Collaborative Injection in Federated Learning

• Collaborative injection in federated learning is a technique where multiple clients intentionally inject domain knowledge, noise, or adversarial data to shape the global model.
• It employs methods such as knowledge injection protocols and aggregation-neutral perturbations that boost robustness and preserve privacy.
• The approach also covers malicious strategies like coordinated backdoor attacks and data poisoning, necessitating advanced detection and defense mechanisms.

Collaborative injection in federated learning (FL) refers to the deliberate, coordinated introduction of information—whether knowledge, features, noise, adversarial data, or gradient manipulation—across multiple clients to influence the federated training process. This influence can be benign (e.g., knowledge injection, privacy-preserving perturbation, collaborative defenses) or malicious (e.g., multi-client backdoor attacks, prompt injection, data poisoning, or strategic manipulation in competitive landscapes). The following sections catalog the spectrum of collaborative injection mechanisms, threat models, detection and mitigation strategies, and emerging research frontiers.

1. Definitional Scope and Taxonomy

Collaborative injection encompasses any multi-party, round-synchronous or asynchronous manipulation or enrichment of local FL computations targeting global model formation. It includes:

• Benign collaborative injection: Joint injection of domain knowledge or privacy-preserving noise intended to enhance model generalization, robustness, or privacy. Examples: knowledge-guided local transformations (Fan et al., 2022), coalition-based aggregation-neutral perturbations (Bai et al., 11 Jan 2026).
• Malicious collaborative injection: Adversarial or competitive multi-agent strategies to subvert model utility, integrity, or privacy. Examples: distributed multi-target backdoor attacks (Liu et al., 2024), colluding prompt-injection (Lee et al., 30 Jan 2025), coordinated noise attack in competitive FL (Dorner et al., 2023), collusive data injection (Shalom et al., 2023), membership inference amplification (Bai et al., 11 Jan 2026).

Collaborative injection can be explicitly coordinated (e.g., by authenticated coalitions or attacker groups), emergent (via rational agents with aligned incentives), or policy-guided, depending on the domain and threat assumptions.

2. Mechanisms: Benign Knowledge and Privacy Injection

2.1 Knowledge-Injection Protocols

Benign collaborative injection allows clients to privately refine or enrich their local FL objective using proprietary domain knowledge, without disclosing that knowledge to the server or other clients. A canonical instantiation is "Knowledge-Injected Federated Learning" (Fan et al., 2022), where:

• Each client augments its loss via prediction-type and range-type knowledge models (KMs). The client-side transformation

$$f^m(\theta;x)=T_{\lambda^m,g_p^m,g_r^m}(f(\theta;\cdot))(x)$$

enforces soft and hard constraints before per-client gradient calculation.

• The function transformation masks logits for non-allowed classes (support constraints) and convex-combines the output with expert signals:

$$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$

which ensures only classes in the support set defined by $g_r(x)$ have nonzero predicted probability.

• Personalized gradient computation is followed by server-level FedAvg aggregation. No knowledge model leaves the client.
• Empirical evaluations demonstrate superior test accuracy and strict constraint adherence compared to standalone ML or pure KM training, particularly in data-sparse, non-IID, or industrial settings (Fan et al., 2022).

2.2 Privacy and Membership Inference Defenses

In collaborative defense settings, clients can inject structured, coalition-coordinated perturbations to mask local updates against inference attacks, while ensuring zero mean at aggregation. The aggregation-neutral perturbation (ANP) module of CoFedMID (Bai et al., 11 Jan 2026) exemplifies this:

• Each member $i$ of a defender coalition draws a noise vector $\Delta_i$, constrained so $\sum_{i\in C} \alpha_i\Delta_i=0$ (where $\alpha_i$ is the aggregation weight).
• The perturbed local model $\widetilde{w}_i=w_i+\Delta_i$ is uploaded such that the global FedAvg update is unchanged.
• This step significantly reduces AUC of trajectory-based membership inference (e.g., from $0.63$ to $0.59$ on CIFAR-100) while incurring negligible accuracy loss (Bai et al., 11 Jan 2026).
• Empirical tuning of noise magnitude and the fraction of model parameters perturbed offers flexible privacy/utility trade-offs.

3. Collaborative Malice: Distributed Backdoors, Data and Gradient Attacks

3.1 Distributed Multi-Target Backdoor Attacks

"Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning" (Liu et al., 2024) formalizes an attack paradigm where $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$0 adversarial clients independently inject distinct triggers and target labels into the FL process. Notable components include:

• Each colluding client $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$1 generates backdoor samples via a unique trigger $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$2 in a specified input channel and frequency block, ensuring orthogonality to minimize gradient conflict.
• Local training for each attacker optimizes a composite loss comprising clean data and multiple backdoor tasks:

$$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$3

• Backdoor replay ensures that previous triggers persist when new ones are injected, avoiding catastrophic forgetting and destructive gradient interference.
• Empirical results: Attack Success Rate (ASR) for each backdoor remains above $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$4 immediately and $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$5 after $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$6 rounds, with clean accuracy near baseline (Liu et al., 2024).

3.2 Prompt Injection and Policy-Escalation Attacks

Federated LLMs in sensitive domains (e.g., military) are vulnerable to collusive prompt-injection attacks, which may:

• Leak secret information by crafting adversarial prompts and analyzing model gradients (measured by extraction rate $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$7),
• Enable free-riding, where clients abstain from genuine model updates but exploit the shared global model,
• Instigate controlled misinformation or utility drop, tracked by in-model prevalence $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$8 or $$T_{\lambda,g_p,g_r}(f)(x) = (1-\lambda)\,\operatorname{softmax}\left(f(x)+\infty\cdot(g_r(x)-\mathbf{1}^k)\right) + \lambda g_p(x)$$9 (Lee et al., 30 Jan 2025).

Mitigation involves technical and policy-layer responses, including game-theoretic red/blue wargaming for adversarial scenario exploration, anomaly-based quality assurance systems for weight update monitoring (with real-time clipping/back-projection of suspicious gradients), and formal policy ratification pipelines—often with direct human-AI collaboration in policy refinement and audit.

3.3 Collusion and Rational Competitive Attack

When FL participants are direct competitors, they may engage in rational collaborative injection strategies to maximize relative utility, even absent adversarial intent. Game-theoretic analyses in (Dorner et al., 2023) show:

• Without extrinsic penalties, all Nash equilibria correspond to large or even infinite perturbations, as clients degrade the global model to harm others.
• Peer-prediction style penalty mechanisms ($g_r(x)$0) or server-level noise-injection can enforce honesty, restoring asymptotic risk rates to those in honest FedSGD (e.g., $g_r(x)$1 excess risk).
• These incentive structures ensure budget balance, voluntary participation, and efficiency, though they may not be robust to large coalitions (Dorner et al., 2023).

4. Data Injection and Robust Training

False data injection is a canonical attack in which colluding agents provide updates computed on misleading, biased, or fixed-label data. The server-side mitigation protocol of (Shalom et al., 2023) operates by:

• Monitoring each client’s update trajectory deviation (in $g_r(x)$2 norm) from the median of other clients.
• Marking clients as malicious if their cumulative deviation within a window exceeds a tunable threshold, with majority-history decision rules for isolation.
• Convergence analysis guarantees, under i.i.d. honest-client data and majority-honest assumption, that all attackers are eventually isolated with high probability, and that the federated model converges to the truthful optimum.
• Empirical results show the approach reliably suppresses both constant-output and label-flipping attacks, returning test error to baseline after attacker isolation (Shalom et al., 2023).

5. Collaborative Robustness via Machine Teaching

In highly noisy or adversarial data regimes, robust federated learning may be achieved by collaborative machine teaching protocols (Han et al., 2019), wherein:

• Each agent is equipped with a small, trusted verification set, used to screen and minimally perturb its main data for inclusion in model training.
• Agents solve a joint optimization for compact, informative subsets and bounded feature/label perturbations under penalization and global consensus constraints. This ensures minimization of test error given corrupted local datasets.
• Block-coordinate ADMM is used for federated optimization, ensuring parallelizable convergence and transferable robustness guarantees.
• Empirical results: With 90% corrupted training data, collaborative injection and data cleaning restore $g_r(x)$3 on synthetic regression tasks from $g_r(x)$4 (trusted-only) to $g_r(x)$5 (full algorithm), and AUC from $g_r(x)$6 to $g_r(x)$7 on classification (Han et al., 2019).

6. Selective, Graph-Guided, and Personalized Collaboration

Recent work leverages graph structures to guide selective knowledge injection among similar clients (Elbakary et al., 11 Jun 2025). The SFMTL-Graph framework illustrates:

• Clients exchange lightweight feature anchors and classification heads, not full models.
• Cross-client similarities are continuously tracked via a dynamic graph and community detection (Newman–Girvan modularity), ensuring knowledge flows only among highly similar clients to prevent negative transfer.
• Empirically, SFMTL-Graph achieves the strongest personalization, lowest variance, and communication overhead two orders of magnitude below classic FedAvg in highly non-IID regimes (Elbakary et al., 11 Jun 2025).

7. Open Directions and Implications

Collaborative injection, in all forms, exposes limits of FL’s privacy, security, and utility guarantees. Challenges include:

• Scaling privacy-preserving coalition mechanisms to large, heterogeneous populations (Bai et al., 11 Jan 2026).
• Designing backdoor-robust learning protocols resilient to low-magnitude, dispersed, replay-synchronized attacks (Liu et al., 2024).
• Establishing tightly-integrated, auditable human–AI policy frameworks in sensitive collaborative contexts (e.g., defense, financial consortia) (Lee et al., 30 Jan 2025).
• Incentivizing honesty in dynamic, competitive, or self-interested FL ecosystems beyond simple majority-honest or i.i.d. data regimes (Dorner et al., 2023).

The landscape continually balances privacy, accountability, personalization, and security. As federated learning becomes more entrenched in critical domains, the theoretical rigor and empirical breadth of collaborative injection research will be central to both capabilities and risk mitigation.