aiqbench analysis
This research addresses a critical security vulnerability in Federated Learning where malicious orchestrators induce targeted overfitting to compromise specific client models. The authors propose practical detection mechanisms like model fingerprinting that allow clients to identify these attacks within one or two training rounds, ensuring early disengagement before significant data integrity is lost. By shifting the focus from passive privacy preservation to active threat monitoring during aggregation, this work strengthens the trustworthiness of decentralized AI systems against insider threats.
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
arXiv:2509.11974v2 Announce Type: replace-cross Abstract: Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy-enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques -- label flipping, backdoor trigger injection, and model fingerprinting -- which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1-2 training rounds with F1 scores up to 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Abstract:Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy-enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques -- label flipping, backdoor trigger injection, and model fingerprinting -- which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1-2 training rounds with F1 scores up to 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Accepted to Proceedings on Privacy Enhancing Technologies (PoPETs), 2026. 27 pages
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2509.11974 [cs.CR]
(or arXiv:2509.11974v2 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2509.11974 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 285 words
Related coverage
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
arXiv · Jul 28, 2026
Fine-grained Distributed Backdoor Attacks in Federated Learning
arXiv · Sep 9, 2026
Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure
arXiv · Sep 30, 2026
BRFID: Toward Byzantine-Robust Federated Intrusion Detection
arXiv · Sep 26, 2026