Pith. sign in

REVIEW 3 major objections 7 minor 1 cited by

DMPA: Model Poisoning Attacks on Decentralized Federated Learning for Model Differences

T0 review · 3 major / 7 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A colluding group of malicious clients can break decentralized federated learning using only its own models, by computing the principal eigenvector of their correlations and using it to craft poisoned updates.

desk verdict The paper's own Table 1 contradicts its claim that DMPA consistently beats existing attacks; the spectral idea is worth a look but the evaluation doesn't hold up. read the letter →

arxiv 2502.04771 v1 pith:YWMAHAZ4 submitted 2025-02-07 cs.LG cs.AI

Chao Feng , Yunlong Li , Yuanzhe Gao , Alberto Huertas Celdrán , Jan von der Assen , Gérôme Bovet , Burkhard Stiller This is my paper · ORCID
classification cs.LGcs.AI
keywords decentralizedfederatedlearningmodelpoisoningattackcollusivecorrelationmatrixeigenvectorrobustaggregationByzantinerobustnessadversarialmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that decentralized federated learning (DFL), where clients exchange and aggregate models directly with peers instead of through a central server, is vulnerable to a powerful new model poisoning attack called DMPA. DMPA has malicious clients collude using only their own model updates, with no knowledge of benign clients' models, aggregation rules, or global state. The attack computes the correlation matrix of the malicious updates, takes the eigenvector of the maximum eigenvalue as an optimal poisoning direction, negates the original updates, and adds a projection onto that direction, keeping only the top 10 percent of parameters. The authors report that this consistently produces the lowest benign-client F1 scores compared with state-of-the-art attacks (LIE, Min-Max, Min-Sum) across three datasets, three overlay topologies, and four aggregation rules including robust ones like Krum and Median. If true, this matters because DFL is often promoted as more robust than centralized FL, and this attack shows a practical, knowledge-light way to undermine that robustness.

What carries the argument

The central object is the principal eigenvector of the correlation matrix of the malicious clients' model updates, which the paper treats as the 'optimal poisoning direction' (also called the angle bias vector). The machinery centers the updates, computes the covariance matrix, normalizes by standard deviations to obtain a correlation matrix, extracts the eigenvector for the largest eigenvalue, and uses it to compute a projection $P = (y_{\max}^\top U) y_{\max}$. The crafted update is $U_{\text{new}} = -U + P$, and a mask keeps the top 10 percent of squared parameters to preserve the attack after averaging; the eigenvector is asserted, without proof, to be the direction that maximally increases benign loss after aggregation.

What would settle it

Take one of the reported configurations, such as CIFAR-10 with FedAvg in a fully connected topology and 40 percent malicious clients, and rerun DMPA with the projection onto the maximum-eigenvalue eigenvector replaced by a projection onto a random unit vector or onto the minimum-eigenvalue eigenvector; if the benign F1 drop is essentially unchanged, the principal-direction claim is not what carries the attack.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that a decentralized model poisoning attack called DMPA outperforms existing federated-learning poisoning attacks by exploiting the correlation structure among colluding malicious models. The procedure takes the malicious updates as a matrix, centers them, forms a covariance matrix, normalizes to a correlation matrix, and extracts the eigenvector associated with the largest eigenvalue; this eigenvector is asserted to be the optimal poisoning direction. Each malicious update is then set to the negation of the original update plus the projection of that update onto this eigenvector, and finally only the top 10 percent of parameters by squared magnitude are retained, with the rest replaced by the mean vector. The authors report that in their experiments DMPA achieves the lowest average F1 scores for benign clients in almost every tested configuration, including under FedAvg, Krum, Trimmed Mean, and Median aggregation, across fully connected, ring, and star topologies, and for malicious-client ratios from 10 to 60 percent.

Load-bearing premise

The attack's whole force rests on an unproven bet: that the direction in which the attackers' own model updates differ most is also the direction that most damages the honest models after averaging, and if that bet fails the attack reduces to a random or arbitrary perturbation.

Editorial extensions

If this is right

  • If DMPA works as reported, a DFL network with a modest fraction of colluding clients can be severely degraded, with benign F1 scores dropping below 0.1 in several fully connected configurations.
  • Robust aggregation rules such as Krum, Median, and Trimmed Mean do not by themselves neutralize the attack, since DMPA reports the lowest F1 scores even under these defenses.
  • The attack requires no knowledge of benign models, so DFL defenses cannot rely on hiding benign updates or on assuming attackers only know global aggregates.
  • Ring topologies appear to dilute but not stop the attack, suggesting that sparser peer-to-peer overlays are a partial mitigation rather than a defense.
  • The same attack pipeline transfers across datasets, model architectures, and overlay topologies without per-environment adaptation, which makes it a practical threat across DFL deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test whether the maximum-eigenvalue eigenvector is truly the optimal poisoning direction; a natural ablation would compare it against random or minimum-eigenvalue directions while holding all other steps fixed.
  • Because DMPA's correlation matrix is built only from malicious updates, a defense that monitors the principal component or covariance structure of incoming updates could in principle detect this attack pattern, though the paper does not propose or evaluate such a defense.
  • The top-10 percent sparsification step appears to be what lets the attack survive coordinate-wise robust aggregators like Median and Trimmed Mean; removing that mask in an experiment would isolate its contribution.
  • The paper explicitly leaves non-IID data to future work; if the attack's power depends on malicious updates sharing a coherent direction, non-IID local data could weaken the correlation and reduce DMPA's effectiveness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes DMPA, a collusive model poisoning attack for decentralized federated learning (DFL). The attack computes the correlation matrix of malicious client model updates, extracts the principal eigenvector, projects the updates onto that direction, negates the updates, and retains the top 10% of parameters by magnitude. The authors evaluate DMPA against LIE, Min-Max, and Min-Sum across MNIST, Fashion-MNIST, and CIFAR-10 under three topologies (fully connected, ring, star) and four aggregation rules (FedAvg, Krum, Trimmed Mean, Median), reporting F1 scores of benign clients. The abstract and Section 5 claim that DMPA consistently surpasses existing state-of-the-art attacks and that its F1 scores are the lowest in all settings.

Significance. If the claimed universal superiority held, DMPA would be a valuable new attack for DFL, a setting with comparatively little attack research, and the paper would provide useful evidence about the vulnerability of robust aggregation rules in decentralized topologies. The paper is also careful to state a strict threat model in which attackers know only their own compromised models, which is a reasonable and practically relevant assumption. However, the central contribution is purely empirical, and the paper's own results contradict the headline claim in several settings. The reported evaluation also lacks error bars, multiple runs, or an analysis of the attack's key hyperparameters, so the paper's main assertion is not supported as written.

major comments (3)
  1. [Section 5, Table 1] The central claim that DMPA's F1 scores are 'all the lowest' is directly contradicted by the paper's own Table 1. Since a lower F1 score indicates a more effective attack, several baseline results are better than DMPA: CIFAR-10 Ring/Median gives LIE 0.2806 versus DMPA 0.3145; Fashion-MNIST Ring/Krum gives Min-Max 0.4537 versus DMPA 0.7675; MNIST Fully/Median gives Min-Max 0.8281 versus DMPA 0.8479; and CIFAR-10 Fully/Krum gives LIE 0.2305 versus DMPA 0.5696. These cells falsify the abstract's 'consistently surpasses' claim and the Section 5 statement that 'its F1 scores are all the lowest.' If the numbers are accurate, the main claim is false; if they are inaccurate, the experimental report cannot be trusted. Either way, the paper's central empirical contribution is unsupported.
  2. [Section 4, Equations (5)-(7) and Algorithm 1] The attack's central design choice is asserted rather than derived. The paper claims that the principal eigenvector of the correlation matrix of malicious updates identifies the 'optimal poisoning direction' and that negating the updates, adding the projection onto that eigenvector, and keeping the top 10% of parameters maximizes the benign loss after aggregation. No optimization problem, formal justification, or proof is given for this choice, and no sensitivity analysis is provided for the top_k_percent hyperparameter. Because the method's effectiveness depends entirely on this heuristic, the paper needs either a derivation of why this direction is optimal for decreasing benign F1 under the tested aggregation rules or an ablation study showing that this specific construction is necessary. As written, the attack could reduce to an arbitrary perturbation, which is especially important given the contradictory results in Table 1.
  3. [Section 5, Experimental Setup and Table 1] The evaluation reports only a single average F1 value per setting, with no standard deviations, confidence intervals, number of independent runs, or seed variations. This is a serious problem because many of the comparisons in Table 1 are close; for example, in Fashion-MNIST Star/Median, DMPA achieves 0.878103 versus Min-Max 0.878469, a difference of 0.0004 that is meaningless without an estimate of variance. The lack of any uncertainty quantification means that even when DMPA appears best, the result cannot be distinguished from noise. The paper should include multiple trials with different random seeds and report variances, or at least justify why a single run is sufficient.
minor comments (7)
  1. [Section 4.1] There is a typo in 'This workd proposes' that should be corrected.
  2. [Equation (2)] The text says 'aggeration' instead of 'aggregation' in the sentence introducing Equation (2).
  3. [Throughout] The attack name is inconsistently written as both DMPA and DPMA; the authors should use one spelling consistently.
  4. [Section 4, Equations (4)-(5) and Algorithm 1] The notation is inconsistent: Algorithm 1 defines C = (1/(n-1)) V V^T, while Equation (4) writes C = (1/(n-1)) V^T V; the dimensions of V, T, and the element-wise division in Equation (5) are also not defined clearly. This makes the method hard to reproduce.
  5. [Section 5, Experimental Setup] The paper does not mention whether code, hyperparameter configurations, or pre-trained models are publicly available, which limits reproducibility.
  6. [Section 5, Figure 3] The figure caption and the text do not explain the exact aggregation rule used for each panel beyond the labels, and the legend is unclear; the reader cannot tell which curve corresponds to which method in the densely overlapping plots.
  7. [Section 2] The related-work section would benefit from a more explicit discussion of how the described CFL attacks are adapted to DFL, since the paper assumes the malicious clients collude and share models but does not describe how the DFL topology affects the adaptation.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: DMPA's update rule is defined from malicious updates alone and is benchmarked externally; the two self-citations are background-only, while the real problems are an unproven optimality claim and Table 1 contradicting the 'all lowest' statement.

full rationale

The claimed derivation chain for DMPA (Section 4, Equations 3-7, Algorithm 1) takes only the malicious update matrix U and applies centering, covariance/correlation, principal-eigenvector projection, negation, and a top-10% mask; no term in the construction involves benign F1, test accuracy, or any target quantity the paper later claims to predict. The attack is then compared against external baselines on MNIST, Fashion-MNIST, and CIFAR-10 across three topologies and four aggregators, so the central empirical claim is not generated by fitting a parameter to those results. The two self-citations (Feng et al. 2023 and Feng et al. 2024) appear in background sentences about DFL security and are not used to define DMPA or to justify its superiority, so they are not load-bearing and do not make the derivation circular. The serious issues here are non-circular: the 'optimal poisoning direction' is asserted rather than derived (no objective, proof, or sensitivity analysis is given for the maximum-eigenvalue choice), and the paper's own Table 1 contradicts the abstract's claim that DMPA's F1 scores are 'all the lowest' (e.g., CIFAR-10 Ring/Median: LIE 0.2806 beats DMPA 0.3145; Fashion-MNIST Ring/Krum: Min-Max 0.4537 beats DMPA 0.7675). These concern correctness and internal consistency, not derivation-from-inputs circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The method is a heuristic built from standard linear algebra operations plus hand-chosen design choices (top-k=10%, sign inversion). No parameters are fitted to data, so circularity is low, but the core effectiveness assumption is ad hoc and untested against the closest prior DFL attack.

free parameters (1)
  • top_k_percent = 10
    Algorithm 1 line 12 selects top 10% of parameters to replace in the poisoned update; no sensitivity analysis or justification is provided.
assumptions (5)
  • ad hoc to paper The maximum-eigenvalue eigenvector of the correlation matrix of malicious model updates identifies the optimal poisoning direction.
    Introduced in Section 4, Equations 5-7; no optimization problem or proof is given, and the claim is central to the attack's design.
  • ad hoc to paper Negating malicious updates, adding the projection onto the principal eigenvector, and retaining top 10% parameters yields a poisoned update that degrades benign models after aggregation.
    This is the attack strategy in Algorithm 1 (lines 8-13) and Section 4; asserted without derivation or sensitivity analysis.
  • domain assumption Malicious clients can collude and share their local model updates with each other.
    Standard in collusive attack literature and stated in Section 3 threat model; also used to adapt LIE, Min-Max, Min-Sum to DFL (Li et al. 2023).
  • domain assumption IID data partitioning with alpha=100 is a representative benchmark setting for DFL attacks.
    Experimental setup defaults alpha to 100 following Shejwalkar and Houmansadr 2021; the paper acknowledges non-IID is left to future work, so the scope of the claim is limited to IID.
  • standard math Standard linear algebra facts about covariance, correlation matrices, and eigendecomposition.
    Used in Equations 3-5; these are unproved background results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DMPA: Model Poisoning Attacks on Decentralized Federated Learning for Model Differences." pith.science (2026). https://pith.science/paper/YWMAHAZ4

@misc{pith2026250204771,
  author       = {Pith},
  title        = {Pith review of: DMPA: Model Poisoning Attacks on Decentralized Federated Learning for Model Differences},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YWMAHAZ4}},
  note         = {Machine review of arXiv:2502.04771}
}
read the original abstract

Federated learning (FL) has garnered significant attention as a prominent privacy-preserving Machine Learning (ML) paradigm. Decentralized FL (DFL) eschews traditional FL's centralized server architecture, enhancing the system's robustness and scalability. However, these advantages of DFL also create new vulnerabilities for malicious participants to execute adversarial attacks, especially model poisoning attacks. In model poisoning attacks, malicious participants aim to diminish the performance of benign models by creating and disseminating the compromised model. Existing research on model poisoning attacks has predominantly concentrated on undermining global models within the Centralized FL (CFL) paradigm, while there needs to be more research in DFL. To fill the research gap, this paper proposes an innovative model poisoning attack called DMPA. This attack calculates the differential characteristics of multiple malicious client models and obtains the most effective poisoning strategy, thereby orchestrating a collusive attack by multiple participants. The effectiveness of this attack is validated across multiple datasets, with results indicating that the DMPA approach consistently surpasses existing state-of-the-art FL model poisoning attack strategies.

Figures

Figures reproduced from arXiv: 2502.04771 by the authors.

Figure 1
Figure 1. DFL Process with Malicious Participants Threat Model Adversary Objective. The primary goal of the attacker is to minimize the performance of the global model in the DFL system by manipulating the updates to the client mod￾els under its control. Specifically, the attacker hopes to mis￾lead the learning process of the global model by introducing carefully crafted malicious updates to the model parameters, ultimately l… view at source ↗
Figure 2
Figure 2. Overview of DMPA Attack Process As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack Performance in CIFAR-10, MNIST, and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. FedStrategist: A Meta-Learning Framework for Adaptive and Robust Aggregation in Federated Learning

    cs.LG 2025-07 reject novelty 4.0 of 10

    A LinUCB contextual bandit selects federated aggregation rules online based on update variance, cosine similarity, and mean norm, claiming superior accuracy and tunable risk posture.

Reference graph

Works this paper leans on

23 extracted references · 12 canonical work pages · cited by 1 Pith paper

  1. [1]

    P.; Parimala, M.; Maddikunta, P

    Alazab, M.; RM, S. P.; Parimala, M.; Maddikunta, P. K. R.; Gadekallu, T. R.; and Pham, Q.-V. 2021. Federated learning for cybersecurity: Concepts, challenges, and future directions. IEEE Transactions on Industrial Informatics, 18(5): 3501--3509

    work page 2021

  2. [2]

    Baruch, G.; Baruch, M.; and Goldberg, Y. 2019. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32

    2019

  3. [3]

    M.; Guerraoui, R.; and Stainer, J

    Blanchard, P.; El Mhamdi, E. M.; Guerraoui, R.; and Stainer, J. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30

    2017

  4. [4]

    Cao, X.; and Gong, N. Z. 2022. Mpaf: Model poisoning attacks to federated learning based on fake clients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 3396--3404

    work page 2022

  5. [5]

    Deng, L. 2012. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine, 29(6): 141--142

    work page 2012

  6. [6]

    H.; Baltensperger, J.; Beltran, E

    Feng, C.; Celdran, A. H.; Baltensperger, J.; Beltran, E. T. M.; Bovet, G.; and Stiller, B. 2023. Sentinel: An Aggregation Function to Secure Decentralized Federated Learning. arXiv:2310.08097

    arXiv 2023

  7. [7]

    H.; Vuong, M.; Bovet, G.; and Stiller, B

    Feng, C.; Celdran, A. H.; Vuong, M.; Bovet, G.; and Stiller, B. 2024. Voyager: MTD-Based Aggregation Protocol for Mitigating Poisoning Attacks on DFL. IEEE/IFIP Network Operations and Management Symposium

    work page 2024

  8. [8]

    Hallaji, E.; Razavi-Far, R.; and Saif, M. 2022. Federated and transfer learning: A survey on adversaries and defense mechanisms. In Federated and Transfer Learning, 29--55. Springer

    work page 2022

Show all 23 references
  1. [9]

    Krizhevsky, A.; Hinton, G.; et al. 2009. Learning multiple layers of features from tiny images

    2009

  2. [10]

    Li, B.; Su, N.; Ying, C.; and Wang, F. 2023. Plato: An open-source research framework for production federated learning. In Proceedings of the ACM Turing Award Celebration Conference-China 2023, 1--2

    2023

  3. [11]

    Li, X.; Wang, N.; Yuan, S.; and Guan, Z. 2024. FedIMP: Parameter Importance-based Model Poisoning Attack Against Federated Learning System. Computers & Security, 103936

    2024

  4. [12]

    Lian, X.; Zhang, C.; Zhang, H.; Hsieh, C.-J.; Zhang, W.; and Liu, J. 2017. Can decentralized algorithms outperform centralized algorithms? a case study for decentralized parallel stochastic gradient descent. Advances in neural information processing systems, 30

    2017

  5. [13]

    T.; Pérez, M

    Martínez Beltrán, E. T.; Pérez, M. Q.; Sánchez, P. M. S.; Bernal, S. L.; Bovet, G.; Pérez, M. G.; Pérez, G. M.; and Celdrán, A. H. 2023. Decentralized Federated Learning: Fundamentals, State of the Art, Frameworks, Trends, and Challenges. IEEE Communications Surveys & Tutorial...

    2023

  6. [14]

    McMahan, B.; Moore, E.; Ramage, D.; Hampson, S.; and y Arcas, B. A. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, 1273--1282. PMLR

    2017

  7. [15]

    Shejwalkar, V.; and Houmansadr, A. 2021. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS

    2021

  8. [16]

    Tan, S.; Hao, F.; Gu, T.; Li, L.; and Liu, M. 2023. Collusive model poisoning attack in decentralized federated learning. IEEE Transactions on Industrial Informatics

    2023

  9. [17]

    Xiao, H.; Rasul, K.; and Vollgraf, R. 2017. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747

    2017 arXiv

  10. [18]

    Yang, Q.; Liu, Y.; Chen, T.; and Tong, Y. 2019. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST), 10(2): 1--19

    2019

  11. [19]

    Yin, D.; Chen, Y.; Kannan, R.; and Bartlett, P. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. In International conference on machine learning, 5650--5659. Pmlr

    2018

  12. [20]

    Y.; and Brinton, C

    Yuan, L.; Wang, Z.; Sun, L.; Philip, S. Y.; and Brinton, C. G. 2024. Decentralized federated learning: A survey and perspective. IEEE Internet of Things Journal

    2024

  13. [21]

    Y.; Hu, S.; Chen, C.; Liew, A.; and Li, Z

    Zhang, H.; Yao, Z.; Zhang, L. Y.; Hu, S.; Chen, C.; Liew, A.; and Li, Z. 2023. Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning. arXiv preprint arXiv:2304.10783

    2023 arXiv

  14. [22]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  15. [23]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.