Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips

Researchers demonstrate a novel backdoor attack against Federated Learning systems by exploiting hardware faults (bit-flips) to poison model parameters during training. The attack achieves 94% success rate on ResNet-18 with minimal fault injections, expanding the threat surface of distributed ML systems beyond software-based attacks.

This research exposes a critical vulnerability in Federated Learning architectures by bridging hardware-level attacks with distributed machine learning systems. Traditional FL security focuses on algorithmic defenses against data poisoning, but this work demonstrates that adversaries can weaponize hardware faults like Rowhammer to inject backdoors during the federated training process itself. The attack is particularly concerning because it operates at the model adaptation phase and requires minimal computational overhead—just 10 faults per malicious client across 19 occurrences suffices for near-complete attack success.

The broader context reveals an expanding attack surface as organizations increasingly adopt decentralized learning architectures. Hardware fault attacks have become practically viable through techniques like Rowhammer, which exploits DRAM vulnerabilities in commodity systems. FL deployments typically involve heterogeneous hardware controlled by potentially untrusted parties, creating ideal conditions for such attacks. This research highlights the intersection of physical security and machine learning—a gap often overlooked in cryptographic and algorithmic security frameworks.

For organizations deploying FL systems, this introduces non-trivial security implications. Standard FL defense mechanisms that filter malicious updates or add noise may prove insufficient against hardware-induced poisoning. The attack's task-agnostic nature means backdoors persist across different models and datasets, amplifying risk. Industries relying on federated learning for sensitive applications—healthcare, financial services, autonomous systems—must now account for hardware-level threat modeling alongside software defenses. Future FL implementations will require hardware security measures, anomaly detection at the parameter level, and potentially attestation mechanisms to verify client integrity throughout the training process.

• →Federated Learning systems face a new category of backdoor attacks exploiting hardware faults rather than algorithmic vulnerabilities
• →A ResNet-18 model can be successfully poisoned with just 10 bit-flips per malicious client across 19 occurrences, achieving 94% attack success
• →The attack is task-agnostic and works across different models and datasets, indicating broad applicability across FL deployments
• →Hardware fault techniques like Rowhammer create practical attack vectors against distributed learning systems previously considered secure at the algorithmic level
• →Current FL defense mechanisms focusing on software-level poisoning may be insufficient against hardware-induced model corruption