Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning

# Selection-Aware Backdoor Attacks in Federated LearningThis work was accepted and presented at the 2026 International Conference on Intelligent Multimedia, Networking, and Security (IMNS 2026).
Source: [https://arxiv.org/html/2608.06637](https://arxiv.org/html/2608.06637)
###### Abstract

Robust aggregation methods are widely used in federated learning to mitigate the impact of adversarial client behavior\. Distance\-based aggregation rules, such as Krum and Multi\-Krum, select updates that are closest to the majority under the assumption that benign updates form a compact cluster\. However, these methods rely on geometric properties that can be exploited by adaptive adversaries\. We introduce the Krum\-Proxy attack, a selection\-aware backdoor injection strategy that consistently bypasses Byzantine\-robust aggregation\. Rather than relying on naive scaling or constraining, our method actively optimizes malicious updates to infiltrate the dense core of the benign distribution\. The proposed method constructs adversarial updates that are not only similar to benign updates but are also optimized to lie in regions of the update space that are favored during aggregation\. This is achieved through a two\-stage optimization procedure that separates task\-specific attack objectives from geometry\-aware refinement, using a nearest\-neighbor proxy, stochastic reference modeling, and anchor\-guided alignment\. To maintain stealth, we introduce a projection mechanism that constrains adversarial updates within realistic norm and variance bounds\. Experiments on standard federated learning benchmarks show that Krum\-Proxy achieves higher attack success while preserving clean accuracy, highlighting the vulnerability of distance\-based aggregation to selection\-aware adversaries\.

## IIntroduction

Federated Learning \(FL\) enables collaborative model training across decentralized data sources while preserving data privacy\[[11](https://arxiv.org/html/2608.06637#bib.bib11)\]\. However, the server relies on client\-provided updates without direct access to local data, making it vulnerable to adversarial manipulation\.

Model poisoning and backdoor attacks are among the most critical threats in FL, where malicious clients inject carefully crafted updates to manipulate the global model while maintaining a benign appearance\[[3](https://arxiv.org/html/2608.06637#bib.bib3)\]\. These attacks can embed targeted behaviors that are triggered only under specific inputs, making them difficult to detect\. To mitigate such threats, Byzantine\-resilient methods such as Krum and Multi\-Krum have been proposed\[[1](https://arxiv.org/html/2608.06637#bib.bib1)\]\. These methods select updates closest to the majority based on pairwise distances, assuming benign updates form a compact cluster\.

Despite their theoretical guarantees, Krum\-based defenses are vulnerable to adaptive adversaries\. Prior work has shown that malicious updates can be crafted to mimic the statistical properties of benign updates, allowing them to bypass distance\-based filtering\[[4](https://arxiv.org/html/2608.06637#bib.bib4),[5](https://arxiv.org/html/2608.06637#bib.bib5)\]\. Since Krum relies on a single scalar distance over the entire model update, it fails to capture structured deviations across layers\[[2](https://arxiv.org/html/2608.06637#bib.bib2),[4](https://arxiv.org/html/2608.06637#bib.bib4)\], allowing adversarial signals to remain hidden\.

Our work differs from previous Krum\-aware and optimization\-based attacks\[[5](https://arxiv.org/html/2608.06637#bib.bib5),[15](https://arxiv.org/html/2608.06637#bib.bib15),[16](https://arxiv.org/html/2608.06637#bib.bib16)\]by reducing the attacker’s dependence on real\-time benign updates while still explicitly targeting the geometry used by Krum\-style aggregation\. The attack uses attacker\-local stochastic references to approximate benign update structure, optimizes a differentiable proxy of Krum’s neighborhood score, and separates backdoor injection from geometry shaping through a two\-stage schedule\. Our contributions are as follows\.

- •Selection\-aware attack formulation for Krum\-based aggregation:We propose*Krum\-Proxy*, a targeted backdoor attack that explicitly optimizes for the selection rule of Krum, rather than relying only on norm matching, scaling, or directional constraints\. The attack uses a differentiable approximation of Krum scoring constructed from attacker\-local reference updates\.
- •Stochastic Reference Construction:We introduce a stochastic reference modeling strategy that approximates benign update geometry using attacker\-trained clean deltas with varied training conditions\. This captures benign variability and enables local estimation of neighborhood structure for Krum scoring without access to real client updates\.
- •Two\-Stage Optimization:We develop a two\-stage optimization procedure that separates \(i\) backdoor injection with cross\-entropy loss from \(ii\) geometry shaping through norm matching, proxy distance, and anchor losses with a reduced learning rate\. This decoupling prevents competing objectives from interfering with early backdoor convergence and enables stable selection\-aware refinement in the second stage\.
- •Anchor\-Guided Alignment and Projection:We introduce an anchor\-guided alignment and projection mechanism that steers adversarial updates toward high\-density benign regions while preserving the backdoor signal through controlled norm and direction constraints\.
- •Comprehensive Empirical Validation:Experiments demonstrate that Krum\-Proxy achieves higher and more stable attack success than scaling\-based and constrain\-and\-scale baselines while maintaining competitive clean accuracy\. We also report malicious selection and inclusion rates, directly validating that the attack improves aggregation\-level evasion\.

## IIRelated Work

The standard FL aggregation method, FedAvg, is efficient but highly vulnerable to adversarial manipulation, as malicious clients can arbitrarily influence the global model\[[3](https://arxiv.org/html/2608.06637#bib.bib3)\]\. To address this, Byzantine\-robust aggregation rules such as Krum and Multi\-Krum were proposed, which select updates closest to the majority based on pairwise distances\[[1](https://arxiv.org/html/2608.06637#bib.bib1)\]\.

However, prior work has shown that distance\-based aggregation degrades in heterogeneous and high\-dimensional settings, weakening its robustness guarantees in practice\[[2](https://arxiv.org/html/2608.06637#bib.bib2),[9](https://arxiv.org/html/2608.06637#bib.bib9),[10](https://arxiv.org/html/2608.06637#bib.bib10)\]\. Alternative aggregation methods attempt to mitigate these issues, but still rely on assumptions that adversaries can exploit\[[13](https://arxiv.org/html/2608.06637#bib.bib13),[14](https://arxiv.org/html/2608.06637#bib.bib14)\]\.

Model poisoning attacks exploit this vulnerability by directly manipulating client updates during training\. Early work demonstrated that adversaries can induce targeted misbehavior or degrade model performance even with limited control\[[7](https://arxiv.org/html/2608.06637#bib.bib7),[15](https://arxiv.org/html/2608.06637#bib.bib15)\]\. Backdoor attacks further increase stealth by embedding malicious behaviors that are triggered only with specific input\. Bagdasaryan et al\.\[[3](https://arxiv.org/html/2608.06637#bib.bib3)\]introduced the Constrain\-and\-Scale attack, which jointly optimizes attack success and stealth through norm and direction constraints\. Subsequent work showed that such attacks can persist across rounds and remain effective with partial participation\[[8](https://arxiv.org/html/2608.06637#bib.bib8),[17](https://arxiv.org/html/2608.06637#bib.bib17)\]\. Distributed attacks, such as DBA\[[6](https://arxiv.org/html/2608.06637#bib.bib6)\], further improve robustness by splitting the attack across multiple clients\.

Building on this, Baruch et al\.\[[4](https://arxiv.org/html/2608.06637#bib.bib4)\]demonstrated that small but carefully aligned perturbations can bypass defenses by exploiting benign variance\. Fang et al\.\[[5](https://arxiv.org/html/2608.06637#bib.bib5)\]proposed local poisoning attacks that explicitly target aggregation rules such as Krum\. Shejwalkar and Houmansadr\[[16](https://arxiv.org/html/2608.06637#bib.bib16)\]further formulated poisoning as an optimization problem, allowing attackers to systematically adapt to defense mechanisms\.

Krum\-Proxy differs from these aggregation\-aware attacks in both access assumptions and optimization structure\. Fang et al\.\[[5](https://arxiv.org/html/2608.06637#bib.bib5)\]directly target Byzantine\-robust aggregation, but rely on knowledge of the update population when optimizing against the aggregation rule\. Shejwalkar et al\.\[[16](https://arxiv.org/html/2608.06637#bib.bib16)\]formulate defense\-aware poisoning through MinMax and MinSum objectives, but these objectives impose global distance constraints rather than a local proxy of Krum’s nearest\-neighbor selection\. In contrast, Krum\-Proxy constructs attacker\-local stochastic references, derives a differentiable proxy Krum score from their inner neighborhood, and applies it after a separate backdoor injection stage\.

## IIIProposed Method: Selection\-Aware Two\-Stage Krum\-Proxy Attack

We propose a geometry\-aware model poisoning attack that explicitly targets the selection mechanism of Krum and Multi\-Krum\. The attack consists of three components: \(i\) stochastic reference construction, \(ii\) two\-stage adversarial optimization, and \(iii\) projection\-based stealth enforcement\.

### III\-AThreat Model

We assume a gray\-box adversary controllingffout ofNNclients \(f<N/2f<N/2\)\. The attacker knows that the server uses Krum or Multi\-Krum, but does not observe benign client updates or server\-side scores at attack time\. The attacker has labeled local data drawn from a distribution comparable to benign clients, with target\-task label coverage sufficient for backdoor training and clean reference construction\. In our implementation, the attacker reconstructsR=6R=6stochastic references per attack round and usesE1=E2=1E\_\{1\}=E\_\{2\}=1additional local epochs for the two attack stages\. The goal is to induce a target label on the triggered inputs while maintaining clean accuracy\.

1

Input :Global model

wtw\_\{t\}; local data

𝒟\\mathcal\{D\}; reference set

\{Δr\}r=1R\\\{\\Delta\_\{r\}\\\}\_\{r=1\}^\{R\}; local benign delta

Δloc\\Delta\_\{\\text\{loc\}\}
Param :

η\\eta,

E1E\_\{1\},

E2E\_\{2\},

kk,

\(λl,λn,λk,λa\)\(\\lambda\_\{l\},\\lambda\_\{n\},\\lambda\_\{k\},\\lambda\_\{a\}\), clip

τ=5\.0\\tau\{=\}5\.0
Output :Adversarial model

wadvw\_\{\\text\{adv\}\}
2

31ex

//Anchor construction

4

sr←1k​∑j∈𝒩k​\(r\)‖Δr−Δj‖2,∀rs\_\{r\}\\leftarrow\\frac\{1\}\{k\}\\\!\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\(r\)\}\\\|\\Delta\_\{r\}\-\\Delta\_\{j\}\\\|^\{2\},\\ \\forall r
5

\(1\),\(2\)←arg⁡sortr​sr\(1\),\(2\)\\leftarrow\\arg\\text\{sort\}\_\{r\}\\,s\_\{r\}\(top\-two lowest\)

6

Δanchor←0\.85​Δ\(1\)\+0\.15​Δ\(2\)\\Delta\_\{\\text\{anchor\}\}\\leftarrow 0\.85\\,\\Delta\_\{\(1\)\}\+0\.15\\,\\Delta\_\{\(2\)\}
7

81ex

//Stage 1: Backdoor injection

9

w←wtw\\leftarrow w\_\{t\}
10for*e=1e=1toE1E\_\{1\}*do

11foreach*mixed batch\(x,y\)\(x,y\)of clean \+ trigger\-poisoned samples*do

12

g←∇wℒCE​\(fw​\(x\),y\)g\\leftarrow\\nabla\_\{w\}\\mathcal\{L\}\_\{\\text\{CE\}\}\(f\_\{w\}\(x\),y\)
13clip

‖g‖≤τ\\\|g\\\|\\leq\\tau;

w←SGD​\(w,g,η,μ=0\.9\)w\\leftarrow\\text\{SGD\}\(w,g,\\eta,\\mu\{=\}0\.9\)
14

15

16

171ex

//Stage 2: Geometry shaping

18for*e=1e=1toE2E\_\{2\}*do

19foreach*mixed batch\(x,y\)\(x,y\)*do

20

Δadv←w−wt\\Delta\_\{\\text\{adv\}\}\\leftarrow w\-w\_\{t\}
21

dj←‖Δadv−Δj‖2d\_\{j\}\\leftarrow\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{j\}\\\|^\{2\}
22

𝒩←top\-​k​\(\{dj\},smallest\)\\mathcal\{N\}\\leftarrow\\text\{top\-\}k\\,\(\\\{d\_\{j\}\\\},\\,\\text\{smallest\}\)
23

ℒkrum←1⌊k/2⌋​∑j∈𝒩⁣\[:⌊k/2⌋\]dj\\mathcal\{L\}\_\{\\text\{krum\}\}\\leftarrow\\frac\{1\}\{\\lfloor k/2\\rfloor\}\\sum\_\{j\\in\\mathcal\{N\}\[:\\lfloor k/2\\rfloor\]\}d\_\{j\}
24

ℒnorm←\(‖Δadv‖−‖Δloc‖\)2\\mathcal\{L\}\_\{\\text\{norm\}\}\\leftarrow\(\\\|\\Delta\_\{\\text\{adv\}\}\\\|\-\\\|\\Delta\_\{\\text\{loc\}\}\\\|\)^\{2\}
25

ℒanchor←‖Δadv−Δanchor‖2\\mathcal\{L\}\_\{\\text\{anchor\}\}\\leftarrow\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{\\text\{anchor\}\}\\\|^\{2\}
26

ℒ←λl​ℒCE\+λn​ℒnorm\+λk​ℒkrum\+λa​ℒanchor\\mathcal\{L\}\\leftarrow\\lambda\_\{l\}\\mathcal\{L\}\_\{\\text\{CE\}\}\+\\lambda\_\{n\}\\mathcal\{L\}\_\{\\text\{norm\}\}\+\\lambda\_\{k\}\\mathcal\{L\}\_\{\\text\{krum\}\}\+\\lambda\_\{a\}\\mathcal\{L\}\_\{\\text\{anchor\}\}
27

g←∇wℒg\\leftarrow\\nabla\_\{w\}\\mathcal\{L\}; clip

‖g‖≤τ\\\|g\\\|\\leq\\tau
28

w←SGD​\(w,g,0\.5​η,μ=0\.9\)w\\leftarrow\\text\{SGD\}\(w,g,0\.5\\eta,\\mu\{=\}0\.9\)
29

30

31

321ex

//Projection

33

Δadv←w−wt\\Delta\_\{\\text\{adv\}\}\\leftarrow w\-w\_\{t\}
34

σref←stdr​‖Δr−Δ¯ref‖\\sigma\_\{\\text\{ref\}\}\\leftarrow\\text\{std\}\_\{r\}\\,\\\|\\Delta\_\{r\}\-\\bar\{\\Delta\}\_\{\\text\{ref\}\}\\\|
35if*‖Δ*adv*−Δ\(1\)‖\>σ*ref*\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{\(1\)\}\\\|\>\\sigma\_\{\\text\{ref\}\}*then

36

α←clip​\(‖Δadv−Δ\(1\)‖−σref‖Δadv−Δ\(1\)‖,0,0\.75\)\\alpha\\leftarrow\\mathrm\{clip\}\\\!\\left\(\\tfrac\{\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{\(1\)\}\\\|\-\\sigma\_\{\\text\{ref\}\}\}\{\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{\(1\)\}\\\|\},\\,0,\\,0\.75\\right\)
37

Δadv←\(1−α\)​Δadv\+α​Δ\(1\)\\Delta\_\{\\text\{adv\}\}\\leftarrow\(1\{\-\}\\alpha\)\\Delta\_\{\\text\{adv\}\}\+\\alpha\\Delta\_\{\(1\)\}
38

39

‖Δ‖target←max⁡\(‖Δ‖med,0\.5​‖Δloc‖\)\\\|\\Delta\\\|\_\{\\text\{target\}\}\\leftarrow\\max\(\\\|\\Delta\\\|\_\{\\text\{med\}\},\\,0\.5\\\|\\Delta\_\{\\text\{loc\}\}\\\|\)
40

Δadv←Δadv⋅‖Δ‖target/‖Δadv‖\\Delta\_\{\\text\{adv\}\}\\leftarrow\\Delta\_\{\\text\{adv\}\}\\cdot\\\|\\Delta\\\|\_\{\\text\{target\}\}/\\\|\\Delta\_\{\\text\{adv\}\}\\\|
41return

wadv=wt\+Δadvw\_\{\\text\{adv\}\}=w\_\{t\}\+\\Delta\_\{\\text\{adv\}\}
42

Algorithm 1Selection\-Aware Two\-Stage Krum\-Proxy Attack
### III\-BProblem Setup

Letwtw\_\{t\}denote the global model in roundttandΔi=wi−wt\\Delta\_\{i\}=w\_\{i\}\-w\_\{t\}the local update of clientii\. Krum selects the update minimizing the average squared distance to itskknearest neighbors:

score​\(Δi\)=1k​∑j∈𝒩k​\(i\)‖Δi−Δj‖2\\text\{score\}\(\\Delta\_\{i\}\)=\\frac\{1\}\{k\}\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\(i\)\}\\\|\\Delta\_\{i\}\-\\Delta\_\{j\}\\\|^\{2\}\(1\)Multi\-Krum selects themmupdates with the lowest scores and averages them\. The adversary seeks an updateΔadv\\Delta\_\{\\text\{adv\}\}that preserves the effectiveness of the backdoor while minimizing this score to maximize the probability of selection\.

### III\-CStochastic Reference Construction

The adversary constructs a reference set\{Δr\}r=1R\\\{\\Delta\_\{r\}\\\}\_\{r=1\}^\{R\}by trainingRRclean models on disjoint partitions of its accessible data, starting fromwtw\_\{t\}\. To capture benign heterogeneity, each reference uses an independently sampled learning rateηr∼𝒰​\[ηmin,ηmax\]\\eta\_\{r\}\\sim\\mathcal\{U\}\[\\eta\_\{\\min\},\\eta\_\{\\max\}\]and a local epoch countEr∼𝒰​\{Emin,…,Emax\}E\_\{r\}\\sim\\mathcal\{U\}\\\{E\_\{\\min\},\\dots,E\_\{\\max\}\\\}\. The set is reconstructed each round to track the evolving global model weightswtw\_\{t\}\. From it we derive the centroidΔ¯ref\\bar\{\\Delta\}\_\{\\text\{ref\}\}, spreadσref=stdr​‖Δr−Δ¯ref‖\\sigma\_\{\\text\{ref\}\}=\\text\{std\}\_\{r\}\\\|\\Delta\_\{r\}\-\\bar\{\\Delta\}\_\{\\text\{ref\}\}\\\|, and median norm‖Δ‖med=medianr​‖Δr‖\\\|\\Delta\\\|\_\{\\text\{med\}\}=\\text\{median\}\_\{r\}\\\|\\Delta\_\{r\}\\\|, all of which are used in subsequent stages\. The training anchor is constructed once asΔanchor=0\.85​Δ\(1\)\+0\.15​Δ\(2\)\\Delta\_\{\\text\{anchor\}\}=0\.85\\Delta\_\{\(1\)\}\+0\.15\\Delta\_\{\(2\)\}, whereΔ\(1\),Δ\(2\)\\Delta\_\{\(1\)\},\\Delta\_\{\(2\)\}are the two references with the lowest Krum scores on the reference set itself\. We use a blended anchor rather than strictly adhering to the single optimal referenceΔ\(1\)\\Delta\_\{\(1\)\}\. The0\.850\.85/0\.150\.15blend keeps the anchor close to the lowest\-score reference while using the second\-lowest reference to smooth the gradient and reduce overfitting to an isolated trajectory\.

### III\-DKrum\-Proxy Objective

True Krum scores require observing other clients’ updates and are unavailable to the adversary\. We approximate them using the reference set: for candidateΔadv\\Delta\_\{\\text\{adv\}\}, we compute distances to all references and average the closest⌊k/2⌋\\lfloor k/2\\rflooramong the nearest top\-kkneighbors \(Algorithm[1](https://arxiv.org/html/2608.06637#alg1), lines 14–15\)\. The two\-step structure focuses on optimizing the densest benign neighborhood while preserving differentiability through selection\. Unlike MinMax/MinSum\[[16](https://arxiv.org/html/2608.06637#bib.bib16)\], which treat neighbors uniformly, and the method of Fang et al\.\[[5](https://arxiv.org/html/2608.06637#bib.bib5)\], which requires observing other clients’ updates and uses non\-differentiable line search, our proxy operates from a local reference set and supports gradient\-based joint optimization with the backdoor objective\. Although the proxy objective explicitly minimizes the Krum distance, this provides a strong approximation of selection likelihood under Multi\-Krum as well, since Multi\-Krum relaxes the selection criteria by averaging themmupdates with the lowest Krum scores\. Using only the inner half of the nearest neighbors emphasizes the densest reference region and the full\-kkablation in Section[V\-B](https://arxiv.org/html/2608.06637#S5.SS2)shows that averaging over more neighbors dilutes this signal and increases instability\.

### III\-ETwo\-Stage Optimization

Stage 1 \(Backdoor Injection\)trains forE1E\_\{1\}local epochs on mixed batches of clean and trigger\-poisoned samples under cross\-entropy loss alone with SGD \(η\\eta, momentum0\.90\.9\)\. Isolating the backdoor objective allows it to converge without competing gradient signals from the geometry losses, which have substantially smaller magnitudes early in training and would otherwise be suppressed \(confirmed by ablation in Section[V\-B](https://arxiv.org/html/2608.06637#S5.SS2)\)\.

Stage 2 \(Geometry Shaping\)trains forE2E\_\{2\}local epochs at half the learning rate under composite loss

ℒ=λl​ℒCE\+λn​ℒnorm\+λk​ℒkrum\+λa​ℒanchor,\\mathcal\{L\}=\\lambda\_\{l\}\\mathcal\{L\}\_\{\\text\{CE\}\}\+\\lambda\_\{n\}\\mathcal\{L\}\_\{\\text\{norm\}\}\+\\lambda\_\{k\}\\mathcal\{L\}\_\{\\text\{krum\}\}\+\\lambda\_\{a\}\\mathcal\{L\}\_\{\\text\{anchor\}\},\(2\)whereℒnorm=\(‖Δadv‖−‖Δloc‖\)2\\mathcal\{L\}\_\{\\text\{norm\}\}=\(\\\|\\Delta\_\{\\text\{adv\}\}\\\|\-\\\|\\Delta\_\{\\text\{loc\}\}\\\|\)^\{2\}matches the norm to a locally computed benign\-style delta andℒanchor=‖Δadv−Δanchor‖2\\mathcal\{L\}\_\{\\text\{anchor\}\}=\\\|\\Delta\_\{\\text\{adv\}\}\-\\Delta\_\{\\text\{anchor\}\}\\\|^\{2\}pulls the update towards the dense core\.\(λl,λn,λk,λa\)\(\\lambda\_\{l\},\\lambda\_\{n\},\\lambda\_\{k\},\\lambda\_\{a\}\)are scalar hyperparameters that balance the contributions of the corresponding components in the objective function\.

### III\-FProjection\-Based Stealth Enforcement

After Stage 2, a two\-step projection \(Algorithm[1](https://arxiv.org/html/2608.06637#alg1), lines 22–28\) enforces stealth without erasing the backdoor\. First, if the adversarial update deviates from the Krum\-optimal referenceΔ\(1\)\\Delta\_\{\(1\)\}by more thanσref\\sigma\_\{\\text\{ref\}\}, it is interpolated towardΔ\(1\)\\Delta\_\{\(1\)\}with the pull factor capped at0\.750\.75, keeping the update near the densest reference while preserving at least25%25\\%of the learned adversarial direction\. The projection uses a single Krum\-optimal reference rather than the blended training anchor because hard alignment at inference benefits from projecting to the densest single point, whereas the blend exists to provide a smoother gradient signal during training\. Second, the result is scaled again to the median benign norm with a floor at0\.5​‖Δloc‖0\.5\\\|\\Delta\_\{\\text\{loc\}\}\\\|, preventing collapse to trivially small updates that would erase the backdoor signal\.

## IVExperimental Setup

### IV\-AFederated Learning Architecture

We simulate a federated learning setup comprising a central server andN=100N=100clients, as illustrated in Fig\.[1](https://arxiv.org/html/2608.06637#S4.F1)\. In each round, a subset of 10 clients \(sampling fraction0\.10\.1\) is selected to perform local training\. The server aggregates updates using Krum and Multi\-Krum, where the number of Byzantine clients is set equal to the number of malicious clients per round, andk=n−f−2k=n\-f\-2is used for neighbor selection\. This ensures that the attack is evaluated under the maximum adversarial budget tolerated by Krum\.

![Refer to caption](https://arxiv.org/html/2608.06637v1/CIFAR.jpeg)Figure 1:Overview of the experimental federated learning architecture\.
### IV\-BDataset, Partitioning and Model

We evaluate the proposed attack on the CIFAR\-10, MNIST, and EMNIST datasets to assess performance across varying data modalities and complexities\. CIFAR\-10 is used as the primary benchmark, while MNIST and EMNIST provide additional evaluation on grayscale digit and character recognition tasks\. Each dataset is partitioned across clients using a Dirichlet distribution with concentration parameters ranging fromα=0\.3\\alpha=0\.3to0\.90\.9to simulate varying degrees of non\-IID data heterogeneity\. Each client performs an80/2080/20train\-test split \(seed = 42\)\. For CIFAR\-10, the training data is augmented using random cropping, horizontal flipping, and color jittering, while MNIST and EMNIST are used without augmentation\.

We use a lightweight ResNet architecture \(Tiny ResNet\-18\) with a base channel width of 8, resulting in approximately0\.270\.27M parameters\. This reduced model size enables efficient simulation while maintaining sufficient clean accuracy for the CIFAR\-10 classification\.

### IV\-CClient Training

Experiments are conducted over 100 communication rounds\. All methods are initialized from the same global model state at the beginning of the attack window\. This state is obtained after the initial benign FL rounds and corresponds to the normal global model available to clients when the attack begins\. All benign clients use SGD with momentum0\.90\.9, weight decay5×10−45\\times 10^\{\-4\}, and label smoothing0\.050\.05\. A cosine annealing learning rate scheduler is applied per training step for benign training\. The batch size is fixed at 64\. To model realistic client variability, learning rates and local epochs are randomly sampled\. For Krum\-Proxy, malicious clients use fixed learning rates and no label smoothing during attack optimization\. All attacks use the same client sampling procedure, malicious\-client budget, poison fraction, attack window, and attack\-start global model\. These hyperparameters were selected from preliminary tuning runs and then fixed across the reported Krum and Multi\-Krum evaluations\.

### IV\-DAttack Configuration

We use a trigger\-based targeted attack with target label 2, poison fraction 10%, 20 backdoor samples per batch, and 3 malicious clients per round, staying within Krum’s assumed Byzantine budget\.

We use\(λl,λn,λk,λa\)=\(0\.4,0\.1,0\.25,0\.05\)\(\\lambda\_\{l\},\\lambda\_\{n\},\\lambda\_\{k\},\\lambda\_\{a\}\)=\(0\.4,0\.1,0\.25,0\.05\)andE1=E2=1E\_\{1\}=E\_\{2\}=1, with gradient norm clipping atτ=5\.0\\tau=5\.0in both stages\. The same values are used across the reported Krum and Multi\-Krum evaluations\. The proposed attack is applied during local training using shared reference deltas \(R=6R=6\) constructed from partitions of the malicious clients sampled\. These references incorporate both inter\-client data heterogeneity and stochastic training variations\.

### IV\-EEvaluation Metrics

We centrally evaluated the global model after each communication round using clean model test accuracy \(MTA\) in the CIFAR\-10 test samples and attack success rate \(ASR\) in trigger\-poisoned CIFAR\-10 test samples, as shown in Fig\.[1](https://arxiv.org/html/2608.06637#S4.F1)\.

### IV\-FBaselines

We evaluate FedAvg, Krum, and Multi\-Krum aggregation, and compare the proposed attack with two poisoning baselines: Scaled Backdoor, which uniformly scales poisoned updates, and Constrain\-and\-Scale\[[3](https://arxiv.org/html/2608.06637#bib.bib3)\], which enforces norm and direction constraints for stealth\.

## VResults and Analysis

### V\-AAttack Effectiveness

Figures[2](https://arxiv.org/html/2608.06637#S5.F2)\(a\)\-\(d\) show ASR and MTA throughout training under Krum and Multi\-Krum\. The Scaled Backdoor baseline remains largely ineffective under robust aggregation, while Constrain\-and\-Scale achieves only partial and unstable evasion, particularly under Krum\. In contrast, the proposed Krum\-Proxy attack rapidly converges to high ASR under both defenses while maintaining competitive MTA throughout training, demonstrating that directly optimizing the aggregation selection objective enables consistent evasion without sacrificing model utility\. Table[II](https://arxiv.org/html/2608.06637#S5.T2)summarizes convergence and post\-convergence stability across methods and shows that Krum\-Proxy improves injection stability, enabling persistent attack success once selected rather than relying on intermittent reinjection\.

![Refer to caption](https://arxiv.org/html/2608.06637v1/ieee_final_clean_plot.png)Figure 2:Attack performance under robust aggregation\. \(a\) Attack success rate under Krum\. \(b\) Attack success rate under Multi\-Krum\. \(c\) Main task accuracy under Krum\. \(d\) Main task accuracy under Multi\-Krum\. Legends indicate different attack methods \(Scaled Backdoor, Constrain\-and\-Scale, and Krum\-Proxy\)TABLE I:Final Performance Summary After 100 Communication RoundsTABLE II:Post\-Convergence Persistence \(Krum\)MethodASR \(%\)RoundsASRRoundsMTAConstrain\-and\-Scale92\.2±\\pm13\.12411Krum\-Proxy98\.6±\\pm2\.8636RoundsASR: Number of rounds where ASR\>\>90%\.RoundsMTA: Number of rounds where MTA drops<<75%\.
### V\-BAblation Study

Table[III](https://arxiv.org/html/2608.06637#S5.T3)reports post\-convergence MTA stability, measured as the number of rounds with MTA below 75 after the attack first reaches ASR≥90\\geq 90, together with the average MTA and ASR across 100 communication rounds under Krum aggregation\. The results show that removing key components of our proposed method substantially degrades the optimization stability and attack reliability\.

TABLE III:Ablation analysis of Krum\-Proxy Components under Krum aggregation\.VariantAvg\. MTAAvg\. ASRMTA CrashKrum\-Proxy \(Full\)85\.6188\.073w/o Two\-Stage \(joint loss\)78\.7384\.8722w/oℒkrum\\mathcal\{L\}\_\{\\text\{krum\}\}80\.5986\.1717w/oℒanchor\\mathcal\{L\}\_\{\\text\{anchor\}\}\+ Projection86\.3981\.603Full\-kk\-Proxy \(kkneighbors\)82\.4382\.1012w/o Stochastic References81\.7676\.1214Avg\. MTA: Mean main task accuracy across all rounds;Avg\. ASR: Mean attack success rate across all rounds;MTA Crash: Post\-convergence rounds with MTA<75%<75\\%\.Eliminating the two\-stage optimization causes the most severe instability, producing 22 post\-convergence MTA crashes and reducing average MTA by 6\.88 percentage points\. This indicates that joint optimization disrupts early backdoor convergence due to competing gradients\. Removingℒkrum\\mathcal\{L\}\_\{\\text\{krum\}\}produces 17 post\-convergence crashes and lowers average ASR from 88\.07% to 86\.17%, indicating that without explicit proxy minimization the attack relies more heavily on projection and becomes less stable across rounds\.

Replacing stochastic reference construction with a single deterministic reference causes the largest ASR degradation overall, reducing average ASR to 76\.12%, delaying convergence until round 27, and producing 14 post\-convergence crashes\. This indicates that stochastic references are necessary to capture benign variability\. Using a full\-kk\-proxy instead of the proposed inner half\-kkaveraging results in 12 post\-convergence crashes and reduces round\-100 MTA to 68\.75%, demonstrating that averaging over all neighbors dilutes the optimization signal\.

Finally, removing anchor alignment and projection together yields the highest average MTA \(86\.39%\) and only 3 post\-convergence crashes, but reduces average ASR by 6\.47 percentage points and delays convergence by four rounds, indicating that these mechanisms primarily improve early\-round selection consistency rather than late\-round model stability\.

Under an MTA crash threshold of<60%<60\\%, the proposed full method exhibits zero catastrophic post\-convergence failures, while the single\-stage and no\-ℒkrum\\mathcal\{L\}\_\{\\text\{krum\}\}variants produce 10 and 7 such crashes, respectively\. For example, the single\-stage variant reaches 90% ASR but later falls to 27% MTA, showing that backdoor success can result in unusable clean\-task performance\.

### V\-CHeterogeneity Sensitivity

The results demonstrate that the proposed attack remains highly effective across varying levels of data heterogeneity as well\. Under mild heterogeneity \(α=0\.7\\alpha=0\.7\), the model achieves 90\.02% MTA with 99\.94% ASR\. As heterogeneity increases toα=0\.5\\alpha=0\.5, MTA slightly improves to 90\.68% while ASR remains high at 98\.02%\. Under strong heterogeneity \(α=0\.3\\alpha=0\.3\), MTA decreases to 87\.78%, but the attack continues to achieve a high ASR of 98\.20%, demonstrating robustness to non\-IID data distributions\.

### V\-DCross\-Dataset Generalization

To verify that the proposed attack is not specific to CIFAR\-10, we also evaluated it on MNIST and EMNIST in the same Krum\-based federated setting\. On MNIST, the attack similarly achieves rapid convergence, surpassing 90% ASR by round 18 and maintaining near\-perfect attack success thereafter while preserving high clean accuracy \(98\.99% final MTA, 99\.95% final ASR at round 100\)\. On EMNIST, which introduces greater class diversity and heterogeneity, the attack rapidly exceeds 90% ASR by Round 7 and maintains sustained high ASR \(\>98%\>98\\%\) while preserving stable model accuracy \(approximately 87 to 90% MTA\)\. These results demonstrate that our method remains effective even in more complex and heterogeneous data distributions\.

### V\-EGeneralization and Aggregation Evasion

Krum\-Proxy improves aggregation\-level evasion\. Under Krum, malicious selection increases from 9 to 29 rounds\. Under Multi\-Krum, malicious inclusion increases from 62/300 to 175/300 updates, raising the inclusion rate from 20\.7% to 58\.3%\.

To evaluate whether the attack transfers beyond Krum\-style aggregation, we also test the Trimmed Mean aggregation\. Krum\-Proxy remains effective, reaching 97\.65% final ASR with 94\.99% MTA and no MTA crashes below 75%\.

To evaluate sensitivity to the malicious\-client budget, we vary the number of malicious clients under Krum and Multi\-Krum\. Under Krum,11,22, and33malicious clients per round reach 98\.17%, 98\.21%, and 100% final ASR while maintaining 91\.79%, 86\.29%, and 91\.79% final MTA, respectively\. Under Multi\-Krum, the corresponding runs reach 99\.21%, 99\.84%, and 99\.74% final ASR while maintaining 89\.80%, 93\.96%, and 93\.09% final MTA\.

## VIDiscussions and Limitations

The proposed attack has some practical limitations\. Its effectiveness depends on the quality of locally constructed clean reference updates\. Under strong non\-IID settings or high client heterogeneity, these estimates may deviate from the true global distribution, reducing selection probability\. The attack is also sensitive to tightly clustered benign updates, where even small deviations can prevent selection despite maintaining overall stealth\. There is also a trade\-off between stealth and backdoor strength, as stronger geometric constraints improve selection but may weaken the attack signal\.

The proposed method is designed for Krum\-style distance\-based selection and does not explicitly optimize coordinate\-wise rules such as Median, Trimmed Mean, or Bulyan\.

The proposed attack also introduces additional computation due to reference construction and proxy\-based optimization and relies on local approximations of server\-side behavior, which may not fully capture the true aggregation dynamics\. Krum\-Proxy required1\.29×1\.29\\timesthe end\-to\-end runtime of Constrain\-and\-Scale in the CIFAR\-10 Krum setting, reflecting the cost of reference construction and proxy\-based refinement\.

These observations suggest that future defenses should incorporate richer signals beyond single\-round distance metrics, such as temporal consistency or structural analysis of updates, to better detect defense\-aware attacks\.

## VIIConclusion

This paper presents the Krum\-Proxy attack, a selection\-aware model poisoning strategy that bypasses Krum\-based robust aggregation by explicitly optimizing adversarial updates for favorable geometric placement under the aggregation rule\. Experimental results show that Krum\-Proxy substantially improves attack success and stability under Krum, while increasing malicious inclusion under Multi\-Krum and preserving competitive model utility\. These findings demonstrate that distance\-based robust aggregation remains vulnerable to adaptive adversaries that directly optimize the defender’s selection criterion\. Future work should explore defense mechanisms that incorporate richer signals beyond single\-round distance comparisons, such as temporal consistency or structural analysis of updates, to detect such attacks efficiently\.

## References

- \[1\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer, “Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent,” inAdvances in Neural Information Processing Systems \(NeurIPS\), 2017\.
- \[2\]E\. M\. El Mhamdi, R\. Guerraoui, and S\. Rouault, “The Hidden Vulnerability of Distributed Learning in Byzantium,” inProceedings of the 35th International Conference on Machine Learning \(ICML\), 2018\.
- \[3\]E\. Bagdasaryan, A\. Veit, Y\. Hua, D\. Estrin, and V\. Shmatikov, “How To Backdoor Federated Learning,” inProceedings of the 23rd International Conference on Artificial Intelligence and Statistics \(AISTATS\), 2020\.
- \[4\]T\. Baruch, G\. Baruch, and Y\. Goldberg, “A Little Is Enough: Circumventing Defenses for Distributed Learning,” inAdvances in Neural Information Processing Systems \(NeurIPS\), 2019\.
- \[5\]M\. Fang, X\. Cao, J\. Jia, and N\. Gong, “Local Model Poisoning Attacks to Byzantine\-Robust Federated Learning,” inProceedings of the 29th USENIX Security Symposium, 2020\.
- \[6\]C\. Xie, K\. Huang, P\.\-Y\. Chen, and B\. Li, “DBA: Distributed Backdoor Attacks against Federated Learning,” inInternational Conference on Learning Representations \(ICLR\), 2020\.
- \[7\]A\. Bhagoji, S\. Chakraborty, P\. Mittal, and S\. Calo, “Analyzing Federated Learning through an Adversarial Lens,” inProceedings of the 36th International Conference on Machine Learning \(ICML\), 2019\.
- \[8\]J\. Sun, A\. Kairouz, H\. B\. McMahan, and A\. Suresh, “Can You Really Backdoor Federated Learning?,” arXiv preprint arXiv:1911\.07963, 2019\.
- \[9\]Z\. Allen\-Zhu, Z\. Li, and Y\. Song, “Byzantine\-Resilient Non\-Convex Stochastic Gradient Descent,” inAdvances in Neural Information Processing Systems \(NeurIPS\), 2020\.
- \[10\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett, “Byzantine\-Robust Distributed Learning: Towards Optimal Statistical Rates,” inProceedings of the 35th International Conference on Machine Learning \(ICML\), 2018\.
- \[11\]H\. B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas, “Communication\-Efficient Learning of Deep Networks from Decentralized Data,” inProceedings of the 20th International Conference on Artificial Intelligence and Statistics \(AISTATS\), 2017\.
- \[12\]S\. M\. Karimireddy, L\. He, and M\. Jaggi, “Learning from History for Byzantine Robust Optimization,” inProceedings of the 36th International Conference on Machine Learning \(ICML\), 2019\.
- \[13\]K\. Pillutla, S\. M\. Kakade, and Z\. Harchaoui, “Robust Aggregation for Federated Learning,” inIEEE Transactions on Signal Processing, vol\. 70, pp\. 1142–1154, 2022\.
- \[14\]Z\. Wang, Z\. Charles, Z\. Zhang, G\. Joshi, and V\. Smith, “A Field Guide to Federated Optimization,” arXiv preprint arXiv:2107\.06917, 2021\.
- \[15\]M\. Tolpegin, S\. Truex, M\. E\. Gursoy, and L\. Liu, “Data Poisoning Attacks Against Federated Learning Systems,” inEuropean Symposium on Research in Computer Security \(ESORICS\), 2020\.
- \[16\]A\. Shejwalkar and V\. Houmansadr, “Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning,” inProceedings of the Network and Distributed System Security Symposium \(NDSS\), 2021\.
- \[17\]J\. Wang, H\. Liu, and N\. Gong, “Attack of the Tails: Yes, You Really Can Backdoor Federated Learning,” inAdvances in Neural Information Processing Systems \(NeurIPS\), 2020\.