Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design

This paper investigates the security of Personalized Federated Learning (PFL), a distributed machine learning paradigm where edge devices train private, personalized models to handle heterogeneous data. While PFL improves performance by allowing local model adaptation, the authors identify a critical security blind spot: these personalized models are highly susceptible to transfer-based adversarial attacks. In this scenario, a malicious client can use its own local model to generate adversarial examples that effectively transfer to and compromise the personalized models of other clients.

The authors conduct a systematic vulnerability assessment across eight state-of-the-art PFL methods using three benchmark datasets (CIFAR-10, CIFAR-100, and GTSRB). They analyze the "gray-box" threat model, where attackers have access to the model architecture but not the specific parameters of the victim's personalized model. To explain the observed vulnerability, the researchers identify five key determinants of attack transferability: model sensitivity, loss landscape geometry, distribution alignment, fitness difference, and parameter sensitivity. Based on these insights, they propose a defense framework that integrates stochastic input noise, input-scaled trace regularization, and parameter sensitivity maximization to improve robustness.

• PFL methods exhibit a significant accuracy drop when subjected to adversarial attacks, with vulnerability often increasing alongside model performance.
• Partial model-sharing methods (e.g., FedRep, FedBABU) generally demonstrate better adversarial robustness than full model-sharing methods (e.g., FedProx).
• Unlike centralized learning, where proxy model accuracy strongly correlates with attack transferability, PFL systems show that transferability is largely independent of the proxy model's accuracy.
• The proposed defense framework provides a plug-and-play solution that consistently mitigates the impact of transfer-based attacks across diverse PFL implementations.