Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning
Authors: Yuqi Jia
Minghong Fang
Hongbin Liu
Jinghuai Zhang
Neil Zhenqiang Gong
Venue: NeurIPS 2025 poster ()
Keywords: Federated Learning
Poison Forensics
Poisoning Attacks
Primary area: general_machine_learning

Abstract: Poisoning attacks compromise the training phase of  federated learning (FL) such that the learned global model misclassifies attacker-chosen inputs called target inputs. Existing defenses mainly focus on protecting the training phase of FL such that the learnt global model is poison free. However, these defenses often achieve limited effectiveness when the clients' local training data is highly non-iid or the number of malicious clients is large, as confirmed in our experiments. In this work,  we propose FLForensics, the first poison-forensics method for FL. FLForensics complements existing training-phase defenses. In particular, when training-phase defenses fail and a poisoned global model is deployed, FLForensics aims to trace back the malicious clients that performed the poisoning attack after a misclassified target input is identified. We theoretically show that FLForensics can accurately distinguish between benign and malicious clients under a formal definition of poisoning attack. Moreover, we empirically show the effectiveness of FLForensics at tracing back both existing and adaptive poisoning attacks on five benchmark datasets.

Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning
Yuqi Jía Duke University
Minghong Fang University of Louisville minghong.fang louisville.edu
Honghin Liu
Duke University hongbin. liu duke.edu
yuqi.jia duke.edu
Jinghuai Zhang
Neil Gong Duke University neil.gong duke.edu
University of California, Los Angeles jinghuai 1998@@@@i99@@@@00 waw.ll..cl@aaaa..c. g.ucla.edu
Abstract
Poisoning attacks compromise the training phase of federated learning (FL) such that the learned global model misclassifies attacker-chosen inputs called targer inputs. Existing defenses mainly focus protecting the training phase of FL such that the learnt global model poison free. However, these defenses often achieve limited effectiveness when the clients' local training data highly non- iid or the number of malicious clients large, as confirmed in our experiments. In this work, we propose F..Forensics, the first forsoinforensics method for FL. FLForensics complements existing training-phass defenses. In particular, when training-phi Saaning-phase defenses fail and poisoned global model is deployed, FLForensics aims to trace back the malicious clients that performed the poisoning attack after misclassified target input is identified. We theoretically show that FLForensics can accurately distinguish between benign and malicious clients under formal definition of poisoning attack. Moreover, we empirically show the effectiveness of FLForensics at tracing back both existing and adaptive poisoning attacks on five benchmark datasets. Our code and data are available at: /https: com/Jyghaaah/PPForensiccc
Introduction
Federated learning (FL) 32 is distributed learning paradigm, allowing many clients jointly train global model without sharing raw data. Specifically, in each round the server broadcasts the current model, clients update it their private data, and the server aggregates the updates (32) FL has been widely deployed in various real-world applications, such as credit risk prediction
and next-word
prediction [.] However, FL's distributed updates make prone to poisoning attacks: malicious
clients can submit crafted updates that the server accepts [16] 4 37 40 g 19] The resulting global model maps an attacker-chosen target input to attacker-chosen target label while leaving other predictions intact. This target input may be any sample carrying an injected trigger (a backdoor) or even a clean sample without trigger.
against poisoning attacks to FL focus on protecting the training phase. Robust aggregators such Trim, Median [42). FLTrust 77. and FLAME (33 try to filter potentially malicious updates, while detectors like Fe.eetccor detects clients whose updates inconsistent across multiple rounds (43). However, these training-phase defenses insufficient. In particular, when data are highly non-IID or attackers control many clients, malicious and benign updates become hard distinguish, as shown in our experiments. Consequently, even these thining-phase defenses are adopted, the learnt global model may still be poisoned and the poisoned global model deployed.
Existing defenses 42
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Our work: In this work, we propose FLForensies, the first poison-forensic method for FL. Unlike training- phase defenses, FLForensics aims to trace back the malicious clients that performed the poisoning attack after the attack has happened, i.e., after training- phase defenses fail, a poisoned global model has been deployed, and a misclassified target input has been identified. Identifying such a misclassified input-e.g., via manual inspection or automatic tools [22 14 3 orthogo- nal to FLForensics. For instance, we show that our FLFonensics can be adapted to detect whether a misclassified input is a misclassified target input or not in Appendix G FLForensics consists of two major steps: calculating influence scores and detecting malicious chietss. Step I assigns each client an influence score for the misclassified target input, and Step II uses these scores to distinguish malicious from benign clients.
Calculating influence scores. To quantify the misclassification of a target input, we measure each client's effect by the change it causes in the global model's cross-entropy loss on the misclassified target input across all rounds. One challenge is that clients' local training data are often non-iid. Specifically, some benign clients (denoted as Category 1) have large amount of local training examples with the target label, while other benign clients (Category IT) do not. As a result, both malicious clients and Category benign clients have large influence scores, making challenging to distinguish them. To separate them, the server also tests every client on a random non-target input with the target label, yielding another influence score. Thus client i receives a wwo-dimensional score (s,, sy) from the target and non-target inputs, respectively.
Defecting malicious clients. We observe that malicious clients have large 8; but small s/. Category I benign clients have large 8(), and Category II benign clients have small (8;, s(). Based on such observations, we detect malicious clients by clustering their 2-D scores with HDBSCAN ( which needs no preset cluster count. We further use a scaled Euclidean distance, which normalizes the two dimensions of a two-dimensional influence score to have the same, comparable scale. Clusters with positive mean s; become potentially malicious. However, these clusters may also include Category benign clients. To address the challenge, our key observation is that the influence-score gap s 8; of malicious client is smaller than that of Category I benign client. FLForensics leverages this to pinpoint the truly malicious clients inside each cluster.
Theoretical and empirical evaluation. Theoretically, we show the security of FLForensics against poisoning attacks. In particular, based on a formal definition of poisoning attacks and mild assump- tions, we show that 1) both malicious clients and Category I benign clients have larger influence scores 8; than Category II benign clients, and 2) malicious client has a smaller influence-son score gap sf s; than benign client. Empirically, we comprehensively evaluate FLForensics on five benchmark datasets. Our results show that FLForensics can accurately trace back malicious clients under various existing and adaptive attacks. We note that training-phass defenses are ineffective for most attack scenarios in our evaluation.
We summarize our main contributions as follows:
We propose the first ypison-forensio method called FLForensics to trace back malicious clients FL.
We theoretically show the security of FLForensics against poisoning attacks.
We empirically evaluate FLForensics on five benchmark datasets against existing and adap- tive poisoning attacks.
2 Preliminaries and Related Work
Federated learning (FL): FL enables n clients to collaboratively train a shared global model under a central server's coordination. Each client updates the global model using its local data and sends model update to the server, which aggregates them (e.g., via FedAvg (32 model:
update the global
Wi41 We + at Agg(g
St
9
where 04 is the learning rate. In practice, only a subset of clients is selected per round. Many FL. 28
variants [32 42
33
18 differ primarily in their aggregation rules.
Poisoning attacks FL.: Poisoning attacks aim to corrupt the training process so that the resulting global model is compromised. In targeted poisoning attacks 3 37, the model misclassifies attacker-
2

---

Misclassifedd
Chock points
Server
FLForensics
Client
Benign
Maliddous
Benign
Benign
Training
Poison Forensics
Figure I: Overview of Fo.rrnssic.. During training, the server stores the intermediate global mod- els and clients' model updates in some training rounds called check points. Given misclassified target input detected after deploying the poisoned global model, the server uses Fo.reenssss to trace back the malicious clients that performed the poisoning attack.
chosen inputs into a target label while maintaining overall accuracy. We refer to these simply as poisoning attacks. Some attacks prigger-embedded target inputs (i.e., backdoor attacks [4 3), where any input with a trigger is misclassified. Others use triggerless target inputs (37] which are naturally occurring but mislabeled edge cases. In both cases, malicious clients manipulate their local data or model updates to implant the attack during training. Details are deferred to Appendix
Training-phase defenses: Most defenses aim secure the training phase prevent a poisoned global model. Some approaches improve the aggregation rule to tolerate malicious updates, e.g., Trimmed Mean, Median [42. FLTrust 77,, and FLAME 33 Others
9 II offer provable guaran- tees by training multiple global models and using ensemble prediction. See Appendix [A.2 for more details. Furthermore, some defenses focus on detection and recovery from attacks. FeDetecor (43
detects clients with inconsistent model updates, and FedRecover 10 reconstructs clean model without retraining from scratch.
However, these thining-phass defenses suffer from a few key limitations. Robust FL methods still struggle when malicious clients are numerous or client data is highly non-iid. Moreover, FLDetec- tor cannot detect data poisoning attacks where malicious clients poison data but follow protocol. Consequently, poisoned model may still be deployed. In our work, assume poisoned global model is already deployed. Given misclassified target input detected post-deployment, our goal is to trace back the malicious clients responsible for the attack.
Poison forensics for centralized learning: Poison forensics methods 36 of misclassification in centralized learning. PF 36) and GAS (25) identify poisoned training data responsible for misclassification, while Beagle [3] recovers triggers from multiple poisoned in- puts. These methods assume centralized access to training data and do not generalize well FL, as shown our experiments. In contrast, our FLForensics the first poison-forensics method tai- lored FL., capable of identifying malicious clients post-deployment. Interestingly, method also performs well in centralized settings with unbalanced data, where existing methods degrade (see Appendix G
25
13 trace the source
3 Threat Model
We assume an attacker compromises the FL training by controlling set of malicious clients, which may be fake or compromised genuine ones. These clients craft model updates that poison the global model, while the server remains honest. After training, the poisoned model deployed for real-world use. In this work, we focus on largeted poisoning attacks, where the model misclassifies attacker-chosen target inputs as an attacker-specified target label, while behaving normally on other inputs. Appendix[[providee discussion of untargeted poisoning attacks.
Poisoning attacks:
a misclassified target input poisoning attack is detected after model deployment. Detection can be done automati- cally 22 [4 31) or manually by users observing application enrors caused by the misclassification.
Poison forensies:
We adopt standard voison-forensee setting 36 25
13

---

0.06
8 1.00
0.4
Scaled S
Non
0.00
4000
0.0
-02
-0.04
-0.0002-00 Non-scaled
0.0000 0.0000 0.0001
-0.50 -0.25 0.00
0.25
(a)
(b)
(c)
Figure 2: (a) Influence scores and (b-c) clustering results in one of our experiments using Eu- clidean and scaled Euclidean distance. Dots represent clients: red (malicious), green (Category I benign), and blue (Category II benign). Different markers represent different HDBSCAN clusters.
Given such misclassified target input, the goal is trace back the malicious clients responsible for the attack. In Section 7 we further show that FLForensics can help determine whether a misclassi- fied input is indeed target input.
4
Our FLForensics
4.1
Overview
During training. FLForensics stores intermediate global models and client updates check points. When target input is misclassified, FLForensics proceeds in two steps: (1) it computes each client's inffuence score from the stored check points, and (2) it detects malicious clients via clustering the influence scores. Figure [ shows the workflow and Algorithm provides the pseudo-code.
4.2 Calculating Influence Scores
Quantifying a misclassification: We denote target input as æ, which is misclassified as the target label y by the poisoned global model w. To measure client's contribution misclassification, use the cross-entropy loss (a w) of the poisoned global model w. Denote wy as the global model in training round t, where final model after It rounds. The overall loss change is (C y; wo) - LCg (2, , WR), which we attribute clients' model updates across rounds.
... R. then wo the initial global model and wR the
Expanding the training process: Since the loss change is accumulated over the training rounds, we expand them to measure the influence of each client on the loss change. Specifically, ac- cording to Taylor expansion, for training round t, we have (CE(Z, (z, yi wx+1) ss loE(H, yı we) + Vice(2, yi w:) (we+1 wt). Therefore, by summing over training rounds, have:
(cr(x,y;oo) Lor(s,
Vlor(z, (We+1 -w:)-
Assigning influence scores: If a client is selected in training round quantify its contribution
to the model difference W++1 - wt. Then we obtain an influence score for by summing over such contributions over multiple training rounds that involve this client. Let C. be the set of selected clients in round If we we assume the global model is updated as using only the model update
Ft of client i, then w Wi
91
(4) and i's influence score is:
Σ
VoCr,, y T g()))
&.L.L FEC.
Using check points to save space and computation: If FLForensics uses all training rounds to calculate the influence scores, the server needs to save global models and clients' updates in all training rounds, which incurs substantial space and computation overhead. To reduce overhead, we compute influence scores using subset of h check points Ω [41,..,,4)) 4):
8;
Σ
a V.ce(2 w. (1)
(4)
tEN

---

Algorithm FLForensics
Input: Misclassified target input 2, target label non-targe input x', check points Ω (1,,42," ... J. global models (we) in the check points, selected clients C₁ in each check point t E 92, and clients' model updates {ge Tres,iec.
Output: Predicted malicious clients M.
1: I/Calculating influence scores
2: for i = to n do
iEC, at a.ViCE(2, yi w 9t EIENSt 4: 82 = iEC, iEC, 04 Ve we) Di (1)
3: 8; -
(8)
5: end for
6: I (1),,,)), (52, s2),.... (5x1 s,
7: //ettcting malicious clients
8: C1.'.. Cma Coutlier HDBSCAN(Z):
Coutlier is set that contains all outliers if any-
9: :p:,Cp::". :Cps t- clusters with average 8; > 0;
b Get potential malicious clusters.
10: threshold & - / E/= kEcpy 8;
11: --0; 0:
12: for j j- to
13: Uhreshold, + Eiery 4/Eiecy 8;
14: if "thresholdj S threshold then M = M U Cpyi
end if
16: end for
for in Coutlier do
18: threshold, < s///5;
if threeholdy threshold then M M (i}:
20: end if
end for
22:
return MW
The space cost is linear to the model size, number of check points, and active clients per round.
Using a non-target input to augment clients' influence scores: Due to non-iid data, some benign clients (denoted as Category may have many examples labeled y and thus yield high 8,, similar to malicious clients. Other benign clients (Category If) do not, and yield lower scores. In particular, our theoretical analysis in Appendix B shows that malicious clients and Category benign clients both have larger influence scores than Category II benign clients. Figure 2a shows the influence scores 8; of malicious, Category benign, and Category II benign clients in an experiment. To differentiate them, we compute a second influence score using a non-turgel input x':
Σ LEQILL REC.
VocEl wi) Tg) gt
gi
(5)
r' can be either a random true input, and we show in Appendix G that both choices yield similar performance. This gives each client a two-dimensional influence score (si, s(). Typically, Category benign clients have both scores large, while malicious clients have a large 8; but a small s/.
4.3 Detecting Malicious Clients
Our method is based two observations: (I) Both malicious and Category benign clients have larger 8; than Category clients. (II) Malicious clients have smaller gaps s - 8; than benign clients.
We provide theoretical justification for these observations in Appendix B
Clustering the clients via HDBSCAN with scaled Euclidean distance: Let I
(() sf). (sn. s(,}} denote client scores. We cluster clients using HDBSCAN (6], which does not require specifying the number of clusters and handles outliers. To account for differences in score scales, we normalize each score dimension by its range and compute scaled Euclidean dis- tance, i.e., 8; as 8:/ <t/mmax"_ 8 min 8,), and & as s <//(maxj_ 8' min 88)) Figures 2b and show the improved separation using this distance metric.
5

---

Identifying malicious clients and Category I benign clients based on Observation I: We treat clusters with positive average 8; as potentially malicious, since both malicious and Category benign clients can fall into this category. For instance, in Figure 2c] both red clusters (malicious) and the green cluster (Category benign) are potential malicious clusters.
Distinguishing between malicious clients and Category I benign clients based on Observation II: To further separate malicious and Category I benign clients. we compute the ratio of average sj to 8; in each potential malicious cluster. Based on Observation II, a cluster is classified as malicious this ratio is below a threshold. We set it to the mean ratio across all such clusters. Furthermore, HDBSCAN may output some clients as outliers that do not belong to any cluster. Outlier clients are handled similarly by comparing their s//s, to the same threshold. Figure 2c illustrates how this approach identifies the red clusters as malicious.
5 Experiments
5.1 Experimental Setup
Datasets: We conduct our experiments using five diverse benchmark datasets: four image datasets (CIFAR-10, Fashion-MNIST, MNIST, and ImageNet-Fruiis and one text dataset (entiment140), Detailed descriptions of these datasets are provided in Section Cin in Appendix.
FL training settings: Following [6], we model FL with 100 clients. For CIFAR-IO, Fashion-MNIST, MNIST, and ImageNet-Fruits we create non-llI partitions using the method of [16] (Appendix F shows the details).. Since Sentiment140 already exhibits user-level non-IlD, we simply group users uniformly at random into 100 clients. We train ResNet-20 (26 for CIFAR- 10, a CNN (Table 4 Appendix) for -ashion-MNIST and MNIST, a LSTM 27 for Sentiment140 and a ResNet-50 [26] for ImageNet-Fruuts. Default hyper-parameters (learning rate, batch size, global rounds, local epochs) are listed in 5 in Appendix. By default, every round involves all clients and the server aggregates via FedAvg [32]. We will also conduct experiments to vary the client fraction and the aggregation rule to test FLForensics.
Poisoning attacks to FL: We consider three popular poisoning attacks to FI., i.e., Scaling 33 A litle enough (ALJE) 4, and Edge (37 attacks. Scaling and ALIE use trigger-embedded target inputs, while Edge uses triggerless target inputs. The description of those attacks are shown in Appendix[] D By default, we assume there are 20% malicious clients, who perform attacks in each training round. We will also explore the impact of the fraction of malicious clients and fraction of attacked training rounds on FLForensics.
We evaluate with detection accuracy (DACC), positive rate (FPR), and false negative rate (FNR). DACC is the fraction of clients correctly classified; FPR the fraction of benign clients classified malicious; FNR the fraction of malicious clients missed. Higher DACC and lower FPR/ENR indicate a better method. We report the attack success rate (ASR) in Table which means the fraction of target inputs that the poisoned model predicts as the target label.
Evaluation metrics:
Poison-forensics settings: For each dataset we randomly choose a misclassified target input. FLForensics also requires non-target input. Because the server may lack real data, it synthesizes a non-turgel inpul: image pixels are sampled i.i.d. from U(0, 1), and text is a random tweet of the same length. Results in Appendix G also show that using a true input instead can slightly improves FL.orensics. By default, the server saves the global model and clients' updates every 10 rounds.
Each update of is fy-normalized before computing influence scores in Equations 4 and 5 to offset scale differences. Unless stated otherwise, we report results on CIFAR- 10 under Scaling attack. All the experiments are finished on one single Quadro RTX 6000 GPU with 24GB memory.
5.2 Compared methods
We compare FLForensics with the following methods including variants of FLForensics.
Poison Forensies (PF) 36 PF is designed for centralized learning. To apply it in FL., we assume the server can access clients' local data. PF identifies poisoned training examples, and a client classified as malicious if its fraction of detected poisoned samples exceeds the average across clients.

---

Table I: DACC/FPR/ENR of FeDetccorr a training-phase method to detect malicious clients.
Attack
MNIST
Fashion-MNNSTT
CIFAR-10
Sentiment1-0
ImageNet-Fruits
Scaling
0.96000.08900000
088000.138/0.100
0.4000,53800.880
0.02000.75/1.000
0:475/0-43800.855
ALIE
0.000/1 00001000000
W.0001.0001.CO 1000
0.000/1.0000 100001.0000
0.010M0.98//.00
0.075/0.900/1.00
Edge
0.160N08000/1.00
0.39000566300.00
0.160008000 800000000000000 0.08000900X11000
0.750000281/00250
Table 2: Results of FLForensics and compared poison forensics methods.
Dataset (DACCIFPRENR)
Attack
Method
MNIST
Fashion-MNIST
CIFAR-10
Sentiment140
ImageNct-Fouits
PF
100000.12500.000
0,90090 125/0.000
0.9000.12500.000
0.99000.013/0.000
1.600/0.37500.00
Forensies
0.48000.41300.900
0.741Vo. 10000.900
0.9000012540.000
0.99/0.013/0.000
0. 0.6000.31130.550
Scaling
Forensics-A
0.9000.11540.0000
125/0.000
1.0000.00000.000
0.9000. 12500.005000000
0.90000 125/0.000
0.900V. 125/0.000
FLForensiss
1.0000.00000000
LOU000,00000.000
L00000.000000000
0.980N0.02540.000
1.000/0.000000000
0,740003255000000
0.90090. 125/0.000
0.900/ 125/0.000
0.760/0.27500.
1.000/0000000000
FLForenicss G
0.52100.363419950
0.74000.10000.900 10000.000
0.900/0.12500 12500.000
0.980N0.02500.000
0.525/0.40000799
ALIB
FL. Forensics-AA
0.90000.15/0.000
1. 1.00/0.00000.000
0.900/ 12500.000
0,900/0. 125/0.000
0.875/0116600.0
FL. Forensiss
1.0000.00000.000
1.0000.00000.000
1.00090.000000000
1.0099.00000000
PF
0.920/0 12200.000000000
L000/0.00000000
1.8200.22540.000
0.97000.08600000
0.8500. 18000.88000000
FL Forensics G
0. 1.93000.0840.000
0.920V0. 100/0.000
0.920/0 10000000000000000
0.94000.075/0.0000
0.700V. 125/1.000
Edge
Forensics
0,92000. 100/0,000
0.920V0. 10000.000
100. 33000000
0,920V0. 100/0.000
0.800V. 12500.500
FLForensics
..0000000000.000
L00000,00900000
.9.8000.000000000
0.97W0.033/00000
0.950/0.33100.125
F FLForensics-G (GAS [25] FLForensics). GAS computes influence scores for training examples in centralized learning. However, lacks detection step. We extend it to FL (with access to local data) and combine it with FLForensics as an end-to-end method. Specifically, we compute influence scores using GAS and then detect poisoned examples using HDBSCAN (details in Appendix EE Similar to PF, clients are marked as malicious based on their fraction of detected poisoned examples.
FL F..ensssssAA This is variant of FLForensics that uses only target input æ. The influence scores 8; for each client (Equation[4) 4), clusters clients with HDBSCAN, and treats clusters with positive average scores as malicious. We include this variant highlight the limitations of using only target input.
computes
5.3 Experimental Results
Training-phase defenses are insufficient: Training-phan defenses rely on robust aggregation or attacker detection to prevent poisoning attacks. However. Table 9 in Appendix shows robust FL methods, such as Trim, Median 442) FLTrust (7). and FLAME [33,, still leave high attack- rates. Table [ further shows that FLDetector often misses malicious clients. Non-iid data blur the line between benign and malicious updates, so these defenses remain vulnerable.
FLForensies is effective and outperforms baselines: Table 2holeesshwws the results of FLForensics and compared ppison-forensee methods. FLForensics accurately traces attackers across all datasets and attacks: its DACC is always or close 1, while both FPR and FNR remain at or below 3% in only a few Scaling and Edge attack cases. Furthermore, FLForensics outperforms all compared forensics methods. FL.oorenics-AA which relies solely on the target input, mislabels > >10% of benign clients on CIFAR-10. This shows that using only target input x cannot effectively distinguish between malicious and Category I benign clients. PF and FLForensics-G. even when given the unfair advantage of direct access to local data, still trail behind FL When using clients' updates, as shown in Table 10 in Appendix, FL FLForeniic--G performs worse, while PF achieves nearly the same accuracy it attains with direct access to local data.
We conduct additional studies to evaluate the robustness and versatility of Fl.oorssics. Details are shown in Appendix G First, we compare using random input versus true target-class input as the non-target input FL Forensics: results are generally comparable, with slightly lower FPRs when using true input. Second, we apply Fl.Foressics to clean-label attacks,
Other experiments:
7

---

FRR
PMR
DACS
594
PAR
DA6C
PPR
FAR
Fraction Maliciuss
Dagree
Aggrogation
1.0
100
06
04
00
00
10%
20%
(b) Degree non-iid Figure 3: Ablation-study results for FLForensics. Figure 7 in the Appendix shows additional studies
(a) Fraction malicious clients
(c) Aggregation rules
(e.g., check points, client fraction, and scaling factor).
ASR
DAGC
FPR
FNR
Allack Frequency
Allack Probabilit
1.0
1.0
0.5
0.4
02
0.2
0.0
1.0
0.8
0.5
Triggor Location
Trigerr Value
Triggor Siza
0.8
0.6
0.5
0.4
0.4
04
0.0
UR
LR
UL
L1
Random
0.0
0.0
2x2
3x3
5x5
10x10
Figure 4: Results of FLForensics for adaptive attacks.
where poisoned samples retain their original labels. Even in this setting, FLForensics performs well (e.g.. DACC=0.95, FPR=0.06, FNR=0.0 on CIFAR-10). Lastly, we show that Forensiis can be adapted to centralized learning by treating each training example pseudo-client. On imbalanced datasets, it outperforms existing poison-forensics baselines, similar the FL case with non-iid data.
5.4 Ablation Studies
This section presents several ablation studies for FLForensics, including the impact of (i) the fraction of malicious clients, (ii) degree of non-lID data, and (iii) aggregation rules. Appendix H further shows the impact of the number of check points, scaling factor, and fraction of selected clients.
Figure 3a shows that FLForensics works well when large fraction of clients (e.g., 40%) are malicious. Specifically, FLForensics achieves the FNR and FPR=0 for attacker fractions varies from 10% to 40%. We consider least 10% of malicious clients because the attacks themselves become ineffective
Impact of fraction of malicious clients:
[16 when the fraction is small.
Impact of degree of non-iid: Based on Figure 3b FLForensics works well across different degrees of non-iid. particular, FLForensics achieves 0 FPR and most 15% FNR, confirming design for non-lID data. Note that 0.1 degree of non-iid represents the iid setting.
Impact of aggregation rule: Figure 3c shows that FLForensics still identifies malicious clients when the server uses Byzantine-robust aggregation rules. Although these rules alone cannot stop the attacks (as shown in Table 9) pairing them with Fl.Forensics provides strong defense. FLForessics achieves slightly higher FPR under FLAME because Scaling attack less effective for FLAME, causing few Category I clients to be misclassified malicious.

---

6
Adaptive Attacks
Our theoretical analysis in Appendix B proves FLForensics resilient to any (adaptive) poisoning attack that meets our formal definition. Attacks that violate this definition can hurt FLForensics's detection but usually decrease their own ASR. We thus test several such adaptive variants under default settings, e.g., CIFAR-I0, 150 check points, and all clients participate in each round.
Attack frequency and probability: To evade detection, malicious clients may attack only inter- mittently. First, they can strike every training rounds. As shown in the subfigures on the first row of Figure 4 when e I 5, attacks remain effective (high ASR) and FLForensics is still effective; once e 2 I0, ASR falls below 12% and FLForensics's s performance drops because the threat itself weak. Second, clients may attack each round with probability p. As shown in Figure 4 when p declines, ASR and FL. 's recall both decrease, but Fl.Foresiccs stays effective for p 2 0.5 with a FPR less than 1. 1.25%. Even at p = 0.2, while the ASR is 20%, Fl.Foressics misses some malicious clients but misclassifies at most one benign client. This means if an attacker aims to evade FLForensics, its attack becomes less or not effective.
Trigger location, value, and size: Subfigures on the second row of Figure 4 evaluate FLForensics under the Scaling attack as we vary the trigger's location, value, and size. Attacks with triggers placed at fixed locations-URR LR, UL, and LI achieee high ASRs, where these denote the upper right, lower right, upper left, and lower left corners of the image, respectively. The trigger in these experiments is the same in [3]. In these cases, FLForensics identifies all malicious clients. When the trigger at random locations, the attack is less effective, leading to some missed detections (FNR around 30%). Furthermore, altering the RGB value shows similar pattern: once the attack effective--t e.g. white (255, 255, 255) or gray (204, 204, 204) - FLForensics traces every malicious client, whereas an all all-black trigger, which fails poison the model (ASR=0), leaves them undetected. Finally, we find that increasing trigger size boosts ASR: a 2x2 square ineffective and hampers detection, but sizes larger than 3x3 already let FLForensies catch every malicious client even when ASR is only 14.2%. Overall, FL.Frensicc succeeds whenever the trigger is large, distinctly colored, consistently placed enough to mount meaningful attack, and it degrades only when the attack itself has little impact.
7 Discussion
Recovering from attacks after Fl.Foreniis:: After FLForensics detects malicious clients, the server can discard their updates and re-train the global model. On 110 under Edge attack, the case with highest FNR, test accuracy improves from 81.9% to 82.8%, while ASR drops from 17.4% to 5.6%. This recovery can be made communication-effeee with methods like FedRecover [10].
Detecting misclassified target input: FLForensics assumes the given misclassified sample is a target input. If it is not, the real attackers may not contribute to it and thus escape detection. We adapt FLForensics to first decide whether a misclassified sample is a target input. For a misclas- sified input æ and a non-target input z', we compute each client's 's influence scores (s,, (s) and run FLForensics to form potential malicious clusters Cp,- Our intuition is that all potential mali- cious clusters have nearly identical mean 8; and s',, making and x' indistinguishable in influ- ence, we label the misclassified input x non-target. If every such cluster satisfies Cp, satisfies S; S a for some < 1, we judge to be non-target input; otherwise, S Eieep, / Eierry
we treat it as a target input. With a 0.2, we evaluate the method on 50 randomly chosen target samples and 50 misclassified non-target samples. It correctly labeled 96% of the target inputs and 98% of the non-target inputs.
8 Conclusion and Future Work
In this work, we propose FLForensics, the first poison-forensics method to trace back malicious clients in FL. We theoretically show the security of FLForensscs against (adaptive) poisoning attacks under formal definition of poisoning attack. Moreover, our empirical evaluation results on multiple benchmark datasets show that FlForensies can accurately trace back malicious clients against both oftte-of- and adaptive poisoning attacks. An interesting future work is to extend FLForensics

---

to untargeted poisoning attacks and explore the security of FLForensics against strategically crafted misclassified target input.
Acknowledgement
We thank the anonymous reviewers for their constructive comments. This work was supported by NSF under grant no. 2131859, 2125977, 21 215262 and 1937787.
References
[1] Federated Learning: Collaborative Machine Learning without Centralized Training Data.
[2] Utilization of FATE in Risk Management of Credit in Small and Micro Enterprises.
[3] Eugene Bagdasaryan, Andreas Veit, Yiging Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In AISTATS, 2020.
[4] Moran Baruch, Gilad Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In NeurIPS, 2019.
[5] Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. university press, 2004.
Cambridge
[6] Ricardo JGB Campello, Davoud Moulavi, and Jörg Sander. Density-based clustering based on hicrarchical density estimates. In PAKDD, 2013.
[7] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021.
[8] Xiaoyu Cao and Neil Zhenqiang Gong. Mpaf: Model poisoning attacks to federated learning based on fake clients. CVPR Workshops, 2022.
[9] Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. AAAI, 2021.
[10] Xiaoyu Cao, Jinyuan Jia, Zaixi Zhang, and Neil Zhenqiang Gong. Fedrecover: Recovering from poisoning attacks in federated learning using historical information. In IEEE Symposium on Security and Privacy, 2023.
[11] Xiaoyu Cao, Zaixi Zhang, Jinyuan Jia, and Neil Zhenqiang Gong. Fleert: Provably secure federated learning against poisoning attacks. In IEEE Transactions Information Forensics and Security, 2022.
[12] George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. In CVPR, 2022.
[13] Siyuan Cheng, Guanhong Tao, Yingqi Liu, Shengwei An, Xiangzhe Xu, Shiwei Feng, Guangyu Shen, Kaiyuan Zhang. Qiuling Xu, Shiging Ma, et al. Beagle: Forensics of deep learning backdoor attack for better defense. In NDSS, 2023.
[14] Edward Chou, Florian Tramer, and Giancarlo Pellegrino. Sentinet: Detecting localized univer- sal attacks against deep learning systems. In S&P Workshops, 2020.
[15] Jia Deng, Wei Dong, Richard Socher, Li-Jia L.i, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. In CVPR, 2009.
[16] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In USENIX Security Symposium, 2020.
[17] Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Elizabeth S Bentley. Aflguard: Byzantine- robust asynchronous federated learning. In ACSAC, 2022.
10

---

[18] Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sundararaja Sitharama Iyen- gar, and Haibo Yang. Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025.
[19] Minghong Fang, Minghao Sun, Qi Li, Neil Zhenqiang Gong, Jin Tian, and Jia Liu. Data poisoning attacks and defenses to crowdsourcing systems. In The Web Conference, 2021.
[20] Minghong Fang, Xilong Wang, and Neil Zhenqiang Gong. Provably robust federated rein- forcement learning. In The Web Conference, 2025.
[21] Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. Byzantine-robust decentralized federated learning. In CCS, 2024.
[22] Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In ACSAC, 2019.
[23] Alec Go. Richa Bhayani, and Lei Huang. Twitter sentiment classification using distant super-
vision. CS224N project report, Stanford, 2009.
[24] Tianyu Gu, Brendan Dolan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. In IEEE Access, 2019.
[25] Zayd Hammoudeh and Daniel Lowd. Identifying training-set attack's 's target using renormal- ized influence estimation. In CCS, 2022.
[26] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[27] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. In Neural computation, 1997.
(28) Yuqi Jia, Saeed Vahidian, Jingwei Sun, Jianyi Zhang, Vyacheslav Kungurtsev, Neil Zhenqiang Gong, and Yiran Chen. Unlocking the potential of federated learning: The symphony of dataset distillation via deep generative latents. In European Conference on Computer Vision, pages 18-33. Springer, 2024.
[29] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[30] Yann LeCun, Corinna Cortes, and CJ Burges. Mnist handwritten digit database. Available: http://yann. lecun. com/exdb/mnistt, 1998.
[31] Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The "beatrix" resurrections: Robust backdoor detection via gram matrices. In NDSS, 2023.
[32] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-effiiiee learning of deep networks from decentralized data. In AISTATS, 2017.
[33] Thien Due Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, et al. Flame: Taming backdoors in federated learning. In USENIX Security Symposium, 2022.
[34] Fruit Ripening. Banana ripening process dataset. fruit wwwpa/////aaaaaaiiiiaieeiee
https://mniverserrooff..o com/
[35] Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Du- mitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In NeurIPS, 2018
[36] Shawn Shan, Arjun Nitin Bhagoji, Haitao Zheng, and Ben Zhao. Poison forensies: Trace- back of data poisoning attacks in neural networks. In USENIX Security Symposium, 2022.
11

---

[37] Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In NeurIPS, 2020.
[38] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for bench- marking machine learning algorithms, 2017.
[39] Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. In International Conference on Machine Learning, 2024.
[40] Yueqi Xie, Minghong Fang, and Neil Zhengiang Gong, Model poisoning attacks to federated learning via multi-round consistency. In Proceedings of the Computer Vision and Pattern Recognition Conference, 2025.
[41] Huan Xiong. Dped: Discrete principal coordinate descent for binary variable problems. In AAAI, 2022.
[42] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust dis- tributed learning: Towards optimal statistical rates. In JCML, 2018
[43] Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fidetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In KDD, 2022.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction clearly summarize the proposed method and the paper's 's contributions, which are well supported by the technical content.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of the work in Appendix [
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specificatton, asymptotic approximations only holding locally). The au- thors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low images taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [es]]
13

---

Justification:
All theoretical results are presented with clearly stated assumptions and proofs in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proofs provided appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide full experimental details in SectionS5art Appendix C includ- ing datasets, model architectures, and hyperparameters.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, other means that are appropriate the research performed.
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results way produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
14

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: All datasets are public, and we will release our code and implementation upon publication support reproducibility.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cr
Pllyy)) for more details.
While encourage the release of code and data, understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
//nips. ctccc//poocoo http/uulic/geee hetoolicggiies/// Cat////oeeeeeeeeeeeeeeee www.eeessmsssiinnPem ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g.. data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
The paper includes comprehensive details on training/testing setups, model architectures, attack methods, and FL parameters (Section 5 and Appendix C.F.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: While we do not report formal error bars, we report results across five datasets, three types poisoning attacks, and ablation studies across key factors, demon- strating consistent trends that validate statistical robustness.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
15

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (c.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state The authors should prefer- ably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Ye]]
Justification: We provide these information in Section The experiments be run on one single Quadro RTX 6000 GPU with 24GB memory and don't 't require more compute than reported in the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:///wwrrrrpccoo///aaacccchaa
Answer:
[Yes]
Justification: Our study adheres to the NeurlPS Code of Ethics and does not involve human subjects private user data.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification:
We discuss the positive societal impacts of work in Appendix g
Guidelines:
16

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitiga- tion strategics (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work does not release models or data posing high risk for misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by re- quiring that users adhere usage guidelines or restrictions access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All used datasets and models (e.g.. CIFAR-10) are cited with proper attribu- tion and used under their respective public licenses (Appendix C
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
17

---

For scraped data from a particular source (e.g., website), the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms of use the pack- age should be provided. For popular datasets, paperswi thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the li- cense of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and the documenta- tion provided alongside the assets?
Answer: [NA]
Justification:
We do not introduce any new dataset or model asset in this work.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the pa- per include the full text instructions given to participants and screenshots, applicable, well as details about compensation (if any)?
Answer: [NA]
Justification:
This work does not involve crowdsourcing or human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to NeurIPS Code Ethics, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects. and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our research does not involve human subjects and thus does not require IRB approval.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
18

---

Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: This paper does not involve large language models as a core methodological component.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy for what should or should not be described.
19

---

Appendix
A Related Work
A.1 Details of Poisoning Attacks in FL
Trigger-embedded poisoning attacks (backdoor attacks): These attacks treat any input embed- ded with specific trigger as a target input. In the Scaling attack [3, malicious clients duplicate local data, embed trigger into these examples, relabel them the target label, and amplify the resulting model update with a scaling factor À before sending it to the server.
The ALIE attack 4 follows similar data manipulation strategy, but constructs adversarial updates by solving an optimization problem to maximize the malicious effect.
Triggerless poisoning attacks: These attacks target specific inputs without any trigger. For exam- ple, the Edge-case attack [37], the attacker injects -f-issiibibttionn samples (edge cases) into the local training set of malicious clients and labels them with the target label. These inputs become target inputs post-training due to label manipulation.
A.2 Details of Training-phase Defenses
Robust aggregation: Byzantine-robuse methods like Trimmed Mean and Median 42 filter out extreme updates to resist outliers. FLTrust 7 anchors updates to a trusted reference dataset.
FLAME 33
incorporates client reputation into aggregation to downweight suspect clients.
Provably robust FL: FLCert trains multiple global models using subsets of clients, providing an ensemble-based lower bound on test accuracy even under strong attacks.
Client detection:
FLDetector 4 tracks consistency in model updates over time identify ma-
licious clients. FedRerover I0 recovers clean global model by filtering out detected malicious updates, avoiding the need to retrain from scratch.
B Theoretical Analysis
FLForensics builds on Observations I and II (Section 4.3 In this section, we provide theoretical justification for these observations under a formal definition of poisoning attacks and several mild assumptions. While these assumptions may not always hold in practice, we empirically validate the effectiveness of FLForensics in Section 3.3
B.1 Setup and Assumptions
We first formalize poisoning attacks in FL. Malicious clients aim to make the global model predict the target label y on any target input æ, minimizing log (z, yı w), while benign clients aim main- tain accuracy on non-target inputs z'. This leads to the following assumptions (see Appendix B.2 for formal definitions):
Local Linearity: Cross-entropy loss is approximately linear in a small neighborhood around the global model.
Behavioral Difference:
Malicious clients tend to decrease (x w) but not fce('', y; w), while benign clients do the opposite.
Label-rich Advantage: Category I benign clients, who have more data with target label, are more likely to behave like malicious clients on target inputs than Category clients.
B.2 Formal Definitions and Assumptions
Definition 1 (Poisoning Attack to FL.). In poisoning attack, malicious clients aim to poison the global model w such that it predicts target label y for any target input x, i.e., the loss tc (x, y w) is small; and benign clienty aim to learn the global model such that it is accurate for non-target
20

---

true inputs, i.e., the loss log(2', y: w) is small, Therefore, in a training round, a malicious client's 's model update does not increase the loss lor(z, y; w) for a target input, while a benign client's model update does not decrease such loss. On the contrary, a malicious client's 's model update does not decrease the loss lc : y; w), while benign client's 's model update does not increase such loss. Formally, for any check-point training round t. E 52 malicious client i, and benign client j. we have the following assumptions to characterize the training process:
lor(1' yr we + 9i S tor(x' y. Wt + 9i
(3)
(C wt ( 2 (CE(E, We Dr (8)
(7)
where Wt + 9t and + g6 respectively are the global models after training round I. if only the model updates of clients i and j were used to update the global model.
Assumption 1 (Local Linearity). We assume the cross-entropy losses lar(a', y, we) and lor(a, yi we) are locally linear the region around Wi. In particular, based on first-order Tay- lor expansion, we have the following:
ECE(a', . yr we 8) loE(d' w) + ViCE(1 (3; yy: T
(CE( y3 W + 8) (or( ys w/) + ViCE (2, 8.
We note that the local linearity assumption was also used in the machine learning community 41 Assumption (Label-rich Advantage). According to the definitions of Category and Category II benign clients, Category benign client possesses larger fraction of local training examples with the target label y compared to a Category benign client. Therefore, given any target input x with target label y, we assume that the local model of Category benign client is more likely predict x as than that of a Category II benign client. Formally, for any
training round t E Ω Category I benign client Jı, and Category Il benign client j2. we make the following assumption:
lor(x, yi W₁ + ( S (CF(E, W/ +g. (12)).
g.
(8)
where wt + (1)) +g is the local model of Category benign client ji and w, + 9t (22) of Category benign client j2 in the training round t.
is the local model
B.3 Guarantee for Observation I
We show that under these assumptions, malicious clients and Category I benign clients have higher influence scores 8, target inputs than Category II benign clients. Theorem andnd together show that Observation I holds.
Theorem 1. Suppose the server picks all clients in each check-point training round, i.e., C. (1,2.... ... , for 1. E Q, and FLForensics uses a true non-target inpul with target label y. Based on the poisoning attack definition and Assumption [ we have that the influence score s of a malicious client: is no smaller than the influence score sj of a Category II benign client j. Concretely, we have 8, 2 8j. where s and sj are computed based on Equation 4
in Assumption we have the following for each check-point training Proof. By setting 8 = Di (1) round
(CE(I, 8i Wi (( (o ys w.) VlCE(I, y5 wt) (0)
Similarly, by setting 5 = Dt (i) in Assumption
have:
(c y; w. + )( lorla, us wx) + V(oE(1, at
(10)
By combining Equation 7 and 10, we have:
ViCg(E, w.) gi (i) S VICE(A, w.)) gi
(11)
Since the learning rate at > 0 and C. 21, ... ,n] in each check-point training round, we have the following by summing over the theck-point training rounds on both sides of Equation II
Σ VoC gi
ai V.CE yi wx) gt ())
(12)
21

---

S 8j.
(13)
Therefore, we have 8; 2 8j, which completes the proof.
Theorem 2. Suppose the server picks all clients in each check-point training round, i.e., C2 ... .n) t E St and FLForensics uses a true non-target input with target label y. Based on
Assumption [ and Assumption 2 we have that the influence score Sj of a Category benign client ji is no smaller than the influence score 822 of a Category II benign client j2. Specifically, we have 85, 2 8/2, where 8n and 8), are computed based on Equation 4
Proof. According to Assumption 2 we have:
(oE(a, yi Wt + gt ( S LCE(a, yi we + 10))
(14)
By setting 8 = St and = Di (ja) in Assumption
i we can get:
lon(x, y1 wi + 96 ( = (ow yi wi) Vlor(E, y wx) 9t (n)
(15)
fO y3 we + 9t (12)) (o ys m.) VlCE(1, y; wx) gl
(16)
By combining Equation
14
15 and
16 have:
ViCg(E, y: w.) g S (x y; w;) g. (ia)
(17)
Since the learning rate ar > 0 and C. = {1, 21, ... n in each theck-point training round, we have the following by summing over the check-point training rounds on both sides of Equation 17
Σ IR
ViCE v. wr) gf
(2, g.
(18)
AE
841 -8j2
(19)
which gives 8, 2 $22 and completes the proof.
B.4 Guarantee for Observation II
We show that influence score gaps s - 5; are smaller for malicious clients than for benign ones.
Theorem 3. Suppose the server picks all clients in each check-point training round, iee, C. (1, .n] for E Ω and Fl.Forensics uses true non-target imput with target label y. Based on the poisoning attack definition and Assumption] 7 we have the influence score gap s 8t of malicious client is no larger than the influence score gap s'j 3J-s; sj of a benign client j. Formally, 83, where s; and 8j are computed based on Equation while s and s' are computed based on Equation 5
we have s s; S -
Proof. By setting 8 in Assumption round t:
(1)
have the following for each check-poit -hickt training
EC (x', y. we + )1 = loo(l', y wy) + VlCE(1 (ocre(,,, w)) gt
(20)
Similarly, by setting 5 = gr (1) in Assumption
we have:
loE(2', y: + ge ( LoE('', y: wi) + VlCE(2' y, w !.
(21)
By combining Equation 6 20 and 21 we have:
Vloc(1' y w,) 2 VlCE(d' yr w)) T
(22)
Since the learning rate a₁ and C. 21,2, ,.] in each check check-point training round, we have the following by summing over the check point training rounds on both sides of Equation 22
0+ VlCr(a' w:) gi > On VlCe(1' wx) 9i
(23)
(EQ
tEQ
2 s/y.
(24)
By combining Equations 13 and 24
we have 5y
S 8/ 8j. which completes the proof.
22

---

Table 3: Dataset statisties.
Dataset
Training
Testing
Classes
CIFAR-10
50,000
10,000
10
Fashion-MNiSh
60,000
10,000
10
MNIST
60,000
10,000
10
Sentiment 140
72,491
358
ImageNet-Fruits 13,000
500
10
Table CNN architecture for Fashion-MNISS and MNIST.
Layer
Size
Input
28 x 28
Convolution + ReLU
x 30
Max Pooling
2 2
Convolution ReLU
x 3 50
Max Pooling
2 2
Fully Connected ReLU
100
Softmax
10
Table 5: Default parameter setting. Since ImageNet-Fruits Fruits only has 40 clients and 8 malicious clients, and "min_cluster www.steeuuuseeeeeeeeeee size" is set to when performing clustering using HDBSCAN, we dupli- cate the influence scores of all clients before clustering, resulting in a total of 80 influence scores.
Parameter
CIFAR-10
-NNIST
MNIST
Seatiment140
ImageNet-Fruid
# clients
100
40
# malicious clicats
20
munds
1500
2000
# local training epochs
Batch size
64
Leaming rate
10-2
10
10"4
x 10 (decay at the 800th
10
epoch with factor 0.5)
chack
150 200
200
150
100
min_cluster.sizz size
7
Corollary 1.
Given malicious client and a benign client j. if the influence scores s; and
8j 0, then the inftuence score ratios satisfy: 2 51 ",
Proof. From Equation 13 and Equation
24 we have of S 80g and 8, 2 8y. Since 8, > and 83 > 0,
have:
(25)
8
$j
S
which completes the proof.
This directly implies the following:
Corollary 2. If S1, > 0, then 2
Remark. This explains why Fl.orensiccs can use the ratio s 8; to distinguish malicious clients from Category benign clients when both fall into the same high-s; cluster.
C Dataset Description
We conduct our experiments using five diverse benchmark datasets: four image datasets (CIFAR- 10, Fashion-MNIST, MNIST, and ImageNet-Fruits) and one text dataset (Sentiment140), Table summarizes their key statistics.
23

---

(a) MNIST
(b) ImageNet-
Fruits
Figure 5: Triggers in MNIST and ImageNet-Fruise datasets.
CIFAR-10 [29]. This is a commonly employed dataset in image classification task, comprising 50,000 training examples and 10,000 testing examples. Fach input is 3-channel color image of 32x32 pixels in size and belongs to one of ten classes. Model: ResNet-20 (26), implemented using MXNet. License: Apache License 2.0. Dataset License: MIT License. https: // www.
cs. toronto. edu/ "kriz/ cifar. html
Fashion-MNIST (38)
This dataset consists of 70,000 grayscale images of fashion items, divided into 60,000 training examples and 10,000 testing examples. Each input is of 28x28 pixels in size and belongs to one of ten classes. Model: A custom CNN architecture implemented using MXNet (Table 4. Dataset License: MIT License. https: // githuu.. com/ zalandoresearch.
f fashion ms
MNIST 30). Like FaShion-MNIST, MNIST also contains 70,000 1-channel grayscale images, split into 60,000 training examples and 10,000 testing examples. Each input is 28 x8x28 28 pixel image of handwritten digit. The dataset includes ten classes with each class corresponding to a digit from O to Model: Same CNN architecture Fashion-MNIST, implemented using MXNet. Dataset License: Creative Commons Attribution
Alike 3.0. http: yann. lecun. com/ eadb/ mnist/
Sentiment140 [23). This is two-class text classification dataset for sentiment analysis. The dataset is collected from Twitter users. In our experiments, we adopt users with at least 50 tweets, which results in 927 users. Each user has pre-defined set of training and testing tweets. For sidered users, we have 72,491 training tweets and 358 testing tweets in total. Model: LSTM (27%, implemented using MXNet. License: Apache License 2.0. Dataset License: Other (academic use only). https: //ap::////uguai inggingfacc ace. co/ dat datasets/ s tatanffrrdni
sentimentigy
ImageNet-Fruits [12.. This is an image classification dataset comprising 128x 128 pixel color images. It represents a subset the larger ImageNet- Ik (I5) dataset, specifically curated to include ten fruit categories. Model: ResNet-50 [26], implemented using MXNet. License: Apache License 2.0. Dataset License: ImageNet terms (non-commercial research only). https: // image menage--ets net. org/ download
D Poisoning Attack Description
Scaling 3]. Following 3], malicious clients duplicate their local data, embed a trigger, relabel these copies with the target label, and train the mix of original and duplicated samples. Furthermore, malicious clients scale their updates by a factor y before sending them to the server. We set 7 by default, since is stealthy yet still effective. Triggers follow 3 for CIFAR-10 and [24 for Fashion-MNIST; those for MNIST and ImageNet-Fruits appear in Fig. 5a and Fig. 5b For Senti- m4 insert the phrase 'debug FLpoisoning" in place of consecutive words. Target labels are for CIFAR-10, O for Fashion-MNIST and MNIST, 'negative" for Sentiment 140, and for ImageNet-Fruit.
little is enough (ALIE) [4) The attacker in ALIE attack uses the same strategy as that in Scaling attack to embed the triggers into duplicated local training inputs and set their labels as target labels on the malicious clients. However, instead of scaling the model updates, the malicious clients carefully craft their model updates via solving an optimization problem.
The attacker Edge attack injects some training examples (called edge-case examples) labeled as the target label into the malicious clients" local training data, which are from a distri- bution different from that of the learning task's overall training data. Each malicious client trains its local model using the original local training examples and the edge-case ones following the FI.
Edge [37].
24

---

algorithm. In our experiments, for CIFAR-10 and Sentiment140 datasets, we use the edge-case examples respectively designed for CIFAR-10 10 and Sentiment 10 datasets [37. For the Fashion- MNIST and MNIST datasets, we use the edge-case examples designed for EMNIST dataset in (37 For ImageNet-Fruits dataset, we use unripe banana images from 34 as edge-case examples and label them as 'cucumber'. The target inputs are from the same dataset as the edge-case examples.
E Extending GAS to FL
Since the total number of training examples possessed by all clients is much larger than the number of clients, when we detect malicious training examples, we use HDBSCAN divide the examples into a big cluster (size is at least half of the whole training dataset size) and outliers with respect to their influence scores by setting "min_cluste" ciuster-size" as DD// 1, where D the whole training dataset size. Unlike FLForensics, we adopt the Euclidean distance metric for HDBSCAN since GAS only has one-dimensional influence score, for which scaling is meaningless. We then use the outliers to determine the threshold since the big cluster corresponds to the majority clean training examples. Specifically, HDBSCAN outputs a confidence level (a number between and 1) for each outlier, which indicates the confidence HDBSCAN has at predicting an input as outlier. We adopt a confidence level of 95%, which widely used in statistics. Specifically, we treat the outliers whose confidence levels are at least 95% and whose influence scores are positive as "true" outliers. Moreover, we set the smallest influence score of such true outliers as the threshold.
F
Simulating Non-iid Setting in FL
Following previous works 7 [6 to simulate the non-iid data distribution across clients, we ran- domly partition all clients into C' groups, where C' is the number of classes We then assign each training example with label y to the clients in one of these C groups with a probability. In particular, a training example with label y is assigned to clients in group y with a probability of p. and to clients in any other groups with an equal probability of 1-2, C-T. where p E [0.1, 1.0.. Within the same group, the training example is uniformly distributed among the clients. Therefore, P controls the degree of non-iid. When p = 0.1, the local training data follows iid distribution in our datasets; otherwise, the clients' local training data is non-iid. A higher value p implies a higher degree of non-iid.
G Details of Other Experiments
Using true input as non-target input: In our experiments, we random input (e.g., a random image) as a non-target input in FL Forensiss.. When a true input with the target label is available, the server also use it as the non-target input. Table comparres the results when FLForensics uses a random input or true input as the non-target input on the five datasets and three attacks. We find that random inputs and true inputs achieve comparable results in most cases, except several cases, for which true inputs achieve slightly lower FPRs. These results indicate that if a true input with the target label from the learning task's 's data distribution is available, the server can use it as the non-target input.
Forensics for clean-label targeted attacks: We focus on dirty-label attacks, where poisoned sam- ples are relabeled to the target label. However, we find that FLForensics also works well for clean- label attacks, where labels remain unchanged, since it relies clients' model updates rather than training data. Once those updates are backdoored, Forensics can still trace back. We test this using the clean-label attack (5 on CIFAR-10 with FedAvg, training 'cat" images to resemble "dog" features while keeping their original labels. Under default settings, Fl.orensicss achieves DACC=0.95, FPR=0.06, and FNR=0.0, confirming its effectiivenss.
Extending FLForensics to centralized learning: FLForensics can also be extended to centralized learning by treating each training example as client.' In this setting, w, in Equation iis the model at
(4) the 4th mini-batch, and gi is the gradient of the loss of w, on the ith example, Table 7 shows results on the dataset sampled from 100, where we inject triggers (as in our FL setup) into 10% of
training data with target label 1. Fo. denotes the use of a true input as the non-target When the dataset is imbalanced, which is similar
input. Class distributions are shown in Figure 6
25

---

Table 6: Results of FLForensics when using random true input non-target input.
Scaling atlack
ALIE atlack
Edge attack
Dataset
Non-target input
DACC
DACC
FPR
FNR
DACC
FPR
FNR
Random
1.000
0.000
0.000
1.000
0.000
0.000
0,980
0.000
0.100
CIFAR-10
True 1.000
0.000
0.000
1.000
0.000
0.000
0,970
0.013
0.100
Random
1.000
0.000
0.000
1.000
0.000
0.000
1.000
0.000
0.000
Fashion-MNIIT
True
1.000
0.000
0.000
1.000
0.000
0.000
1.000
0.000
0.000
Random
1.000
0.000
0.000
1.000
0.000
0.000
1.000
0.000
MNIST
True
1.000
0.000
0.000
1.000
0.000
0.000
1,000
0.000
0.000
Random
0.980
0.025
0.000
1.000
0.000
0.000
0,970
0.038
0.000
Sentiment 40
True
0.990
0.013
0.000
1.000
0.000
0.000
0.990
0.013
0.000
Random
1.000
0.000
0.000
1.000
0.000
0.000
0.950
0.031
0.125
ImageNet-Firuit
True
1.000
0.000
0.000
1.000
0.000
0.000
0.950
0.031
0.125
5000
Number training examples
4000
2000
2000
1000
2
Figure 6: Number of training examples for each class, where class distribution is roughly a power- law. We sample the unbalanced dataset from CIFAR-10. We have 20,431 training examples in total.
Table Results for centralized learning. The class distributions are shown in Figure
Method
DACC
FPR
FNR
PF
0.831
0.189
0.000
FLForensics-G
0.828
0.191
0.000
FT. Forensics-A A
0.826
0.194
0.000
FLForensics
0,992
0.008
0.005
FLForcnsics
0.998
0.002
0.000
Table 8: Storage overhead of FLForensics.
# check
Storage overhead (GB)
Dataset
clients
points
CIFAR-10
100
15.22
Fashion- Fashion-MNIST MNNST
200
100
10.43
MNIST
200
100
10.43
Sentiment140
150
100
3.02
ImageNet-Fruus Fruits
100
40
22.20
to non-III data in FL. and the target label belongs to a majority class, FLForensics significantly outperforms existing poison-forensics methods.
H Other Ablation Studies
In this Section, provide other ablation studies for FLForensics.
Impact of number check points and storage overhead: Figure 7a shows the impact of the number of check points on FL.orensics. We observe a trade-off between storage overhead and
poison-forensies performance. particular, when server saves more check points, which incurs
more storage overhead, the server can more accurately detect the malicious clients. We also note
26

---

AMOC
FRR
PMR
PAR
DA6C
PR
PAR
Number of Chack Points
Praction Solected
Scaling Factor
1.0
100
1.0
06
0.
0.
00
60
00
0.6
0.5
1.0
15.0
(a) Number of check points
(h) Fraction selected clients
(c) Scaling factor
Figure 7: Results of other ablation studies for FLForensics.
that the storage overhead is acceptaale for a powerful server to achieve good poison-forensics per- formance. Table X shows the storage overhead for different datasets in our default settings. For instance, saving 150 check points for CIFAR-10 10 requires 15.22GB storage, which is acceptable for powerful server like a data center.
Impact of fraction selected clients: Based on Figure 7b Forenssics works well even the server selects small fraction of clients in each training round. The reason is that once malicious client appears in multiple check-point training rounds, FLForensics can accumulate its influences to distinguish it with benign clients. Note that in this experiment, we save all training rounds as check points so malicious client appears in multiple of them.
Impact of scaling factor y: Based on the results in Figure 7c we observe that FoForessics works well for wide range of scaling factors used by the Scaling attack. The reason is that once the Scaling attack is effective, FLForensics can identify the malicious clients. Previous work [3] shows that the higher the scaling factor, the more effective the attack, but also makes the attack more susceptible to detection. We can observe that our FLForensics can detect all the malicious clients even when the scaling factor is close In such cases, methods (e.g., FLDetector) that rely on the magnitudes of clients' model updates to detect malicious clients often fail.
I Limitation
Forensies for untargeted poisoning attacks: This work focuses on forensics for targeted poison- ing attacks. A promising direction for future work is extending FLForensics to handle untargeted attacks (16), where the poisoned model misclassifies many clean inputs, resulting in low test accu- racy. Our current method is less effective in this setting, the misclassified input in untargeted poisoning attack also a non-target input.
Broader Impact
Our work proposes FLForsssccs, the first method to trace back malicious clients in poisoning tacks to FL. It addresses a critical gap in existing defenses, which primarily focus on preventing attacks during training. FLForensies provides complementary line of defense by enabling post- deployment forensics, which is especially important when training-phase defenses fail.
This contribution has positive societal impact, it helps increase accountability in collaborative learning systems deployed in sensitive domains such as healthcare, finance, and mobile platforms. By identifying malicious participants after attack-induced misclassifications, FL Forensics promotes the development of more trustworthy and robust federated systems.
27

---

Table 9: Test accuracy (TACC) and attack success rate (ASR) of different FL aggregation rules under different attacks. For the Trim aggregation rule, the trim parameter is set to the number of malicious clients. The server in FLTrust holds small and clean root dataset. In experiments, the size of the root dataset is set to 50, and the root dataset is drawn from the same distribution as that of the learning task's overall training data. For the FLAME aggregation rule, we use the same parameters as in [33]. We do not show ASR when there is no attack (i.e., "-") because different attacks use different triggers.
(a) CIFAR-10
FedAvg
Trim
Median
FLTrust
FLAME
Attack
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
attack
0.837
0.769
0.755
0.811
0.774
Scaling attack
0.831
0.682
0.777
0.950
0,780
0.930
0.816
0.642
0,776
0.644
ALIE attack
0.843
0.956
0.814
0.754
0.809
0.980
0.806
0.968
0.780
0.958
Edge allack
0.819
0.174
0.761
0.337
0.762
0.352
0.794
0.056
0.789
0.087
(b) BushionnMMNIST
FedAvg
Trim
Median
FLTrust
FLAME
Attack
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
No attack
0,900
0.856
0.864
0.880
0.887
Scaling attack
0.887
0.953
0,870
0.892
0.841
0.043
0.874
0.037
0.024
ALIE attack
0.889
0.941
0.809
0.113
0.764
0.040
0.876
0.038
0.886
0.020
Edge attack
0.886
0.990
0.862
1.000
0.856
1.000
0.861
0.990
0.883
0.990
(c) MNIST
FedAvg
Trim
Median
FLTrust
FLAME
Attack
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
No attack
0.960
0.948
0.943
0.926
0.948
Scaling attack
0.958
0.950
0.921
0.013
0.936
0.010
0.926
0.006
0.954
0.005
attack
0.958
0.944
0.788
0.045
0.929
0.013
0.927
0.007
0.953
0.005
Edge attack
0.953
0.990
0.938
0.980
0.939
0.960
0.919
0.580
0.953
0.070
(d) SENT140
FedAvg
Trim
Median
FI.Trust
FLAME
Attack
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
No attack
0.660
0.684
0.673
0.494
0.589
Scaling attack
0.659
0.995
0.616
0.985
0.645
1.000
0.494
1.000
0.592
0.232
ALIE attack
0.687
1.000
0.654
1.000
0.531
0.801
0.494
1.000
0.651
0.122
Edge attack
0.564
0.600
0.567
0.683
0.609
0.858
0.494
1.000
0.581
0.175
(c) ImageNet- fruuttsss
FedAvg
Trim
Median
FLTrust
FLAME
Attack
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
TACC
ASR
No attack
0.517
0.537
0.509
0.480
0.492
Scaling attack
0.494
0.881
0.465
0.749
0.467
0.842
0.473
0.108
0.494
0.102
ALIE attack
0.488
1.000
0.486
0.113
0.469
0.132
0.482
0.115
0.502
0.952
Edge attack
0.514
0.283
0.529
0.279
0.502
0.219
0.490
0.377
0.470
0.465
Table 10: Results of PF and FLForensics- G when they use the clients' model updates.
Scaling allack
ALIE attack
Edge attack
Method
DACC
FPR
FNR
DACC
FPR
FNR
DACC
FPR
FNR
PF
0.900
0.125
0.000
0.900
0.125
0.000
0.920
0.100
0.000
FL. Forensiiis
0.850
0.150
0.150
0.880
0.150
0.000
0.880
0.138
0.050
28


Reviews:
[{"review_id": "gZwfLpNqx9", "reviewer": "Reviewer_Fzy5", "summary": "This paper proposes FLForensics, the first post-hoc forensic method for identifying malicious clients in FL after a poisoning attack has occurred. Instead of preventing attacks during training, FLForensics traces back attackers once a misclassified target input is discovered from the deployed global model. It assigns each client a 2D influence score based on how their updates affect the model’s behavior on both the target input and a non-target input. The paper also offers both theoretical and empirical justifications.", "questions": "1. While the method is in general interesting, some of the details seem bizarre, for example, the method requires \"scaled\" distance to work seemingly suggest the method itself is not robust enough. Can the authors demonstrate why the scaling is necessary? For example, are there cases where non-scaled cases can perform better for clustering? \n\n2. Intuitive speaking, the results should highly depend on the strength of attacks, probably whether these malicious clients are all targeting the same target. How did the authors choose the strength of the attacks? \n    - for the attacks that are strong enough to flip 100% of the labels, the detection might be able to identify, but what if the clients are minor and only want to flip the label in a lower rate?\n   - are there trade-offs between the success rate of the attack vs. the success rate of the detections? \n   - line 237 says the paper will also present ASR, but the table does not seem to have these results\n\n3. while the local linearity assumption is fairly reasonable in ML community, in this particular setting, the authors are referring to the \\delta as model updates, thus the problem might depend on the practical settings on the FL system and how the system chooses to update the model, some discussions, and evidence that in most FL settings, this assumption still holds might be necessary.", "limitations": "There is no explicitly section on limitation, but the authors have discussed future work, which can probably be interpreted as limitations.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "strengths\n\n- The novel problem setting is very interesting, practically important, and a creative usage of the influence function method. \n\n- The emperiments have been conducted over a range of datasets and model architectures, although fairly small, but reasonable in FL studies. \n\nweakness:\n\n- The method requires access of target input and also access to the client model after training to \"tests every client on a random non-target input 50 with the target label\". In practice (not experimental settings), when the server relies client on a practical manner, the requirement does not seem to be very realistic. \n\n- The method also relies on unsupervised manner (clustering) to detect anormally, through which the results seem too ideal (see questions for more details)", "was_revised": true, "final_justification": "The reviewer has mostly addressed my concerns, I will keep my original positive score.", "rebuttal": "Thank you for your recognition of our work and your valuable comments. Below are our responses.\n\nW1: **Requirements seems not realistic**: FLForensics traces back malicious clients based on a single reported misclassification event. We assume the server has received such an input from a client. To access client models, we store model checkpoints from selected rounds during training, eliminating the need to request any additional information post-training. In summary, the only requirement is a misclassification event reported by a client.\n\nFurthermore, as discussed in Appendix G (“Detecting Misclassified Target Input”), our method can distinguish between misclassifications caused by poisoning attacks and those resulting from natural errors. Therefore, the misclassified input does not need to be a poisoning-induced target input.\n\nW2: **Relies on unsupervised manner**: Please see the responses for Q1, Q2, and Q3.\n\nQ1: **Why scaling is necessary**: The scaling operation enhances the robustness of our method. As illustrated in Figure 2(b), since $s_i$​ and $s’_i$ may be on different scales, clustering can become significantly biased, placing excessive weight on the dimension with larger magnitudes (typically $s’_i$​) while largely ignoring the other. As a result, clusters (i.e., points with different shapes) are formed primarily based on $s’_i$, leading to inaccurate separation. By scaling the two influence scores, clustering considers both dimensions equally, regardless of their original scales. In other words, the scaling operation ensures that FLForensics can robustly identify the malicious client cluster even when $s_i$ and $s’_i$ are on different scales. Therefore, the scaled case is consistently more stable and robust than the non-scaled case.\n\nQ2: **The strength of the attack**: (1). As shown in Figure 4, the Adaptive Attack achieves very high ASR under some settings (e.g., attack frequency = 1, attack probability = 1, trigger size = 10, and trigger value is random or white), while the ASR is relatively low under others (e.g., attack frequency = 10, attack probability = 0.2, etc.). When the attack is highly effective, we achieve nearly 100% detection accuracy. Even when the attack is less effective, our method still maintains over 90% detection accuracy in most cases. The only exceptions arise when the trigger value is black or the trigger size is 2$\\times$2, in which cases the detection accuracy drops. However, in these scenarios, the ASR is 0, indicating that the attacks are ineffective.\n\n(2). According to Figure 4, there is generally a trade-off: higher ASR typically makes the attack easier to detect. However, even in many scenarios with very low ASR (e.g., attack frequency = 10, trigger location = UL, trigger value = grey, trigger size = 3$\\times$3), our method still achieves nearly 100% detection accuracy.\n\n(3). ASR is an important metric. However, due to space limitations, we had to place the ASR results in Table 6 of the Appendix. We mention this on line 263. We will add a citation to Table 6 at line 237.\n\nQ3: **Problem might depend on the practical settings**: In common FL systems, clients exchange either models or model updates with the server. In our paper, we assume that model updates are exchanged. However, if full models are shared instead, the server can still compute the updates by subtracting the previous global model (e.g., $w^{(i)}_ {t+1} - w_ t$, where $w^{(i)}_ {t+1}$ is the shared model from client $i$.) allowing influence scores to be calculated for traceback. Additionally, the server can apply different aggregation rules when updating the global model. We demonstrate this in Figure 3(c), which shows results under various aggregation rules. These observations collectively indicate that FLForensics remains effective under different FL system settings."}, {"review_id": "8hjYYTq2on", "reviewer": "Reviewer_Y9xs", "summary": "This paper proposes a mechanism to detect malicious clients in an FL protocol in the aftermath of data poisoning. By examining the influence score of model updates to the misclassified instance, the protocol is able to detect malicious clients. The forensic detection is effective across multiple datasets, aggregation rules and attack methods.", "questions": "1. The attack success rate for Scaling attack against FLTrust on CIFAR10 (Table 6a) is very different from the one in Table III d) in the original FLTrust paper. Why?\n\n2. The assumption of label-rich advantage looks somewhat artificial. What was the motivation of singling out this assumption? Is this assumption backed up with empirical evidence?", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strength**\n\nThis paper is overall well-written. It provides a simple yet effective solution to detect malicious client after deployment. The experiments cover a decent number of research questions and the designs are fair. \n\n**Weakness**\n\nThe theoretical analysis in Section 5 is unnecessary. The proof are very definitional from the assumptions. I suggest removing it and shifting more important results such as how to determine if a misclassified input is target or non-target. \n\nOverall, I find the idea of this paper solid and the approach sound. The setting may not be the most interesting, but it seems to be the first paper investigating this problem. The empirical evaluation is the highlight while some of the theoretical claims and assumptions seem unnecessary to me. The paper is borderline. I want to listen to authors' response to my questions.", "was_revised": true, "final_justification": "The authors have addressed my technical concerns, and proposed a plan to improve the writing in the camera ready version. Therefore, I raised my rating from 3 to 4.", "rebuttal": "Thank you for your feedback! We will carefully consider the theoretical analysis section and adjust the content of the paper accordingly.\n\nQ1: **Results is different from the original paper**: Our experimental setup is largely aligned with that of FLTrust, with two main differences: the amount of data held by the server and the scaling factor used in the Scaling attack. In the FLTrust paper, the server holds 100 data samples, and the scaling factor is set to the number of clients (100 in their experiments). This means each malicious update is scaled by a factor of 100 to amplify its influence during aggregation. In contrast, our work uses only 50 server data samples and sets the scaling factor to 1. This design choice is motivated by the following considerations:\n\n1). We found that when the server holds 100 data samples, the ASR of the Scaling attack drops to 0.01, which aligns with the results reported in the FLTrust paper. In such cases, using FLForensics to trace back malicious clients and retrain a global model becomes less meaningful. Therefore, we reduce the number of server data samples to make the attack more effective.\n\n2). Setting the scaling factor to 1 avoids making the malicious updates significantly larger in magnitude than benign updates. If we used a scaling factor of 100, the malicious updates would become trivially detectable, for instance, by simply filtering out updates with abnormally large norms. To demonstrate that FLForensics can accurately trace back malicious clients even when malicious updates appear similar in scale to benign ones, we chose a scaling factor of 1.\n\nAdditionally, we also conducted experiments using the same settings as FLTrust. The results are as follows:\n\n100 server data samples and a scaling factor of 1:\n\n|Attack|TACC|ASR|DACC/FPR/FNR|\n|-|-|-|-|\n|Scaling|0.815|0.012|1.000/0.000/0.000|\n|ALIE|0.827|0.028|1.000/0.000/0.000|\n|Edge|0.823|0.036|0.920/0.000/0.000|\n\n100 server data samples and a scaling factor of 100:\n\n|Attack|TACC|ASR|DACC/FPR/FNR|\n|-|-|-|-|\n|Scaling|0.815|0.031|1.000/0.000/0.000|\n|ALIE|0.826|0.037|1.000/0.000/0.000|\n|Edge|0.803|0.046|0.980/0.000/0.100|\n\nThe results show that FLForensics can still accurately trace back malicious clients. Although the detection accuracy for certain attacks (e.g., Edge attack) is lower in these settings, this is largely because such attacks have negligible impact. This highlights a trade-off between attack effectiveness and traceback effectiveness.\n\nQ2: **Label-rich advantages**: Our motivation for the \"label-rich advantage\" assumption stems from the empirical observation that a subset of benign clients consistently exhibits very high influence scores. Figure 2(a) illustrates this phenomenon: clients are color-coded as red (malicious), green (Category I benign), and blue (Category II benign). As shown, the influence scores of Category I benign clients are very close to those of malicious clients, while Category II benign clients display significantly different influence patterns. This also explains why **FLForensics-A**, which uses only the one-dimensional influence score, consistently exhibits some FPR. Since the 1D influence score cannot distinguish between malicious clients and Category I benign clients, it tends to misclassify Category I benign clients as malicious.\n\nTo further validate this assumption, we conducted the following experiment: we relabeled all test data samples to the target label and evaluated the cross-entropy loss on these inputs using each client’s final-round local model. Averaging the results, we found that malicious clients had an average loss of 4.82, while Category I and Category II benign clients had average losses of 0.18 and 12.04, respectively. This indicates that **Category I clients are far more likely to predict arbitrary inputs as the target label**, even more so than the malicious clients themselves. This clear separation in behavior provides strong empirical support for the \"label-rich advantage\" assumption."}, {"review_id": "6jrLDwECEM", "reviewer": "Reviewer_7o1F", "summary": "The paper proposes FLForensics, a method to identify malicious clients in federated learning (FL) after a poisoning attack has taken place. The approach assumes access to individual client updates and relies on storing model updates at selected checkpoints during training. Once a misclassified target input is identified, the server computes per-client influence scores and uses clustering to distinguish malicious clients from benign ones. The authors provide a theoretical analysis under simplifying assumptions and evaluate the method on several datasets and poisoning attacks. The entire framework is built on vanilla FL, where no privacy mechanism such as secure aggregation is used.", "questions": "I apologize if my evaluation comes across as harsh, but I do not believe there are any revisions that could bring this paper to an acceptable standard for NeurIPS.", "limitations": "A significant limitation of the paper is its reliance on vanilla federated learning, which is known to offer no privacy protection and is rarely used in practice without secure aggregation. More critically, the authors' claim that \"we propose the first poison-forensics method called FLForensics to trace back malicious clients in FL\" is not true. There is prior work that addresses malicious client identification in federated learning, including settings with privacy constraints.", "rating": 2, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 1, "clarity": 2, "significance": 1, "originality": 2, "strengths_and_weaknesses": "Strengths:  The topic addressed by the paper, i.e., identifying malicious clients in federated learning (FL), is both important and timely. However, the paper suffers from several significant weaknesses that limit its overall contribution and practical relevance.\n\nWeaknesses:\n\n1. A fundamental limitation of the paper is that it assumes a vanilla FL setup in which clients send their raw local model updates to the server without any privacy-preserving mechanism. This setup is largely unrealistic in real-world applications (note that it does not provide privacy), where secure aggregation is the de facto standard. In such settings, the server only observes the aggregated model update and has no access to individual client contributions. The proposed FLForensics framework critically relies on access to per-client updates, rendering it inapplicable with secure aggregation. Consequently, the practical relevance of the proposed method is very limited.\n\nMoreover, there is a growing body of literature that addresses poisoning attacks and even malicious client identification under secure aggregation, which the authors do not sufficiently acknowledge. For instance, methods like FedGT (Xemrishi et al., TIFS 2025) directly tackle malicious client detection in a secure aggregation setting, a significantly more challenging and realistic problem.\n\n2. The paper makes overstated and inaccurate claims, such as being \"the first poison-forensics method for FL to trace back malicious clients.\" This is simply incorrect. There is a substantial body of prior work that addresses malicious client identification in federated learning, both in vanilla FL and under secure aggregation. Examples include:\n\nLi et al. ``Learning to detect malicious clients for robust federated learning,'' 2020\n\nXemrishi et al. ``FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation,'' TIFS, 2025.\n\nBellafqira et al. ``FedCAM - Identifying Malicious Models in Federated Learning Environments Conditionally to Their Activation Maps''\n\nMallah, ``Untargeted poisoning attack detection in federated learning via behavior attestationAl'', IEEE Access 2023\n\nThese works propose a variety of methods for detecting or identifying malicious clients during or after training, and some even operate under secure aggregation, which makes the problem more realistic and challenging. The paper under review fails to acknowledge this body of literature, which undermines its novelty claims and weakens its contribution. Overall, the claim of being the \"first\" to address this problem is both misleading and unjustified.\n\n3. The threat model is not clearly defined. While the authors state that they focus on targeted poisoning attacks, the experimental evaluation is based on attacks such as Scaling [3], ALIE [4], and Edge-case attacks [30], which are not targeted attacks in the sense commonly used in the literature. This inconsistency weakens the validity of the empirical evaluation and raises concerns about the alignment between the stated objectives and the experiments.\n\n4. The writing quality of the paper is poor, with numerous inconsistencies and lapses in clarity, particularly in the definition of the threat model and in some methodological descriptions. Parts of the text appear hastily written or potentially AI-generated, giving the impression that the submission was rushed. Regardless of authorship, the paper does not meet the minimum presentation standards expected for a NeurIPS submission, which makes it difficult to thoroughly evaluate the technical contributions.\n\n5. The results section is weak.", "was_revised": true, "final_justification": "The main (significant) weakness I pointed our remains:  The approach proposed by the authors requires accessing the individual models, which significantly simplifies the problem. \n\nWhile the paper has some merits, I do not think the work meets the standards for a top-tier conference like NeurIPS.", "rebuttal": "Thank you for the insightful comments. Here are our responses to your comments.\n\nW1. **Assumes a vanilla FL**: \n\n1). Following many prior works on federated learning defenses (e.g., “Learning to detect...”, FedCAM, and “Untargeted poisoning... ” mentioned by the reviewer), we adopt the commonly used assumption that the server is honest and directly receives model updates from clients.\n\n2). If a trusted third party is available to assist with secure aggregation, it can also be leveraged to perform the forensic traceback procedure, which is orthogonal to our proposed method and can complement it.\n\n3). We appreciate the reference to FedGT. As this line of work suggests, one possible way to ensure privacy while still enabling malicious client detection is to operate on aggregated group updates rather than individual ones. We believe our traceback approach could potentially be extended to such a group-based secure aggregation setting. In particular, instead of computing influence scores over individual client updates, we can compute group-level influence scores over aggregated updates, where each group consists of a small subset of clients. By designing overlapping groups and aggregating their updates, our traceback mechanism can still identify malicious clients using group-level influence patterns, similar in spirit to approaches like FedGT. We view this as a promising direction for future work.\n\n4). Finally, we note that in many practical FL deployments (especially in cross-silo settings), secure aggregation is not yet widely adopted due to its added communication and system complexity. Thus, our work remains applicable to a broad range of real-world scenarios.\n\nW2: **Overstated and inaccurate claims**: Our work is **poison-forensics**, meaning that after FL training is completed (even after the model has been deployed), if a user reports a misclassification event, FLForensics can trace back the malicious clients who participated in training. The papers mentioned by the reviewer have a different goal from ours. All four papers are **FL aggregation rules**, not post-training poison-forensics. Specifically:\n\n“Learning to detect...” states: “After obtaining the spectral anomaly detection model, we apply it in every round of the FL model training to detect malicious client updates.”\n\n“FedGT...” is also an aggregation rule: “a novel framework for identifying malicious clients in federated learning with secure aggregation”\n\n“FedCAM” also states: “During each FL training round, the server calculates the geomed normalized AMs for each client-updated model using the trigger set”\n\n\"Untargeted poisoning...\" states: “attestedFL removes the local models that are unreliable before computing the global model in each iteration of federated learning”\n\nThe above evidences show that all of these works perform defense during FL training, and can thus be considered robust aggregation rules. In contrast, our work is post-training poison-forensics. Therefore, we believe our claim, \"the first poison-forensics method for FL to trace back malicious clients.\", is correct.\n\nW3: **Attacks are not commonly used in the literature**: Actually, the three attack papers we evaluate are all highly impactful, commonly used targeted attacks. Specifically, Scaling (published at AISTATS 2020) has around 2800 citations on Google Scholar, ALIE (NeurIPS 2019) has over 700 citations, and Edge-case (NeurIPS 2020) has over 800 citations.\n\nW4: **Writing quality**: We would greatly appreciate it if the reviewer could provide specific suggestions (for example, where in the paper you observed inconsistencies or lapses), so that we can revise accordingly. However, we would like to clarify that our paper is **not AI-generated**.\n\nW5: **Results section is weak**: We would appreciate it if the reviewer can point out which specific parts of our results are considered weak, so we will carefully consider and address the feedback."}, {"review_id": "LK6HOhjfLQ", "reviewer": "Reviewer_p7T5", "summary": "The paper presents a framework called FLForensics that allows to reliably identify malicious clients that ran targeted poisoning attacks - even if they managed to slip through poisoning defences such as robust aggregation. For this, the aggregation server keeps a subset of model snapshots and submitted client updates. When an attack is detected for a deployed model through unexpected misclassifications, this repository allows to trace back the malicious clients by computing influence scores for target and non-target inputs. Using an unsupervised clustering algorithm on these two-dimensional scores then allows to reliably classify malicious clients even in settings with non-iid data. The authors implement FLForensics and test its effectiveness on a range of datasets and models, data distributions, poisoning attacks, and (robust) aggregation rules. This demonstrates the effectiveness through a very high detection accuracy, also in comparison to prior works that have been adapted for the setting.", "questions": "Only two questions came to mind while reading the paper:\n- As an optimization the aggregation server only stores a subset (10%?) of all intermediate states. However, it would be interesting to know if this impacts the potential for recovery from the attack. If all interim models and client updates would be available, would it be possible to compute a \"fixed\" model that tries to exclude/reverse the effect of the malicious clients without having to completely re-run the training process?\n- If attackers are aware that FLForensics is deployed, could they adapt the attacks in a way that their non-target influence score would be less suspicious?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The paper is very well written and accessible. It provides a clear motivation for studying poisoning detection/tracing even in the presence of robust aggregation. The assumptions required for FLForensics to function properly are clearly articulated and appear very reasonable. The proposed approach is accompanied by a thorough formal analysis. The evaluation results are impressive in terms of effectiveness and consider a wide range of datasets and models, aggregation rules, poisoning attacks, data distributions, and most importantly also adapt prior works for this setting for a fair comparison. I was not able to spot weaknesses in the paper. Therefore, I recommend acceptance.", "was_revised": true, "final_justification": "Thank you for following up on my two suggestions/questions in the rebuttal. There are no concerns from my side regarding this paper, so retain my positive rating.", "rebuttal": "We sincerely appreciate your recognition of our work! Here are our responses to your questions:\n\nQ1: **Recovery from the attack**: This is a very valuable suggestion. Indeed, if we save the checkpoint of each training round, including both the clients' updates and the global models, we can retain only the updates from benign clients, remove those identified as malicious by FLForensics, and directly perform aggregation, thus avoiding a complete re-run. On the other hand, if only partial intermediate states are saved, we may have to resume training from a specific intermediate round, which can still help mitigate the impact of backdoor attacks. Additionally, techniques such as unlearning [1] or recovery-based methods [2] can be used to further exclude the influence of malicious clients.\n\n[1] Zeng, Yi, et al. \"Adversarial unlearning of backdoors via implicit hypergradient.\" ICLR, 2022.\n\n[2] Cao, Xiaoyu, et al. \"Fedrecover: Recovering from poisoning attacks in federated learning using historical information.\" 2023 IEEE Symposium on Security and Privacy. IEEE, 2023.\n\nQ2: **Adapt the attacks**: Since FLForensics only stores a subset of all intermediate states, malicious clients can evade the defense by reducing the frequency or probability of their attacks rather than launching them in every round. The top two subfigures in Figure 4 illustrate the results of such adaptive attacks. We observe that FLForensics is still able to accurately identify the malicious clients. However, when the attack becomes less effective, for example, with an attack frequency of 10 or an attack probability of 0.2, the influence scores of malicious clients become less suspicious, leading to a slight increase in the FPR and FNR of FLForensics. This highlights a trade-off between attack effectiveness and stealthiness."}]

Author rebuttal:

Meta-review: This paper received the following ratings: Borderline accept, Borderline accept, Reject, Accept. The authors introduce FLForensics, a post-hoc forensic method for identifying malicious clients in federated learning after a poisoning attack. By computing 2D influence scores from stored model updates, it traces back attackers once a misclassified input is detected. Most reviewers find the proposed method novel and practically important. The experiments have been conducted over a range of datasets and model architectures, showing strong detection accuracy. The proposed approach is also accompanied by a formal analysis. Some concerns are also raised about some unrealistic assumptions and lack of comparison to more advanced defenses. AC finds the strength outweighs the weakness, and recommends accepting the paper.
Decision: Accept (poster)