---
title: FedThief in Self-Centered Federated Learning
url: https://www.emergentmind.com/topics/fedthief
type: topic
---

# FedThief in Self-Centered Federated Learning

FedThief is a federated learning attack framework proposed for **Self-Centered Federated Learning (SCFL)**, a threat paradigm in which malicious participants do not merely sabotage the shared model but also seek a private competitive advantage by building a stronger model for themselves [2509.00540]. In this formulation, the attacker’s objective is explicitly dual: to degrade the performance of the global model used by other participants while enhancing its own model within the same federated process. FedThief realizes that objective by poisoning uploaded updates and, in parallel, training a separate private pathway supported by a divergence-aware ensemble mechanism. In adjacent work, “FedThief-style” is sometimes used more loosely for federated model theft or data extraction; however, the specific method named **FedThief** refers to this SCFL attack on federated image classification rather than to ownership watermarking, traitor tracking, or gradient inversion [2509.00540].

## 1. Self-Centered Federated Learning and the FedThief threat model

FedThief is formulated in a standard centralized FL system for a \(C\)-class image classification task with \(N\) clients, a central server, client-local private datasets, and iterative communication rounds. Each client \(c_k\) owns a local dataset
\[
D_k = \{(x_k^i, y_k^i)\}_{i=1}^{N_k},
\]
where \(x_k^i \in \mathbb{R}^{d_{\text{in}}}\), \(y_k^i \in \{0,1\}^C\), and \(|D_k| = N_k\). Each client trains a local model \(f(\theta_k)\), with parameters \(\theta_k \in \mathbb{R}^{d_\theta}\), mapping inputs to class predictions [2509.00540].

The threat model assumes that a fraction \(\alpha\) of clients are malicious, with the full client set denoted by \(\mathcal{K}\) and the malicious subset by \(\mathcal{K}_m\). The paper adopts the standard FL vulnerability that uploaded updates cannot be directly verified. This places FedThief within the model-poisoning or Byzantine-attack landscape, but its attacker utility differs from conventional sabotage-only formulations. Existing attack strategies, in the paper’s framing, typically upload tampered updates to degrade the global model and thereby also degrade the attacker’s own local model, yielding no private advantage. FedThief instead targets a rational, self-interested adversary whose goal is to outperform other participants, not merely to reduce system-wide accuracy [2509.00540].

The attacker’s advantage is quantified through the difference between malicious ensemble accuracy and global-model accuracy,
\[
\Delta_{\text{mal}} = Acc_e - Acc_g.
\]
A successful attack is therefore one that produces both a low \(Acc_g\) and a high \(Acc_e\). This metric is central because it makes explicit that FedThief is not satisfied with global degradation alone; it seeks asymmetry in favor of the attacker [2509.00540].

## 2. Architectural decomposition of the malicious client

The distinctive mechanism in FedThief is a **multi-model malicious client**. Rather than using a single local model for both participation and attack, each malicious participant maintains four components: a **private model** \(\theta_p\), a **malicious model** \(\theta_m\), an **error model** \(\theta_e\), and an **ensemble model** realized through a learned local ensemble head \(\mathcal{E}_k^t\) [2509.00540].

The private model is optimized for the attacker’s own utility. The malicious model is the model that interacts with the federated protocol and generates poisoned uploads. The error model tracks degradation induced by poisoned updates. The ensemble component combines the outputs of the other models and serves as a teacher for knowledge distillation back into the private model. The malicious client also splits its local dataset into \(D_k^{\text{train}}\) and \(D_k^{\text{val}}\), using roughly \(1/v\) of local data for validation and the remainder for training [2509.00540].

The paper emphasizes two mechanisms. First, the attacker degrades the global model by uploading modified content during the upload stage. Second, it enhances its own model through **divergence-aware ensemble techniques** that integrate global updates and local knowledge. An important technical clarification is that the paper does **not** provide a separate explicit mathematical divergence metric formula such as a parameter distance or KL-based divergence specifically designated as “the” divergence measure. “Divergence-aware” is instead realized architecturally through the simultaneous maintenance of \(\theta_p\), \(\theta_m\), and \(\theta_e\), which encode different trajectories relative to the global process [2509.00540].

This separation is the core novelty. A conventional poisoning attacker uses one model and therefore damages both the federation and its own training path. FedThief decouples “what is uploaded” from “what is retained,” allowing the malicious client to preserve and refine a stronger private model while still participating in global degradation.

## 3. Optimization objectives and round-level mechanics

At round \(t\), the malicious model is trained on local training data to produce
\[
g_m^t = \nabla f(\theta_m^t; D_k^{\text{train}}).
\]
The uploaded malicious gradient is then constructed as
\[
\tilde{g}_m^t = \mathcal{A}(g_m^t) = g_m^t + \beta \cdot \delta,
\]
where \(\mathcal{A}(\cdot)\) is a Byzantine attack function, \(\delta\) is an adversarial direction, and \(\beta > 0\) controls perturbation magnitude [2509.00540]. The paper does not define a bespoke layer-wise poisoning rule as part of FedThief itself; instead, FedThief is a framework that wraps existing attack backends. In experiments, \(\mathcal{A}(\cdot)\) is instantiated with **LIE**, **Min-Sum**, and **FedGhost**, chosen because they do not require knowledge of benign updates or the exact server aggregation rule [2509.00540].

The server aggregates malicious and benign updates as
\[
g^t = \mathrm{Aggregate}\big(\{\tilde{g}_m^t\} \cup \{g_{\text{benign}}^t\}\big).
\]
The malicious model is then synchronized with the global direction:
\[
\theta_m^{t+1} = \theta_m^t - \eta g^t.
\]
This preserves alignment with the federated trajectory and supports stealth. Separately, the private model computes
\[
g_p^t = \nabla f(\theta_p^t; D_k^{\text{train}}),
\]
and malicious clients collaboratively update their private models using shared private gradients:
\[
\theta_p^{t+1} = \theta_p^t - \eta \cdot \frac{1}{|\mathcal{K}_m|} \sum_{k \in \mathcal{K}_m} g_{p,k}^t.
\]
The error model follows the poisoned path directly:
\[
\theta_e^{t+1} = \theta_e^t - \eta \cdot \tilde{g}_m^t.
\]
These three models thus encode, respectively, a self-serving local trajectory, a globally synchronized poisoned trajectory, and an attack-induced degradation trajectory [2509.00540].

The ensemble stage operates in logit space rather than parameter space. For validation inputs, the attacker obtains logits \(z_p\), \(z_m\), and \(z_e\) from the private, malicious, and error models and trains a multinomial logistic regression head \(\mathcal{E}_k^t\) with regularized multiclass cross-entropy. The paper states that this logistic regression includes \(L_2\) regularization and is optimized with **L-BFGS** until convergence. Local ensemble heads are then averaged across malicious clients:
\[
\mathcal{L}^{t+1} = \frac{1}{|\mathcal{K}_m|} \sum_{k \in \mathcal{K}_m} \mathcal{E}_k^t.
\]
The resulting global malicious ensemble serves as a teacher for the private model [2509.00540].

Distillation is performed using the standard cross-entropy and KL components:
\[
\mathcal{L}_{\mathrm{CE}} = - \sum_{i=1}^{C} y^i \log f(\theta_p^{t+1}),
\]
\[
\mathcal{L}_{\mathrm{KD}} = \sum_i P_i \log \frac{P_i}{Q_i},
\qquad
P = \sigma(z_{\text{ensemble}}),\; Q = \sigma(z_p),
\]
and the combined objective
\[
\mathcal{L}_{\mathrm{total}} = \lambda \cdot \mathcal{L}_{\mathrm{CE}} + (1-\lambda)\cdot \mathcal{L}_{\mathrm{KD}}.
\]
The private model is finally updated by SGD using \(\mathcal{L}_{\mathrm{total}}\). The operational significance of this design is that the attacker’s private model benefits from both its own supervision and the richer ensemble teacher while remaining insulated from the full damage imposed on the shared global model [2509.00540].

## 4. Experimental setting and empirical behavior

FedThief is evaluated on **MNIST**, **Fashion-MNIST**, and **CIFAR-10**. The models for MNIST and Fashion-MNIST are lightweight CNNs with three convolution layers, ReLU, \(2 \times 2\) max-pooling, and three fully connected layers. For CIFAR-10, the paper uses an AlexNet variant with five convolution layers, batch normalization, ReLU, max-pooling, and dense layers. The FL setting uses **50 clients**, **IID** equal-sized balanced partitions, and **40 communication rounds**. Local optimization uses **Adam** with learning rate \(\eta = 0.001\) and batch size \(256\); local epochs are \(2\) for MNIST and Fashion-MNIST and \(4\) for CIFAR-10. Distillation uses temperature \(\tau = 3.0\) and loss coefficient \(\lambda = 0.5\). The malicious fraction is evaluated at \(\alpha = 20\%\) and \(\alpha = 40\%\). Server-side aggregation rules include **FedAvg**, **FedProx**, **Median**, **Trimmed-Mean**, **Multi-Krum**, and **Bulyan** [2509.00540].

The principal empirical result is that the malicious ensemble almost always outperforms the global model, especially on more difficult datasets and at higher malicious fractions. On **CIFAR-10** with **Bulyan**, **LIE**, and \(\alpha=0.4\), the no-attack baseline global accuracy is \(\widetilde{Acc}_g = 59.42\), the attacked global model falls to \(Acc_g = 16.23\), and the malicious ensemble reaches \(Acc_e = 51.61\), yielding \(\Delta_{\text{mal}} = +35.38\). On **CIFAR-10** with **FedAvg**, **MinSum**, and \(\alpha=0.4\), the global model reaches \(38.84\) while the malicious ensemble reaches \(55.99\), giving \(+17.15\). Under **FedProx** with the same backend and adversarial fraction, the global model reaches \(35.40\) and the malicious ensemble \(56.96\), giving \(+21.56\) [2509.00540].

The gains are smaller on easier datasets. On **MNIST** with **FedAvg**, **LIE**, and \(\alpha=0.4\), the global model achieves \(97.73\) and the malicious ensemble \(98.12\), for an advantage of \(+0.39\). On **Fashion-MNIST**, the gains are intermediate: with **Multi-Krum**, **LIE**, and \(\alpha=0.4\), the global model reaches \(81.05\) and the malicious ensemble \(84.21\), for \(+3.16\). This suggests that task complexity affects the extent to which the multi-model ensemble can extract a self-centered advantage [2509.00540].

The paper also reports that the malicious ensemble becomes better early in training and maintains that advantage through the learning process across all six aggregation rules. It further evaluates generalization to **data poisoning**, specifically **Symmetry Flipping** and **Pair Flipping**, under **Bulyan** with \(\alpha = 0.4\). For **MNIST** with Pair Flipping, the global model reaches \(51.50\) and the malicious ensemble \(98.06\), for \(+46.56\). For **Fashion-MNIST**, the corresponding values are \(41.84\) and \(83.69\), for \(+41.85\). For **CIFAR-10**, they are \(26.12\) and \(49.42\), for \(+23.30\) [2509.00540].

The ablations reinforce the design choices. For the distillation trade-off, \(\lambda=1\) weakens generalization, too small a \(\lambda\) causes the private model to drift toward the global teacher, and the best reported setting is \(\lambda=0.5\). For the validation split ratio \(v\), a moderate split works best; on CIFAR-10 with LIE and \(\alpha=0.2\), **Bulyan** yields \(\Delta_{\text{mal}}=+1.83\) at \(v=2\), \(+4.26\) at \(v=5\), and \(+3.78\) at \(v=10\), while **Multi-Krum** yields \(+1.82\), \(+2.96\), and \(+1.96\) respectively. Component ablation shows that using only \(\theta_p\) gives \(49.27\), \(\theta_p + \theta_m\) gives \(54.62\), \(\theta_p + \theta_e\) gives \(52.28\), and the full \(\theta_p + \theta_m + \theta_e\) system gives \(57.55\) on CIFAR-10 at \(\alpha=0.2\). Distillation temperature is also tuned, with \(T=3\) giving \(57.55\), slightly above \(T=2\) at \(57.30\) and \(T=5\) at \(57.53\) [2509.00540].

## 5. Relation to adjacent uses of “FedThief” in federated-security literature

The term **FedThief** can be misleading because adjacent papers use “FedThief-style” to refer more broadly to federated extraction or theft, but these works target different assets and channels. **FedSpy-LLM** is a federated-learning **gradient inversion** attack aimed at reconstructing private text used to fine-tune large language models, including PEFT settings such as SLoRA and FedAdapter, from pre-aggregation client gradients or updates observed by an honest-but-curious server or a passive eavesdropper [2604.06297]. Its two main phases are **Token Recovery** and **Sequence Order Calibration**, and its core mechanism is a gradient decomposition strategy based on low-rank subspaces and PEFT null-space regularization. Relative to that line of work, FedThief is not a data reconstruction attack and does not attempt to recover client training examples.

A different neighboring line concerns **insider model leakage** and post hoc attribution. **FedTracker** provides ownership verification through a global watermark and source attribution through client-specific fingerprints, with black-box verification for ownership and white-box access required for tracing [2211.07160]. **FedCIP** similarly addresses a malicious client that repeatedly leaks global models over time, using client-side watermarking, cycle-based watermark replacement, and participant-set intersection for traitor tracking while claiming compatibility with secure aggregation [2306.01356]. These systems are defenses or forensic mechanisms rather than attack frameworks. They do not implement SCFL and do not seek malicious private-model improvement.

A third neighboring thread is **centralized black-box model stealing**. The study of foundation-model susceptibility to model theft examines hard-label API extraction for image classification, showing, for example, that a ViT-L/16 victim on CIFAR-10 can reach **94.28% agreement**, compared with **73.20%** for a ResNet-18 victim, when the thief is also ViT-L/16 [2502.18077]. That work is relevant as architectural motivation—shared pretrained representations can increase extractability—but it does not study federated protocols, aggregation, malicious clients, or SCFL.

This distinction is substantive. FedThief, in the narrow sense, is a **utility-driven federated poisoning framework**. FedSpy-LLM targets **training-data extraction from updates**. FedTracker and FedCIP target **ownership verification and leaker attribution**. The FM-stealing study targets **centralized hard-label API extraction**. Treating all of these as interchangeable “FedThief” variants obscures different assets, observability assumptions, and defender objectives.

## 6. Limitations, common misconceptions, and significance

Several limitations are explicit in the FedThief formulation. The attack incurs **high computational overhead** because each malicious client maintains multiple models and trains an ensemble head. It also incurs **extra communication overhead** because malicious clients share private gradients and ensemble heads among themselves. The private benefit is partly contingent on **private data quality**; highly imbalanced, sparse, or unrepresentative local data may reduce gains. The paper also notes **potential sensitivity under non-IID conditions**, while the reported experiments themselves are primarily **IID**, chosen to isolate attack behavior rather than to study heterogeneity comprehensively [2509.00540].

A common misconception is to interpret the “divergence-aware” label as evidence of an explicit divergence penalty or closed-form divergence metric. The paper does not provide such a standalone formula. The divergence concept is encoded through the use of three model trajectories—private, malicious, and error—and the ensemble that learns how to combine them. Another misconception is to view FedThief as merely another Byzantine attack wrapper. That is incomplete: the framework’s defining contribution is not only poisoned upload construction but the preservation of attacker utility through model-role separation and ensemble distillation [2509.00540].

The paper’s broader implication is that defenses which evaluate only **global robustness** may overlook a stronger adversary class. FedThief remains effective under robust aggregation rules such as **Median**, **Trimmed-Mean**, **Multi-Krum**, and **Bulyan**, and the reported positive \(\Delta_{\text{mal}}\) under those defenses indicates that a system can appear resistant in terms of aggregate convergence while still granting malicious participants a substantial competitive edge [2509.00540]. A plausible implication is that federated defenses should not measure success solely by final global accuracy or convergence stability; they may also need to monitor whether adversaries can privately outperform honest participants while manipulating shared training.

In that sense, FedThief marks a shift in how federated attacks are conceptualized. Rather than modeling the attacker as purely destructive, it models the attacker as economically or strategically rational: a participant who exploits the collaborative channel to damage competitors and simultaneously improve its own model. That reframing is its central contribution to the federated learning literature [2509.00540].

Source: https://www.emergentmind.com/topics/fedthief