🤖 machine learning

Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

This paper investigates the effectiveness and theoretical properties of label-flipping and oversampling attacks on federated conditional GANs, demonstrating that malicious clients can induce significant semantic damage with linear scaling of poisoning strength while remaining difficult to detect due to minimal quadratic deviation in distributional metrics.

Original authors: Panav Shah, Avishek Ghosh

Published 2026-08-11

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Panav Shah, Avishek Ghosh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where a group of friends wants to build a super-smart robot artist together, but they can't share their private sketchbooks. Instead, they each draw on their own tablets and only send the "rules" for how to draw to a central hub. This is Federated Learning: a way for computers to learn together without ever seeing each other's raw data, keeping everything private. Now, imagine the robot they are building is a Generative Adversarial Network (GAN). Think of a GAN as a creative duet between two robots: one is the Generator, an artist trying to create fake images that look real, and the other is the Discriminator, a critic trying to spot the fakes. If you add Conditional GANs to the mix, you give the artist a specific instruction, like "Draw a cat" or "Draw a dog," and the robot learns to follow those commands perfectly.

The big question this paper tackles is: What happens if one of the friends in the group is actually a prankster? In a normal classroom, if one student acts incorrectly, the teacher might catch them. But in this secret club of computers, the central hub trusts everyone. The researchers wanted to know if a sneaky computer could trick the whole group into learning the wrong thing, specifically by messing with the labels (the instructions) it sends. They discovered that a bad actor can indeed trick the robot artist into drawing the wrong things, and the scary part is that the robot's overall "art score" might still look perfect, hiding the damage completely.

The Great Label Switcheroo

In this study, the researchers set up a scenario where a few "malicious" clients (the pranksters) join a group of honest computers to train a conditional GAN. Their goal? To perform a Targeted Label-Flipping Attack. Imagine you are teaching a robot to recognize animals. You show it a picture of a cat and say, "This is a cat." The prankster, however, takes a picture of a cat, flips the label, and tells the robot, "This is a dog." They do this for a specific pair of classes—say, turning "cats" into "dogs"—while leaving everything else alone.

The researchers tested two ways to do this. The first is Simple Label Flipping, where the prankster just changes the name tag on the picture. The second, more powerful method is Oversampling. Here, the prankster not only changes the label but also tells the robot, "Pay extra attention to this picture! Look at it five times!" This upweights the fake instruction, making the robot learn the wrong lesson much faster.

The Invisible Damage

The most fascinating discovery in the paper is how hard it is to catch these pranksters. The researchers used a mathematical tool called KL Divergence (think of it as a "confusion meter") to measure how much the robot's understanding of "cats" and "dogs" got messed up.

They found a strange and dangerous asymmetry. When the pranksters flip labels, the robot's ability to tell the difference between the real cat and the fake dog (the "source" and "target" classes) collapses very quickly. The confusion meter shows a linear drop—meaning the damage happens fast and steadily as more pranksters join in.

However, if you look at the robot's overall performance or how well it draws "dogs" compared to what a "true" dog should look like, the damage grows much slower. It grows quadratically. In plain English, this means the robot's output looks almost normal for a long time, even while it is being secretly corrupted. The "confusion" between the two specific classes is huge, but the "deviation" from the true dog shape is tiny.

The "Aggregate FID" Blind Spot

To prove this, the researchers ran simulations on three famous image datasets: FEMNIST (handwritten letters), MNIST (handwritten numbers), and CIFAR-10 (color photos of objects like cats and dogs). They set up a scenario with 50 clients, some honest and some malicious.

The results were chillingly clear. They measured the Fréchet Inception Distance (FID), which is a standard score used to judge how good an AI's images are. Usually, a lower score is better. The researchers found that even when the attack was strong enough to make the robot draw "dogs" that looked exactly like "cats," the Aggregate FID (the score for all images combined) barely moved. It changed by less than 6% in some cases.

Why? Because the attack is so targeted. The robot is still drawing perfect cats, perfect birds, and perfect cars. It's only the "dog" category that is secretly full of cats. Since the standard score averages everything together, the massive error in one small category gets drowned out by the perfection of the others. It's like a restaurant where 99% of the dishes are 5-star, but one specific dish is actually a shoe. If you only taste a little bit of everything, you might think the restaurant is still great, missing the fact that the "steak" is actually a shoe.

The Oversampling Boost

The paper also showed that the Oversampling variant (where the prankster says "look at this 5 times") was even more effective. By increasing the weight of the poisoned samples, the pranksters could achieve the same level of damage with fewer bad actors, or cause much more damage with the same number of bad actors. Crucially, this extra power didn't make the attack any easier to detect. The "confusion meter" still showed a linear drop in quality for the specific pair, while the overall "art score" remained stubbornly flat.

The Bottom Line

The authors conclude that targeted label-flipping attacks are a serious threat to Federated Conditional GANs because they are effective yet stealthy. The damage to the specific relationship between two classes (like cats and dogs) happens immediately and severely, but the overall system looks healthy enough to fool standard monitoring tools.

The paper suggests that if we want to catch these pranksters, we can't just look at the overall "art score" or the average quality of images. We have to look closely at the specific instructions. We need to check if the "dog" generator is suddenly acting like a "cat" generator. Until we develop better ways to monitor these specific class-to-class relationships, a group of computers training a shared AI might be drawing shoes as steaks, and no one would notice until it's too late.

Technical Summary: Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

Problem Statement
In Federated Learning (FL) for Generative Adversarial Networks (GANs), specifically Conditional GANs (cGANs), the system is vulnerable to data-poisoning attacks where malicious clients manipulate local training data to corrupt the global model. While prior work has explored poisoning in federated classifiers and unconditional generators, the impact of targeted label-flipping on conditional generators remains underexplored. The core problem addressed is the ability of adversaries to skew the learned class-conditional distributions such that samples conditioned on a specific target label $t$ are mapped to a source class $s$ , while remaining undetectable by standard, label-agnostic monitoring metrics (e.g., aggregate Fréchet Inception Distance).

Methodology
The authors propose and analyze two variants of targeted label-flipping attacks within a standard FedAvg framework:

Simple Label Flipping: Malicious clients relabel a fraction $p$ of samples from a source class $s$ to a target class $t$ during local training, using standard unweighted Stochastic Gradient Descent (SGD).
Oversampling-Based Label Flipping: Malicious clients perform the same relabeling but upweight the poisoned samples by a factor $r > 1$ during gradient computation. This amplifies the influence of the poisoned data on the local update without altering the dataset size visible to the server.

The threat model assumes an honest-but-curious server that aggregates updates via sample-size-weighted averaging without robust defenses (e.g., Krum or coordinate-wise median). Adversaries control a fraction $\alpha$ of clients and know the global architecture and loss function but not the private data of honest clients.

Theoretical Analysis
The paper derives a mixture-model characterization of the poisoned target-class distribution $\tilde{P}_t$ . The authors define an effective poisoning strength $\beta$ as a function of the adversarial fraction ( $\alpha$ ), flipping probability ( $p$ ), oversampling factor ( $r$ ), and source class prior ( $\Pi_s$ ).

Key theoretical findings include:

Source-Target Divergence: The Kullback–Leibler (KL) divergence between the source distribution $P_s$ and the contaminated target distribution $\tilde{P}_t$ decreases linearly with respect to $\beta$ . This indicates that the semantic damage (the collapse of the distinction between source and target) occurs immediately as the attack strength increases.
Target Distribution Deviation: Conversely, the KL divergence between the true target distribution $P_t$ and the contaminated distribution $\tilde{P}_t$ grows only quadratically with respect to $\beta$ . The first-order term in the expansion vanishes because $\tilde{P}_t$ is constructed as a convex combination involving $P_t$ itself.
Detectability Asymmetry: This creates a structural asymmetry where the attack inflicts significant semantic damage at order $\beta$ , while the natural detection signal (deviation from the true target) only emerges at order $\beta^2$ . Furthermore, label-agnostic metrics like aggregate FID are shown to be insensitive because the per-class deviation is diluted by a factor of $1/C$ (where $C$ is the number of classes) when averaged across all classes.

Experimental Results
The authors empirically validate these theoretical predictions on three federated benchmarks: FEMNIST, MNIST, and CIFAR-10, using a projection discriminator architecture.

KL Divergence Trends: Experiments confirm that $KL(P_s \parallel \tilde{P}_t)$ decreases approximately linearly with $\beta$ , while $KL(P_t \parallel \tilde{P}_t)$ increases quadratically.
Oversampling Impact: The oversampling variant ( $r=5$ ) achieves a higher effective $\beta$ than simple flipping ( $r=1$ ) for the same number of adversarial clients, amplifying the attack's effectiveness without proportionally increasing detectability.
Visual and Metric Evidence:
- Feature distributions (HOG) show the target class shifting toward the source class as adversarial participation increases.
- Generated images conditioned on the target label visually resemble the source class.
- Crucially, aggregate FID (label-agnostic) remains nearly flat (changing by less than 6% even at high poisoning strengths), whereas target-class FID grows substantially. This confirms that standard aggregate metrics fail to detect the attack.

Key Contributions

Formulation: The paper formulates two targeted label-manipulation attacks (simple and oversampling-based) specifically for federated cGANs, providing algorithmic descriptions of the adversarial client updates.
Analytical Characterization: It provides a closed-form analytical characterization showing that the semantic damage of the attack scales linearly with poisoning strength $\beta$ , while deviation from the true target distribution scales quadratically. This asymmetry explains why the attack is effective yet difficult to detect.
Empirical Validation: The study validates these theoretical predictions across FEMNIST, MNIST, and CIFAR-10 under realistic non-IID federated settings, demonstrating close agreement between theory and experiment.

Significance and Claims
The paper claims to be the first to provide a closed-form analytical characterization of how targeted label flipping biases the learned class-conditional distributions of a federated cGAN. The primary significance lies in demonstrating that targeted attacks on conditional generators can cause severe semantic corruption (e.g., generating "dogs" when "cats" are requested) while remaining invisible to standard, label-agnostic quality metrics. The authors argue that this decoupling between damage and detectability makes such attacks particularly dangerous in federated settings where servers rely on aggregate statistics for monitoring. They suggest that effective defenses must operate at the level of class-conditional statistics rather than aggregate metrics.