SpooFL: Spoofing Federated Learning

2026-01-21

AI Summary

This work addresses a critical limitation in existing federated learning defenses: despite their efforts to mitigate deep leakage attacks, they often still leak high-level semantic information such as class distributions or feature representations and remain vulnerable to denoising-based attacks. To overcome this, the paper introduces a novel defense paradigm by reframing federated learning defense as a deception problem. It proposes generating synthetic data using an external dataset that shares no class overlap with the private training data, thereby producing highly realistic yet semantically irrelevant samples. These synthetic samples are strategically injected during federated training to actively mislead attackers. The approach effectively thwarts state-of-the-art deep leakage attacks while preserving the utility of the main model, fundamentally preventing the exposure of meaningful semantic information.

Technology Category

• Machine Learning: Distributed Machine Learning & Federated Learning
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Generation

Application Category

• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Traditional defenses against Deep Leakage (DL) attacks in Federated Learning (FL) primarily focus on obfuscation, introducing noise, transformations or encryption to degrade an attacker's ability to reconstruct private data. While effective to some extent, these methods often still leak high-level information such as class distributions or feature representations, and are frequently broken by increasingly powerful denoising attacks. We propose a fundamentally different perspective on FL defense: framing it as a spoofing problem.We introduce SpooFL (Figure 1), a spoofing-based defense that deceives attackers into believing they have recovered the true training data, while actually providing convincing but entirely synthetic samples from an unrelated task. Unlike prior synthetic-data defenses that share classes or distributions with the private data and thus still leak semantic information, SpooFL uses a state-of-the-art generative model trained on an external dataset with no class overlap. As a result, attackers are misled into recovering plausible yet completely irrelevant samples, preventing meaningful data leakage while preserving FL training integrity. We implement the first example of such a spoofing defense, and evaluate our method against state-of-the-art DL defenses and demonstrate that it successfully misdirects attackers without compromising model performance significantly.

Problem

• Federated Learning
• Deep Leakage
• Privacy Attack
• Data Reconstruction
• Spoofing Defense

Innovation

• spoofing
• federated learning
• deep leakage
• synthetic data
• privacy defense