Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design
2026-06-22 • Machine Learning
Machine LearningCryptography and Security
AI summaryⓘ
The authors studied personalized federated learning (PFL), where many devices train their own private models without sharing raw data. They found that PFL methods are more vulnerable to special attacks where bad actors use knowledge from their models to trick and damage other devices' models. The authors showed this problem both with theory and experiments using common datasets. To help fix this, they proposed a defense approach combining noise, regularization, and sensitivity techniques to make the models safer. This work is the first to systematically explore and address adversarial attacks in personalized federated learning systems.
Federated LearningPersonalized Federated LearningAdversarial AttacksTransfer-based AttacksMachine Learning SecurityData HeterogeneityDistributed Edge SystemsRegularizationInput NoiseModel Robustness
Authors
Mingyuan Fan, Cen Chen
Abstract
The proliferation of IoT devices has fueled distributed edge systems to collect vast amounts of sensitive data, creating fertile ground for on-device machine learning applications. While federated learning (FL) mitigates privacy concerns by exchanging model parameters instead of raw data, we identify a critical blind spot in current research. We examine the most commonly used personalized federated learning (PFL) methods, which allow clients to maintain private, personalized models to address data heterogeneity across clients. Through systematic analysis, we reveal that PFL methods exhibit heightened vulnerability to transfer-based adversarial attacks compared to centralized learning paradigms. Wherein, malicious clients can exploit local model knowledge to craft adversarial examples that can compromise peer clients' personalized models. We establish this vulnerability through both theoretical analysis and empirical evaluation across multiple benchmark datasets, demonstrating significant accuracy drops across various PFL methods. To address this challenge, we propose a defense framework combining stochastic input noise, input-scaled trace regularization, and parameter sensitivity maximization to improve FL's robustness. Our findings establish the first systematic study of adversarial threats in PFL systems, providing both diagnostic tools and practical countermeasures.