提出新型细粒度控制攻击，让恶意客户端精准操控联邦排序学习的模型性能。
Beyond Denial-of-Service: The Puppeteer's Attack for Fine-Grained Control in Ranking-Based Federated Learning
- 设计双阶段攻击：通过操控排名边缘和选择边界实现精度精确控制。
- 在7个数据集上平均误差仅0.224%，比基线提升17倍，且收敛轨迹正常。
- 揭示联邦排序学习对隐蔽攻击的脆弱性，适合安全研究与防御设计者关注。
联邦排序学习（FRL）是一种抗模型投毒攻击的联邦学习范式，其基于离散排名机制通信，显著降低通信开销并限制攻击者在连续空间中优化恶意更新的能力，因而具备较高鲁棒性。然而我们发现，该框架仍易受新型局部模型投毒攻击——细粒度控制攻击的影响。本文提出首个专为排序型联邦学习设计的边缘控制攻击（ECA）。与传统拒绝服务攻击不同，ECA可将对手模型精度精确降至任意目标水平，同时保持正常的收敛轨迹以逃避检测。该攻击分为两阶段：(i) 识别并操纵升序与降序边，使全局模型逼近目标模型；(ii) 扩大选择边界差距，稳定全局模型于目标精度。在七个基准数据集及九种拜占庭鲁棒聚合规则下实验表明，ECA实现精度控制的平均误差仅为0.224%，较基线最高提升17倍。研究强调需加强针对高级投毒攻击的防御机制。代码已开源：https://github.com/Chenzh0205/ECA
原文摘要 · Abstract (English)
Federated Rank Learning (FRL) is a promising Federated Learning (FL) paradigm designed to be resilient against model poisoning attacks due to its discrete, ranking-based update mechanism. Unlike traditional FL methods that rely on model updates, FRL leverages discrete rankings as a communication parameter between clients and the server. This approach significantly reduces communication costs and limits an adversary's ability to scale or optimize malicious updates in the continuous space, thereby enhancing its robustness. This makes FRL particularly appealing for applications where system security and data privacy are crucial, such as web-based auction and bidding platforms. While FRL substantially reduces the attack surface, we demonstrate that it remains vulnerable to a new class of local model poisoning attack, i.e., fine-grained control attacks. We introduce the Edge Control Attack (ECA), the first fine-grained control attack tailored to ranking-based FL frameworks. Unlike conventional denial-of-service (DoS) attacks that cause conspicuous disruptions, ECA enables an adversary to precisely degrade a competitor's accuracy to any target level while maintaining a normal-looking convergence trajectory, thereby avoiding detection. ECA operates in two stages: (i) identifying and manipulating Ascending and Descending Edges to align the global model with the target model, and (ii) widening the selection boundary gap to stabilize the global model at the target accuracy. Extensive experiments across seven benchmark datasets and nine Byzantine-robust aggregation rules (AGRs) show that ECA achieves fine-grained accuracy control with an average error of only 0.224%, outperforming the baseline by up to 17x. Our findings highlight the need for stronger defenses against advanced poisoning attacks. Our code is available at: https://github.com/Chenzh0205/ECA
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。