联邦微调中的隐私泄露与后门投毒研究：FedAvg 攻击与 FLTrust 防御实测
Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning
arXiv 上的联邦学习攻防实验报告，服务端能从一次更新里偷出标签集，30% 恶意客户端就能植入后门，FLTrust 能防住，代码可直接跑。
一项为第4届联邦机器学习国际暑期学校准备的研究报告，用 MobileNetV4-Conv-Small 在十个 Quick, Draw! 类别上构建了可复现的联邦微调管线。实验显示：好奇的服务器能从单步客户端更新中恢复完整私有标签集，但图像重建的 mean SSIM 仅 0.130；标签计数恢复率随客户端从 1 个增至 10 个由 87.5% 降到 75.0%，低于均匀猜测的 80.0%。投毒方面，30% 客户端注入后门即可达到 21.9% 攻击成功率，FLTrust 可将其压到 1.8%，但在全部客户端恶意时失效。代码和 notebook 已开源在 GitHub，可在 Google Colab 上运行。
Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning
Federated learning (FL) is increasingly used to adapt a pretrained, centrally fine-tuned model to data that remain on user devices, beyond training a model from scratch. In this report, prepared for the 4th Federated Machine Learning International Summer School, we study the privacy and integrity of this approach with a reproducible pipeline. An ImageNet-pretrained MobileNetV4-Conv-Small model is fine-tuned centrally on ten Quick, Draw! classes (97.50% test accuracy) and then adapted with head-only FedAvg over ten non-IID clients, which raises client training accuracy from 90.34% to 91.49% while preserving global accuracy. We evaluate four adversarial scenarios. First, from a single one-step client update, an honest-but-curious server recovers the complete private label set, but its reconstructions follow class prototypes rather than the private drawings (mean SSIM 0.130). Second, from a one-round FedAvg aggregate, label-count recovery falls from 87.5% with one client to 75.0% with five and ten clients, below the 80.0% of an uninformed uniform guess. Third, under FedAvg, a backdoor injected by 30%, 50%, and 100% of the clients reaches an attack success rate (ASR) of 21.9%, 31.3%, and 54.7% at a cost of at most 0.8 percentage points of clean accuracy, whereas label flipping is effective only when most of the source-class data are relabeled. Fourth, FLTrust with a root set retained from centralized fine-tuning lowers the backdoor ASR to 1.8% and 4.0% at 30% and 50% malicious clients and the label-flipping ASR from 12.6% to 0.8% without measurable clean-accuracy loss, but provides no protection when every client is malicious. The report closes with a live session in which participants draw, fine-tune, and poison the model through Indigma's FedMaestro orchestrator. Code and executed notebooks, runnable on Google Colab, are at https://github.com/Indigma-Innovations/fl-summer-school.
