aiqbench analysis
This research addresses a critical security vulnerability in Federated Learning where malicious orchestrators induce targeted overfitting to compromise specific clients. The authors propose practical client-side detection mechanisms—such as label flipping and model fingerprinting—that can identify these attacks within one or two training rounds, enabling early disengagement before data integrity is severely compromised. These findings are essential for advancing the trustworthiness of privacy-preserving machine learning systems in real-world deployments.
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
arXiv:2509.11974v3 Announce Type: replace-cross Abstract: Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy-enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques -- label flipping, backdoor trigger injection, and model fingerprinting -- which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1-2 training rounds with F1 scores up to 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Abstract:Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy-enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques -- label flipping, backdoor trigger injection, and model fingerprinting -- which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1-2 training rounds with F1 scores up to 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Published in Proceedings on Privacy Enhancing Technologies (PoPETs), 2026. 27 pages, 20 figures. First co-authors: Soumia Zohra El Mestari, Maciej Krzysztof Zuziak. Corresponding authors: Soumia Zohra El Mestari, Maciej Krzysztof Zuziak
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
K.4.1; I.2.6; K.6.5
arXiv:2509.11974 [cs.CR]
(or arXiv:2509.11974v3 [cs.CR] for this version)
https://doi.org/10.56553/popets-2026-0131 DOI(s) linking to related resources
Full text under the publisher's open licence · 233 words
Related coverage
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
arXiv · Jul 20, 2026
Fine-grained Distributed Backdoor Attacks in Federated Learning
arXiv · Sep 9, 2026
Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure
arXiv · Sep 30, 2026
BRFID: Toward Byzantine-Robust Federated Intrusion Detection
arXiv · Sep 26, 2026