Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning

# Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning
Source: [https://arxiv.org/html/2608.25133](https://arxiv.org/html/2608.25133)
Deval MukherjeeAffiliation:University of Nevada Las Vegas Las Vegas, Nevada mukhed2@unlv\.nevada\.eduHomook ChoAffiliation:Cyber Security Research Center at KAIST Daejeon, South Korea chmook79@kaist\.ac\.krWei LiAffiliation:Georgia State University Atlanta, Georgia wli28@gsu\.eduZuobin Xiong1, Deval Mukherjee1, Homook Cho2and Wei Li3Affiliation:1Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA 2Cyber Security Research Center at KAIST, Daejeon, South Korea 3Department of Computer Science, Georgia State University, Atlanta, Georgia, USA 1zuobin\.xiong@unlv\.edu, mukhed2@unlv\.nevada\.edu;2chmook79@kaist\.ac\.krAffiliation:3wli28@gsu\.edu

###### Abstract

The development of federated learning \(FL\) techniques has helped improve the privacy preservation of users’ data and extended the applications of machine learning models\. However, the involvement of a large number of users in FL also creates open opportunities for different adversaries, such as poisoning attacks, byzantine attacks, and adversarial examples attacks\. Yet, recent research has disclosed that existing poisoning attacks and byzantine attacks can not achieve satisfactory penetration in realistic FL scenarios caused by strong assumptions,e\.g\.,client selection rate, and the ratio of malicious attackers\. In this paper, the transferability of adversarial examples among different client models is analyzed to understand the relation between adversarial examples and clients’ data distribution\. Moreover, to mitigate the attacks of transferable adversarial examples, we design a defense mechanism stemming from the transferability of model robustness by adversarial training\. As a result, through theoretical analysis of transferability, we gain insights into adversarial examples and the vulnerability of federated learning systems\. Our proposed adversarial attack and defense methods are evaluated via real\-life datasets in various settings to show their performance over the existing state\-of\-the\-art methods\.

###### Index Terms:

Federated Learning, Adversarial Examples, Model Robustness, Security and Privacy

## IIntroduction

Federated Learning \(FL\)\[[1](https://arxiv.org/html/2608.25133#bib.bib23)\]has emerged as an attractive distributed machine learning framework, where multiple private data owners \(e\.g\.,clients\) collaboratively train a machine learning model on the central organizer \(i\.e\.,the service provider\) without sharing their private data\. In particular, each participating client performs a local update privately and sends the updated parameter to the service provider for aggregation in an iterative manner\. Benefited from these features, FL has been adopted by a suite of prevalent applications at scale in the real world, such as the next word prediction model from Google G\-board\[[2](https://arxiv.org/html/2608.25133#bib.bib4)\], the Siri voice recognition model from Apple\[[3](https://arxiv.org/html/2608.25133#bib.bib14)\], and the credit information analysis model from different financial institutions\[[4](https://arxiv.org/html/2608.25133#bib.bib22)\]\. To handle the diverse real\-world applications, despite the existence of many variants of FL models, the original version, known as Federated Averaging \(FedAvg\)\-based\[[1](https://arxiv.org/html/2608.25133#bib.bib23)\]methods, remains the most widely adopted paradigm due to its concise system design and outstanding scalability\. However, “FedAvg” does not fully understand the underlying challenges of system heterogeneity and statistical heterogeneity in diverse environments, where the clients possess different computational power and highly skewed non\-identically distributed data in practice\. An advanced personalized solution “FedProx”\[[5](https://arxiv.org/html/2608.25133#bib.bib24)\], extended from FedAvg, is designed to hold the merits of FedAvg but also address the challenges of systems and data heterogeneity\. In both algorithms, the primary focus is to improve the model performance in FL at scale, but they overlook the security issues behind the scenes\.

Many potential attacks may harm the system security in FL since the collaborating participants are mutually untrusted clients,e\.g\.,Android/iPhone users, and different organizations\. Therefore, any client can perform malicious operations or act as an honest\-but\-curious client even if they follow common system requirements\. As a result, the adversarial attacks111In this paper, we mainly investigate the adversarial attacks\. We acknowledge that privacy inference is another important issue in FL, but it is beyond the scope of this work\.in FL can be categorized into three branches: \(i\) Poisoning attacks \(including backdoor attacks\)\[[6](https://arxiv.org/html/2608.25133#bib.bib15),[7](https://arxiv.org/html/2608.25133#bib.bib16),[8](https://arxiv.org/html/2608.25133#bib.bib17)\]that aim at causing degraded model performance on poisoned models or poisoned data; \(ii\) Byzantine attacks\[[9](https://arxiv.org/html/2608.25133#bib.bib8),[10](https://arxiv.org/html/2608.25133#bib.bib9)\]that allure the FL training converges to ‘sub\-optimal to utterly ineffective models’; and \(iii\) Evasion attacks\[[11](https://arxiv.org/html/2608.25133#bib.bib18),[12](https://arxiv.org/html/2608.25133#bib.bib2),[13](https://arxiv.org/html/2608.25133#bib.bib19)\]where the adversary tries to invade the model’s integrity with an adversarially crafted input example\. Existing literature has intensively studied various methods in \(i\) and \(ii\) regarding these attacks and their corresponding defenses, whilethey make some unrealistic assumptions that are hard to meet in real\-world FL applications\. For instance, in the related works on poisoning attacks\[[7](https://arxiv.org/html/2608.25133#bib.bib16),[6](https://arxiv.org/html/2608.25133#bib.bib15),[14](https://arxiv.org/html/2608.25133#bib.bib25)\]and defense\[[15](https://arxiv.org/html/2608.25133#bib.bib26),[16](https://arxiv.org/html/2608.25133#bib.bib3),[17](https://arxiv.org/html/2608.25133#bib.bib27)\], authors assume that the adversarial party has the ability to compromise at most10%10\\%to25%25\\%of all FL clients, which means the attacker may need to control over 10 million users in a real\-world App like Google G\-board with billions of user base\[[18](https://arxiv.org/html/2608.25133#bib.bib28)\]\. On the other hand, for Byzantine attacks and defenses, different assumptions such as i\.i\.d\. data in FL system\[[19](https://arxiv.org/html/2608.25133#bib.bib29),[20](https://arxiv.org/html/2608.25133#bib.bib30)\], a clean dataset on server\[[21](https://arxiv.org/html/2608.25133#bib.bib31),[22](https://arxiv.org/html/2608.25133#bib.bib32)\], and the total number of FL clients\[[23](https://arxiv.org/html/2608.25133#bib.bib33),[24](https://arxiv.org/html/2608.25133#bib.bib34)\]are required to launch an attack or defense, which is hardly achievable in real applications\. Besides, in the recent paper by Shejwalkaret al\.\[[25](https://arxiv.org/html/2608.25133#bib.bib35)\], where authors conduct a comprehensive review of existing attacks on FL through analysis and evaluation,the conclusion is that most poisoning attacks and Byzantine attacks fail to achieve the claimed attack performance in FL at scale settings even in the absence of any robust defense mechanisms\.

These unrealistic assumptions and experimental findings therefore motivate us to explore a more operable attack – evasion attacks, with minimal attacker knowledge and a practical threat model\. In this paper, we revisit evasion attacks in the realistic FL setting, providing findings on theoretical attack performance and robust defense against the attack\. Specifically, considering both applicability and feasibility in real\-world applications, “FedProx” paradigm is selected as the representative base case for analysis\. Built on which, exploring and rethinking the relationship between adversarial examples and their transferability in the “FedProx” FL system is our main target\. Our theoretical result is promising, where we find that the transferability of adversarial examples in the FL system can be harnessed by the local private data distribution of the malicious client\. In addition to that, an efficient and robust defense mechanism is proposed to defend against adversarial examples in the FL system\.

In summary, this work makes the following contributions:

- •We study the evasion attacks in FL at a realistic scenario, which is the first work to analyze the transferability of adversarial examples in FL through a theoretical manner, to the best of our knowledge\.
- •We design a robust defense framework in federated learning against adversarial example attacks, which has both efficiency and superior performance\.
- •Extensive experiments are conducted on popular FL datasets, reflecting our theoretical analysis on the transferability of adversarial examples and justifying the defense performance of our robust defense method\.

The remainder of this paper is organized as follows\. The related works in adversarial attacks and defenses are introduced in Section[II](https://arxiv.org/html/2608.25133#S2)\. Then, the system settings and threat model are formulated in Section[III](https://arxiv.org/html/2608.25133#S3), followed by the analysis of attack transferability in Section[IV](https://arxiv.org/html/2608.25133#S4)\. Next, the robust defense mechanism is proposed in Section[V](https://arxiv.org/html/2608.25133#S5), and extensive evaluations are conducted in attack and defense scenarios in Section[VI](https://arxiv.org/html/2608.25133#S6)\. Finally, the paper is concluded in Section[VII](https://arxiv.org/html/2608.25133#S7)

## IIRelated Works

### II\-AAdversarial Attacks in FL

In FL, adversarial attacks can stem from clients, the central server, or the communication channel\. This paper focuses on the client as the attack source\. As insiders participating in the training phase, clients can launch causative attacks affecting model performance during both training and inference stages\. In the training stage, poisoning and backdoor attacks can be launched by a malicious participant through submitting poisonous data or tampering with model updates during training that skew the model’s predictions\[[6](https://arxiv.org/html/2608.25133#bib.bib15),[7](https://arxiv.org/html/2608.25133#bib.bib16),[8](https://arxiv.org/html/2608.25133#bib.bib17)\]\. On the contrary, evasion attacks\[[11](https://arxiv.org/html/2608.25133#bib.bib18),[13](https://arxiv.org/html/2608.25133#bib.bib19)\], can manipulate the model’s predictions by crafting an adversarial input as test data during inference\. The target of adversarial attacks can also be the clients’ privacy information, where attackers can use learning based methods to reconstruct private client data using gradient\-based data or extract label information\[[26](https://arxiv.org/html/2608.25133#bib.bib20),[27](https://arxiv.org/html/2608.25133#bib.bib21)\]\.

The impact of adversarial attacks in FL may vary\. For utility\-centric attacks, it is measured as the reduction in the test accuracy of the model after the attack, usually quantified by the accuracy drop as the attack success rate\. For privacy\-centric attacks, attackers aim to perform membership/label inference or model inversion, and the impact can have different metrics like mean squared error \(MSE\), peak signal\-to\-noise ratio \(PSNR\), structural similarity index \(SSIM\), and learned perceptual image patch similarity \(LPIPS\)\. In this work, our main focus is on the evasion attack in FL with theoretical analysis, which has not been investigated in previous works, to the best of our knowledge\.

### II\-BRobust Defenses in FL

In response to adversarial attacks in FL, various mechanisms have been proposed to build safe and robust FL systems\. In this section, we only list those representatives in enhancing robustness while omitting the privacy\-preserving techniques, as they are related to our work\. PruneFL\[[28](https://arxiv.org/html/2608.25133#bib.bib5)\]and Network Pruning\[[29](https://arxiv.org/html/2608.25133#bib.bib6)\]are examples of pruning\-based defense methods, where pruning algorithms can be applied during the aggregation or local update to remove malicious parameters generated by poisoning attacks\. Byzantine robust aggregation methods\[[30](https://arxiv.org/html/2608.25133#bib.bib7),[9](https://arxiv.org/html/2608.25133#bib.bib8),[10](https://arxiv.org/html/2608.25133#bib.bib9)\]are typically implemented on the server side and filter out malicious updates and ensure that only valid updates are used in the model\. Regularization is also a defense strategy applicable to both server and client sides in FL, protecting against data poisoning and model poisoning attacks\[[31](https://arxiv.org/html/2608.25133#bib.bib13)\]\. Specifically, on the client side, participants employ regularization techniques like dropout, batch normalization, or weight decay during their model training \(LSR\[[32](https://arxiv.org/html/2608.25133#bib.bib10)\], ConTre\[[33](https://arxiv.org/html/2608.25133#bib.bib12)\]\), which combats overfitting and contributes to overall FL robustness\. These methods are mainly used to cure poisoning attacks, yet the investigated problem in this paper is evasion attacks\. So far, only adversarial training is an effective defense strategy against evasion, and the state\-of\-the\-art is Federated Adversarial Training \(FAT\)\[[34](https://arxiv.org/html/2608.25133#bib.bib11)\]\.

However, the adversarial training framework can only work for known attacks presented in the adversarial training dataset, with a high computation cost\. Defending evasion attacks on the local client side with an efficient mechanism is still an open challenge, which motivates our matrix decomposition\-based method in Section[V](https://arxiv.org/html/2608.25133#S5)\.

## IIISystem Setting & Threat Model

### III\-ASystem Setting

Our system setting is adopted from\[[5](https://arxiv.org/html/2608.25133#bib.bib24)\], in which authors devise “FedProx” that can handle the system heterogeneity \(e\.g\.,straggler caused by computing power and network connection\) and statistical heterogeneity \(e\.g\.,different local optima caused by highly non\-i\.i\.d\. data\)\. Specifically, the system of FedProx consists of a central server andKKclients\. Each local clientk∈\{1,2,…,K\}k\\in\\\{1,2,\.\.\.,K\\\}holds a local datasetDk=\{\(xi,yi\)\}i=1nkD\_\{k\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{n\_\{k\}\}and performs local training algorithm to minimize the objective functionFk​\(w,wt\)F\_\{k\}\(w;w^\{t\}\), which is defined as follows\.

Fk​\(w,wt\)=1nk​∑i=1nk\[l⁡\(f⁡\(w,xi\),yi\)\]\+μ2​‖w−wt‖2,\\displaystyle F\_\{k\}\(w;w^\{t\}\)=\\frac\{1\}\{n\_\{k\}\}\\sum\_\{i=1\}^\{n\_\{k\}\}\[l\(f\(w;x\_\{i\}\),y\_\{i\}\)\]\+\\frac\{\\mu\}\{2\}\\\|w\-w^\{t\}\\\|^\{2\},\(1\)where the first term is the loss value of model parameterwwon the local datasetDkD\_\{k\}, andwtw^\{t\}in the second term is the global model parameter output by thett\-th round server aggregation\. The optimized model parameter of clientkkfor this round is defined aswkt\+1:=minw⁡Fk​\(w,wt\)w\_\{k\}^\{t\+1\}:=\\min\_\{w\}F\_\{k\}\(w;w^\{t\}\)\. Following this, the updated aggregated modelwt\+1w^\{t\+1\}is constructed on the server through weighted averaging as shown in Eq\. \([2](https://arxiv.org/html/2608.25133#S3.E2)\)

wt\+1=∑k=1Kpk​wkt\+1,\\displaystyle w^\{t\+1\}=\\sum\_\{k=1\}^\{K\}p\_\{k\}w\_\{k\}^\{t\+1\},\(2\)wherepk≥0p\_\{k\}\\geq 0and∑kpk=1\\sum\_\{k\}p\_\{k\}=1\. Generally,pkp\_\{k\}is set to bepk=nknp\_\{k\}=\\frac\{n\_\{k\}\}\{n\}, wheren=∑knkn=\\sum\_\{k\}n\_\{k\}is the total number of data points in the FL system\. With the local objective function and the aggregation rule, the federated optimization objective of FedProx is formulated as Eq\. \([3](https://arxiv.org/html/2608.25133#S3.E3)\)

minw⁡F⁡\(w\)=𝔼k​\[Fk​\(w,wt\)\]=∑k=1Kpk​Fk​\(w,wt\)\.\\displaystyle\\min\_\{w\}F\(w\)=\\mathbb\{E\}\_\{k\}\[F\_\{k\}\(w;w^\{t\}\)\]=\\sum\_\{k=1\}^\{K\}p\_\{k\}F\_\{k\}\(w;w^\{t\}\)\.\(3\)
Regarding this system setting, we have made some commonly used assumptions to facilitate our analysis in later sections\.

- •\(Lipschitz Continuity\)∀w,w′∈𝒲\\forall w,w^\{\\prime\}\\in\\mathcal\{W\}, the loss functionl⁡\(f⁡\(w,x\),y\)l\(f\(w;x\),y\)is Lipschitz continuous withι\>0\\iota\>0\[[35](https://arxiv.org/html/2608.25133#bib.bib43),[36](https://arxiv.org/html/2608.25133#bib.bib44)\]: ‖l⁡\(f⁡\(w,x\),y\)−l⁡\(f⁡\(w,x\),y\)‖≤ι​‖w−w′‖\.\\displaystyle\\\|l\(f\(w;x\),y\)\-l\(f\(w;x\),y\)\\\|\\leq\\iota\\\|w\-w^\{\\prime\}\\\|\.\(4\)
- •\(Lipschitz Continuous Gradient\)∀w,w′∈𝒲\\forall w,w^\{\\prime\}\\in\\mathcal\{W\}, the gradient of the loss functionl⁡\(f⁡\(w,x\),y\)l\(f\(w;x\),y\)is Lipschitz continuous withλ\>0\\lambda\>0\[[35](https://arxiv.org/html/2608.25133#bib.bib43),[37](https://arxiv.org/html/2608.25133#bib.bib45)\]: ‖∇l​\(f⁡\(w,x\),y\)−∇l​\(f⁡\(w′,x\),y\)‖≤λ​‖w−w′‖\.\\displaystyle\\\|\\nabla l\(f\(w;x\),y\)\-\\nabla l\(f\(w^\{\\prime\};x\),y\)\\\|\\leq\\lambda\\\|w\-w^\{\\prime\}\\\|\.\(5\)

### III\-BThreat Model

In this work, the FedProx framework is considered as the cyber\-range of a malicious client \(referred to as “the attacker” hereafter\)\. Thegoalof the attacker is to generate adversarial examples that can cause performance degradation \(e\.g\., misclassification\) on a targeted client \(referred to as “the victim” hereafter\)\.

The attacker may be a current OR previous client in this FL system, holding his/her local private dataset and local model parameters \(i\.e\., model parameterwktw\_\{k\}^\{t\}\) as the FL training evolves\. In such a setting, theknowledgeof the attacker is only the task of the FL system and his own data and model\. As we are in the FedProx setting, the victim’s model parameters do not necessary to be the same as the attacker’s, resulting in a black\-box setting\.

Theattack vectorof the attacker is described as follows: \(i\) The attacker joined the FL system to receive the initialized model and task, and started the FL process\. \(ii\) Based on the attacker’s own local model, he can craft adversarial examples locally, which prevents possible detection mechanisms\. These well\-functioning adversarial examples can attack the attacker’s local model successfully\. \(iii\) Once the adversarial example is generated, the transferability of the adversarial example will be utilized as the key of an attacker to invade many victim clients with less effort\. The generated adversarial examples will be spread widely or distributed to the target victim\. When the victim uses them as inputs, the attack will be effective due to the transferability of adversarial examples among different machine learning models\[[38](https://arxiv.org/html/2608.25133#bib.bib36),[39](https://arxiv.org/html/2608.25133#bib.bib37)\]\. This attack can be implemented even when there is only one attacker, regardless of the total number of clients or the model parameter/structure of the victim client\.

Indeed, the transferability of adversarial examples is mostly studied via experimental results in previous literature, and the cause of transferability is still an open question\. In this threat model, we want to not only investigate the adversarial example attack in FL at scale but also analyze the key factors that may influence the transferability of attack examples to inspire further research on attack and defense\.

## IVTransferable Adversarial Attack

### IV\-AAdversarial Example Attack in FL

Without loss of generality, we consider the most commonCCclassification task in FL, where the clients’ models are separately trained on their private datasetDk=\{\(xi,yi\)\}i=1nkD\_\{k\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{n\_\{k\}\}andxi∈𝒳x\_\{i\}\\in\\mathcal\{X\}is the feature space of data whileyi∈𝒴=\{1,2,…,C\}y\_\{i\}\\in\\mathcal\{Y\}=\\\{1,2,\\dots,C\\\}is the label space\. The model of each client is denoted as a functionf⁡\(w,x\):𝒳→ℝ\|𝒴\|f\(w;x\):\\mathcal\{X\}\\rightarrow\\mathbb\{R\}^\{\|\\mathcal\{Y\}\|\}mapping the input data to a probability simplex, where thecc\-th elementfc​\(w,x\)f\_\{c\}\(w;x\)in the outputf⁡\(w,x\)f\(w;x\)represents the probability ofxxbelongs tocc\-th class\. Therefore,arg⁡maxc​fc​\(w,x\)\\arg\\max\_\{c\}f\_\{c\}\(w;x\)is the classified label computed by modelww\. Also, there is a continuous loss function \(usually cross\-entropy loss\)l⁡\(f⁡\(w,x\),y\):𝒳×𝒴→ℝl\(f\(w;x\),y\):\\mathcal\{X\}\\times\\mathcal\{Y\}\\rightarrow\\mathbb\{R\}associated with each classifier, whereyyis the ground\-truth label of corresponding dataxx\. Generally, a correct classification result will have the smallest loss value, while a misclassified label can induce a larger loss\.

For an attackerAAwith classifier functionf⁡\(wA,⋅\)f\(w\_\{A\};\\cdot\), when an input dataxxis correctly predicted, the ground\-truth labely=arg⁡maxc​fc​\(w,x\)y=\\arg\\max\_\{c\}f\_\{c\}\(w;x\)\. To achieve the desired \[untarget adversarial attack\], an adversarial examplex′x^\{\\prime\}can be generated through different attack methods so that the crafted adversarial examplex′x^\{\\prime\}is misclassified into a different labely′≠yy^\{\\prime\}\\neq y\. Under this situation, the loss function value ofx′x^\{\\prime\}with respect towAw\_\{A\}will increase, which means thatl⁡\(f⁡\(wA,x′\),y\)l\(f\(w\_\{A\};x^\{\\prime\}\),y\)becomes higher than the original lossl⁡\(f⁡\(wA,x\),y\)l\(f\(w\_\{A\};x\),y\)on clean dataxx\. In practice, maximizing the loss function value based on model parameters is the most common way of constructing adversarial examples in existing literature, such as FGSM\[[39](https://arxiv.org/html/2608.25133#bib.bib37)\], PGD\[[40](https://arxiv.org/html/2608.25133#bib.bib39)\], C&W\[[41](https://arxiv.org/html/2608.25133#bib.bib40)\], etc\. Moreover, from\[[42](https://arxiv.org/html/2608.25133#bib.bib38)\], we know that the imperceptible adversarial examples can sabotage other unseen models with different hyper\-parameters \(cross\-model generalization\) or trained on disjoint sub\-datasets \(cross\-training data generalization\)\. This transferability ofx′x^\{\\prime\}is able to increase the loss function value of other clients in the FL system with different model parameters other thanwAw\_\{A\}\. In this regard, the increased loss value is very likely to pushx′x^\{\\prime\}across the decision boundary to make a misclassification result\. Therefore, the adversarial example generated by the attackerAAcan penetrate other benign clients even if they are personalized with non\-i\.i\.d data in the federated setting \(e\.g\.,our target FedProx\)\.

For an individual victim clientVVwith local model parameterwVw\_\{V\}, when the adversarial examplex′x^\{\\prime\}generated by the attackerAAis taken as an input, the classification function outputf⁡\(wV,x′\)f\(w\_\{V\};x^\{\\prime\}\)and loss function valuel⁡\(f⁡\(wV,x′\),y\)l\(f\(w\_\{V\};x^\{\\prime\}\),y\)will shift away from the normal level\. Since the loss functions \(e\.g\.,cross\-entropy\) are always continuous and differentiable, the difference between loss function valuel⁡\(f⁡\(wV,x′\),y\)l\(f\(w\_\{V\};x^\{\\prime\}\),y\)on the victim andl⁡\(f⁡\(wA,x′\),y\)l\(f\(w\_\{A\};x^\{\\prime\}\),y\)on the attacker can be quantified by analyzing model parameterswVw\_\{V\}andwAw\_\{A\}\. If the adversarial examplex′x^\{\\prime\}works on modelwAw\_\{A\}with a large loss function value, the loss valuel⁡\(f⁡\(wV,x′\),y\)l\(f\(w\_\{V\};x^\{\\prime\}\),y\)should also be large, which means the attack is transferable from the attacker to victim’s modelwVw\_\{V\}\. Our purpose of this work is to investigate the relation betweenl⁡\(f⁡\(wV,x′\),y\)l\(f\(w\_\{V\};x^\{\\prime\}\),y\)andl⁡\(f⁡\(wA,x′\),y\)l\(f\(w\_\{A\};x^\{\\prime\}\),y\), and therefore to understand the transferability of adversarial example as well as its associated factors\.

Remark\.There are a wealth of attack methods\[[39](https://arxiv.org/html/2608.25133#bib.bib37),[40](https://arxiv.org/html/2608.25133#bib.bib39),[41](https://arxiv.org/html/2608.25133#bib.bib40),[43](https://arxiv.org/html/2608.25133#bib.bib41),[44](https://arxiv.org/html/2608.25133#bib.bib42)\]available to generate this adversarial examplex′x^\{\\prime\}yet they are out of the scope of our work\. In this study, we primarily focus on the transferability of this adversarial example regardless of what methods are used to generate it\.

### IV\-BTransferability of Adversarial Example

In this work, we define the transferability of adversarial examples from the perspective of loss function value similarity between the attacker and the victim\.

###### Definition 1\.

\(Transferability of Adversarial Example\)\. Given an adversarial examplex′x^\{\\prime\}, a source model parameterwAw\_\{A\}used to generatex′x^\{\\prime\}, and a target model parameterwVw\_\{V\}to be attacked, the difference between loss values,‖l⁡\(f⁡\(wA,x′\),y\)−l⁡\(f⁡\(wV,x′\),y\)‖\\\|l\(f\(w\_\{A\};x^\{\\prime\}\),y\)\-l\(f\(w\_\{V\};x^\{\\prime\}\),y\)\\\|, measures the transferability of the adversarial examplex′x^\{\\prime\}\.

Intuitively, the smaller the distance between the two losses, the higher the chance thatx′x^\{\\prime\}can invade modelwVw\_\{V\}, which expresses a stronger transferability\. Next, we dive in to seek what is the underlying factors influencing the transferability of an adversarial example among different clients in the FedProx system and formulate the findings within Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1)\.

###### Theorem 1\.

The transferability of adversarial examplex′x^\{\\prime\}between an attackerAAand any victim clientVVis related to local data distribution and given in the following equation\.

‖l⁡\(f⁡\(wA,x′\),y\)−l⁡\(f⁡\(wV,x′\),y\)‖≤\\displaystyle\\\|l\(f\(w\_\{A\};x^\{\\prime\}\),y\)\-l\(f\(w\_\{V\};x^\{\\prime\}\),y\)\\\|\\leqι​η​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\+∑l=0m−1\(\(bV\)l​Gm​a​x​\(wAm​t−1−l\)\),\\displaystyle\\iota\\eta\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\+\\sum\_\{l=0\}^\{m\-1\}\(\(b\_\{V\}\)^\{l\}G\_\{max\}\(w\_\{A\}^\{mt\-1\-l\}\)\),\(6\)wherepAp\_\{A\}andpVp\_\{V\}are the local data distribution of the attacker and the victim,Gm​a​x​\(⋅\)G\_\{max\}\(\\cdot\)is the maximal value of gradient,bV=\(1−η​μ\+η​∑c=1CpV​\(yi=c\)​γ\)b\_\{V\}=\(1\-\\eta\\mu\+\\eta\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\\gamma\), and some constantι\\iota,η\\eta,γ\\gammaare given in common assumptions\.

This theorem reveals that the transferability of an adversarial example is mostly related to the data distribution difference between its source client \(attacker\) and the target client \(victim\)\.

###### Proof\.

To accomplish this proof, some commonly used assumptions in optimization theory are needed, for more details, please refer to Section[III\-A](https://arxiv.org/html/2608.25133#S3.SS1)\.

According to the Lipschitz Continuity, we can derive

‖l⁡\(f⁡\(wA,x′\),y\)−l⁡\(f⁡\(wV,x′\),y\)‖≤ι​‖wA−wV‖\.\\displaystyle\\\|l\(f\(w\_\{A\};x^\{\\prime\}\),y\)\-l\(f\(w\_\{V\};x^\{\\prime\}\),y\)\\\|\\leq\\iota\\\|w\_\{A\}\-w\_\{V\}\\\|\.\(7\)Therefore, finding the upper bound‖l⁡\(f⁡\(wA,x′\),y\)−l⁡\(f⁡\(wV,x′\),y\)‖\\\|l\(f\(w\_\{A\};x^\{\\prime\}\),y\)\-l\(f\(w\_\{V\};x^\{\\prime\}\),y\)\\\|\(i\.e\.,the transferability betweenwAw\_\{A\}andwVw\_\{V\}\) is transformed to the upper bound of‖wA−wV‖\\\|w\_\{A\}\-w\_\{V\}\\\|\. This distance‖wA−wV‖\\\|w\_\{A\}\-w\_\{V\}\\\|between the attacker and victim may be changed in each round, and in most federated learning, including our target FedProx, the local clients train their local models \(e\.g\.,wAw\_\{A\}andwVw\_\{V\}\) separately in an iterative manner\. Thus, without loss of generality, we consider a universal case where the global training hasTTrounds and in each round the local client performsmmtimes iterative updates, which means a local client will havem​TmTtimes updates\.

For a local clientkk, according to the objective function defined in Eq\. \([1](https://arxiv.org/html/2608.25133#S3.E1)\), the cross\-entropy loss of themm\-th update during thett\-th round can be rewritten in the following format,

Fk​\(wkm​t,wt−1\)\\displaystyle F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)=\\displaystyle=1nk​∑i=1nk\[l⁡\(f⁡\(wkm​t,xi\),yi\)\]\+μ2​‖wkm​t−wt−1‖2,\\displaystyle\\frac\{1\}\{n\_\{k\}\}\\sum\_\{i=1\}^\{n\_\{k\}\}\[l\(f\(w\_\{k\}^\{mt\};x\_\{i\}\),y\_\{i\}\)\]\+\\frac\{\\mu\}\{2\}\\\|w\_\{k\}^\{mt\}\-w^\{t\-1\}\\\|^\{2\},=\\displaystyle=𝔼\(xi,yi\)∈Dk​\[l⁡\(f⁡\(wkm​t,xi\),yi\)\]\+μ2​‖wkm​t−wt−1‖2,\\displaystyle\\mathbb\{E\}\_\{\(x\_\{i\},y\_\{i\}\)\\in D\_\{k\}\}\[l\(f\(w\_\{k\}^\{mt\};x\_\{i\}\),y\_\{i\}\)\]\+\\frac\{\\mu\}\{2\}\\\|w\_\{k\}^\{mt\}\-w^\{t\-1\}\\\|^\{2\},=\\displaystyle=𝔼\(xi,yi\)∈Dk​\[∑c=1Cyc​log⁡fc​\(wkm​t,xi\)\]\+μ2​‖wkm​t−wt−1‖2,\\displaystyle\\mathbb\{E\}\_\{\(x\_\{i\},y\_\{i\}\)\\in D\_\{k\}\}\[\\sum\_\{c=1\}^\{C\}\{\\color\[rgb\]\{0,0,0\}y\_\{c\}\}\\log f\_\{c\}\(w\_\{k\}^\{mt\};x\_\{i\}\)\]\+\\frac\{\\mu\}\{2\}\\\|w\_\{k\}^\{mt\}\-w^\{t\-1\}\\\|^\{2\},=\\displaystyle=∑c=1Cpk​\(yi=c\)​𝔼xi\|yi=c​\[log⁡fc​\(wkm​t,xi\)\]\+μ2​‖wkm​t−wt−1‖2\.\\displaystyle\\sum\_\{c=1\}^\{C\}p\_\{k\}\(y\_\{i\}=c\)\\mathbb\{E\}\_\{x\_\{i\}\|y\_\{i\}=c\}\[\\log f\_\{c\}\(w\_\{k\}^\{mt\};x\_\{i\}\)\]\+\\frac\{\\mu\}\{2\}\\\|w\_\{k\}^\{mt\}\-w^\{t\-1\}\\\|^\{2\}\.\(8\)whereyc\{\\color\[rgb\]\{0,0,0\}y\_\{c\}\}is the one\-hot vector with 1 in thecc\-th position, andpk​\(yi=c\)p\_\{k\}\(y\_\{i\}=c\)is the data distribution in datasetDkD\_\{k\}\. Based on this reformulated loss function, in the next iteration, a new local modelwkm​t\+1w\_\{k\}^\{mt\+1\}is updated as follows,

wkm​t\+1=\\displaystyle w\_\{k\}^\{mt\+1\}=wkm​t−η∇Fk\(wkm​t;wt−1\)\\displaystyle w\_\{k\}^\{mt\}\-\\eta\\nabla F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)\(9\)whereη\\etais the learning rate, and∇Fk​\(wkm​t,wt−1\)\\nabla F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)is the gradient with respect to model parameters\. We can calculate the gradient∇Fk​\(wkm​t,wt−1\)\\nabla F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)in Eq\. \([10](https://arxiv.org/html/2608.25133#S4.Ex6)\)

∇Fk​\(wkm​t,wt−1\)=\\displaystyle\\nabla F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)=∑c=1Cpk​\(yi=c\)​∇w𝔼xi\|yi=c​\[log⁡fc​\(wkm​t,xi\)\]\\displaystyle\\sum\_\{c=1\}^\{C\}p\_\{k\}\(y\_\{i\}=c\)\\nabla\_\{w\}\\mathbb\{E\}\_\{x\_\{i\}\|y\_\{i\}=c\}\[\\log f\_\{c\}\(w\_\{k\}^\{mt\};x\_\{i\}\)\]\+μ⁡\(wkm​t−wt−1\)\.\\displaystyle\+\\mu\(w\_\{k\}^\{mt\}\-w^\{t\-1\}\)\.\(10\)For simplicity, hereafter we useG⁡\(wkm​t\)G\(w\_\{k\}^\{mt\}\)to represent the gradient term∇w𝔼xi\|yi=c​\[log⁡fc​\(wkm​t,xi\)\]\\nabla\_\{w\}\\mathbb\{E\}\_\{x\_\{i\}\|y\_\{i\}=c\}\[\\log f\_\{c\}\(w\_\{k\}^\{mt\};x\_\{i\}\)\], and Eq\. \([10](https://arxiv.org/html/2608.25133#S4.Ex6)\) is simplified to

∇Fk​\(wkm​t,wt−1\)=∑c=1Cpk​\(yi=c\)​G​\(wkm​t\)\+μ⁡\(wkm​t−wt−1\)\.\\displaystyle\\nabla F\_\{k\}\(w\_\{k\}^\{mt\};w^\{t\-1\}\)=\\sum\_\{c=1\}^\{C\}p\_\{k\}\(y\_\{i\}=c\)G\(w\_\{k\}^\{mt\}\)\+\\mu\(w\_\{k\}^\{mt\}\-w^\{t\-1\}\)\.\(11\)
Now, we can compute the distance between the attacker’s modelwAw\_\{A\}and the victim’s modelwVw\_\{V\}\. In themm\-th iteration of thett\-th round, the distance is calculated as follows,

‖wAm​t−wVm​t‖=\|\(wAm​t−1−η⁡\(\(∇FA​\(wAm​t,wt−1\)\)CLOSECLOSE\\displaystyle\\\|w\_\{A\}^\{mt\}\-w\_\{V\}^\{mt\}\\\|=\\\|\(w\_\{A\}^\{mt\-1\}\-\\eta\(\{\\color\[rgb\]\{0,0,0\}\(\\nabla F\_\{A\}\(w\_\{A\}^\{mt\};w^\{t\-1\}\)\}\)−\(wVm​t−1−η\(\(∇FV\(wVm​t;wt−1\)\)∥\\displaystyle\-\(w\_\{V\}^\{mt\-1\}\-\\eta\(\{\\color\[rgb\]\{0,0,0\}\(\\nabla F\_\{V\}\(w\_\{V\}^\{mt\};w^\{t\-1\}\)\}\)\\\|=\\displaystyle=∥wAm​t−1−wVm​t−1−η∑c=1CpA\(yi=c\)G\(wAm​t−1\)\\displaystyle\\\|w\_\{A\}^\{mt\-1\}\-w\_\{V\}^\{mt\-1\}\-\\eta\\sum\_\{c=1\}^\{C\}p\_\{A\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\+∑c=1CpV\(yi=c\)G\(wVm​t−1\)−ημ\(wAm​t−1−wVm​t−1\)∥\\displaystyle\+\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{V\}^\{mt\-1\}\)\-\\eta\\mu\(w\_\{A\}^\{mt\-1\}\-w\_\{V\}^\{mt\-1\}\)\\\|=\\displaystyle=∥\(1−ημ\)\(wAm​t−1−wVm​t−1\)\\displaystyle\\\|\(1\-\\eta\\mu\)\(w\_\{A\}^\{mt\-1\}\-w\_\{V\}^\{mt\-1\}\)\+\\displaystyle\+η\(∑c=1CpV\(yi=c\)G\(wVm​t−1\)−∑c=1CpA\(yi=c\)G\(wAm​t−1\)\)∥\\displaystyle\\eta\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{V\}^\{mt\-1\}\)\-\\sum\_\{c=1\}^\{C\}p\_\{A\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\\\|≤\\displaystyle\\leq‖\(1−η​μ\)​\(wVm​t−1−wAm​t−1\)‖\\displaystyle\\\|\(1\-\\eta\\mu\)\(w\_\{V\}^\{mt\-1\}\-w\_\{A\}^\{mt\-1\}\)\\\|\+\\displaystyle\+η​‖\(∑c=1CpV​\(yi=c\)​G​\(wVm​t−1\)−∑c=1CpA​\(yi=c\)​G​\(wAm​t−1\)\)‖\\displaystyle\\eta\\\|\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{V\}^\{mt\-1\}\)\-\\sum\_\{c=1\}^\{C\}p\_\{A\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\\\|\(12\)
The second term in Eq\. \([12](https://arxiv.org/html/2608.25133#S4.Ex7)\) can be rewritten as follows,

η​‖\(∑c=1CpV​\(yi=c\)​G​\(wVm​t−1\)\)−\(∑c=1CpA​\(yi=c\)​G​\(wAm​t−1\)\)‖\\displaystyle\\eta\\\|\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{V\}^\{mt\-1\}\)\)\-\(\\sum\_\{c=1\}^\{C\}p\_\{A\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\\\|=\\displaystyle=η\|\(∑c=1CpV​\(yi=c\)​G​\(wVm​t−1\)\)−\(∑c=1CpV​\(yi=c\)​G​\(wAm​t−1\)\)\\displaystyle\\eta\\\|\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{V\}^\{mt\-1\}\)\)\-\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\+\(∑c=1CpV\(yi=c\)G\(wAm​t−1\)\)−\(∑c=1CpA\(yi=c\)G\(wAm​t−1\)\)∥\\displaystyle\+\(\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\-\(\\sum\_\{c=1\}^\{C\}p\_\{A\}\(y\_\{i\}=c\)G\(w\_\{A\}^\{mt\-1\}\)\)\\\|≤\\displaystyle\\leqη​∑c=1CpV​\(yi=c\)​‖G⁡\(wVm​t−1\)−G⁡\(wAm​t−1\)‖\\displaystyle\\eta\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\\\|G\(w\_\{V\}^\{mt\-1\}\)\-G\(w\_\{A\}^\{mt\-1\}\)\\\|\+η​G​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\+\\eta G\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|≤\(i\)\\displaystyle\\overset\{\(i\)\}\{\\leq\}η​∑c=1CpV​\(yi=c\)​γ​‖wVm​t−1−wAm​t−1‖\\displaystyle\\eta\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\\gamma\\\|w\_\{V\}^\{mt\-1\}\-w\_\{A\}^\{mt\-1\}\\\|\+η​Gm​a​x​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\+\\eta G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|The inequality \(ii\) holds because of the Lipschitz Continuous Gradient condition of the loss function, andGm​a​x​\(wAm​t−1\)G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)is the maximal value of the gradient inwAm​t−1w\_\{A\}^\{mt\-1\}\.

Therefore, combining the inequality Eq\. \([IV\-B](https://arxiv.org/html/2608.25133#S4.Ex14)\) and Eq\. \([12](https://arxiv.org/html/2608.25133#S4.Ex7)\), we can have a one step upper bound for‖wAm​t−wVm​t‖\\\|w\_\{A\}^\{mt\}\-w\_\{V\}^\{mt\}\\\|represented bywAm​t−1w\_\{A\}^\{mt\-1\}andwVm​t−1w\_\{V\}^\{mt\-1\}as shown in Eq\. \([14](https://arxiv.org/html/2608.25133#S4.Ex21)\)\.

‖wAm​t−wVm​t‖\\displaystyle\\\|w\_\{A\}^\{mt\}\-w\_\{V\}^\{mt\}\\\|≤\\displaystyle\\leq\(1−η​μ\+η​∑c=1CpV​\(yi=c\)​γ\)​‖\(wVm​t−1−wAm​t−1\)‖\\displaystyle\(1\-\\eta\\mu\+\\eta\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\\gamma\)\\\|\(w\_\{V\}^\{mt\-1\}\-w\_\{A\}^\{mt\-1\}\)\\\|\+η​Gm​a​x​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\+\\eta G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\(14\)
Based on this inequality, we can reduce to the general case of the distance betweenwAm​tw\_\{A\}^\{mt\}andwVm​tw\_\{V\}^\{mt\}\. To ease the reading experience, we usebVb\_\{V\}to denote\(1−η​μ\+η​∑c=1CpV​\(yi=c\)​γ\)\(1\-\\eta\\mu\+\\eta\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\\gamma\)for simplicity\. Then we will have the following induction\.

‖wAm​t−wVm​t‖\\displaystyle\\\|w\_\{A\}^\{mt\}\-w\_\{V\}^\{mt\}\\\|≤\\displaystyle\\leqbV​‖\(wVm​t−1−wAm​t−1\)‖\+\\displaystyle b\_\{V\}\\\|\(w\_\{V\}^\{mt\-1\}\-w\_\{A\}^\{mt\-1\}\)\\\|\+η​Gm​a​x​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\\eta G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|≤\\displaystyle\\leq\(bV\)2​‖\(wVm​t−2−wAm​t−2\)‖\+\\displaystyle\(b\_\{V\}\)^\{2\}\\\|\(w\_\{V\}^\{mt\-2\}\-w\_\{A\}^\{mt\-2\}\)\\\|\+η​Gm​a​x​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\\eta G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\+η​bV​Gm​a​x​\(wAm​t−1\)​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\+\\eta b\_\{V\}G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|=\\displaystyle=\(bV\)2​‖\(wVm​t−2−wAm​t−2\)‖\+η​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\\displaystyle\(b\_\{V\}\)^\{2\}\\\|\(w\_\{V\}^\{mt\-2\}\-w\_\{A\}^\{mt\-2\}\)\\\|\+\\eta\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|×\(Gm​a​x​\(wAm​t−1\)\+bV​Gm​a​x​\(wAm​t−2\)\)\\displaystyle\\times\(G\_\{max\}\(w\_\{A\}^\{mt\-1\}\)\+b\_\{V\}G\_\{max\}\(w\_\{A\}^\{mt\-2\}\)\)…\\displaystyle\\dots≤\\displaystyle\\leq\(bV\)m​‖\(wVm​t−m−wAm​t−m\)‖\+\\displaystyle\(b\_\{V\}\)^\{m\}\\\|\(w\_\{V\}^\{mt\-m\}\-w\_\{A\}^\{mt\-m\}\)\\\|\+η​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖​∑l=0m−1\(\(bv\)l​Gm​a​x​\(wAm​t−1−l\)\)\\displaystyle\\eta\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\\sum\_\{l=0\}^\{m\-1\}\(\(b\_\{v\}\)^\{l\}G\_\{max\}\(w\_\{A\}^\{mt\-1\-l\}\)\)≤\(i\)\\displaystyle\\overset\{\(i\)\}\{\\leq\}η​‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖​∑l=0m−1\(\(bv\)l​Gm​a​x​\(wAm​t−1−l\)\)\\displaystyle\\eta\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\\sum\_\{l=0\}^\{m\-1\}\(\(b\_\{v\}\)^\{l\}G\_\{max\}\(w\_\{A\}^\{mt\-1\-l\}\)\)\(15\)This final inequality \(ii\) holds because the model parameterswVm​t−m:=wt−1w\_\{V\}^\{mt\-m\}:=w^\{t\-1\}is the aggregated global parameter in the previous round \(i\.e\.,the \(t−1t\-1\)\-th round\) andwAm​t−m:=wt−1w\_\{A\}^\{mt\-m\}:=w^\{t\-1\}is also the aggregated model parameter by definition\. Thus,‖\(wVm​t−m−wAm​t−m\)‖\\\|\(w\_\{V\}^\{mt\-m\}\-w\_\{A\}^\{mt\-m\}\)\\\|equals to00\.

With the upper bound of model parameters distance‖wAm​t−wVm​t‖\\\|w\_\{A\}^\{mt\}\-w\_\{V\}^\{mt\}\\\|, the transferability of adversarial example can be calculated by substituting Eq\. \([15](https://arxiv.org/html/2608.25133#S4.Ex23)\) into Eq\. \([7](https://arxiv.org/html/2608.25133#S4.E7)\)\. So, we can derive the transferability as follows

‖l⁡\(f⁡\(wA,x′\),y\)−l⁡\(f⁡\(wV,x′\),y\)‖≤\\displaystyle\\\|l\(f\(w\_\{A\};x^\{\\prime\}\),y\)\-l\(f\(w\_\{V\};x^\{\\prime\}\),y\)\\\|\\leqι​η\\displaystyle\\iota\\eta‖∑c=1CpV​\(yi=c\)−pA​\(yi=c\)‖\+∑l=0m−1\(\(bV\)l​Gm​a​x​\(wAm​t−1−l\)\)\.\\displaystyle\\\|\\sum\_\{c=1\}^\{C\}p\_\{V\}\(y\_\{i\}=c\)\-p\_\{A\}\(y\_\{i\}=c\)\\\|\+\\sum\_\{l=0\}^\{m\-1\}\(\(b\_\{V\}\)^\{l\}G\_\{max\}\(w\_\{A\}^\{mt\-1\-l\}\)\)\.\(16\)This finishes the proof of Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1)\. ∎

This theorem confirms that there is a positive relation between the transferability of adversarial examples and the distribution differences between the victim and the attacker client\. That is, when the data distribution of the attacker is similar to that of the victim, the crafted adversarial examples based on the source model of the attacker will be more transferable and form a successful attack\. We conduct a series of experiments on the transferability of adversarial examples to catch the relation in Section[VI](https://arxiv.org/html/2608.25133#S6), and the experimental results are in compliance with our analysis in Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1)\.

## VMethodology: Robust Defense in FL

![Refer to caption](https://arxiv.org/html/2608.25133v1/FederatedLearning-2.png)Fig\. 1:Overview of the Federated Learning Framework used in this study\.Motivated by our theoretical analysis in Section[IV](https://arxiv.org/html/2608.25133#S4), which reveals that the transferability of adversarial examples stems from similarities from the data\-distribution and the weights of the attacker model and the victim model\. So, to mitigate the transferability of the samples from attacker we need to make the victim model learn more robust and unique features\. To employ our solution we used SVD\-driven Feature Evolution Module \(SDFEM\) and Adversarial Training alongside it to force the model to learn robust features\. It gave great results in centralized settings by Liu et al\.\[[45](https://arxiv.org/html/2608.25133#bib.bib46)\]\.

### V\-ASDFEM for Feature Robustness

Inspired by Liu et al\.\[[45](https://arxiv.org/html/2608.25133#bib.bib46)\], the Singular Value Decomposition \(SVD\) method can be applied to the input of models\. Its primary goal is to suppress feature channels that are highly sensitive to adversarial perturbations while retaining robust semantic features\. The SDFEM module is deployed at the input layer of the client’s local model without changing the original model parameters, which can serve as a plug\-in kit\.

Letx∈ℝh×wx\\in\\mathbb\{R\}^\{h\\times w\}represent an input image sample\. The module first decomposes the feature map using SVD:

x=U​Σ​VT,x=U\\Sigma V^\{T\},\(17\)whereUUandVVare orthogonal matrices, andΣ\\Sigmais a diagonal matrix containing the singular valuesσi\\sigma\_\{i\}which represent the energy of feature channels\.

Algorithm 1Robust FedProx with SDFEMServer executes:

1Initialize

w0w^\{0\}, global mask

MM
2for*roundt=0,1,…,T−1t=0,1,\\dots,T\-1*do

3Select subset of clients

St⊆\{1,…,K\}S\_\{t\}\\subseteq\\\{1,\\dots,K\\\}
4Broadcast

wtw^\{t\}to all

k∈Stk\\in S\_\{t\}
5for*each clientk∈Stk\\in S\_\{t\}*do

6

wkt\+1,Mkt\+1←ClientUpdate​\(k,wt\)w\_\{k\}^\{t\+1\},M\_\{k\}^\{t\+1\}\\leftarrow\\text\{ClientUpdate\}\(k,w^\{t\}\)
7end for

8

wt\+1←∑k∈Stpk​wkt\+1w^\{t\+1\}\\leftarrow\\sum\_\{k\\in S\_\{t\}\}p\_\{k\}w\_\{k\}^\{t\+1\}
9end for

10ClientUpdate\(k,wtk,w^\{t\}\):

11Generate

Dka​d​vD\_\{k\}^\{adv\}using local surrogate

12Initialize

wk←wtw\_\{k\}\\leftarrow w^\{t\}
13for*local epoche=1​…​Ee=1\\dots E*do

14Update

wk,Mkw\_\{k\},M\_\{k\}to minimize Eq\. \([19](https://arxiv.org/html/2608.25133#S5.Ex35)\)

15end for

16return

wk,Mkw\_\{k\},M\_\{k\}

To distinguish between robust and non\-robust features, we introduce a learnable evolution maskM∈ℝh×wM\\in\\mathbb\{R\}^\{h\\times w\}\. The input is reconstructed by re\-weighting the singular values via element\-wise multiplication with this mask:

SDFEM​\(x,M\)=U⁡\(Σ⊙M\)​VT,\\text\{SDFEM\}\(x,M\)=U\(\\Sigma\\odot M\)V^\{T\},\(18\)where⊙\\odotdenotes the Hadamard product\. By learningMMduring training, the model can automatically attenuate singular values that contribute to the gradients exploited by transfer\-based attacks, effectively lowering the gradient maximum termGm​a​xG\_\{max\}discussed in Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1)\.

### V\-BAdversarial Training in Federated Aggregation

The SDFEM method can only protect the local model, and generate robust local features and parameters\. To ensure the global model aggregates robust features, the federated learning optimization problem needs to be modified as well\. Adversarial training is adopted in the robust federated aggregation\. The local models from SDFEM can propagate their robustness to other clients and learn from each other to increase the global robustness against unseen data\[[46](https://arxiv.org/html/2608.25133#bib.bib1)\]\. The major steps for adversarial training in FedProx are as follows\.

Adversarial Data Generation\.In each round, clientkkutilizes a local surrogate model to generate a batch of adversarial examplesDka​d​v=\{\(xi′,yi\)\}D\_\{k\}^\{adv\}=\\\{\(x^\{\\prime\}\_\{i\},y\_\{i\}\)\\\}from the local clean dataDkD\_\{k\}\. These examples are generated using PGD to maximize the local loss, serving as proxies for transferable attacks\.

![Refer to caption](https://arxiv.org/html/2608.25133v1/L1_vs_ASR_SVHNFedprox.png)\(a\)SVHN ASR
![Refer to caption](https://arxiv.org/html/2608.25133v1/L1_vs_ASR_Updated.png)\(b\)Cifar10 ASR
![Refer to caption](https://arxiv.org/html/2608.25133v1/transfer_plot_svhn.png)\(c\)SVHN Transferability
![Refer to caption](https://arxiv.org/html/2608.25133v1/transfer_plot_cifar.png)\(d\)Cifar10 Transferability

Fig\. 2:Correlation between Model Distance and Attack Success Rate \(Fig\.[2a](https://arxiv.org/html/2608.25133#S5.F2.sf1),[2b](https://arxiv.org/html/2608.25133#S5.F2.sf2)\), and between Distribution Distance and Attack Transferability \(Fig\.[2c](https://arxiv.org/html/2608.25133#S5.F2.sf3),[2d](https://arxiv.org/html/2608.25133#S5.F2.sf4)\) across different datasets\.Modified Local Objective\.The local objective functionFk​\(w,wt\)F\_\{k\}\(w;w^\{t\}\)is updated to jointly optimize the model weightswkw\_\{k\}and the feature evolution maskMkM\_\{k\}\. The robust client minimizes the objective function in Eq\. \([19](https://arxiv.org/html/2608.25133#S5.Ex35)\)\.

minwk,Mk\\displaystyle\\min\_\{w\_\{k\},M\_\{k\}\}\\quadα​𝔼\(x,y\)∈Dk​\[l⁡\(f⁡\(wk,SDFEM​\(x,Mk\)\),y\)\]\\displaystyle\\alpha\\mathbb\{E\}\_\{\(x,y\)\\in D\_\{k\}\}\[l\(f\(w\_\{k\};\\text\{SDFEM\}\(x,M\_\{k\}\)\),y\)\]\+\\displaystyle\+\(1−α\)​𝔼\(x′,y\)∈Dka​d​v​\[l⁡\(f⁡\(wk,SDFEM​\(x′,Mk\)\),y\)\]\\displaystyle\(1\-\\alpha\)\\mathbb\{E\}\_\{\(x^\{\\prime\},y\)\\in D\_\{k\}^\{adv\}\}\[l\(f\(w\_\{k\};\\text\{SDFEM\}\(x^\{\\prime\},M\_\{k\}\)\),y\)\]\+\\displaystyle\+μ2​‖wk−wt‖2,\\displaystyle\\frac\{\\mu\}\{2\}\\\|w\_\{k\}\-w^\{t\}\\\|^\{2\},\(19\)whereα\\alphais a hyperparameter balancing clean accuracy and robustness\. The full training procedure for our proposed method is in Algorithm[1](https://arxiv.org/html/2608.25133#algorithm1)\.

## VIExperiments

In this section, we aim to answer the following questions via experiments: \(1\) Do our experimental findings align with the theoretical correlation between data distribution and transferability derived in Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1)? \(2\) Does the proposed robust mechanism effectively mitigate transferable adversarial attacks in a federated setting?

### VI\-AExperimental Setup

#### VI\-A1Datasets and Models

We utilize two benchmark image classification datasets:CIFAR\-10andSVHN\. For the model architectures, we employVGG11and WideResNet\-28\-10\(WRN28\)to represent standard and high\-capacity deep learning models, respectively\.

#### VI\-A2Federated Learning Settings

We simulate a federated learning environment withK∈\{10,100\}K\\in\\\{10,100\\\}clients\. In each communication round, a fractionC=\{0\.8,1\}C=\\\{0\.8,1\\\}of clients are randomly selected to participate\. To simulate realistic statistical heterogeneity, we partition the data among clients using two settings:

- •IID Setting:Data is shuffled and uniformly distributed across all clients\.
- •Non\-IID Setting:We sample class labels from a Dirichlet distribution with concentration parameterα∈\{0\.1,0\.5,1\}\\alpha\\in\\\{0\.1,0\.5,1\\\}, where a smallerα\\alphaindicates higher data skewness\.

The global model is trained forT=400T=400rounds\. For local updates, we use an SGD optimizer with a learning rate ofη=0\.01\\eta=0\.01, momentum0\.90\.9, and local epochE=1E=1for ideal IID settings andE=3E=3for Non\-IID settings\.

#### VI\-A3Attack and Defense Implementation

For the attack generation, we assume a gray\-box threat model where the adversary uses their local surrogate model to generate transfer\-based attacks\. We evaluate against four state\-of\-the\-art gradient\-based attacks:VMIFGSM,BIM,VNIFGSM,DIFGSM\. The perturbation budget is set toϵ=8/255\\epsilon=8/255with step size22and number of steps100100\. For our defense in adversarial training, the balance hyperparameterα\\alphain Eq\. \([19](https://arxiv.org/html/2608.25133#S5.Ex35)\) is set to0\.50\.5\.

### VI\-BRQ1: Verification of Theoretical Analysis

A core contribution of this paper is Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1), which posits that the transferability of adversarial examples is bounded by the model parameter difference between the attacker and victim \(see Eq\. \([7](https://arxiv.org/html/2608.25133#S4.E7)\)\) as well as the distributional distance \(see Eq\. \([16](https://arxiv.org/html/2608.25133#S4.Ex34)\)\)\. To verify this, we conducted experiments calculating the trend in attack success rate \(ASR\) and the change of model prediction loss, which aligns with our analysis\. The results are visualized in Fig\.[2](https://arxiv.org/html/2608.25133#S5.F2)\. It is obviously observed in Fig\.[2a](https://arxiv.org/html/2608.25133#S5.F2.sf1),[2b](https://arxiv.org/html/2608.25133#S5.F2.sf2)that when the model parameter distance‖wV−wA‖\\\|w\_\{V\}\-w\_\{A\}\\\|is increased, the adversarial attack ASR is reduced drastically, reflecting a negative correlation\. In Fig\.[2c](https://arxiv.org/html/2608.25133#S5.F2.sf3),[2d](https://arxiv.org/html/2608.25133#S5.F2.sf4), the distribution distance is measured by the L1 norm of their class distribution difference‖pV−pA‖\\\|p\_\{V\}\-p\_\{A\}\\\|\. As displayed in the figures, although not a linear relation, the attack transferability gap is increased as the distribution distance gets large\. This positive correlation is measured in Spearman’s coefficient, withrrvalues over 0\.4 and 0\.5,p≈0p\\approx 0for both datasets, which means statistically significant correlation\.

In summary, the empirical results are well\-aligned with our analysis, confirming that the transferability of attacks and model/distribution difference are positively correlated\.

### VI\-CRQ2: Defense Performance Analysis

We compare the proposed defense mechanism with baselines under four scenarios \(IID vs\. Non\-IID on CIFAR\-10 and SVHN\)\. Results are reported in Tables[I](https://arxiv.org/html/2608.25133#S6.T1)–[IV](https://arxiv.org/html/2608.25133#S6.T4)\.

Performance on IID Data\.Tables[I](https://arxiv.org/html/2608.25133#S6.T1)and[II](https://arxiv.org/html/2608.25133#S6.T2)show that standard federated training without adversarial robustness \(FedProx\) is extremely vulnerable to transfer\-based attacks: although clean accuracy remains high \(e\.g\., 88–98%\), the accuracy on adversarial examples collapses to nearly zero \(often<1%<1\\%\) across all attack variants\. In contrast, both FAT and our method substantially improve robustness, and our method consistently provides additional gains over FAT while maintaining comparable clean accuracy\. Specifically, on CIFAR\-10 in Table[I](https://arxiv.org/html/2608.25133#S6.T1), our method improves transfer robustness over FAT for both backbones\. For VGG11, ours increases robust accuracy by \+1\.69 \(VMIFGSM\), \+1\.17 \(BIM\), \+1\.79 \(VNIFGSM\), and \+1\.86 \(DIFGSM\) points, with only a minor clean\-accuracy change \(92\.62 vs\. 93\.53\)\. For WRN28, ours yields larger gains, improving robustness by \+3\.36 \(VMIFGSM\), \+2\.04 \(BIM\), \+3\.21 \(VNIFGSM\), and \+4\.28 \(DIFGSM\) points while preserving clean accuracy \(86\.40 vs\. 85\.97\)\. Notably, our method is competitive with the centralized upper bound under transfer attacks for WRN28 \(e\.g\., 83\.93 vs\. 83\.79 on VMIFGSM\), indicating that the proposed defense can approach centralized robustness even under federated constraints\. Table[II](https://arxiv.org/html/2608.25133#S6.T2)demonstrates the robustness of our method under IID settings on the SVHN dataset\. Compared with the standard FedProx models \(in VGG11 and WRN28\), which show extreme vulnerability to transfer attacks, our defense method maintains robust accuracy on adversarial examples\. For instance, in the VGG11 model, our method achieves an average robustness improvement of roughly60%60\\%and6%6\\%in BIM attack compared to FedProx and FAT, respectively\.

TABLE I:Comparison of defense accuracy \(%\) against various transfer\-based adversarial attacks onCIFAR\-10 \(IID\)\.TABLE II:Comparison of defense accuracy \(%\) against various transfer\-based adversarial attacks onSVHN \(IID\)\.Performance on Non\-IID Data\.Tables[III](https://arxiv.org/html/2608.25133#S6.T3)and[IV](https://arxiv.org/html/2608.25133#S6.T4)focus on the more realistic federated setting with heterogeneous client distributions\. Consistent with Theorem[1](https://arxiv.org/html/2608.25133#Thmtheorem1), transfer\-based attacks tend to be slightly less effective under Non\-IID partitions for non\-robust baselines, due to larger distribution shifts between attacker and victim\. Nevertheless, the accuracy on adversarial examples remains significantly low \(<1%<1\\%\) without explicit defenses, whereas our method continues to outperform the baseline FAT across datasets\. For example, in Table[III](https://arxiv.org/html/2608.25133#S6.T3), our method yields clear robustness gains over baselines\. For VGG11, it improves robustness over FAT by \+5\.06 \(VMIFGSM\), \+4\.59 \(BIM\), \+4\.97 \(VNIFGSM\), and \+4\.75 \(DIFGSM\) points\. For WRN28, ours improves both clean accuracy \(\+2\.99 points\) and robustness substantially, with \+9\.26, \+9\.07, \+9\.26, and \+8\.43 point gains under VMIFGSM/BIM/VNIFGSM/DIFGSM, respectively\. These results highlight that our method remains effective and can even be more beneficial under pronounced data heterogeneity\. Similar results can be observed on the SVHN non\-i\.i\.d\. scenario in Table[IV](https://arxiv.org/html/2608.25133#S6.T4)\.

TABLE III:Comparison of defense accuracy \(%\) against various transfer\-based adversarial attacks onCIFAR\-10 \(Non\-IID\)\.TABLE IV:Comparison of defense accuracy \(%\) against various transfer\-based adversarial attacks onSVHN \(Non\-IID\)\.

## VIIConclusion

In this work, we studied transferable adversarial example attacks in federated learning and revealed how their effectiveness is fundamentally tied to the data distribution shift across clients\. We provided a theoretical analysis that characterizes the vulnerability of federated systems under heterogeneous data\. Building on these insights, we proposed a defense mechanism that leverages the SVD and robustness propagation\. Extensive experiments on real\-world datasets demonstrate our method can improve robust accuracy while maintaining competitive clean performance, outperforming strong federated baselines\. Overall, our findings highlight transferability as a critical security dimension in federated learning and suggest that robustness\-aware defenses can substantially strengthen FL in practical environments\.

## Acknowledgment

This work was supported by the National Science Foundation under grants No\. 2429960, No\. 2434899, No\. 2548041, and No\. 2343619\.

## References

- \[1\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InArtificial intelligence and statistics,pp\. 1273–1282\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p1.1)\.
- \[2\]J\. Konečnỳ, H\. B\. McMahan, F\. X\. Yu, P\. Richtárik, A\. T\. Suresh, and D\. Bacon\(2016\)Federated learning: strategies for improving communication efficiency\.arXiv preprint arXiv:1610\.05492\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p1.1)\.
- \[3\]M\. Paulik, M\. Seigel, H\. Mason, D\. Telaar, J\. Kluivers, R\. van Dalen, C\. W\. Lau, L\. Carlson, F\. Granqvist, C\. Vandevelde,et al\.\(2021\)Federated evaluation and tuning for on\-device personalization: system design & applications\.arXiv preprint arXiv:2102\.08503\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p1.1)\.
- \[4\]Y\. Cheng, Y\. Liu, T\. Chen, and Q\. Yang\(2020\)Federated learning for privacy\-preserving ai\.Communications of the ACM63\(12\),pp\. 33–36\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p1.1)\.
- \[5\]T\. Li, A\. K\. Sahu, M\. Zaheer, M\. Sanjabi, A\. Talwalkar, and V\. Smith\(2020\)Federated optimization in heterogeneous networks\.Proceedings of Machine learning and systems2,pp\. 429–450\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p1.1),[§III\-A](https://arxiv.org/html/2608.25133#S3.SS1.p1.1)\.
- \[6\]M\. Fang, X\. Cao, J\. Jia, and N\. Z\. Gong\(2020\)Local model poisoning attacks to byzantine\-robust federated learning\.InProceedings of the 29th USENIX Security Symposium \(USENIX Security\),pp\. 1623–1640\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[7\]G\. Baruch, M\. Baruch, and Y\. Goldberg\(2019\)A little is enough: circumventing defenses for distributed learning\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.32,pp\. 8635–8645\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[8\]G\. Sun, Y\. Cong, J\. Dong, Q\. Wang, L\. Lyu, and J\. Liu\(2022\)Data poisoning attacks on federated machine learning\.IEEE Internet of Things Journal9\(13\),pp\. 11365–11375\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[9\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InProceedings of the International Conference on Machine Learning \(ICML\),pp\. 5650–5659\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[10\]R\. Guerraouiet al\.\(2018\)The hidden vulnerability of distributed learning in byzantium\.InProceedings of the International Conference on Machine Learning \(ICML\),pp\. 3521–3530\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[11\]S\. Wang, R\. Sahay, and C\. G\. Brinton\(2023\)How potent are evasion attacks for poisoning federated learning\-based signal classifiers?\.arXiv preprint arXiv:2301\.08866\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[12\]Z\. Xiong, W\. Li, Y\. Li, and Z\. Cai\(2023\)Exact\-fun: an exact and efficient federated unlearning approach\.In2023 IEEE International Conference on Data Mining \(ICDM\),pp\. 1439–1444\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[13\]T\. Kim, S\. Singh, N\. Madaan, and C\. Joe\-Wong\(2023\)PFedDef: characterizing evasion attack transferability in federated learning\.Software Impacts15,pp\. 100469\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1),[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[14\]V\. Shejwalkar and A\. Houmansadr\(2021\)Manipulating the byzantine: optimizing model poisoning attacks and defenses for federated learning\.InNDSS,Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[15\]L\. Chen, H\. Wang, Z\. Charles, and D\. Papailiopoulos\(2018\)Draco: byzantine\-resilient distributed training via redundant gradients\.InInternational Conference on Machine Learning,pp\. 903–912\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[16\]Z\. Xiong, W\. Li, and Z\. Cai\(2024\)Appro\-fun: approximate machine unlearning in federated setting\.In2024 33rd International Conference on Computer Communications and Networks \(ICCCN\),pp\. 1–9\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[17\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InInternational Conference on Machine Learning,pp\. 5650–5659\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[18\]K\. Bonawitz, H\. Eichner, W\. Grieskamp, D\. Huba, A\. Ingerman, V\. Ivanov, C\. Kiddon, J\. Konečnỳ, S\. Mazzocchi, B\. McMahan,et al\.\(2019\)Towards federated learning at scale: system design\.Proceedings of machine learning and systems1,pp\. 374–388\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[19\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.Advances in neural information processing systems30\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[20\]Q\. Xia, Z\. Tao, Z\. Hao, and Q\. Li\(2019\)FABA: an algorithm for fast aggregation against byzantine attacks in distributed neural networks\.InIJCAI,Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[21\]X\. Cao, M\. Fang, J\. Liu, and N\. Z\. Gong\(2020\)Fltrust: byzantine\-robust federated learning via trust bootstrapping\.arXiv preprint arXiv:2012\.13995\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[22\]C\. Xie, S\. Koyejo, and I\. Gupta\(2019\)Zeno: distributed stochastic gradient descent with suspicion\-based fault\-tolerance\.InInternational Conference on Machine Learning,pp\. 6893–6901\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[23\]F\. Sattler, K\. Müller, T\. Wiegand, and W\. Samek\(2020\)On the byzantine robustness of clustered federated learning\.InICASSP 2020\-2020 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 8861–8865\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[24\]K\. Pillutla, S\. M\. Kakade, and Z\. Harchaoui\(2022\)Robust aggregation for federated learning\.IEEE Transactions on Signal Processing70,pp\. 1142–1154\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[25\]V\. Shejwalkar, A\. Houmansadr, P\. Kairouz, and D\. Ramage\(2022\)Back to the drawing board: a critical evaluation of poisoning attacks on production federated learning\.In2022 IEEE Symposium on Security and Privacy \(SP\),pp\. 1354–1371\.Cited by:[§I](https://arxiv.org/html/2608.25133#S1.p2.1)\.
- \[26\]B\. Hitaj, G\. Ateniese, and F\. Perez\-Cruz\(2017\)Deep models under the gan: information leakage from collaborative deep learning\.InProceedings of the ACM SIGSAC Conference on Computer and Communications Security \(CCS\),pp\. 603–618\.Cited by:[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[27\]C\. Fuet al\.\(2022\)Label inference attacks against vertical federated learning\.InProceedings of the 31st USENIX Security Symposium \(USENIX Security\),pp\. 1397–1414\.Cited by:[§II\-A](https://arxiv.org/html/2608.25133#S2.SS1.p1.1)\.
- \[28\]Y\. Jianget al\.\(2023\)Model pruning enables efficient federated learning on edge devices\.IEEE Transactions on Neural Networks and Learning Systems34\(12\),pp\. 10374–10386\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[29\]S\. Liu, G\. Yu, R\. Yin, and J\. Yuan\(2021\)Adaptive network pruning for wireless federated learning\.IEEE Wireless Communications Letters10\(7\),pp\. 1572–1576\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[30\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.InAdvances in Neural Information Processing Systems \(NeurIPS\),pp\. 118–128\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[31\]T\. Su, M\. Wang, and Z\. Wang\(2021\)Federated regularization learning: an accurate and safe method for federated learning\.InProceedings of the IEEE 3rd International Conference on Artificial Intelligence Circuits and Systems \(AICAS\),pp\. 1–4\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[32\]X\. Jiang, S\. Sun, Y\. Wang, and M\. Liu\(2022\)Towards federated learning against noisy labels via local self\-regularization\.InProceedings of the 31st ACM International Conference on Information and Knowledge Management \(CIKM\),pp\. 862–873\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[33\]Z\. Chenet al\.\(2022\)Contractible regularization for federated learning on non\-iid data\.InProceedings of the IEEE International Conference on Data Mining \(ICDM\),pp\. 61–70\.Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[34\]G\. Zizzo, A\. Rawat, M\. Sinn, and B\. Büsser\(2020\)FAT: federated adversarial training\.Note:arXiv preprintExternal Links:2012\.01791Cited by:[§II\-B](https://arxiv.org/html/2608.25133#S2.SS2.p1.1)\.
- \[35\]K\. Wei, J\. Li, M\. Ding, C\. Ma, H\. H\. Yang, F\. Farokhi, S\. Jin, T\. Q\. Quek, and H\. V\. Poor\(2020\)Federated learning with differential privacy: algorithms and performance analysis\.IEEE Transactions on Information Forensics and Security15,pp\. 3454–3469\.Cited by:[1st item](https://arxiv.org/html/2608.25133#S3.I1.i1.p1.1),[2nd item](https://arxiv.org/html/2608.25133#S3.I1.i2.p1.1)\.
- \[36\]R\. Hu, Y\. Guo, E\. P\. Ratazzi, and Y\. Gong\(2020\)Differentially private federated learning for resource\-constrained internet of things\.arXiv preprint arXiv:2003\.12705\.Cited by:[1st item](https://arxiv.org/html/2608.25133#S3.I1.i1.p1.1)\.
- \[37\]X\. Li, K\. Huang, W\. Yang, S\. Wang, and Z\. Zhang\(2019\)On the convergence of fedavg on non\-iid data\.arXiv preprint arXiv:1907\.02189\.Cited by:[2nd item](https://arxiv.org/html/2608.25133#S3.I1.i2.p1.1)\.
- \[38\]Y\. Guo, Q\. Li, and H\. Chen\(2020\)Backpropagating linearly improves transferability of adversarial examples\.Advances in neural information processing systems33,pp\. 85–95\.Cited by:[§III\-B](https://arxiv.org/html/2608.25133#S3.SS2.p3.1)\.
- \[39\]I\. J\. Goodfellow, J\. Shlens, and C\. Szegedy\(2014\)Explaining and harnessing adversarial examples\.arXiv preprint arXiv:1412\.6572\.Cited by:[§III\-B](https://arxiv.org/html/2608.25133#S3.SS2.p3.1),[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p2.1),[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p4.1)\.
- \[40\]A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu\(2017\)Towards deep learning models resistant to adversarial attacks\.arXiv preprint arXiv:1706\.06083\.Cited by:[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p2.1),[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p4.1)\.
- \[41\]N\. Carlini and D\. Wagner\(2017\)Towards evaluating the robustness of neural networks\.In2017 ieee symposium on security and privacy \(sp\),pp\. 39–57\.Cited by:[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p2.1),[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p4.1)\.
- \[42\]C\. Szegedy, W\. Zaremba, I\. Sutskever, J\. Bruna, D\. Erhan, I\. Goodfellow, and R\. Fergus\(2013\)Intriguing properties of neural networks\.arXiv preprint arXiv:1312\.6199\.Cited by:[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p2.1)\.
- \[43\]J\. Su, D\. V\. Vargas, and K\. Sakurai\(2019\)One pixel attack for fooling deep neural networks\.IEEE Transactions on Evolutionary Computation23\(5\),pp\. 828–841\.Cited by:[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p4.1)\.
- \[44\]C\. Xie, Z\. Zhang, Y\. Zhou, S\. Bai, J\. Wang, Z\. Ren, and A\. L\. Yuille\(2019\)Improving transferability of adversarial examples with input diversity\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 2730–2739\.Cited by:[§IV\-A](https://arxiv.org/html/2608.25133#S4.SS1.p4.1)\.
- \[45\]X\. Liu, T\. Hu, P\. Yi, Q\. Pan, H\. Ma, Y\. Jiang, and B\. Li\(2025\)Defending against transfer\-based adversarial attacks using svd\-driven feature evolution\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\) Workshops,Cited by:[§V\-A](https://arxiv.org/html/2608.25133#S5.SS1.p1.1),[§V](https://arxiv.org/html/2608.25133#S5.p1.1)\.
- \[46\]Z\. Xiong, Z\. Cai, D\. Takabi, and W\. Li\(2021\)Privacy threat and defense for federated learning with non\-iid data in aiot\.IEEE Transactions on Industrial Informatics18\(2\),pp\. 1310–1321\.Cited by:[§V\-B](https://arxiv.org/html/2608.25133#S5.SS2.p1.1)\.