Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs
2026-08-10 • Machine Learning
Machine Learning
AI summaryⓘ
The authors studied a way bad participants can mess with a shared learning system that creates images (GANs) by flipping labels on purpose. They showed that these label flipping attacks can trick the global model into mixing up which images belong to which labels. By making the bad labels more common during training, the attackers can have an even stronger effect. The authors measured how much the resulting image distributions changed and found the attack is both effective and hard to spot using common checks. They tested their ideas using popular datasets like MNIST and CIFAR10.
federated learningGANslabel flipping attackadversarial attackoversamplingKullback-Leibler divergencedistributional shiftFEMNISTMNISTCIFAR10
Authors
Panav Shah, Avishek Ghosh
Abstract
In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator. The objective of this attack is to skew the learned generation distribution so that samples conditioned on a target label are instead mapped to a source class. In this work, we investigate the effectiveness of label flipping attacks in federated GANs through both theoretical analysis and empirical evaluation. We further consider an oversampling based variant, in which malicious clients upweight poisoned samples during local training to amplify their influence on the aggregated global model. We quantify the resulting distributional shift by computing the Kullback Leibler divergence between the clean and poisoned class conditional distributions, and show both analytically and on FEMNIST, MNIST, and CIFAR10 that the semantic damage of the attack grows linearly in the effective poisoning strength while deviation from the true target distribution grows only quadratically, making the attack effective yet difficult to detect from label agnostic metrics.