# Deep Model Poisoning Attack on Federated Learning
## 4 Experiments
### Effectiveness and Persistence of Attack  
In this experiment, we present the performance evaluation of the proposed model poisoning attack. The proposed attack method is evaluated under multiple-shot attack (\(\mathbf{MA_{t}}\)) and single-shot attack (\(\mathbf{SA_{t}}\)) scenarios. In the \(\mathbf{MA_{t}}\) scenario, the malicious client acts like benign clients (i.e., trains its private training data locally and submits model update to central server) in the first \(t\) round, and then launches model poisoning attack each round. In contrast, in the \(\mathbf{SA_{t}}\) scenario, the malicious only launches single attack at \(t\) round. In this experiment, the malicious client is assumed to be selected each round It should be noted that we evaluate the effectiveness of attack in \(\mathbf{MA_{t}}\) scenario, while validating the persistence of attack in \(\mathbf{SA_{t}}\) scenario. We make the assumption that the malicious client is selected by central server each round in order to evaluate the effectiveness and persistence of attack. We experimentally compare our proposed deep model poisoning attack and backdoor attack proposed in [4] to validate the effectiveness and persistence of attack. It should be noted that we adopt pixel-pattern [6] to build [4]'s poisoning samples (i.e., adding a pre-defined pixel pattern in the poisoning training data), and then change their labels to target label. In all of our experiments, we consider single attacker-controlled participant scenario for [4]'s attack. For fair comparison, we keep other experiment settings the same as the proposed attack mechanisms.  
Figures 4 and 5 show the attack results of multiple-shot and single-shot attack scenarios, respectively. In multiple-shot attack scenario, one can observe, from Figure 4, that the proposed attack can perform effectively adversarial task without degrading the accuracy of main task. Even for the large dataset like CIFAR-10, the proposed model poisoning attack can achieve over 90% attack success rate for adversarial task, which is higher than that of [4]. Figure 4 demonstrates that the proposed deep model poisoning attack can achieve high attack success rate for \(\mathcal{D}_{p}\), meanwhile keeping its accuracy for test images. Besides, in a single-shot attack scenario, the attack success rate drop dramatically for [4]'s methods when compared with our method. The proposed attack algorithm outperforms [4]' attack in two aspects: (1) the attack success rate falls down slowly, which means that the proposed attack is effective in mitigating catastrophic forgetting of adversarial task; and, (2) retains a higher accuracy for the main task on the testing dataset. Figure 5 illustrates that the proposed deep model poisoning attack has the capability to retain a high attack success rate over a long period of aggregation. The main reason behind the high performance of proposed attack is that poisoning neurons are embedded in the redundant space of a neural network. This reduces the probability of fine-tuning poisoning neurons during the training of main task. The accuracy of main task increases when we set hyperparameter \(\rho_{2}=0\), as shown in Figure 4. The main reason behind this phenomenon is that the constraint regularization term in Equation (3) tends to update neurons not \"important\" to the main task. Therefore, the constraint regularization term in Equation (3) has bad impact on main task.