Proteus: Model Leakage-Induced Adversarial Attack in Federated Learning

The massive volume and privacy-sensitive nature of visualdata have made federated learning (FL) a preferred paradigm for train-ing vision models across distributed data sources. However, during train-ing, FL repeatedly shares the in-progress model with randomly selectedparticipants. This paper investigates an overlooked yet practical threatarising from this sharing process: leaked intermediate models can be ex-ploited by adversaries to craft adversarial examples that compromise thefinal deployed model. Although directly using an intermediate model,especially one leaked early in training, as a surrogate yields only mod-erate attack gains, it can serve as an anchor for anticipating subsequenttraining dynamics. Based on this insight, we propose Proteus, a modelleakage-induced adversarial attack that leverages a leaked model to iden-tify vulnerabilities that persist throughout training, thereby generatingadversarial examples that remain effective against the final deployedmodel. For the first time, we show that models exposed well before con-vergence can already pose substantial risks to the final model, even if itundergoes hundreds of additional training rounds after leakage. Exten-sive experiments across diverse datasets, neural architectures, and FLconfigurations confirm the severity of this threat. Proteus exploits in-herent model leakage in FL and improves the attack success rate from59.75% when directly using the leaked model to 85.40%, even when leak-age occurs after only 30% of the total training process.