Advanced Persistent Threats (APTs) pose serious risks to federated learning (FL) deployments in critical sectors such as healthcare and finance. Conventional defenses struggle to capture the intermittent behavior of attackers, leaving systems vulnerable. This work focuses on a specific APT—Covert Model Poisoning (CMP)—where the adversary injects poisoned model updates in a stealthy, intermittent manner.
The interaction between the FL server and a CMP attacker is modeled as an imperfect repeated game in which neither player can directly observe the other's actions. Based on this formulation, the authors introduce a novel adversarial search algorithm called StratFL and devise belief‑update mechanisms for both the server and the attacker, enabling each side to infer the opponent's strategy under partial information.
Experiments on MNIST and CIFAR‑10 evaluate StratFL against state‑of‑the‑art defenses. The belief‑update algorithms converge across various security scenarios, and StratFL achieves roughly a 10% improvement in model accuracy over baselines.
Review: StratFL elegantly combines game‑theoretic reasoning with federated learning to deliver a transparent and effective defense against covert poisoning, meriting further exploration in real‑world deployments.