Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

2026-08-10

AI Summary

This work addresses the security threat in federated conditional generative adversarial networks where malicious clients launch label-flipping attacks to corrupt the global generator, thereby misaligning the semantics of target classes with source categories. To amplify the impact of poisoned samples, the authors propose integrating label flipping with an oversampling strategy. They quantify the induced conditional distribution shift using KL divergence and empirically validate their approach on FEMNIST, MNIST, and CIFAR10. The findings reveal a linear relationship between attack strength and semantic distortion, and a quadratic relationship with deviation from the true data distribution. Notably, even minimal poisoning suffices to significantly distort generated semantics while preserving overall statistical characteristics close to benign levels, demonstrating high effectiveness, strong stealthiness, and resilience against detection by unsupervised metrics.

Abstract

In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator. The objective of this attack is to skew the learned generation distribution so that samples conditioned on a target label are instead mapped to a source class. In this work, we investigate the effectiveness of label flipping attacks in federated GANs through both theoretical analysis and empirical evaluation. We further consider an oversampling based variant, in which malicious clients upweight poisoned samples during local training to amplify their influence on the aggregated global model. We quantify the resulting distributional shift by computing the Kullback Leibler divergence between the clean and poisoned class conditional distributions, and show both analytically and on FEMNIST, MNIST, and CIFAR10 that the semantic damage of the attack grows linearly in the effective poisoning strength while deviation from the true target distribution grows only quadratically, making the attack effective yet difficult to detect from label agnostic metrics.

Problem

• label-flipping attack
• oversampling attack
• federated GANs
• distributional shift
• adversarial attack

Innovation

• label-flipping attack
• oversampling attack
• federated GANs
• distributional shift
• Kullback-Leibler divergence