Unmasking Composite Adversaries: A New Threat Model for Federated Learning

Abstract

Federated learning (FL) is increasingly adopted in distributed and privacy-preserving applications for decentralized intelligence, yet it remains highly vulnerable to adversarial attacks. Existing defenses remain fundamentally limited to single-attack scenarios, which overlook the real-world risk of coordinated, multivector attacks. This work presents a comprehensive framework for composite attack in FL, where adversaries simultaneously deploy label flipping, feature manipulation, and data poisoning across clients. We formalize the concept of composite attacks and prove that their joint effect is nonadditive, governed by a quadratic interaction structure in gradient space, producing amplification effects. We define and formalize the attack interaction and amplification phenomenon, where multiple attacks spontaneously align in gradient space, causing greater damage than individual attacks. Under the nonconvex optimization setting, we theoretically demonstrate that composite attacks cause optimization instability and increase gradient variance, while empirically exposing the vulnerability of several existing defenses on benchmark MNIST, CIFAR-100, and NSL-KDD datasets under single and composite attack scenarios. Additionally, we introduce the attack interaction score and the attack amplification ratio to quantify the interaction and amplification effect caused by the composite attack. These findings expose critical gaps in current FL defense strategies and underscore the urgent need for adaptive, composite-resilient solutions to secure FL systems against sophisticated adversaries.