ML Security PapersFedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization
Md Akil Raihan Iftee 1, Syed Md. Ahnaf Hasan 1, Amin Ahsan Ali 1, AKM Mahbubur Rahman 1, Sajib Mistry 2, Aneesh Krishna 2
Published on arXiv
2511.19248
Data Poisoning Attack
OWASP ML Top 10 — ML02
Key Finding
Compromised federated participants using FedPoisonTTP substantially diminish overall test-time adaptation performance across clients on corrupted vision benchmarks.
FedPoisonTTP
Novel technique introduced
Test-time personalization in federated learning enables models at clients to adjust online to local domain shifts, enhancing robustness and personalization in deployment. Yet, existing federated learning work largely overlooks the security risks that arise when local adaptation occurs at test time. Heterogeneous domain arrivals, diverse adaptation algorithms, and limited cross-client visibility create vulnerabilities where compromised participants can craft poisoned inputs and submit adversarial updates that undermine both global and per-client performance. To address this threat, we introduce FedPoisonTTP, a realistic grey-box attack framework that explores test-time data poisoning in the federated adaptation setting. FedPoisonTTP distills a surrogate model from adversarial queries, synthesizes in-distribution poisons using feature-consistency, and optimizes attack objectives to generate high-entropy or class-confident poisons that evade common adaptation filters. These poisons are injected during local adaptation and spread through collaborative updates, leading to broad degradation. Extensive experiments on corrupted vision benchmarks show that compromised participants can substantially diminish overall test-time performance.
Key Contributions
- Identifies and formalizes the security threat of test-time data poisoning in the federated personalization setting, a previously overlooked vulnerability.
- Proposes FedPoisonTTP, a grey-box attack that distills a surrogate model via adversarial queries and synthesizes in-distribution poisons using feature-consistency constraints.
- Demonstrates that high-entropy and class-confident poisons evade common adaptation filters and cause broad performance degradation across clients via collaborative update propagation.
🛡️ Threat Analysis
FedPoisonTTP is fundamentally a data poisoning attack: it synthesizes poisoned inputs injected during local test-time adaptation (which acts as on-the-fly training data for the adaptation step), corrupting local models that then spread the degradation through federated aggregation. The goal is broad performance degradation — characteristic of ML02 — not a hidden triggered behavior (ML10). The compromised participant submitting adversarial model updates is the canonical federated poisoning pattern that ML02 covers.