Tests of personalized systems found that an attacker could target selected AI models while largely preserving predictions from designated models.
The study introduces the Friend-Safe Adversarial Attack, which creates altered inputs designed to cause errors in selected models while keeping other models’ predictions largely unchanged. The researchers tested the approach on MNIST, CIFAR-10 and SVHN, as well as additional personalization methods, model pairings and image datasets.
With exact access to the friend models, the attack reached at least an 88% success rate against target models and maintained at least 81% accuracy on friend models. When the attacker instead used information available to a passive aggregation server, friend-model predictions were preserved by 92–96% on MNIST, 70–74% on SVHN and 37–43% on CIFAR-10.
How the targeted attack performed
In the primary setup—local fine-tuning personalization with exact access to the designated friend models—the attack achieved at least an 88% success rate on target, or “enemy,” models while maintaining at least 81% accuracy on friend models. Standard projected-gradient attacks performed worse at preserving friend predictions, reducing friend accuracy to near 0% on CIFAR-10 and SVHN and to 52.2% on MNIST.
Additional experiments found the selective effect across the FedPer personalization method, different numbers of friend models, limited or surrogate access, and the Tiny-ImageNet and CIFAR-100 datasets. The abstract says the strongest friend-preservation results are an upper bound for the exact-access scenario. With information available to a passive aggregation server—a friend’s final upload, the global model and an extrapolation of those models—the attack preserved 92–96% of friend predictions on MNIST, 70–74% on SVHN and 37–43% on CIFAR-10.
A security issue for personalized systems
Federated learning allows multiple clients to train models without pooling their raw data, but personalization means those clients can end up with different models. The findings indicate that an attacker may be able to target some of those models while avoiding others, rather than causing the same errors everywhere.
That selective behavior adds a security issue for systems using multiple personalized models. The authors say defenses should account for attacks that distinguish between target and non-target models, including situations in which an attacker has only the information observed by a passive server.
Tests, access limits and caveats
This is an experimental study based on image-recognition benchmarks, including MNIST, CIFAR-10, SVHN, Tiny-ImageNet and CIFAR-100, and several simulated personalization and attacker-access settings. The abstract reports broad testing across model pairings and personalization strategies, but it does not describe deployment in a real federated system or tests on clinical data.
The headline friend-preservation results require exact access to the friend models and are presented by the researchers as an upper bound. Performance changes when the attacker has only a surrogate model or information available to a passive aggregation server; in particular, preservation on CIFAR-10 falls to 37–43% in the latter setting. The study therefore shows the attack’s behavior under specified experimental conditions, not a universal level of protection or risk for all federated-learning systems.
// Source
Discover Computing · 2026 · DOI: 10.1007/s10791-026-10547-6
Authors: Hyun Kwon, Dae-Jin Kim
Institutions: Kyung Hee University, Korea Military Academy
