Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

This paper investigates targeted label-flipping and oversampling-based label-flipping attacks in federated conditional GANs (cGANs). The authors formulate two targeted label-manipulation attacks—simple label flipping and oversampling-based label flipping—in the federated cGAN setting, with algorithmic descriptions of the adversarial client update. They derive a mixture-model characterization of the poisoned class-conditional distribution, showing the source–target KL divergence decreases linearly in the effective poisoning strength beta, while deviation from the true target distribution grows only quadratically in beta—an asymmetry indicating the attack is effective yet hard to detect from the target distribution alone. They empirically validate these predictions on FEMNIST, MNIST and CIFAR-10 under a realistic non-IID federated setup, finding close agreement between theory and experiment for both attack variants.

The threat model assumes an honest-but-curious central server that follows the FedAvg protocol faithfully and deploys no additional defenses such as robust aggregation, anomaly detection, or client contribution scoring. A fixed adversarial fraction alpha = k/N is assumed throughout training, with synchronous communication rounds and full client participation. Adversaries are data-poisoning attackers: they cannot tamper with the aggregation rule or directly inject gradients, but they fully control the local datasets and training loops on the clients they own. An adversarial client may relabel any of its samples and apply arbitrary per-sample reweighting during stochastic optimization, but must return weight vectors of the same shape and parameterization as honest clients. The attacker’s goal is targeted: corrupt the conditional P˜t when the global generator is conditioned on label t, while leaving non-target classes intact so that label-agnostic monitoring (aggregate FID, etc.) remains plausible. The adversary knows only the global model architecture, the loss, and the conditioning labels—all public in any practical deployment. It need not know other clients’ parameters, the composition of honest data, or the FedAvg aggregation weights.

In simple label flipping, malicious clients flip a fraction p of source-labeled samples to the target label while keeping the corresponding images unchanged, and train locally with the standard unweighted SGD update. In oversampling-based label flipping, the same flipping operation is performed, but poisoned samples are upweighted by a factor r > 1 during gradient computation—equivalent to sampling each poisoned example r times. This amplifies their contribution to the local updates and, after aggregation, to the global model.

The theoretical analysis focuses on a single source class s and a single target class t. Let Ps and Pt denote the true data distributions of classes s and t, with prior probabilities Πs and Πt, respectively. A fraction alpha of clients behaves adversarially, flipping labels from s to t with probability p. The relative influence of poisoned updates is modeled by a factor r, where r = 1 corresponds to simple label flipping and r > 1 to oversampling-based attacks. Under these assumptions, label manipulation induces an effective transfer of probability mass Δ:= alphapr Πs, resulting in a poisoned target-class distribution P˜t = (Πt Pt + ΔPs)/(Πt + Δ) = (1 − beta)Pt + betaPs, where beta:= Δ/(Πt + Δ). The scalar beta ∈ [0, 1] summarizes the joint influence of alpha, p, r, and the priors: any combination of these knobs that produces the same beta yields the same poisoned mixture.

Lemma 5.1 (Source–Target Divergence under Label Flipping) states that under bounded-likelihood-ratio regularity conditions, the divergence between the source distribution Ps and the contaminated target distribution P˜t admits the first-order expansion KL(Ps ∥ P˜t) = KL(Ps ∥Pt) − beta X2(Ps ∥Pt) + O(beta2), where X2(·∥·) denotes the Pearson chi2-divergence. Thus, targeted label flipping reduces the divergence between the source distribution and the learned target distribution linearly in beta, with a slope governed by how separable Ps and Pt are under the chi2-divergence.

Lemma 5.2 (Deviation from True Target Distribution) states that under the same regularity conditions, the divergence between the true target distribution Pt and the contaminated target distribution P˜t admits the second-order expansion KL(Pt ∥ P˜t) = (beta2/2) X2(Ps ∥Pt) + O(beta3). In particular, the first-order term vanishes because P˜t is, by construction, a convex combination involving Pt itself—so to leading order P˜t “looks like” Pt even when beta is non-negligible.

Together, Lemmas 5.1 and 5.2 describe a structural asymmetry: the semantic damage of the attack (the collapse of source–target divergence) accrues at order beta, while the most natural detection signal—deviation from the true target distribution—only emerges at order beta2. Oversampling (r > 1) amplifies the attack purely by increasing beta via Δ = alphapr Πs, without inducing a proportionally large second-order deviation. This decoupling between damage and detectability is the central qualitative prediction tested empirically.

The experiments evaluate the theoretical predictions on three standard benchmarks: FEMNIST, a federated variant of EMNIST with grayscale handwritten characters under a naturally non-IID per-writer partition; MNIST, with grayscale handwritten digits under a synthetic non-IID partition obtained by Dirichlet sampling over labels; and CIFAR-10, with RGB natural images under the same Dirichlet partitioning scheme. Across all datasets, K = 50 clients are used, and the number of adversarial clients is varied in 0, 5, 10,..., 50 to control the effective poisoning strength beta. For each dataset, a single source–target pair (s, t) is selected to be visually confusable—3 → 2 for FEMNIST, 3 → 8 for MNIST, and cat → dog for CIFAR-10—and the label-flipping probability is fixed to p = 1, so that every source-labeled sample at an adversarial client is reassigned to the target class. Each dataset is run under both attack variants: oversampling with r = 5 and simple flipping with r = 1.

The model architecture is a conditional GAN with a projection discriminator, which incorporates class information via an inner product between the discriminator feature representation and a learned label embedding, D(x, y) = h(x)⊤e(y) + b(x). This is particularly relevant because label-flipping attacks directly perturb the label–feature alignment enforced by this projection term. The generator maps a latent vector z and class label y to an image through residual upsampling blocks with conditional batch normalization; the discriminator uses residual downsampling blocks with spectral normalization, the projection head, and an auxiliary classification branch. Federated training follows the standard FedAvg protocol, with honest clients performing standard cGAN updates and malicious clients running the label-manipulated update.

KL divergences are estimated using the non-parametric k-nearest-neighbor estimator of Pérez-Cruz, applied to Histogram of Oriented Gradients (HOG) features extracted from generator samples. Fixed HOG features sidestep the bias introduced by learned feature extractors and enable a consistent comparison across federated training rounds.

The results show that the qualitative pattern predicted by the theory is reproduced uniformly: KL(Ps ∥ P˜t) decreases approximately linearly with beta, while KL(Pt ∥ P˜t) increases at a faster, approximately quadratic rate. Comparing the two attack variants within each dataset confirms the r-dependence predicted by Δ = alphapr Πs: at a matched number of adversarial clients, oversampling (r = 5) reaches a substantially larger beta than simple flipping (r = 1), but at matched beta the two regimes yield numerically similar KL divergences—the two attacks differ operationally but not analytically. The HOG feature distributions for the source and target classes on FEMNIST under oversampling-based flipping show that the target-class feature distribution visibly shifts toward that of the source class as adversarial participation grows. The distributional collapse is gradual and monotone in beta, and highly localized to the source–target pair: generations conditioned on non-target classes are visually indistinguishable across attack levels, suggesting that aggregate generation-quality metrics (e.g., overall FID) are unlikely to detect the attack.

Table 2 sharpens the detectability point: aggregate FID moves by less than 6% on FEMNIST and CIFAR-10 even at beta ≈ 0.83, where KL(Ps ∥ P˜t) has already dropped by more than half. This is exactly what Lemma 5.2 predicts: the beta2/2 per-class deviation is diluted by ∼ 1/C when averaged over all C classes (1/62 on FEMNIST, 1/10 on MNIST and CIFAR-10). Target-class FID, in contrast, grows roughly quadratically in beta across all three datasets: a defender who knew which class to monitor could detect the attack from it alone, but since the source–target pair is the attacker’s free choice, monitoring all C(C−1) ordered pairs reduces to a label-agnostic scan whose per-pair noise overwhelms the linear-in-beta signal.

The discussion notes that the analysis assumes a single source–target pair, bounded likelihood ratios, and a fixed honest aggregator; partial client participation and asynchronous rounds are natural extensions. The appendix extends the analysis to arbitrary confusion matrices and shows, via Jensen’s inequality on X2(·∥Pt), that spreading contamination across multiple source classes can further reduce the second-order detection signal while preserving the first-order damage—a strictly stronger attack regime left to empirical exploration. On the defense side, the results suggest that effective detectors must operate at the level of class-conditional statistics rather than aggregate metrics, ideally by estimating X2(Ps ∥Pt) from generator outputs directly. Robust aggregation, client contribution scoring, and conditional consistency checks are promising directions, and the closed-form beta-dependence derived is viewed as a baseline against which to evaluate such defenses.

Improvements to AI Systems:

1. Class-Conditional Anomaly Detection for Generative Models

• Implement a monitoring system that estimates per-class KL/χ2 divergences between generated samples and reference distributions, rather than relying on aggregate metrics like FID.

• The improved system can detect targeted data-poisoning attacks in federated GANs by tracking quadratic growth in per-class deviation (KL(P t ∥ P̃ t)) while ignoring linear damage signals that are inherently hard to detect.

• It can flag suspicious source–target pairs (e.g., 3→8 in MNIST) by comparing class-conditional feature distributions (e.g., HOG embeddings) across training rounds, enabling early warning before aggregate quality degrades.

2. Poisoning-Resilient Federated Aggregation

• Design a robust aggregation rule that weights client updates inversely to their estimated contribution to class-conditional distribution shifts, using the closed-form β-dependence (β = αprΠ s) as a prior.

• The improved system can automatically down-weight or exclude clients whose local updates cause KL(P s ∥ P̃ t) to decrease faster than the theoretical linear bound, or whose oversampling factor r exceeds a threshold inferred from update norms.

• It can maintain target-class fidelity even under adversarial label flipping by enforcing consistency between the generator’s conditional outputs and a trusted, small reference set of clean class prototypes.

3. Adaptive Defense Against Oversampling Attacks

• Incorporate a per-client contribution scorer that estimates the effective poisoning strength β from the magnitude of gradient updates on class-conditioned layers (e.g., projection discriminator embeddings).

• The improved system can distinguish between benign non-IID data (which causes natural β-like shifts) and malicious oversampling (which amplifies β beyond expected priors) by comparing observed β against the theoretical maximum from honest data distributions.

• It can trigger conditional consistency checks—e.g., verifying that generated samples for non-target classes remain unchanged—whenever β exceeds a dataset-specific threshold, isolating adversarial clients without global retraining.

4. Attack-Aware Conditional GAN Training

• Modify the generator’s loss to include a regularization term that penalizes large χ2(P s ∥ P̃ t) between source and target classes, directly countering the first-order damage term in Lemma 5.1.

• The improved system can learn to resist label-flipping by enforcing a Lipschitz constraint on class embeddings, making it harder for poisoned updates to collapse the source–target divergence linearly in β.

• It can also use the theoretical asymmetry (damage O(β) vs. detectability O(β2)) to schedule defensive audits: run expensive per-class divergence checks only when aggregate metrics plateau, reducing computational overhead.

5. Federated Learning with Source-Agnostic Robustness

• Extend the theoretical framework to multi-source attacks (as in the appendix) and implement a defense that spreads risk by regularizing the generator to maintain uniform χ2 distances across all class pairs.

• The improved system can neutralize attacks that spread contamination across multiple source classes (which reduce second-order detectability) by enforcing pairwise divergence bounds, making it harder for adversaries to hide damage in aggregate statistics.

• It can automatically adjust its defense strength based on the estimated β from client updates, scaling regularization or aggregation robustness in real-time without human intervention.

6. Practical Deployment Guardrails for Federated cGANs

• Build a post-training certification tool that, given a trained generator, computes the empirical KL(P s ∥ P̃ t) and KL(P t ∥ P̃ t) for all class pairs using a small clean validation set.

• The improved system can output a poisoning risk score per class pair, alerting operators if the linear-vs-quadratic asymmetry is violated (i.e., damage exceeds detectability), even if aggregate FID looks normal.

• It can recommend targeted re-training on specific source–target pairs or flag clients that contributed disproportionately to those pairs, enabling surgical remediation without full federated retraining.

In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator. The objective of this attack is to skew the learned generation distribution so that samples conditioned on a target label are instead mapped to a source class. In this work, we investigate the effectiveness of label flipping attacks in federated GANs through both theoretical analysis and empirical evaluation. We further consider an oversampling based variant, in which malicious clients upweight poisoned samples during local training to amplify their influence on the aggregated global model. We quantify the resulting distributional shift by computing the Kullback Leibler divergence between the clean and poisoned class conditional distributions, and show both analytically and on FEMNIST, MNIST, and CIFAR10 that the semantic damage of the attack grows linearly in the effective poisoning strength while deviation from the true target distribution grows only quadratically, making the attack effective yet difficult to detect from label agnostic metrics.