Entropy-Based Test-Time Trigger Attack

• The paper demonstrates an innovative poisoning attack that leverages high-entropy triggers to manipulate entropy-minimizing TTA algorithms in federated systems.
• It combines grey-box surrogate modeling, feature-consistent poison synthesis, and notch high-entropy loss optimization to degrade global and client performance.
• Empirical analysis shows significant accuracy drops on CIFAR benchmarks, highlighting vulnerabilities even under robust aggregation defenses.

An entropy-based test-time trigger attack is a class of poisoning attacks targeting federated test-time personalization systems, where adversaries inject specifically crafted inputs during the test-time adaptation phase to degrade global and client-level performance. The approach leverages high-entropy triggers—inputs engineered to maximize output distribution entropy—to bias entropy-minimizing adaptation algorithms into damaging local minima. Within the FedPoisonTTP framework, these attacks combine grey-box surrogate modeling, feature-consistent poison synthesis, and optimization over a notch high-entropy loss objective, allowing the attacker to degrade performance while evading common aggregation and adaptation defenses (Iftee et al., 24 Nov 2025).

1. Federated Test-Time Adaptation Threat Model

Federated Test-Time Adaptation (FTTA) involves $N$ clients and a central server holding the global model $\theta^t$ at round $t$. In each communication round, a subset $S_t$ of clients receives $\theta^t$ and performs unsupervised test-time adaptation on local, unlabeled batches $\mathcal{D}_{i,t}$, producing adapted models or updates $\Delta\theta^t_i$. The server aggregates updates as

$$\theta^{t+1} = \theta^t + \eta \cdot \sum_{i\in S_t} \frac{n_i}{\sum_{j\in S_t} n_j} \Delta\theta^t_i,$$

where $\eta$ is the step size and $n_i$ is the batch size for client $i$.

The adversarial threat model is “grey-box”: the attacker controls a single client and observes only the global model broadcast $\theta^t$, never accessing other clients’ data, updates, or local model states. The attacker injects a small fraction $\mathcal{D}^p_{a,t}$ of poisoned examples into its local TTA batch, balancing between stealth constraints (bounded $\ell_\infty$/$\ell_2$ norms, class balance, norm clipping) and attack efficacy. The objective is to maximize the expected global and per-client accuracy degradation post-adaptation on benign data (Iftee et al., 24 Nov 2025).

2. Surrogate Model Distillation for Adversarial Optimization

Lacking direct visibility into future global models, the adversary performs online surrogate modeling:

• History-Based Estimation: Honest-client update estimate:

$$\widehat{\Delta\theta}_{\text{hist}} = \frac{1}{k}\sum_{j=t-k+1}^t (\theta^j-\theta^{j-1})$$

The attacker's estimated contribution is subtracted to obtain $\widehat{\Delta\theta}_{-a}$.

• Candidate Post-Aggregation Surrogate: Given a candidate attacker update $\Delta\theta_a$:

$$\hat{\theta}^{t+1}(\Delta\theta_a) = \theta^t + \eta\,(\widehat{\Delta\theta}_{-a}+\Delta\theta_a)$$

• Posterior Distillation: When the true $\theta^{t+1}$ arrives, the surrogate's dynamics parameter $s$ is updated via KL minimization using the benign pool $\mathcal{B}_{ab}$:

$$L_{\text{distill}}(s) = \frac{1}{|\mathcal{B}_{ab}|} \sum_{x\in \mathcal{B}_{ab}} \mathrm{KL}\big(h(x;\theta^{t+1})\,\|\,h(x;\hat{\theta}^{t+1}(s))\big)$$

This surrogate allows iterative refinement of the poisoning strategy, despite partial observability.

3. Feature-Consistent Poison Synthesis

Ensuring that poisoned inputs remain in-distribution is critical to transferability and stealth. FedPoisonTTP matches feature statistics between poisons and a benign sample pool:

• Per-Layer Moments: For each layer $l$, the mean and diagonal variance over activations $f^l_m(x;\theta)$ are defined by

$$\mu^l(x) = \frac{1}{M_l}\sum_{m=1}^{M_l} f^l_m(x), \quad \sigma^l(x)^2 = \frac{1}{M_l} \sum_{m=1}^{M_l} (f^l_m(x) - \mu^l(x))^2$$

• Layer-Averaged Moment-Matching Regularizer:

$$L_{\text{reg}}(\mathcal{D}^p_{a,t}, \mathcal{B}_{ab}) = \frac{1}{L}\sum_{l=1}^L \Big( \|\mu^l(\mathcal{D}^p_{a,t}) - \mu^l(\mathcal{B}_{ab})\|_2^2 + \beta \|\sigma^l(\mathcal{D}^p_{a,t}) - \sigma^l(\mathcal{B}_{ab})\|_2^2 \Big)$$

with hyperparameter $\beta$ weighting variance consistency.

This procedure enforces the poisoned batch’s statistical alignment with the benign distribution, supporting both stealth and downstream transferability during aggregation and adaptation.

4. High-Entropy Trigger Optimization

FedPoisonTTP specifically targets entropy-minimizing TTA algorithms (e.g., TENT) by injecting high-entropy triggers, confusing decision boundaries:

• Notch High-Entropy (NHE) Loss: For each poisoned example, a “notched” target $Q$ is constructed by zeroing the true class and uniformly distributing mass over remaining $K-1$ classes. The NHE loss is

$$L_{\text{NHE}}(\mathcal{D}^p_{a,t};\theta) = \frac{1}{|\mathcal{D}^p_{a,t}|} \sum_{(x,y)\in \mathcal{D}^p_{a,t}} \mathrm{CE}(h(x;\theta), Q)$$

• Combined Attack Loss:

$$L_{\text{attack}} = \alpha\,L_{\text{reg}}(\mathcal{D}^p_{a,t},\mathcal{B}_{ab}) + \gamma\,L_{\text{NHE}}(\mathcal{D}^p_{a,t};\hat{\theta}^t)$$

with $\alpha, \gamma\ge 0$ controlling feature-consistency versus entropy maximization.

• PGD Poison Update: Poisons are optimized via projected gradient descent with norm constraints:

$$\delta_i \leftarrow \mathrm{Project}_{\|\delta\|\leq \epsilon}\left[\delta_i - \eta_{\text{pgd}}\,\nabla_{\delta_i} L_{\text{attack}}\right]$$

The poisonous batch is then mixed with benign data at ratio $\rho$ in the adaptation batch. The adversary submits the adapted update after norm clipping.

5. Attack Propagation and Systemic Effects

Attack deployment follows routine injection of handcrafted poisons into each participating round’s local TTA batch. Honest clients only observe post-aggregation models and adapt on all-benign streams, yet the global model incorporates the attacker’s poisoned update $\Delta\theta^t_a$. As the attacker participates, even intermittently, collectively poisoned updates propagate (“ripple”) across aggregation rounds, gradually biasing global model parameters such that entropy-minimizing TTA increasingly harms accuracy on benign client distributions.

The attack’s stealth is preserved through:

• Feature moment matching,
• Class balance,
• Norm-clipping of $\Delta\theta$ (to evade robust aggregation defenses such as Krum and norm bounding).

Table: Propagation Mechanism Overview

Phase	Mechanism	Stealth Feature
Local Injection	Poison in TTA batch	Feature-consistent, class-balanced
Aggregation	Model drift	Norm clipping on update
Cross-Round Propagation	Model “ripples”	In-distribution feature stats

A plausible implication is that cumulative participation, even at low frequency, undermines both immediate and downstream client model robustness.

6. Empirical Impact and Ablation Analysis

FedPoisonTTP was evaluated on CIFAR-10-C and CIFAR-100-C (corruption level 5) with $N = 10$ clients and $M = 5$ adversaries, poison ratio $\rho=0.5$, batch size 100, using FedAvg, FedProx, pFedGraph, and FedAMP for federation, and TENT and CoTTA for TTA:

• Accuracy Degradation: On clean baseline TENT+FedAvg, CIFAR-10-C accuracy drops from 81.19% to 77.95% ($\Delta=-3.24\%$) under attack; for CIFAR-100-C, from 68.13% to 55.15% ($\Delta=-12.98\%$).
• Varying attack parameters:
  • Number of adversaries $M$: one attacker suffices for $\sim$2–5% drop, five for $\sim$10–15%.
  • Poison ratio $\rho$: increasing from 0.1 to 0.5 amplifies effect (~2%→6% on CIFAR-10-C, ~5%→15% on CIFAR-100-C).
  • Batch size: smaller batches exacerbate the attack (batch=10, $\sim$10% drop; batch=200, $\sim$3% drop).
• Across aggregation algorithms and TTA types, the high-entropy attack consistently induces the largest degradations; CoTTA displays 6–14% drops, depending on attacker-dataset-aggregator configuration.
• White-box NHE attacks are ~1–2% stronger than grey-box, but the grey-box surrogate strategy remains potent, yielding $\sim$5–12% accuracy loss (Iftee et al., 24 Nov 2025).

7. Defensive Observations and Future Prospects

Empirical results indicate robust aggregation techniques (Krum, norm clipping) are insufficient; attacks evade detection by conserving update norms and mimicking benign feature statistics. Defensive avenues include:

• Monitoring cross-client entropy or batch-norm drift,
• Incorporating server-side held-out validations post-aggregation to detect distribution shifts,
• Exploring privacy-preserving validation or ensemble-based TTA robust to high-entropy triggers.

Research directions involve development of client-level feature-space outlier detectors and TTA algorithms inherently robust to entropy-based triggers. A plausible implication is further convergence between federated learning security and adaptive outlier detection in non-IID, privacy-sensitive regimes (Iftee et al., 24 Nov 2025).