Mitigating Poisoning Threats and Their Privacy Implications in Federated Learning
Year: 2026
Type: dissertation
Abstract: Advancements in Machine Learning (ML) and distributed intelligence have accelerated the adoption of Federated Learning (FL) as a key enabler of privacy-preserving applications in domains such as IoT, healthcare, and Beyond 5G networks. FL enables collaborative model training without centralising data, but its distributed and heterogeneous nature introduces new security and privacy challenges. In addition to conventional adversarial threats, FL faces unique vulnerabilities including poisoning attacks, and privacy leakage through model updates via threats like inference attacks. Addressing these challenges is critical for ensuring trust in next-generation distributed AI systems. This thesis investigates such threats in FL with a particular emphasis on poisoning attacks and the interplay between poisoning and privacy leakage. The work also investigates how poisoning attacks can be mitigated, essentially preventing any privacy vulnerabilities induced via poisoning. To this end, four major contributions are presented: Rec-Def, SHERPA, X-SHIELD, and ROAM. First, Rec-Def is proposed as a defence against GAN-based inference attacks, highlighting the connection between poisoning and privacy risks. Second, SHERPA introduces an interpretable aggregation algorithm that employs Explainable AI (XAI) technique called SHAP feature attributions to detect poisoned model updates, improving the transparency and reliability of poisoning detection. Third, X-SHIELD extends this approach to hierarchical FL, combining explanation-guided detection with scalable clustering to address robustness in large-scale FL deployments. Finally, the thesis explores the extension of defences and its limitations on fully Decentralised FL (DFL) architectures. For this, the thesis proposes an offensive use of XAI via an new stealthy poisoning attack called ROAM, based on Layerwise Relevance Propagation (LRP) and designs a countermeasure that perturbs sensitive neurons to mitigate privacy leakage via poisoning. The effectiveness of the proposed approaches is validated through extensive experiments across multiple datasets, learning scenarios, and adversarial settings. Results demonstrate that the solutions enhance robustness and privacy while remaining scalable and adaptable to diverse FL environments. Overall, this thesis contributes to advancing the safety and trustworthiness of FL by investigating novel vulnerabilities introducing and solutions that balance privacy preservation, poisoning robustness, and justifiability. These contributions provide both theoretical insights and design mechanisms for deploying FL securely in critical infrastructures such as 6G networks, IoT ecosystems, and industrial applications.
Author: Sandeepa, Chamara
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7165993495