Proteus: Model Leakage-Induced Adversarial Attack in Federated Learning

Abstract: The massive volume and privacy-sensitive nature of visual data have made federated learning (FL) a preferred paradigm for training vision models across distributed data sources. However, during training, FL repeatedly shares the in-progress model with randomly selected participants. This project investigates an overlooked yet practical threat arising from this sharing process: leaked intermediate models can be exploited by adversaries to craft adversarial examples that compromise the final deployed model. Although directly using an intermediate model, especially one leaked early in training, as a surrogate yields only moderate attack gains, it can serve as an anchor for anticipating subsequent training dynamics. Based on this insight, we propose Proteus, a model leakage-induced adversarial attack that leverages a leaked model to identify vulnerabilities that persist throughout training, thereby generating adversarial examples that remain effective against the final deployed model. For the first time, we show that models exposed well before convergence can already pose substantial risks to the final model, even if it undergoes hundreds of additional training rounds after leakage. Extensive experiments across diverse datasets, neural architectures, and FL configurations confirm the severity of this threat. Proteus exploits inherent model leakage in FL and improves the attack success rate from 59.75% when directly using the leaked model to 85.40%, even when leakage occurs after only 30% of the total training process.

For more technical details and experimental results, we invite you to check out our paper: Junjie Shan, Yue Zhang, Ziqi Zhao, and Ka-Ho Chow, "Proteus: Model Leakage-Induced Adversarial Attack in Federated Learning," European Conference on Computer Vision (ECCV), 2026.

@inproceedings{shan2026proteus,
      title={Proteus: Model Leakage-Induced Adversarial Attack in Federated Learning},
      author={Junjie Shan and Yue Zhang and Ziqi Zhao and Ka-Ho Chow},
      booktitle={European Conference on Computer Vision},
      year={2026}
}

This repository is implemented with Python 3.9. You can create a virtual environment and install the required libraries with the following command:

conda create --name proteus python=3.9
conda activate proteus
pip install -r requirements.txt

The CUDA backend is tested on NVIDIA GPUs. A CPU-only run is supported but slow.

Before running the pipeline, ensure you have the RAF-DB dataset prepared. It is available from the official RAF-DB site (http://www.whdeng.cn/RAF/model1.html), with mirrors on Kaggle and HuggingFace.

Place the dataset under ./data/ with the following structure:

data/
└── raf_db_dataset/
    ├── DATASET/
    │   ├── train/
    │   │   ├── 1/  (Surprise)
    │   │   ├── 2/  (Fear)
    │   │   ├── 3/  (Disgust)
    │   │   ├── 4/  (Happiness)
    │   │   ├── 5/  (Sadness)
    │   │   ├── 6/  (Anger)
    │   │   └── 7/  (Neutral)
    │   └── test/
    │       └── 1/ ... 7/
    ├── train_labels.csv
    └── test_labels.csv

.
├── attacks/                   # Attack implementations
│   ├── pgd.py                 # PGD baseline (Madry et al., 2018)
│   └── proteus.py             # Proteus attack (ours)
├── models/                    # Model architectures
│   └── resnet.py              # ResNet-18 (96x96 input)
├── datasets/                  # Dataset loaders
│   └── rafdb.py               # RAF-DB emotion dataset
├── assets/                    # Figures used in this README
├── data/                      # Place RAF-DB here (not included)
├── train_fl.py                # FedAvg federated training
├── eval_attack.py             # Transfer attack evaluation
└── requirements.txt

Proteus crafts a perturbation on a leaked (surrogate) model captured early in FL training and steers it into a parameter-insensitive region, so it stays effective against the final deployed model even after hundreds of additional training rounds (i.e., it suffers little feature drift). Each attack iteration runs three phases (see the figure above):

• Phase 1 — Persistent Direction Discovery. The gradient is averaged over an ensemble of stochastic input transformations. Components tied to brittle, parameter-sensitive features cancel out during averaging, leaving a primary direction toward more stable, low-sensitivity regions.
• Phase 2 — Adversarial Margin Expansion. A look-ahead perturbation is extrapolated along the sign of the Phase-1 direction (step set by --drift-step), and the persistent gradient is re-estimated there to obtain a margin gradient, creating a safety margin against future feature drift.
• Phase 3 — Momentum-Guided Fusion and Ascent. The primary and margin gradients are summed, normalized by their mean absolute value, accumulated with momentum, and applied as a projected L-infinity signed step within the budget.

Train a global model with FedAvg. A checkpoint is saved every round, so any round can later be treated as the "leaked" intermediate model:

python train_fl.py \
    --output-dir checkpoints/rafdb_fedavg \
    --rounds 200 \
    --clients 100 \
    --clients-per-round 10 \
    --local-epochs 5 \
    --lr 0.01 \
    --save-best

For non-IID training, add --partition dirichlet --dirichlet-alpha 0.1.

Outputs: Per-round global checkpoints round{NNNN}_numc7_global.pt, plus best.pt when --save-best is set.

Craft adversarial examples on an early ("leaked") checkpoint and measure how well they fool the final ("deployed") checkpoint. The script reports Transfer ASR (conditional): among samples that both models classify correctly, the fraction the target misclassifies under attack.

python eval_attack.py \
    --source-ckpt checkpoints/rafdb_fedavg/round0060_numc7_global.pt \
    --target-ckpt checkpoints/rafdb_fedavg/best.pt \
    --attacks pgd proteus \
    --num-samples 2048

Outputs: Clean accuracy of both models and the Transfer ASR for each selected attack (PGD baseline and Proteus).

# Step 1: Train the federated model (checkpoints saved every round)
python train_fl.py --output-dir checkpoints/rafdb_fedavg --rounds 200 --save-best

# Step 2: Use an early checkpoint as the leaked surrogate and attack the final model
python eval_attack.py \
    --source-ckpt checkpoints/rafdb_fedavg/round0060_numc7_global.pt \
    --target-ckpt checkpoints/rafdb_fedavg/best.pt \
    --attacks pgd proteus

The core finding: a model leaked early in training is already a dangerous surrogate. The figure below reports Transfer ASR as a function of when the model is leaked (as a percentage of total training progress). Proteus consistently outperforms the PGD baseline and far exceeds the naive strategy of directly attacking with the leaked model, even when leakage happens after only ~30% of training.

In the paper, we further show that this threat holds across diverse datasets (RAF-DB, CIFAR-10, TinyImageNet), neural architectures (ResNet-18, MobileNetV3, EfficientNet), non-IID client partitions, and various FL configurations, and that Proteus remains resilient under five representative defenses.

The implementations of the other baseline attacks compared against in our paper follow the TransferAttack framework. We thank the authors for their excellent open-source work.