Master's thesis presentation - Matisse Colombon

Title: Adapt and Conquer: SecureDL’s Robustness to Multi-Round Model Poisoning

Abstract:

SecureDL is a Byzantine-robust aggregation scheme for decentralized learning that combines cosine-similarity filtering, normalization, and secure multiparty computation, claiming robustness against arbitrarily many colluding clients regardless of what they know about it. It remains untested against adaptive attacks. We implement two multi-round-consistency attacks against it. PoisonedDL ports PoisonedFL, a fixed-direction federated poisoning attack, to the decentralized setting through a two-phase procedure that reconstructs the hidden network state. Adaptive-Threshold PoisonedDL (AT-PoisonedDL) instead sizes each round's injection by binary search against an estimate of SecureDL's cosine acceptance boundary. The outcome splits by attacker knowledge rather than by dataset. Defense-agnostic PoisonedDL is absorbed on MNIST, FashionMNIST and Purchase, ending within one percentage point of baseline; its large effect on CIFAR-10 is better explained as an architecture-enabled training instability than as directional poisoning. Threshold-aware AT-PoisonedDL defeats the defense on all four datasets, inducing a period-2 orbit whose lower phase reaches the random-guessing floor on the three easier tasks (the alternate phase runs higher) and 10 to 50 percent on CIFAR-10, and remains effective when it over-estimates the threshold. The cosine threshold is the single decisive parameter, making this a counterexample to SecureDL's robustness claim rather than an attack outside its design.