---
title: Base-Model Drag Attacks (MPAF) in Federated Learning
url: https://www.emergentmind.com/topics/base-model-drag-attacks-mpaf
type: topic
---

# Base-Model Drag Attacks (MPAF) in Federated Learning

Base-Model Drag Attacks (MPAF) are a class of model poisoning attacks against Federated Learning (FL) systems characterized by the introduction of fake clients whose sole objective is to steer the global model toward a fixed, attacker-chosen base model of poor accuracy. This attack paradigm fundamentally challenges the assumption that an adversary must corrupt a substantial fraction of genuine clients to exert significant influence. Instead, MPAF leverages carefully synchronized updates from a minority of fake clients to subvert standard and "Byzantine-robust" aggregation defenses, posing severe integrity risks to practical FL deployments [2203.08669].

## 1. Federated Learning Threat Model and Attack Setup

The primary scenario consists of $n$ genuine FL clients participating in the distributed learning of a model $w \in \mathbb{R}^d$, while $m$ attacker-controlled fake clients are injected into the system. The server orchestrates synchronous training rounds $t = 0, 1, ..., T-1$, each round sampling a fraction $\beta$ of all clients (with $\beta=1$ as default). Genuine clients compute local updates $\Delta w_i^t$ via several local SGD steps; fake clients send arbitrary updates. The server aggregates all received updates using an aggregation rule $\mathcal{A}$ such as FedAvg (mean), coordinate-wise median, or trimmed-mean before applying a global step:
$$
w^{t+1} \leftarrow w^t + \eta g^t,
$$
where $g^t$ is the aggregated update and $\eta$ is the learning rate. Attackers do not observe benign data, updates, $\beta$, $\eta$, or even which rule $\mathcal{A}$ is used—they only receive the current global model in each round.

## 2. Attack Principle and Mathematical Formulation

The MPAF exploit centers on maintaining a persistent directional influence on $w^t$ by "dragging" it toward a fixed base model $w_b$ that the attacker selects upfront (e.g., a randomly initialized model with uniformly low classification accuracy). In each round, every fake client contributes an identical gradient update:
$$
\Delta w^\text{fake}_{t} = \alpha (w_b - w^t),
$$
where $\alpha>0$ is a scaling factor to ensure the magnitude is competitive with or dominates genuine client updates.

This construction operates purely in parameter space: the malicious updates always point toward $w_b$, regardless of the current model position, ensuring that over multiple rounds, if not neutralized, $w^t$ will progressively approach the base model.

The attacker’s optimality criterion can be viewed as greedily minimizing $\|w^T - w_b\|_2$, making each step a solution to the instantaneous subproblem of maximal drag toward $w_b$.

## 3. Aggregation, Defense Bypass, and Algorithmic Realization

Standard aggregation rules interact with this attack as follows:
- **FedAvg**: The mean is directly susceptible, as even 1% fake clients with large $\alpha$ suffice to overwhelm the aggregate and collapse global accuracy to random guessing.
- **Coordinate-wise Median & Trimmed-Mean**: Each fake update is identical and aligned in parameter space, making it a consistent "outlier" across all affected coordinates; if $m$ is sufficiently large relative to $n$, even clipped or robust rules are pressured to accommodate the attacker's direction. When trimmed-mean is used with trimming parameter $k=m$, malicious updates persistently influence aggregated results when $m/(n+m)$ surpasses critical resilience thresholds.

The MPAF procedure can be formalized as:

**MPAF Algorithm**

- **Inputs**: $n$, $m$, $T$, base model $w_b$, scaling factor $\alpha$
- **For each round $t = 0$ to $T-1$**:
    - Server broadcasts $w^t$ to selected clients.
    - Each genuine client $i$ returns $\Delta w^t_i$ via SGD; each fake client returns $\alpha(w_b - w^t)$.
    - Server aggregates $\left\{\Delta w^t_i\right\} \cup \left\{\Delta w^t_\text{fake}\right\}$ using $\mathcal{A}$; updates $w^{t+1}$.

Empirically, $\alpha$ is chosen so that $\|\Delta w^t_\text{fake}\|_2$ matches large but plausible update magnitudes (e.g., $\alpha=10^6$). The attack saturates for $\alpha \geq 1$, indicating insensitivity to exact learning rate or benign gradient scale [2203.08669].

## 4. Experimental Evaluation and Empirical Impact

Experiments on MNIST, Fashion-MNIST, and Purchase datasets reveal the potency of MPAF:
- With **FedAvg**, as little as $m/n=1\%$ fake clients suffice to degrade test accuracy to random chance (e.g., 10% for a 10-class task).
- With **Median** or **Trimmed-mean** defenders, $m/n=10\%$ induces $32\%$ accuracy drop (Purchase) and up to $50\%$ (MNIST), while baseline noise-injection attacks inflict $<4\%$ drop.
- As $m/n$ increases to $25\%$, degradation deepens (e.g., 32% → 49% on Purchase).
- Reducing participation rate $\beta$ down to $0.01$ (1% clients per round) does not mitigate the attack: MPAF remains highly effective independent of client sampling strategies.
- Tuning the scaling factor $\alpha$ above unity rapidly maximizes the attack’s effect; attack efficacy is robust to the choice of $\eta$ and precise scale, as near-optimal performance is achieved for $\alpha \geq 1$.
- **Norm clipping** curbs outlier update norms but cannot prevent the attack unless the clipping threshold $M$ is set so low that benign training quality also collapses. For practical $M$ values, MPAF still degrades accuracy by $15\text{–}20\%$.

These results highlight how standard defenses are structurally vulnerable to coordinated persistent poisoning via fake clients.

## 5. Limitations of Existing Defenses and Security Implications

The qualitative hallmark of MPAF is directional consistency—fake updates always point toward $w_b$ and are perfectly synchronized. Classic robust aggregation and norm-clipping approaches are primarily designed for magnitude outliers or coordinate-wise extremal behavior; they are fundamentally limited in the presence of many clients persistently dragging the global update in the same direction. 

The paper demonstrates that:
- Median and trimmed-mean rules are not immune, as synchronized malicious updates avoid randomization and can pass robust filters if $m$ is not vanishingly small.
- Norm clipping is ineffective at realistic thresholds.

Table: **Defense Impact Summary**

| Aggregation Rule    | Minimal Fake Fraction for Major Degradation | Test Accuracy Drop     |
|---------------------|---------------------------------------------|------------------------|
| FedAvg              | $1\%$                                       | Down to random chance  |
| Median, Trimmed-mean| $10\%$                                      | $30$-$50\%$            |
| Norm clipping ($M$) | —                                           | $15$-$20\%$ at benign $M$|

## 6. Future Research and Open Directions

Proposed mitigations and research priorities include:
- Development of aggregation or anomaly detection rules that analyze *directional consistency* across rounds, not just per-round magnitude outliers.
- Extension of MPAF to *targeted* poisoning (e.g., choosing $w_b$ to encode a backdoor or trigger-specific behavior).
- Use of side-channel or auxiliary public data to validate global model direction and certify resistance to base-model drag.
- Exploration of formally provable defenses, such as ensemble methods with redundant computation or voting, and systematic resilience checks for fake-client influence.

The paper underscores that adversaries need not compromise genuine clients to achieve catastrophic sabotage in FL; fake-client injection with persistent, strategically aligned parameter updates can undermine standard defense assumptions, motivating a fundamental reevaluation of federated system security [2203.08669].

Source: https://www.emergentmind.com/topics/base-model-drag-attacks-mpaf