arXiv Machine Learning
Aug 11
Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs
arXiv:2608. 09314v1 Announce Type: new Abstract: In a federated learning setup for GANs, several adversarial attacks are possible.
Approaching the Harm of Gradient Attacks While Only Flipping Labels
The paper investigates the impact of label‑flipping attacks on distributed machine learning, where an adversary can only flip a limited number of training labels. It formalizes the attack as a per‑round constrained optimization problem, derives a greedy label‑selection rule for logistic regression, and shows that this rule is provably optimal under mean aggregation. Experiments demonstrate that optimized label flipping can significantly degrade model accuracy, outperforming random flips, and that the attack transfers to other robust aggregators such as coordinate‑wise median and trimmed mean.
Related stories
Hugging Face Trending Papers
Aug 10
Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs
In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator.
arXiv Machine Learning
Aug 20
Gradient Mirage: Trainable yet Label-Unidentifiable Gradients in Large Language Model Split Learning
Gradient Mirage is a defense for large language model split learning that disrupts the assumption that exposed gradients faithfully reflect the client’s full-label training objective, thereby thwarting gradient matching attacks. It introduces inconsistencies across objective, direction, and scale by using selective autoregressive supervision, scale blinding, and directional privatization with a von Mises-Fisher mechanism. The method preserves utility through dual-track backpropagation and bottom-gradient recovery, achieving a stronger privacy‑utility trade‑off in experiments.
arXiv Machine Learning
Aug 21
Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferability
arXiv:2509. 23689v2 Announce Type: replace Abstract: Model Merging (MM) has proven to be an effective alternative to multi-task learning, where several fine-tuned models are merged, without access to the tasks' training data, into one model that retains performance across different tasks.
arXiv Machine Learning
Aug 3
Low-Cost Hard-Label Adversarial Attack with Theoretical Foundations
arXiv:2601. 14300v4 Announce Type: replace Abstract: Hard-label black-box attacks, relying solely on top-1 predictions, represent one of the most challenging yet practically threat models.
arXiv AI
Sep 11
Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
The paper introduces a new gradient inversion attack for federated learning that leverages concepts from erasure‑correcting codes to recover entire training batches and their labels from a single FedSGD round. Unlike previous analytic attacks, this method can exactly reconstruct batches of up to 128 samples on ImageNet and achieves over 90% recovery even when the attacker actively manipulates the model. The study demonstrates that federated learning’s privacy leakage is far greater than previously estimated.
arXiv AI
Oct 26
Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless $l^p$ Norm Solution for Fast Adversarial Training
arXiv:2505. 02360v3 Announce Type: replace-cross Abstract: Adversarial training is a cornerstone of robust deep learning, but fast methods like the Fast Gradient Sign Method (FGSM) often suffer from Catastrophic Overfitting (CO), where models become robust to single-step attacks but fail against multi-step variants.
arXiv AI
Sep 24
When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense
The paper introduces Fed-ADR, a coordinated attack framework where a malicious orchestrator server directs heterogeneous adversarial clients to adapt their gradient updates in real time, thereby evading existing federated learning defenses and drastically reducing global model accuracy. It also presents a lightweight detection mechanism that estimates true client gradients from historical data to spot coordinated attacks, and an in-situ recovery method that restores model performance without restarting training. Experiments on MNIST, Fashion‑MNIST, and CIFAR‑10 show the attack can drop accuracy from over 90% to below 10%, while the defense can recover accuracy to above 90% within a few rounds at a computational cost at least 20× lower than retraining from scratch.
arXiv AI
Jun 4
Efficient Adversarial Attacks on High-dimensional Offline Bandits
arXiv:2602. 01658v2 Announce Type: replace-cross Abstract: Bandit algorithms have recently emerged as a powerful tool for evaluating machine learning models, including generative image models and large language models, by efficiently identifying top-performing candidates without exhaustive comparisons.
arXiv Machine Learning
Jun 8
Certified Robustness to Data Poisoning in Gradient-Based Training
arXiv:2406. 05670v3 Announce Type: replace Abstract: Modern machine learning pipelines leverage large amounts of public data, making it infeasible to guarantee data quality and leaving models open to poisoning and backdoor attacks.
arXiv Machine Learning
Sep 23
FairMean: Promoting Fairness in Distributed Learning under Label Poisoning Attacks
FairMean is a new approach for distributed learning that addresses the conflict between fairness and robustness to label poisoning attacks. It assigns weights to client gradients based on a bounded, nondecreasing function of local loss, giving higher weight to high‑loss clients to promote fairness while limiting the influence of poisoned clients. The method is shown to improve fairness compared to standard average‑loss minimization and to reduce accuracy variance while boosting worst‑client accuracy in experiments.
arXiv Computer Vision
Oct 1
Opportunistic Target Selection: Early Directional Commitment for Query-Efficient Black-Box Adversarial Attacks
arXiv:2605.25663v2 Announce Type: replace-cross Abstract: Black-box adversarial attacks that minimize only the ground-truth confidence suffer from class drift: perturbations wander through the featur...