Title: Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning
Venue: NeurIPS 2025
Accepted: yes
Keywords: Federated Learning

Poison Forensics

Poisoning Attacks
Abstract: Poisoning attacks compromise the training phase of  federated learning (FL) such that the learned global model misclassifies attacker-chosen inputs called target inputs. Existing defenses mainly focus on protecting the training phase of FL such that the learnt global model is poison free. However, these defenses often achieve limited effectiveness when the clients' local training data is highly non-iid or the number of malicious clients is large, as confirmed in our experiments. In this work,  we propose FLForensics, the first poison-forensics method for FL. FLForensics complements existing training-phase defenses. In particular, when training-phase defenses fail and a poisoned global model is deployed, FLForensics aims to trace back the malicious clients that performed the poisoning attack after a misclassified target input is identified. We theoretically show that FLForensics can accurately distinguish between benign and malicious clients under a formal definition of poisoning attack. Moreover, we empirically show the effectiveness of FLForensics at tracing back both existing and adaptive poisoning attacks on five benchmark datasets.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents a framework called FLForensics that allows to reliably identify malicious clients that ran targeted poisoning attacks - even if they managed to slip through poisoning defences such as robust aggregation. For this, the aggregation server keeps a subset of model snapshots and submitted client updates. When an attack is detected for a deployed model through unexpected misclassifications, this repository allows to trace back the malicious clients by computing influence scores for target and non-target inputs. Using an unsupervised clustering algorithm on these two-dimensional scores then allows to reliably classify malicious clients even in settings with non-iid data. The authors implement FLForensics and test its effectiveness on a range of datasets and models, data distributions, poisoning attacks, and (robust) aggregation rules. This demonstrates the effectiveness through a very high detection accuracy, also in comparison to prior works that have been adapted for the setting.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper is very well written and accessible. It provides a clear motivation for studying poisoning detection/tracing even in the presence of robust aggregation. The assumptions required for FLForensics to function properly are clearly articulated and appear very reasonable. The proposed approach is accompanied by a thorough formal analysis. The evaluation results are impressive in terms of effectiveness and consider a wide range of datasets and models, aggregation rules, poisoning attacks, data distributions, and most importantly also adapt prior works for this setting for a fair comparison. I was not able to spot weaknesses in the paper. Therefore, I recommend acceptance.\n\nQUESTIONS:\nOnly two questions came to mind while reading the paper:\n- As an optimization the aggregation server only stores a subset (10%?) of all intermediate states. However, it would be interesting to know if this impacts the potential for recovery from the attack. If all interim models and client updates would be available, would it be possible to compute a \"fixed\" model that tries to exclude/reverse the effect of the malicious clients without having to completely re-run the training process?\n- If attackers are aware that FLForensics is deployed, could they adapt the attacks in a way that their non-target influence score would be less suspicious?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-08"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes FLForensics, a method to identify malicious clients in federated learning (FL) after a poisoning attack has taken place. The approach assumes access to individual client updates and relies on storing model updates at selected checkpoints during training. Once a misclassified target input is identified, the server computes per-client influence scores and uses clustering to distinguish malicious clients from benign ones. The authors provide a theoretical analysis under simplifying assumptions and evaluate the method on several datasets and poisoning attacks. The entire framework is built on vanilla FL, where no privacy mechanism such as secure aggregation is used.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:  The topic addressed by the paper, i.e., identifying malicious clients in federated learning (FL), is both important and timely. However, the paper suffers from several significant weaknesses that limit its overall contribution and practical relevance.\n\nWeaknesses:\n\n1. A fundamental limitation of the paper is that it assumes a vanilla FL setup in which clients send their raw local model updates to the server without any privacy-preserving mechanism. This setup is largely unrealistic in real-world applications (note that it does not provide privacy), where secure aggregation is the de facto standard. In such settings, the server only observes the aggregated model update and has no access to individual client contributions. The proposed FLForensics framework critically relies on access to per-client updates, rendering it inapplicable with secure aggregation. Consequently, the practical relevance of the proposed method is very limited.\n\nMoreover, there is a growing body of literature that addresses poisoning attacks and even malicious client identification under secure aggregation, which the authors do not sufficiently acknowledge. For instance, methods like FedGT (Xemrishi et al., TIFS 2025) directly tackle malicious client detection in a secure aggregation setting, a significantly more challenging and realistic problem.\n\n2. The paper makes overstated and inaccurate claims, such as being \"the first poison-forensics method for FL to trace back malicious clients.\" This is simply incorrect. There is a substantial body of prior work that addresses malicious client identification in federated learning, both in vanilla FL and under secure aggregation. Examples include:\n\nLi et al. ``Learning to detect malicious clients for robust federated learning,'' 2020\n\nXemrishi et al. ``FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation,'' TIFS, 2025.\n\nBellafqira et al. ``FedCAM - Identifying Malicious Models in Federated Learning Environments Conditionally to Their Activation Maps''\n\nMallah, ``Untargeted poisoning attack detection in federated learning via behavior attestationAl'', IEEE Access 2023\n\nThese works propose a variety of methods for detecting or identifying malicious clients during or after training, and some even operate under secure aggregation, which makes the problem more realistic and challenging. The paper under review fails to acknowledge this body of literature, which undermines its novelty claims and weakens its contribution. Overall, the claim of being the \"first\" to address this problem is both misleading and unjustified.\n\n3. The threat model is not clearly defined. While the authors state that they focus on targeted poisoning attacks, the experimental evaluation is based on attacks such as Scaling [3], ALIE [4], and Edge-case attacks [30], which are not targeted attacks in the sense commonly used in the literature. This inconsistency weakens the validity of the empirical evaluation and raises concerns about the alignment between the stated objectives and the experiments.\n\n4. The writing quality of the paper is poor, with numerous inconsistencies and lapses in clarity, particularly in the definition of the threat model and in some methodological descriptions. Parts of the text appear hastily written or potentially AI-generated, giving the impression that the submission was rushed. Regardless of authorship, the paper does not meet the minimum presentation standards expected for a NeurIPS submission, which makes it difficult to thoroughly evaluate the technical contributions.\n\n5. The results section is weak.\n\nQUESTIONS:\nI apologize if my evaluation comes across as harsh, but I do not believe there are any revisions that could bring this paper to an acceptable standard for NeurIPS.\n\nLIMITATIONS:\nA significant limitation of the paper is its reliance on vanilla federated learning, which is known to offer no privacy protection and is rarely used in practice without secure aggregation. More critically, the authors' claim that \"we propose the first poison-forensics method called FLForensics to trace back malicious clients in FL\" is not true. There is prior work that addresses malicious client identification in federated learning, including settings with privacy constraints.", "TITLE": "Official Review", "RECOMMENDATION": 2, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 1, "ORIGINALITY": 2, "DATE": "2025-06-30"}

comments: SUMMARY:
This paper proposes a mechanism to detect malicious clients in an FL protocol in the aftermath of data poisoning. By examining the influence score of model updates to the misclassified instance, the protocol is able to detect malicious clients. The forensic detection is effective across multiple datasets, aggregation rules and attack methods.

STRENGTHS AND WEAKNESSES:
**Strength**

This paper is overall well-written. It provides a simple yet effective solution to detect malicious client after deployment. The experiments cover a decent number of research questions and the designs are fair. 

**Weakness**

The theoretical analysis in Section 5 is unnecessary. The proof are very definitional from the assumptions. I suggest removing it and shifting more important results such as how to determine if a misclassified input is target or non-target. 

Overall, I find the idea of this paper solid and the approach sound. The setting may not be the most interesting, but it seems to be the first paper investigating this problem. The empirical evaluation is the highlight while some of the theoretical claims and assumptions seem unnecessary to me. The paper is borderline. I want to listen to authors' response to my questions.

QUESTIONS:
1. The attack success rate for Scaling attack against FLTrust on CIFAR10 (Table 6a) is very different from the one in Table III d) in the original FLTrust paper. Why?

2. The assumption of label-rich advantage looks somewhat artificial. What was the motivation of singling out this assumption? Is this assumption backed up with empirical evidence?

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes FLForensics, the first post-hoc forensic method for identifying malicious clients in FL after a poisoning attack has occurred. Instead of preventing attacks during training, FLForensics traces back attackers once a misclassified target input is discovered from the deployed global model. It assigns each client a 2D influence score based on how their updates affect the model’s behavior on both the target input and a non-target input. The paper also offers both theoretical and empirical justifications.\n\nSTRENGTHS AND WEAKNESSES:\nstrengths\n\n- The novel problem setting is very interesting, practically important, and a creative usage of the influence function method. \n\n- The emperiments have been conducted over a range of datasets and model architectures, although fairly small, but reasonable in FL studies. \n\nweakness:\n\n- The method requires access of target input and also access to the client model after training to \"tests every client on a random non-target input 50 with the target label\". In practice (not experimental settings), when the server relies client on a practical manner, the requirement does not seem to be very realistic. \n\n- The method also relies on unsupervised manner (clustering) to detect anormally, through which the results seem too ideal (see questions for more details)\n\nQUESTIONS:\n1. While the method is in general interesting, some of the details seem bizarre, for example, the method requires \"scaled\" distance to work seemingly suggest the method itself is not robust enough. Can the authors demonstrate why the scaling is necessary? For example, are there cases where non-scaled cases can perform better for clustering? \n\n2. Intuitive speaking, the results should highly depend on the strength of attacks, probably whether these malicious clients are all targeting the same target. How did the authors choose the strength of the attacks? \n    - for the attacks that are strong enough to flip 100% of the labels, the detection might be able to identify, but what if the clients are minor and only want to flip the label in a lower rate?\n   - are there trade-offs between the success rate of the attack vs. the success rate of the detections? \n   - line 237 says the paper will also present ASR, but the table does not seem to have these results\n\n3. while the local linearity assumption is fairly reasonable in ML community, in this particular setting, the authors are referring to the \\delta as model updates, thus the problem might depend on the practical settings on the FL system and how the system chooses to update the model, some discussions, and evidence that in most FL settings, this assumption still holds might be necessary.\n\nLIMITATIONS:\nThere is no explicitly section on limitation, but the authors have discussed future work, which can probably be interpreted as limitations.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-03"}