How Robust Are Robust Aggregators? Model Poisoning in Federated Learning under Data Heterogeneity

Federated learning trains a shared model acrossmany clients without collecting their data, but a few maliciousclients can sabotage training by sending falsified updates. Robustaggregation rules are designed to resist such attacks, yet theyare often evaluated on homogeneous data, whereas real clientshold heterogeneous data. We study how data heterogeneity affectsfive aggregation rules (FedAvg, coordinate-wise median, trimmedmean, Krum and norm clipping) under four poisoning attacks,in 585 experiments on Fashion-MNIST with Dirichlet-partitionedclients. We find that heterogeneity strongly amplifies the attacks:under sign flipping with 20% malicious clients, the robust ruleslose less than 2 points of accuracy with nearly IID data, but 8 to12 points with highly heterogeneous data. In this setting, Krumis 39 points less accurate than FedAvg even without attackers,while norm clipping, which bounds each client’s influence withoutdiscarding updates, is the most resilient. These results suggestthat robust aggregation rules should be evaluated under realisticnon-IID conditions.