# Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design

Source: [Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design](<https://www.sota2.com/research/paper/6a3a1367206542251d7c746b>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-06-24T05:00:22.884Z

Authors: Mingyuan Fan, Cen Chen

Published: 2026-06-22T02:44:46.000Z

## Abstract

The proliferation of IoT devices has fueled distributed edge systems to collect vast amounts of sensitive data, creating fertile ground for on-device machine learning applications. While federated learning (FL) mitigates privacy concerns by exchanging model parameters instead of raw data, we identify a critical blind spot in current research. We examine the most commonly used personalized federated learning (PFL) methods, which allow clients to maintain private, personalized models to address data heterogeneity across clients. Through systematic analysis, we reveal that PFL methods exhibit heightened vulnerability to transfer-based adversarial attacks compared to centralized learning paradigms. Wherein, malicious clients can exploit local model knowledge to craft adversarial examples that can compromise peer clients' personalized models. We establish this vulnerability through both theoretical analysis and empirical evaluation across multiple benchmark datasets, demonstrating significant accuracy drops across various PFL methods. To address this challenge, we propose a defense framework combining stochastic input noise, input-scaled trace regularization, and parameter sensitivity maximization to improve FL's robustness. Our findings establish the first systematic study of adversarial threats in PFL systems, providing both diagnostic tools and practical countermeasures.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Classification on GTSRB (Acc, AD)](<https://www.sota2.com/research/sota/classification-on-gtsrb-acc-ad.md>): Classification; GTSRB; Accuracy: 99.53.

- [Personalized Federated Learning on CIFAR-100 (test)](<https://www.sota2.com/research/sota/personalized-federated-learning-on-cifar-100-test.md>): Personalized Federated Learning; CIFAR-100 (test); Accuracy: 49.02.

- [Personalized Federated Learning on CIFAR-10](<https://www.sota2.com/research/sota/personalized-federated-learning-on-cifar-10.md>): Personalized Federated Learning; CIFAR-10; Accuracy: 79.32.

- [Personalized Federated Learning Vulnerability Assessment on CIFAR-10](<https://www.sota2.com/research/sota/personalized-federated-learning-vulnerability-assessment-on-cifar-10.md>): Personalized Federated Learning Vulnerability Assessment; CIFAR-10; Average Attack Deviation: 3.84.

- [Personalized Federated Learning Vulnerability Assessment on CIFAR-100](<https://www.sota2.com/research/sota/personalized-federated-learning-vulnerability-assessment-on-cifar-100.md>): Personalized Federated Learning Vulnerability Assessment; CIFAR-100; Average AD: 1.87.

- [Personalized Federated Learning Vulnerability Assessment on GTSRB](<https://www.sota2.com/research/sota/personalized-federated-learning-vulnerability-assessment-on-gtsrb.md>): Personalized Federated Learning Vulnerability Assessment; GTSRB; Average Attack Deviation (AD): 2.34.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.22782>)

[PDF](<https://arxiv.org/pdf/2606.22782.pdf>)