{"id":"365339a0-57d3-4931-8916-6ebb56cb0079","arxiv_id":"2509.05265","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Malicious clients can craft LDP-compliant updates that collapse the global model in federated learning, even when the server uses Multi-Krum or trimmed mean aggregation.","lead":"This paper shows that federated learning systems that add local differential privacy can still be broken by a small number of malicious clients. It introduces model poisoning attacks that push the global model's error rate to near 90% on standard benchmarks, even when the server uses robust aggregation.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The robust-aggregation attacks depend on exact interception of benign LDP reports; without that capability, AdaPA cannot compute the geometric-median or trim bounds in Algorithms 2-4, so the claimed critical vulnerability is contingent.","rationale":"I identified the same load-bearing assumption as the reader, and this pass sharpens it: exact interception of benign reports is not merely an optional enabler of TMMA; it is the sole input to the adaptive attacks against robust aggregation. Algorithms 3 and 4 consume the benign report set directly to compute the geometric median, the distance threshold, and the trim bounds. Without those exact vectors, the AdaPA construction cannot even be instantiated for Multi-Krum or trimmed mean. The paper does provide code and the experiments are plausible under its stated threat model, so I am not claiming internal inconsistency or fraud. However, the abstract's 'revealing critical vulnerabilities' wording overstates what is established if the attacker is restricted to client-only knowledge: the only attack that would remain available is LLRA, and Table IV shows that LLRA-I is largely ineffective against Multi-Krum at 15% malicious clients. This matches the reader's conditional verdict, so I recommend no change to the verdict. The secondary issues raised by the reader, such as missing error bars, the unspecified SCAL parameter, and the weak baseline, are real but less central than the interception dependence; they would further support a conditional rather than an unconditional acceptance.","tokens_in":20577,"tokens_out":6624,"duration_ms":65424,"concrete_test":"Re-run the Fig. 2 and Fig. 3 AdaPA experiments under a partial-knowledge attacker: same N, n, local data, and global model, but no interception of the current round's benign LDP reports; estimate benign updates from public global models or local training instead of using exact Theta^t_{i in [N]-[n]} in Algorithms 3 and 4. If error rates at 15-20% compromised clients drop to near the no-attack baseline (as LLRA-I alone does in Table IV), the robust-aggregation vulnerability claim is contingent on the interception assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that adaptive attacks significantly degrade the global model even under Multi-Krum and trimmed mean (abstract; Section IV-C). For the no-robust-agg setting, LLRA-O alone often already drives error to roughly 90% (Table II), so the distinct claim is AdaPA's evasion of robust aggregation. That evasion is constructed entirely from exact benign updates: Section III-C states compromised clients 'have full knowledge of the parameters uploaded by benign clients' obtained by eavesdropping, and Algorithm 4's FitOnDef uses those vectors to set the Multi-Krum radius (geometric median plus nearest-benign distance) or the coordinate-wise trim bounds. If the attacker cannot intercept the exact LDP reports of all benign clients in the current round, this construction has no input: the geometric median, nearest-neighbor radius, and trim min/max are undefined. The only remaining attack under robust aggregation is LLRA-I, and Table IV shows it is weak in this regime (e.g., under LDPSGD-MK on Fashion-MNIST, 15% malicious only raises error from 22.37% to 30.58%; under PrivateFL-MK, from 22.22% to 23.42%). Thus the headline robustness claims for the adaptive framework, as opposed to simple unconstrained poisoning without defense, rest on a strong man-in-the-middle assumption and would not transfer to attackers who only control clients. This does not invalidate the threat model, but it makes the central claim conditional on a capability that is not established in the paper.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies model poisoning attacks on federated learning with local differential privacy (LDP-FL). The authors propose three attack families: Local Loss Reversal Attack (LLRA), Targeted Model Manipulation Attack (TMMA), and Adaptive Poisoning Attack (AdaPA), the last being designed to evade Multi-Krum and trimmed mean by fitting malicious updates to constraints computed from intercepted benign reports. They evaluate the attacks on LDPSGD, PrivateFL, and LDP-FL over MNIST, Fashion-MNIST, and CIFAR-10, reporting that their attacks drive error rates to roughly 90% in many settings and that AdaPA substantially degrades accuracy under robust aggregation. They also study the effect of data heterogeneity and privacy budget, and they release their code.","tokens_in":20925,"tokens_out":7925,"duration_ms":67798,"significance":"If the empirical claims held in the stated threat model, the paper would be a useful contribution: it is, to the authors' knowledge, the first systematic study of model poisoning on LDP-FL under robust aggregation, and the derivation of TMMA for the real-valued FedAvg case is clean and self-contained. The evaluation covers three protocols, three datasets, and two architectures, and the released code supports reproducibility. The significance is limited by the fact that the most novel results (AdaPA against Multi-Krum and trimmed mean) depend on exact interception of all benign LDP reports, by the absence of any variance analysis or repeated trials, and by the lack of strong attack baselines beyond random poisoning. With revisions that close these gaps, the paper could be a solid assessment of LDP-FL poisoning robustness under a strong adversary.","major_comments":[{"comment":"The central claim that adaptive attacks can degrade the global model under Multi-Krum and trimmed mean is contingent on a man-in-the-middle capability. Section III-A assumes the attacker intercepts the exact LDP reports of benign clients, and Section III-C notes that the cited prior work with this assumption focuses on federated learning without LDP. Algorithms 2-4 use those intercepted reports to compute the geometric median, the nearest-benign distance, and the trim bounds; without this information, FitOnDef has no input. The only local-knowledge attack that remains under robust aggregation is LLRA-I, and Table IV shows it is weak in that regime (e.g., LDPSGD-MK on Fashion-MNIST: 30.58% error with 15% malicious clients versus 22.37% with no attack). This is not a circularity, because the assumption is stated explicitly, but it makes the headline 'critical vulnerability' claim conditional on a capability the attacker may not possess. Please add a partial-knowledge ablation or clearly reposition the robust-aggregation claims as valid only for an adversary who can eavesdrop on all benign reports.","section":"III-A, III-C, Algorithms 2-4, Table IV"},{"comment":"The TMMA formula, theta_adv = (N*theta_target - (N-n)*theta_est)/n, is exact only when malicious clients upload theta_adv unchanged and the server averages the raw real-valued vectors. For LDP-FL, Algorithm 1 then applies DataPerturbation or Clip2Val, which maps every coordinate to one of two discrete values, so the actually uploaded vector is not theta_adv and the aggregated model does not equal theta_target. The paper nevertheless reports TMMA-I and TMMA-O as strong attacks on LDP-FL in Table II. Please analyze the expected aggregate under the discretization, or present TMMA for LDP-FL as a heuristic and state explicitly that exact target manipulation is not achieved in that protocol.","section":"III-B, Algorithm 1 lines 20-23"},{"comment":"All empirical comparisons are point estimates from single runs, although the setup has multiple randomness sources: Dirichlet data partitioning, Poisson sampling, Gaussian noise, and random client selection. With N=20 and only 2-5 malicious clients, the differences among LLRA-I, AdaPA, and RPA in Figures 2-3 are reported without error bars, confidence intervals, or significance tests; Table II even repeats identical values (e.g., 88.65 and 90.00) across many settings. To support the claimed 'consistently outperforms' conclusions, the paper needs repeated seeds, variance reporting, and statistical comparisons. The attack baseline is also only RPA; including an existing optimization-based FL poisoning attack adapted to the LDP setting would substantially strengthen the comparison.","section":"IV-A, IV-C, Table II, Figures 2-3"},{"comment":"FitOnDef in Algorithm 4 multiplies the Multi-Krum clipping radius by the scale zoom factor SCAL, but Section IV-A never reports the SCAL values used, nor does it report the ATE values for each experiment. SCAL directly controls the distance of adversarial updates from the geometric median and is therefore load-bearing for the results in Figure 2. If SCAL was tuned per protocol or dataset, the comparison to LLRA-I (which has no analogous free parameter) is not apples-to-apples. Please report all hyperparameters and include a sensitivity study over SCAL.","section":"Algorithm 2, Algorithm 4, Section IV-A"}],"minor_comments":[{"comment":"The abbreviation 'ARE' appears where 'ATE' (adversarial training epoch) is intended, and Section IV-C uses 'ARE=e' without defining ARE; please unify the notation.","section":"Algorithm 1, line 2; Section IV-C"},{"comment":"The adaptive attack is called 'AdvPA' in Section IV-C but 'AdaPA' in Sections III-C and IV-A; use a single acronym consistently.","section":"Throughout"},{"comment":"Identical error-rate values (such as 88.65 and 90.00) appear for many different protocols and attack families; without variance information this may be a rounding artifact or a copy-paste error and should be clarified in a footnote.","section":"Table II"},{"comment":"The RPA scale factor t is set to 50 in the non-robust experiments and to 1 in the robust-aggregation experiments, but no justification or sensitivity analysis is given for either choice.","section":"Section IV-B"},{"comment":"The phrase 'the highest accuracy (lower is better for attacks) achieved by AdvPA is 0.173' is confusing because the plots report error rate; please label all quantities consistently as error rates or accuracies.","section":"Section IV-C, Multi-Krum discussion"},{"comment":"References [23] and [32] appear to be the same paper (Cao, Jia, and Gong, USENIX Security 21, 'Data Poisoning Attacks to Local Differential Privacy Protocols') and should be merged.","section":"References"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper is the first to systematically attack model poisoning in LDP federated learning. It adapts known ideas—inverted loss, target manipulation—to three protocols, including LDP-FL's discrete two-point output space, and it ships code. The no-robust-aggregation results are strong: LLRA-O and TMMA-O push error to roughly 90% with 10–20% malicious clients on standard benchmarks. That part is credible.\n\nWhat it does well: the TMMA formula is exact for FedAvg, the threat model is stated clearly, and the paper distinguishes input/output and local/global knowledge. The adaptive attacks against Multi-Krum and trimmed mean are a sensible extension: compute the geometric median or trim bounds from benign reports and fit malicious updates inside those bounds.\n\nThree soft spots, in order of importance. First, the robust-aggregation attacks (AdaPA) require the attacker to intercept the exact LDP reports of all benign clients each round. The paper states this, but it is load-bearing: without that capability, Init and FitOnDef have no input, and Table IV shows LLRA-I alone is weak under Multi-Krum (e.g., Fashion-MNIST with LDPSGD-MK goes from 22.37% to 30.58% with 15% malicious). So the headline \"critical vulnerabilities under robust aggregation\" is contingent on a man-in-the-middle capability that is plausible but not established. Second, the evaluation has no repeated trials or variance; Table II is a single run, and the only baseline is RPA. Comparing against a non-private FL poisoning attack (e.g., a norm-based or Fang-style attack) would tell us what LDP actually adds. Third, SCAL, a key parameter in Algorithm 2, is never specified in the experiments, so the adaptive attack is only reproducible from the code, not from the paper. The heterogeneity and privacy-budget analyses are fine as exploratory, but they share the same single-run problem.\n\nThe central claim—that LDPFL without robust aggregation is easily poisoned—holds up. The robust-aggregation claim is real but narrower than the abstract suggests. The math is self-contained and there are no fitted constants, so I don't see circularity.\n\nWho this is for: anyone designing or evaluating LDP federated learning defenses. It deserves a serious referee. The novelty is genuine, code is available, and the questions it raises are important. I'd send it to review, asking the authors to add variances, specify SCAL, add a stronger baseline, and discuss the no-eavesdrop scenario for robust aggregation. I'd probably cite it in work on FL poisoning.","headline":"First systematic poisoning study for LDP federated learning; the no-defense attacks are convincing, but the robust-aggregation headline rests on a strong eavesdropping assumption and the evaluation needs more rigor.","tokens_in":21415,"tokens_out":2675,"would_cite":true,"duration_ms":24939,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Small groups of malicious clients can force LDP federated learning models to near-random accuracy, even when the server uses defensive aggregation.","keywords":["federated learning","local differential privacy","model poisoning","adaptive attacks","Multi-Krum","trimmed mean","privacy budget","non-IID data"],"falsifier":"Run the same attacks with secure aggregation or authenticated channels that hide benign LDP reports from the attacker; if the global model keeps its no-attack accuracy with 10 to 20 percent malicious clients, the collapse result depends on report interception rather than on the LDP mechanisms themselves.","tokens_in":20405,"feed_emoji":"🎯","tokens_out":5661,"duration_ms":51574,"temperature":0.7,"pith_summary":"The paper claims that locally differentially private federated learning is not inherently resistant to model poisoning: a small fraction of malicious clients can drive the global model to near-random accuracy. The attacks work by reversing the local loss or by solving for poisoned uploads that steer the aggregate to a chosen target model. When the server relies on Multi-Krum or trimmed mean, an adaptive version fits the poisoned updates inside the defense's accepted region. Experiments on three protocols, three datasets, and two network architectures report error rates around 90 percent with roughly 10 to 20 percent malicious clients.","feed_headline":"Ten percent malicious clients can collapse private federated learning","feed_subtitle":"Crafted uploads defeat Multi-Krum and trimmed mean, pushing error rates near 90 percent in three privacy protocols.","key_machinery":"The load-bearing object is the adversarial report constructor: a reverse training loop that maximizes global loss, together with the target-manipulation identity $\\hat{\\theta}_{\\mathrm{adv}} = (N\\theta_{\\mathrm{target}} - (N-n)\\theta_{\\mathrm{est}})/n$ for TMMA. For adaptive attacks, each adversarial training epoch ends with a projection step that either clips the poisoned update to a fixed distance from the geometric median of benign updates or clamps it inside the per-dimension bounds that survive trimmed mean. This projection is what lets poisoned updates evade Multi-Krum and trimmed mean selection.","core_discovery":"The paper establishes that client-side privacy noise does not by itself protect federated learning from poisoning; it can even give attackers cover. Under the assumption that the attacker sees the exact LDP reports benign clients upload, compromised clients can compute uploads from the formula $\\hat{\\theta}_{\\mathrm{adv}} = (N\\theta_{\\mathrm{target}} - (N-n)\\theta_{\\mathrm{est}})/n$, placing the aggregated global model exactly on an adversarial target. Against defensive aggregators, adversarial training with a constraint-fitting projection keeps the poisoned updates close to the accepted region while still damaging the model. Across LDPSGD, PrivateFL, and LDP-FL, the strongest variants consistently degrade the global model to error rates near 90 percent, indicating that existing LDPFL protocols are vulnerable to model poisoning.","pith_inferences":["A direct untested corollary is that secure aggregation or authenticated channels that hide benign LDP reports from the attacker would likely blunt TMMA and AdaPA, because both rely on precise knowledge of benign uploads; the local-knowledge LLRA would remain the residual threat.","The same constraint-fitting machinery could be redirected from loss maximization to targeted misclassification or backdoor insertion, since the optimization loop only needs a different objective inside the adversarial training step.","The sharp threshold behaviors in client fraction and privacy budget suggest that round-to-round monitoring of the aggregate's loss or of selected-update statistics could serve as an anomaly signal, though the paper does not evaluate such a defense.","The formulas assume the attacker knows N and n; testing the attacks under uncertain client counts or with clients that drop out mid-round would clarify how much of the reported effectiveness depends on precise system knowledge."],"forward_implications":["Under plain aggregation in LDPSGD and PrivateFL, two compromised clients out of twenty push error rates to about 90 percent on MNIST, Fashion-MNIST, and CIFAR-10, meaning the global model becomes effectively random.","Against Multi-Krum, 10 to 20 percent compromised clients cause model collapse for LDPSGD and PrivateFL, while LDP-FL needs 20 to 25 percent on simple datasets but only 5 to 10 percent on CIFAR-10.","Against trimmed mean, 15 percent compromised clients can produce error rates up to 90 percent on MNIST for both LDPSGD and PrivateFL.","Stronger non-IID data generally makes Multi-Krum-defended systems more vulnerable, whereas trimmed mean behaves differently and can reject uneven poisoned updates under highly skewed data.","Privacy budget is not a reliable defense: for LDP-FL the paper reports a sharp threshold near $\\epsilon=0.674$ where training fails to converge even without attacks, and at small $\\epsilon$ values LDPSGD and PrivateFL remain attackable with only 5 to 10 percent malicious clients."],"supporting_citations":[{"why":"Defines the LDPSGD protocol, one of the three attacked LDP federated learning implementations.","marker":"[14]"},{"why":"Defines PrivateFL, the second attacked protocol, including its local preprocessing layer.","marker":"[15]"},{"why":"Defines LDP-FL and its DataPerturbation and parameter-range constraints, which the attacks must obey.","marker":"[16]"},{"why":"Supplies the moments accountant used to set privacy budgets for LDPSGD and PrivateFL.","marker":"[17]"},{"why":"Supplies the Multi-Krum aggregation rule that the adaptive poisoning attacks are designed to bypass.","marker":"[28]"},{"why":"Supplies the trimmed mean aggregation rule that the adaptive attacks target.","marker":"[29]"},{"why":"Provides the FedAvg aggregation baseline underlying the attacked protocols.","marker":"[30]"},{"why":"Provides the geometric median implementation used in the adaptive attacks against Multi-Krum.","marker":"[41]"}],"fun_headline_variants":["Poisoning attacks outsmart LDP defenses in federated learning","Private federated learning falls to adaptive model poisoning","Adaptive poisoning disables Multi-Krum and trimmed mean in LDPFL","Privacy noise doesn't stop malicious clients from breaking FL","LDPFL protocols collapse under crafted adversarial uploads"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attacker must be able to read the exact LDP reports that benign clients send to the server, because the targeted and adaptive attacks derive their poisoned uploads from those precise values.","fun_headline_variants_meta":{"raw":{"variants":["Poisoning attacks outsmart LDP defenses in federated learning","Private federated learning falls to adaptive model poisoning","Adaptive poisoning disables Multi-Krum and trimmed mean in LDPFL","Privacy noise doesn't stop malicious clients from breaking FL","LDPFL protocols collapse under crafted adversarial uploads"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000267,"raw_usage":{"total_tokens":1604,"prompt_tokens":927,"completion_tokens":677,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":594}},"tokens_in":543,"tokens_out":677,"duration_ms":6424,"temperature":1.0,"reasoning_tokens":594,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:25:56.218257+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same attacks with secure aggregation or authenticated channels that hide benign LDP reports from the attacker; if the global model keeps its no-attack accuracy with 10 to 20 percent malicious clients, the collapse result depends on report interception rather than on the LDP mechanisms themselves.","supporting_citations":[{"cited_title":"Local and central differential privacy for robustness and privacy in federated learning,","cited_arxiv_id":null,"evidence_quote":"Defines the LDPSGD protocol, one of the three attacked LDP federated learning implementations."},{"cited_title":"PrivateFL: Accurate, differentially private federated learning via personalized data transformation,","cited_arxiv_id":null,"evidence_quote":"Defines PrivateFL, the second attacked protocol, including its local preprocessing layer."},{"cited_title":"Robust Aggregation for Federated Learning,","cited_arxiv_id":null,"evidence_quote":"Provides the geometric median implementation used in the adaptive attacks against Multi-Krum."}],"review_version":1}