A clean-label poisoning attack can undermine federated learning in vehicular networks without changing the labels attached to training samples, according to a paper submitted on October 23, 2026. The study also proposes a defense that, its results show, reduces attack success while preserving accuracy on clean data.
Authors Yalin E. Sagduyu, Tugba Erpek, Nathan Stephenson and Mengran Xue examine the interaction between poisoning and defense. They model Basic Safety Message classification for anomaly detection as a distributed learning task across a vehicular network whose topology changes.
The attack operates in feature space: it perturbs benign samples toward malicious feature extremes while leaving their labels intact. This reduces class separability—the distinction between classes that the learning system seeks to recognize. The labels remain unchanged even as the samples’ features are altered.
Countering a clean-label poisoning attack
The proposed feature-consistency relabeling defense detects suspicious samples and relabels them. In the study’s results, this approach keeps attack success low without reducing classification accuracy on clean data.
The researchers also use a game-theoretic framework to model interactions between attackers and defenders. The framework characterizes equilibrium strategies using attack effectiveness and cost parameters.
The clean-label poisoning attack becomes more effective as the number of compromised nodes increases, the authors report. Their results therefore connect attack performance to the extent of node compromise within the vehicular network.
The defense also changes the modeled strategic balance: the study reports that feature-consistency relabeling shifts equilibrium regions toward regimes that discourage attacking behavior.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.