model tracks a reference model with adjustable offset. The authors prove a finite-time convergence theorem for the sliding surface and exponential convergence of the tracking error, and they support the method with extensive experiments on CIFAR10, MNIST, and Tiny ImageNet against nine aggregation rules, reporting that FedSA reaches target accuracies with small errors and outperforms LIE, Min-Max, Min-Sum, and FMPA.","tokens_in":28739,"tokens_out":4941,"duration_ms":38961,"significance":"If the theoretical guarantee were valid for the implemented algorithm, this would be a noteworthy contribution: it would give an attacker the ability to set a federated model's test accuracy to a chosen value with only 10% malicious clients while evading several Byzantine-robust aggregation rules. The paper is also useful for its breadth of empirical evaluation and for raising the question of controllable, non-DoS poisoning attacks. However, I find that the central guarantee is not established for the actual attack: the proof cancels a term that the implementation does not compute, the finite-difference approximation of the AGR Jacobian is not a partial derivative and has no error bound, and the analysis is continuous-time while the algorithm operates in discrete FL rounds. The target accuracy, moreover, is achieved by tuning the parameter C rather than by an a priori mapping from desired accuracy to C. These issues are load-bearing for the paper's main claim.","major_comments":[{"comment":"The proof of Theorem 1 in Supp.-1.1 cancels the term Theta_t exactly (Eqs. (14)-(17)), but Algorithm 1 does not compute or estimate Theta_t, and Sec. 3.1 states that the adversary is unaware of the AGR rules. The text only says that dFAGR/dw' can be approximated by finite differences; it gives no estimator or error bound for Theta_t. For non-differentiable AGRs such as Median, Krum, and Bulyan, the partial Jacobian in Eq. (10) does not exist (or is zero almost everywhere), so the inverse in Eq. (10) is undefined. Consequently, the controller actually implemented in the experiments is different from the one that Theorem 1 proves, and the finite-time/exponential-convergence guarantee does not transfer to the experimental results, including the Median rows of Table 1.","section":"Sec. 3.2, Eq. (10); Supp.-1.1"},{"comment":"The finite-difference approximation for dFAGR/dw' is written as lim_{Delta w' -> 0} (F_AGR(t) - F_AGR(t - Delta t)) / Delta w'. This is not a partial derivative with respect to w'; it is a time-difference ratio divided by a parameter change, and it is dimensionally inconsistent as stated. No finite-difference step size or error bound is provided, so the approximation error in the inversion step of Eq. (10) is uncontrolled. Because this approximation is used by default in the experiments, the size of the discrepancy between the theoretical controller and the implemented one is unknown.","section":"Sec. 3.2, finite-difference formula"},{"comment":"Theorem 1 is proved in continuous time for the ODE dynamics w' = u_t, while the FL system in Sec. 2.1 and Algorithm 1 operate in discrete communication rounds with local SGD updates and a global learning rate eta. The proof uses derivatives with respect to time, but no discretization analysis, sampling-time bound, or relationship between the continuous-time finite-time guarantee and the round index t is given. The experimental convergence curves therefore do not follow from Theorem 1 without additional arguments.","section":"Theorem 1; Sec. 3.2; Algorithm 1"},{"comment":"The claimed 'performance guarantee' is weakened by the way target accuracies are obtained. In Sec. 4.1, the reference model has one accuracy (e.g., 60% for CIFAR10) and other objectives are 'set by adjusting C'; but the paper provides no mapping from C to test accuracy and no procedure for choosing C a priori. The reported |delta| values are therefore the outcome of fitting C (and k) to the target, not of a parameter-free prediction. To support the guarantee, the authors should either give a calibration method for C from the desired accuracy or report the sensitivity of the final accuracy to C.","section":"Sec. 4.1; Remark 2"},{"comment":"The supplement's Remark 1 suggests an alternative control law u_t = [dFAGR/dw']^{-1} [eta sign(s_t)] that omits the term Theta_t. If this simplified law is what was actually used in the experiments, then the proof of Theorem 1 does not apply to it at all: the derivation in Eqs. (14)-(17) relies on the exact cancellation of Theta_t, which cannot occur in the simplified law unless Theta_t is zero. The manuscript should state which control law was implemented and supply a matching proof, including the case where Theta_t is treated as a disturbance.","section":"Sec. 3.2, Eq. (10); Supp.-1.1, Remark 1"}],"minor_comments":[{"comment":"The solution of e_t-dot = -k e_t - C is e_t = (e_0 + C/k)e^{-kt} - C/k, not e_t = 1/k * e^{-kt} - C/k as written; the current formula omits the initial condition and the e_0 term.","section":"Remark 1, Sec. 3.2"},{"comment":"Notation is inconsistent: Eq. (10) uses eta for the switching gain, while the proof in Supp.-1.1 uses alpha and eta_1 with eta = eta_1 + delta; the relationship between these constants is never stated, and the superscript in Eq. (16) (eta^1) appears to be a typo.","section":"Sec. 3.2 and Supp.-1.1"},{"comment":"The entry '53.20 (18.2256.37 (25.27)' in the FedAvg row is malformed and should be split into separate Min-Sum and FMPA columns; as printed it is unreadable.","section":"Table 1, Tiny ImageNet, Target Acc 45%"},{"comment":"The sentence 'as it is the benchmark setting in the literature of positioning attacks against FL' should read 'poisoning attacks'; 'positioning' is a typo.","section":"Sec. 4.1"},{"comment":"The 'stealth' claim is not directly measured: no detection rate, distance-to-benign-update metric, or robustness test against a defense that actively filters outliers is reported; the evasion claim rests only on the final accuracy staying close to the target, which does not by itself establish stealth.","section":"Sec. 4.2"}],"recommendation":"major_revision","confidential_remarks":"The paper has a strong empirical component and a genuinely interesting idea, but the theoretical guarantee as stated does not cover the implemented attack, and the target accuracies are fitted rather than predicted. I would not reject outright, because the gaps may be fixable with a reformulated threat model and a matching proof (or a clearly stated heuristic with uncertainty quantification). However, as submitted, the central claim is not established. The evaluation would also benefit from reporting the chosen C values and the sensitivity of the final accuracy to them."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Let me give you the short version. FedSA is a genuinely new idea—sliding mode control for model poisoning in FL—and the experiments look strong: across nine AGRs and three datasets, the attack lands within a few points of the target accuracy. That is worth something. But the central guarantee in Theorem 1 does not apply to the attack as implemented. The proof cancels Θ_t, the aggregate of benign contributions, exactly; the control law in Eq. (10) requires that term. The threat model says the adversary doesn't know the AGR rules, and the supplement only offers a finite-difference approximation for the AGR Jacobian, no estimator or error bound for Θ_t. For nondifferentiable AGRs like Median, Krum, and Bulyan, the inverse Jacobian in Eq. (10) doesn't exist, yet the experiments report success against those AGRs. So either the experiments use the approximate or simplified controller from the supplement's Remark 1, in which case Theorem 1's finite-time guarantee is not established, or they use something else—the paper doesn't say. That's a load-bearing gap.\n\nThere's also a circularity issue: the target accuracy is reached by adjusting C, so the headline claim of 'predefined' accuracy is more like a fitted outcome. And there is no code or error bars, so we cannot check the variance of those impressive numbers.\n\nWhat the paper does well: it identifies a real gap—controllable, non-DoS poisoning—and the SMC formulation is a fresh angle with a plausible mechanism. The ablation study on k, client fraction, Non-IID degree, client count, and sampling rate is useful. If the experimental results hold up, FedSA is a valuable stress-test tool for defenders, regardless of the theory.\n\nMy recommendation: send it to peer review, but only with a major-revision expectation. The authors need to either (a) prove a guarantee for the actual controller used, including the finite-difference approximation and the nondifferentiable case, (b) release code and parameter values, or (c) soften the 'performance guaranteed' language to what the experiments support. The idea deserves referee time, but the current proof does not support the claims.","headline":"Novel SMC-based FL poisoning attack with impressive empirical coverage, but the proof only covers an idealized controller the implementation doesn't actually run.","tokens_in":29277,"tokens_out":3033,"would_cite":false,"duration_ms":25366,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A sliding-mode controller lets a federated-learning attacker steer the global model to any preset accuracy level.","keywords":["federated learning","model poisoning","sliding mode control","controllable attack","Byzantine-robust aggregation","finite-time convergence","global model accuracy manipulation","adversarial machine learning"],"falsifier":"Run FedSA against coordinate-wise Median with randomized client participation and compare the measured global accuracy trajectory to the target: if the trajectory still converges to $-C/k$ when the attacker's $\\Theta_t$ estimate is wrong, the guarantee must come from a mechanism other than the exact cancellation in the proof; if it does not converge, the theorem's premise is violated. A cleaner test is to set the aggregation rule to a non-differentiable function and check whether the finite-difference Jacobian approximation in Eq. (10) is actually invertible.","tokens_in":28238,"feed_emoji":"🎯","tokens_out":9726,"duration_ms":65445,"temperature":0.7,"pith_summary":"This paper introduces FedSA, a poisoning attack that treats federated learning as a control system and applies sliding mode control to steer the global model toward a poisoned reference model. The claimed result is that with 10% of clients malicious, the attacker can make the global model's test accuracy converge to a predetermined value, such as 60% instead of 66%, while evading eight Byzantine-robust aggregation rules. Attack speed is a tunable parameter, and the target accuracy can be changed mid-run by adjusting a single constant without retraining a new reference model. The paper proves that the sliding surface is reached in finite time and that the error between the global and reference model converges exponentially to a chosen offset.","feed_headline":"Sliding-mode attack steers federated models to any accuracy","feed_subtitle":"With 10% malicious clients, FedSA parks accuracy at a preset level while dodging robust aggregators.","key_machinery":"The load-bearing objects are the sliding surface $$s_t = \\int(\\dot{e}_t + k e_t + C)\\,dt + C_1$$ and the control law $$u_t = \\left[\\frac{dF_{AGR}}{dw'_{t,i}}\\right]^{-1}\\left[k e_t + \\eta\\,\\mathrm{sign}(s_t) - \\Theta_t + C\\right],$$ where $e_t = \\tilde{w} - w_t$ is the error between the target poisoned model and the global model, $k$ sets the exponential rate, $C$ sets the final offset, and $\\Theta_t$ is the combined derivative of the benign clients' contributions to the aggregation. Setting $s_t = \\dot{s}_t = 0$ gives $\\dot{e}_t = -k e_t - C$, whose solution converges to $-C/k$. The term $\\eta\\,\\mathrm{sign}(s_t)$ enforces finite-time reachability of the surface through a Lyapunov argument, while the inverse Jacobian and $\\Theta_t$ terms are what make the malicious update act directly on the aggregate in the proof.","core_discovery":"The central claim is Theorem 1: under the control law in Eq. (10), the sliding surface $s_t$ reaches zero in finite time and stays there, and the error $e_t = \\tilde{w} - w_t$ converges to $-C/k$ exponentially fast. Since the adversary can choose the constant $C$, this fixes the steady-state global model at $w_t = \\tilde{w} + C/k$, which the paper equates with a chosen test accuracy. The paper further claims that FedSA reaches this target with fewer malicious clients than prior flexible attacks, that its convergence speed is controlled by the gain $k$, and that it stays stealthy enough to pass Median, Trimmed Mean, Norm-Bounding, Bulyan, Mkrum, FLTrust, CC, and DNC in the reported experiments.","pith_inferences":["If FedSA works as claimed, defenses that filter statistically outlying updates are attacking the wrong axis: the attack's stealth comes from staying inside the benign distribution, not from being small in norm.","The finite-difference approximation of the aggregation Jacobian is questionable for non-differentiable rules such as Median or Krum, so the empirical success may be carried more by the sign term and the reaching phase than by exact inverse-Jacobian compensation.","A defender who randomizes client participation or injects noise into benign updates would break the exact cancellation of $\\Theta_t$ on which the proof relies; testing FedSA under such perturbation is a direct extension of the paper's theory.","The same sliding-surface formalism could be redirected from global accuracy degradation to targeted misclassification or backdoor insertion, since the error is defined on model parameters rather than on accuracy itself."],"forward_implications":["An attacker with only 10% of clients can drive a federated model's test accuracy to any preset value, including near random guessing, rather than merely causing a denial of service.","Because the target is set by the constant $C$, the attacker can change the objective mid-training without constructing a new poisoned reference model.","The convergence speed is a free parameter $k$: larger $k$ reaches the target faster, giving the attacker a dial to trade stealth against speed.","The theoretical guarantee of finite-time reachability plus exponential convergence distinguishes FedSA from earlier model-replacement attacks that offer only heuristic convergence.","Ablation results indicate the attack remains effective as the malicious fraction drops to 5%, as client count grows to 200, and across Non-IID data splits."],"supporting_citations":[{"why":"Defines Flexible Model Poisoning Attack (FMPA), the main prior controllable attack that FedSA compares against and seeks to improve.","marker":"[Zhang et al., 2023]"},{"why":"Provides the sliding mode control framework and the design rationale for the control law used in FedSA.","marker":"[Young et al., 1999]"},{"why":"Supplies the finite-time stability theorem invoked in the proof of Theorem 1.","marker":"[Khoo et al., 2009]"},{"why":"Establishes the federated averaging setting and the FedAvg aggregation baseline used throughout the experiments.","marker":"[McMahan et al., 2017]"},{"why":"Defines the Median and Trimmed Mean aggregation rules used as defense baselines.","marker":"[Yin et al., 2021]"},{"why":"Defines Krum and multi-Krum, distance-based aggregation rules tested as defenses.","marker":"[Blanchard et al., 2017]"},{"why":"Defines Bulyan and the Byzantine-robust aggregation threat model.","marker":"[Mhamdi et al., 2018]"},{"why":"Provides the Min-Max and Min-Sum attack baselines and the DNC defense evaluated in the experiments.","marker":"[Shejwalkar and Houmansadr, 2021]"},{"why":"Defines the LIE attack baseline against which FedSA is compared.","marker":"[Baruch et al., 2019]"}],"fun_headline_variants":["Sliding-mode attack dials federated models to any preset accuracy","FedSA: sliding-mode control guarantees chosen federated accuracy","Control-theoretic poisoning sets exact federated accuracy","Fewer malicious clients, exact accuracy: FedSA's sliding-mode twist","Poisoning with precision: sliding mode steers federated accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The finite-time convergence guarantee in Theorem 1 requires the attacker to know or accurately estimate $\\Theta_t$, the combined derivative of the benign clients' contributions, and the inverse Jacobian of the aggregation rule, even though the threat model says the adversary is unaware of the aggregation rule.","fun_headline_variants_meta":{"raw":{"variants":["Sliding-mode attack dials federated models to any preset accuracy","FedSA: sliding-mode control guarantees chosen federated accuracy","Control-theoretic poisoning sets exact federated accuracy","Fewer malicious clients, exact accuracy: FedSA's sliding-mode twist","Poisoning with precision: sliding mode steers federated accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000507,"raw_usage":{"total_tokens":2458,"prompt_tokens":915,"completion_tokens":1543,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":1457}},"tokens_in":531,"tokens_out":1543,"duration_ms":12227,"temperature":1.0,"reasoning_tokens":1457,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:01:23.351974+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run FedSA against coordinate-wise Median with randomized client participation and compare the measured global accuracy trajectory to the target: if the trajectory still converges to $-C/k$ when the attacker's $\\Theta_t$ estimate is wrong, the guarantee must come from a mechanism other than the exact cancellation in the proof; if it does not converge, the theorem's premise is violated. A cleaner test is to set the aggregation rule to a non-differentiable function and check whether the finite-difference Jacobian approximation in Eq. (10) is actually invertible.","supporting_citations":[{"cited_title":"Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning","cited_arxiv_id":null,"evidence_quote":"Defines Flexible Model Poisoning Attack (FMPA), the main prior controllable attack that FedSA compares against and seeks to improve."},{"cited_title":"Communication-Efficient Learning of Deep Networks from Decentralized Data","cited_arxiv_id":null,"evidence_quote":"Establishes the federated averaging setting and the FedAvg aggregation baseline used throughout the experiments."},{"cited_title":"Byzantine-Robust Dis- tributed Learning: Towards Optimal Statistical Rates, February","cited_arxiv_id":null,"evidence_quote":"Defines the Median and Trimmed Mean aggregation rules used as defense baselines."},{"cited_title":"The Hidden Vulnerabil- ity of Distributed Learning in Byzantium, July","cited_arxiv_id":null,"evidence_quote":"Defines Bulyan and the Byzantine-robust aggregation threat model."},{"cited_title":"Manipulating the Byzantine: Optimiz- ing Model Poisoning Attacks and Defenses for Federated Learning","cited_arxiv_id":null,"evidence_quote":"Provides the Min-Max and Min-Sum attack baselines and the DNC defense evaluated in the experiments."},{"cited_title":"A Little Is Enough: Circumventing De- fenses For Distributed Learning","cited_arxiv_id":null,"evidence_quote":"Defines the LIE attack baseline against which FedSA is compared."}],"review_version":1}