A new arXiv preprint reports that a proposed defense for federated learning scored higher against transferred adversarial attacks than Federated Adversarial Training, or FAT, in computer simulations. The tests covered CIFAR-10 and SVHN image classification, with both IID and non-IID client partitions.
The study’s first question was whether empirical transferability followed predicted relationships with model and data-distribution differences, and whether the defense mitigated transferable attacks. Its results showed a negative association between model-parameter distance and attack success rate, and a positive association between distribution distance and the gap in transferability. Reported Spearman coefficients were above 0.4 and 0.5, with p approximately 0 for both datasets.
Why the attacks transferred differently
The paper’s theoretical analysis ties transferability to the local data distributions used by the attacking and victim clients. In ordinary terms, transferability describes whether an attack generated for one model also works against a different model. The authors interpret similar data distributions as being associated with more transferable adversarial examples. That conclusion depends on the FedProx setup and assumptions about model and gradient smoothness.
The threat model assumes that the attacker is a current or former federated-learning client. It knows the task, its own local data and its own local model, but not the victim’s parameters. The victim model is treated as different from the attacker’s, creating a black-box setting.
For the experiments, the researchers used VGG11 and WideResNet-28-10, referred to as WRN28, on CIFAR-10 and SVHN. The simulated systems contained either 10 or 100 clients. Depending on the experiment, 0.8 or all of the clients were selected in each round. Training ran for 400 global rounds, with one local epoch for IID data and three for non-IID data. The uneven partitions used Dirichlet concentrations of 0.1, 0.5 or 1.
The gray-box tests used four transfer-based attacks: VMIFGSM, BIM, VNIFGSM and DIFGSM. Each used a perturbation budget of 8/255, a step size of 2 and 100 attack steps. The defense balance setting, alpha, was 0.5.
A sharp weakness in the baseline
Standard FedProx performed well on clean inputs in the reported IID evaluations, with clean accuracy ranging from 88% to 98%. But its accuracy on adversarial examples was nearly zero and was often reported as below 1% across the attack variants.
The proposed approach combines an SVD-driven Feature Evolution Module, or SDFEM, with adversarial training. The paper describes the combination as a way to make the model learn robust features.
The reported gains varied by dataset and data split
On CIFAR-10 with VGG11, the proposed method was ahead of FAT by 1.69 robust-accuracy points for VMIFGSM, 1.17 for BIM, 1.79 for VNIFGSM and 1.86 for DIFGSM. Its reported clean accuracy was 92.62, compared with 93.53 for FAT.
With WRN28 on CIFAR-10, the reported margins over FAT were 3.36, 2.04, 3.21 and 4.28 points across the same four attacks. Clean-accuracy values were 86.40 for the proposed method and 85.97 for FAT. Against VMIFGSM, the proposed method reached 83.93 accuracy, close to the 83.79 reported for the centralized upper-bound comparison.
On IID SVHN, the proposed method’s BIM accuracy was 61.55% with VGG11 and 63.95% with WRN28, compared with 54.13% and 60.43% for FAT. Clean accuracy for the proposed method was 95.67% and 95.50%, respectively.
The largest reported CIFAR-10 differences appeared under the non-IID split, where client data were more unevenly distributed. With VGG11, the proposed method led FAT by between 4.59 and 5.06 points across the four attacks. With WRN28, the margins ranged from 8.43 to 9.26 points, and clean accuracy was 2.99 points higher.
Non-IID SVHN also showed a lead in every listed attack. For VGG11, adversarial accuracy for the proposed method ranged from 28.48% to 36.30%, compared with 27.38% to 32.90% for FAT. For WRN28, it ranged from 24.99% to 28.82%, compared with 23.22% to 25.70%.
What the results leave open
The evidence comes from computational image-classification simulations using two datasets, two model backbones and four listed attacks. The reported results therefore do not establish how the approach would perform with other federated-learning algorithms, architectures, attack budgets or client populations.
The comparisons are reported as point estimates without confidence intervals, standard deviations, independent-run counts or random seeds. The distribution-distance relationship was described as non-linear, and some baseline adversarial-accuracy entries were reported only as below 1%.
The manuscript is an arXiv version-one preprint dated 25 August 2026. Its funding acknowledgment lists National Science Foundation support under grants 2429960, 2434899, 2548041 and 2343619.
Paper data and sources
Original title: Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning
Authors: Zuobin Xiong, Deval Mukherjee, Homook Cho, Wei Li
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text