Adversarial Robustness of Federated Learning in IoT Edge Networks: Model Poisoning Attacks and Byzantine-Resilient Defense Mechanisms

Team

Methodology

1. Deploy a federated test bench with 50 simulated clients (Flower framework) and 5 physical Raspberry Pi nodes, on IoT classification tasks (network anomaly detection, activity recognition).
2. Implement four attack strategies: label flipping, gradient scaling, backdoor injection (Trojan attack), and free-riding attack.
3. Develop ClusterGuard, a robust aggregation mechanism based on HDBSCAN applied to gradient updates, filtering malicious contributions without knowing the number of attackers.
4. Comparative evaluation with Krum, Multi-Krum, Trimmed Mean, Median, and FoolsGold across 30 configurations (attacker ratios from 10% to 40%, varied non-IID distributions).

Attack scenarios

• Label flipping — targeted label inversion on 30% of a compromised client's data to degrade global accuracy.
• Gradient scaling — amplification of malicious gradients by 10-100x to dominate FedAvg aggregation.
• Backdoor injection — inserting a trigger pattern into training data to force misclassification on marked inputs.
• Free-riding — sending random or null updates to benefit from the global model without contributing.

Evaluation metrics

• Global model accuracy under attack (Attack Success Rate) — maximum tolerated degradation < 3% with ClusterGuard.
• Malicious client detection rate — target > 95% with < 2% false positives.
• Communication and computation overhead of ClusterGuard compared to vanilla FedAvg.

Budget

$400 for Raspberry Pi and IoT sensors, $600 in compute credits for large-scale federated training campaigns.

Expected deliverables

• Open-source federated robustness evaluation framework (Flower extension).
• ClusterGuard library published on PyPI.
• Paper published at AAAI 2026 — Workshop on Federated Learning for IoT.