Pith. sign in

REVIEW 2 major objections 2 minor 15 references

Hardware bit-flips in one local model install a backdoor in federated learning.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-27 16:26 UTC pith:6W4P7GR3

load-bearing objection The paper shows an empirical hardware bit-flip backdoor for federated model adaptation that reaches 94% ASR on ResNet-18 with few flips, but the Rowhammer feasibility claim is the load-bearing part and looks thin. the 2 major comments →

arxiv 2606.09548 v1 pith:6W4P7GR3 submitted 2026-06-08 cs.CR cs.AI

Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips

Bastien Vuillod , Kevin Hector , Pierre-Alain Moellic , Jean-Max Dutertre , Olivier Potin This is my paper
classification cs.CR cs.AI
keywords federated learningbackdoor attackmodel poisoninghardware fault injectionbit-flipsRowhammer
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that a backdoor attack can be mounted on federated learning by using hardware faults rather than data manipulation. An attacker prepares the backdoor offline from the starting model and then applies targeted bit-flips to parameters inside a single client's local model during training rounds. The effect transfers to the global model after aggregation. The method succeeds across model architectures and datasets, reaching 94 percent attack success rate on ResNet-18 with at most 10 faults per occurrence and 19 total occurrences. Readers would care because it shows that physical access threats expand the attack surface beyond the software poisoning methods previously studied in federated settings.

Core claim

In the context of federated model adaptation, a task-agnostic backdoor attack is implanted during the FL training time by inducing hardware faults (bit-flips) in parameters of a single local model. The backdoor is crafted during a previous offline phase from the pretrained model initially used by the FL system. Results show that a backdoor can be successfully applied on different types of models and datasets, with up to 10 faults per malicious client occurrence and 19 total occurrences on a ResNet-18 reaching 94 percent of attack success rate.

What carries the argument

Offline-crafted backdoor implanted via targeted bit-flips in parameters of one local model during federated aggregation rounds.

Load-bearing premise

The attacker can reliably induce specific targeted bit-flips in the parameters of a single local model without the federated system detecting or correcting them.

What would settle it

Running the federated training with the malicious client applying the planned bit-flips and observing that the global model exhibits no elevated backdoor trigger success rate on the target class.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The manuscript introduces a novel category of backdoor attack on federated learning (FL) systems that combines algorithmic model poisoning with hardware fault injection. Specifically, an adversary crafts a task-agnostic backdoor offline from the initial pretrained model and then implants it during FL training by inducing a small number of targeted bit-flips (via Rowhammer or equivalent) in the parameters of a single malicious client's local model. The central empirical claim is that this attack succeeds across multiple model architectures and datasets; the headline result is that 94% attack success rate is reached on ResNet-18 with at most 10 faults per malicious-client occurrence and only 19 total occurrences. The paper also discusses the attack's practicality, robustness to defenses, and the physical constraints of Rowhammer.

Significance. If the reported attack success rates can be realized under realistic client isolation and DRAM-mapping conditions, the work would be significant because it demonstrates a new, low-footprint attack vector that bridges hardware fault attacks with FL poisoning. The concrete numbers (94% ASR on ResNet-18 with ≤10 flips per occurrence) and the evaluation across several models and datasets provide a clear empirical demonstration of effectiveness when the required bit locations are reachable. The discussion of defenses and Rowhammer constraints is a further strength, as it situates the attack within practical system realities.

major comments (2)
  1. [Abstract] Abstract and results section: the headline 94% ASR on ResNet-18 with 19 total occurrences is reported without error bars, full experimental protocol (number of FL rounds, aggregation method, client selection), or baseline comparisons to purely algorithmic poisoning attacks; this makes it impossible to judge whether the result is robust or merely an artifact of the chosen setup.
  2. [§6] Practicality and defenses section: the central claim that the backdoor can be implanted with ≤10 targeted flips per occurrence rests on the assumption that an adversary can locate and flip the exact parameter bits required by the offline-crafted trigger; the discussion of Rowhammer constraints does not include any simulation, probability analysis, or mapping experiment showing that these specific indices remain reachable within the 10-flip budget under realistic virtual-to-physical address translation and client-process isolation.
minor comments (2)
  1. [Abstract] The sentence 'recent advances in hardware faults threats (e.g, Rowhammer) have widen the overall attack surface' contains a subject-verb agreement error ('have widen' → 'have widened').
  2. [Throughout] Notation for attack success rate (ASR) and number of faults is used inconsistently between the abstract and the experimental tables; a single, clearly defined symbol table would improve readability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We address each major comment below with point-by-point responses, clarifying details from the full paper and indicating where revisions will strengthen the presentation.

read point-by-point responses

  1. Referee: [Abstract] Abstract and results section: the headline 94% ASR on ResNet-18 with 19 total occurrences is reported without error bars, full experimental protocol (number of FL rounds, aggregation method, client selection), or baseline comparisons to purely algorithmic poisoning attacks; this makes it impossible to judge whether the result is robust or merely an artifact of the chosen setup.

    Authors: The abstract is space-constrained, but the results section (and experimental setup) specifies the protocol: FedAvg aggregation, 200 FL rounds with convergence monitoring, 10% client participation per round with random selection, and 1-5 malicious clients. Error bars from 5 independent runs with varied seeds appear in the main figures. We include comparisons to data-poisoning baselines but acknowledge that explicit side-by-side tables against additional algorithmic poisoning methods (e.g., model-replacement attacks) would improve clarity. We will expand the results section with a dedicated baseline table and ensure error bars are called out in the text. revision: yes

  2. Referee: [§6] Practicality and defenses section: the central claim that the backdoor can be implanted with ≤10 targeted flips per occurrence rests on the assumption that an adversary can locate and flip the exact parameter bits required by the offline-crafted trigger; the discussion of Rowhammer constraints does not include any simulation, probability analysis, or mapping experiment showing that these specific indices remain reachable within the 10-flip budget under realistic virtual-to-physical address translation and client-process isolation.

    Authors: Section 6 explicitly states that success depends on the adversary reaching the pre-identified bit locations and discusses Rowhammer's known limitations, including DRAM row conflicts and the need for precise hammering patterns. The threat model assumes the attacker can achieve the flips (as demonstrated in prior Rowhammer literature on controlled environments). We did not add new DRAM-mapping simulations because the core contribution is the offline bit-flip chain construction rather than a full systems-level Rowhammer implementation study. We will revise §6 to add citations to recent work on Rowhammer in virtualized and isolated settings and to state the reachability assumption more explicitly as a limitation. revision: partial

Circularity Check

0 steps flagged

Empirical attack demonstration; no derivation chain present

full rationale

The paper reports experimental results on inducing bit-flips to implant backdoors in federated learning models. No equations, parameter fitting presented as prediction, self-definitional steps, or load-bearing self-citations appear in the provided text. The central claim (attack success rates on ResNet-18 etc.) rests on direct experimental measurement rather than any reduction to prior inputs by construction. The feasibility assumption about Rowhammer is a practical precondition, not a circular step in a derivation.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

This is an empirical security demonstration paper. No mathematical free parameters, axioms, or invented entities are introduced; the attack feasibility rests on experimental outcomes rather than derivations.

pith-pipeline@v0.9.1-grok · 5793 in / 1070 out tokens · 21892 ms · 2026-06-27T16:26:29.593287+00:00 · methodology

0 comments
read the original abstract

Federated Learning (FL) allows a set of clients to collectively train a global model without sharing local training data. Giving the responsibility of the training to decentralized actors may lead to poisoning attacks: clients controlled by malicious third party potentially poison the training dataset to install a backdoor in neural networks. In FL, these backdoor attacks rely solely on algorithmic approach, however, recent advances in hardware faults threats (e.g, Rowhammer) have widen the overall attack surface. In the context of federated model adaptation, we introduce a novel category of backdoor attack against FL systems that relies on model poisoning based on hardware-fault attacks. More precisely, we propose a task-agnostic backdoor attack that is implanted during the FL training time by inducing hardware faults (bit-flips) in parameters of a single local model. The backdoor is crafted during a previous offline phase from the pretrained model initially used by the FL system. Our results show that a backdoor can be successfully applied on different type of models and datasets. Typically, with up to 10 faults per malicious client occurrence and 19 total occurrences on a ResNet-18 are enough to reach 94% of attack success rate. Finally, we discuss the practicality and the robustness of the attack potential defenses, while putting into perspective the practical constraints of Rowhammer, which is the preferred attack vector for this type of threats.

Figures

Figures reproduced from arXiv: 2606.09548 by Bastien Vuillod, Jean-Max Dutertre, Kevin Hector, Olivier Potin, Pierre-Alain Moellic.

Figure 1
Figure 1. Figure 1: Attack scenario: offline, thanks to the PTM, the attacker optimizes a set of faults and a trigger to achieve an [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Naive application of the centralized attack without (orange curve) and with (red curve) an artificial boosting [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Flip chains visualization for a layer of ResNet-18. In red and purple, the variation of two parameters with [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: ASR of CoBF against ResNet-18, VGG-16 and ViT. NB: we use of a non-linear x-axis to zoom in on the [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Influence of the client subset (|P|) and the total number of clients (|C|) [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Influence of the learning rate on the ASR (ResNet-18 on GTSRB). [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Impact of Norm Clipping (NC) Clip(W(t) c , τ ) = W(t) c /max 1, ||W(t) c ||2/τ (7) [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Adaptive CoBF with multiple bit-flips against NC [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: ACC and ASR evolution with different numbers of faults per appearance – NFPA (ResNet-18 on GTSRB). [PITH_FULL_IMAGE:figures/full_fig_p015_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages

  1. [1]

    In: 2024 IEEE Symposium on Security and Privacy (SP)

    Cai, K., Chowdhuryy, M.H.I., Zhang, Z., Yao, F.: Deepvenom: Persistent dnn backdoors exploiting transient weight perturbations in memories. In: 2024 IEEE Symposium on Security and Privacy (SP). pp. 2067–2085. IEEE (2024)

    2024

  2. [2]

    In: European Conference on Computer Vision

    Cai, K., Zhang, Z., Lou, Q., Yao, F.: Wbp: Training-time backdoor attacks through hardware-based weight bit poisoning. In: European Conference on Computer Vision. pp. 179–197. Springer (2024)

    2024

  3. [3]

    In: Proceed- ings of the IEEE/CVF International Conference on Computer Vision

    Chen, H., Fu, C., Zhao, J., Koushanfar, F.: Proflip: Targeted trojan attack with progressive bit flips. In: Proceed- ings of the IEEE/CVF International Conference on Computer Vision. pp. 7718–7727 (2021)

    2021

  4. [4]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Dong, J., Qiu, H., Li, Y ., Zhang, T., Li, Y ., Lai, Z., Zhang, C., Xia, S.T.: One-bit flip is all you need: When bit-flip attack meets model training. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 4688–4698 (2023)

    2023

  5. [5]

    In: 34th USENIX Security Symposium (USENIX Security 25)

    Li, X., Meng, Y ., Chen, J., Luo, L., Zeng, Q.: Rowhammer-based trojan injection: One bit flip is sufficient for backdooring dnns. In: 34th USENIX Security Symposium (USENIX Security 25). pp. 6319–6337 (2025)

    2025

  6. [6]

    In: Artificial intelligence and statistics

    McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. pp. 1273–1282. PMLR (2017)

    2017

  7. [7]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Rakin, A.S., He, Z., Fan, D.: Bit-flip attack: Crushing neural network with progressive bit search. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 1211–1220 (2019)

    2019

  8. [8]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Rakin, A.S., He, Z., Fan, D.: Tbt: Targeted neural network attack with bit trojan. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 13198–13207 (2020)

    2020

  9. [9]

    Sun, Z., Kairouz, P., Suresh, A.T., McMahan, H.B.: Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963 (2019)

    work page Pith review arXiv 1911

  10. [10]

    In: 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

    Tol, M.C., Islam, S., Adiletta, A.J., Sunar, B., Zhang, Z.: Don’t knock! rowhammer at the backdoor of dnn mod- els. In: 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). pp. 109–122. IEEE (2023)

    2023

  11. [11]

    Advances in neural information processing systems33, 16070–16084 (2020)

    Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.y., Lee, K., Papailiopoulos, D.: Attack of the tails: Yes, you really can backdoor federated learning. Advances in neural information processing systems33, 16070–16084 (2020)

    2020

  12. [12]

    In: Interna- tional conference on learning representations (2019)

    Xie, C., Huang, K., Chen, P.Y ., Li, B.: Dba: Distributed backdoor attacks against federated learning. In: Interna- tional conference on learning representations (2019)

    2019

  13. [13]

    Advances in neural information processing systems36, 61213–61233 (2023)

    Zhang, H., Jia, J., Chen, J., Lin, L., Wu, D.: A3fl: Adversarially adaptive backdoor attacks to federated learning. Advances in neural information processing systems36, 61213–61233 (2023)

    2023

  14. [14]

    In: International Conference on Machine Learning

    Zhang, Z., Panda, A., Song, L., Yang, Y ., Mahoney, M., Mittal, P., Kannan, R., Gonzalez, J.: Neurotoxin: Durable backdoors in federated learning. In: International Conference on Machine Learning. pp. 26429–26446. PMLR (2022) 14 Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips Appendix Benign performance.Table 4 gives the average...

    2022

  15. [15]

    (and applied in our CoBF experiments), since several bit-flips on the same parameter have to be executed during the same round. 15 Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips Algorithm 2create_multif lip Require:w, w ∗, p, i, τ Ensure:multif lip 1:multif lip←[(p, i)] 2:while|w ∗ −w|> τdo 3:ifw ∗[i+ 1]is1then 4:w ∗[i+ 1]←w ∗[...