Paper 2025/510

Adaptive Adversaries in Byzantine-Robust Federated Learning: A survey.

Abstract

Federated Learning (FL) has emerged as a prominent paradigm for collaborative machine learning that enables model training without exposing private data through data decentralisation. Despite these advantages, FL systems remain vulnerable to significant security challenges affecting both privacy and robustness. This paper examines vulnerabilities in FL with a particular focus on model robustness, identifying critical gaps in existing defences against adaptive adversaries that alter their attack strategies after disconnection and subsequently rejoin the system. To the best of our knowledge, prior surveys have not explicitly addressed adaptive adversaries, motivating the focus of this work. We make five contributions: (1) a comprehensive overview of FL systems and their fundamental components, (2) a systematic review of vulnerabilities affecting FL, (3) an analysis of baseline attack vectors alongside state-of-the-art attack and defence mechanisms, (4) the introduction of a novel baseline attack based on Reconnecting Malicious Clients (RMCs), and (5) identification of future research directions for mitigating adaptive attacks. Experimental results demonstrate that widely used secure aggregation rules, including Krum and Trimmed Mean (commonly used as a baseline for other solutions to compare against), are insufficient against such attacks, and existing improvements to these methods fail to address this limitation. These findings highlight the need to reconsider FL security paradigms with explicit consideration of adaptive adversaries.

Note: Revised definitions and affiliations