跳转至

联邦学习中破坏模型置信度的温度缩放攻击

文章背景与核心概要

在现代高风险应用中，预测置信度是触发风险感知逻辑（如人工介入、拒绝预测和保守回退机制）的核心控制信号。然而，现有的联邦学习（FL）攻击研究大多集中于操纵分类准确率或植入后门，忽视了模型置信度校准这一关键脆弱面。

本文介绍了温度缩放攻击（Temperature Scaling Attack, TSA），这是一种新型的联邦学习训练阶段攻击。TSA 能够在保持正常预测准确率和优化信号的同时，战略性地破坏模型的置信度校准。通过在本地训练期间将学习率与温度缩放进行耦合，攻击能够绕过高风险环境中的风险控制逻辑，从而导致严重的现实世界安全隐患，例如医疗验证漏报率激增以及自动驾驶中的置信度门控失效。

论文概览

  • 标题： Temperature Scaling Attack Disrupting Model Confidence in Federated Learning
  • 作者： Kichang Lee, Jaeho Jin, JaeYeon Park, Songkuk Kim, JeongGil Ko
  • 主要学科： 机器学习 (cs.LG)（交叉收录于人工智能与新兴技术领域）
  • arXiv ID： arXiv:2602.06638 (v3)
  • 提交时间： 2026年2月6日；最后修订： 2026年9月3日

Paper Overview

  • Title: Temperature Scaling Attack Disrupting Model Confidence in Federated Learning
  • Authors: Kichang Lee, Jaeho Jin, JaeYeon Park, Songkuk Kim, JeongGil Ko
  • Primary Subject: Machine Learning (cs.LG) (Cross-listed with Artificial Intelligence and Emerging Technologies)
  • arXiv ID: arXiv:2602.06638 (v3)
  • Submitted: February 6, 2026; Last Revised: September 3, 2026

摘要

预测置信度是任务关键型系统中的基础控制信号，直接支配着诸如升级、弃权和保守回退等风险感知逻辑。虽然先前的联邦学习攻击主要针对准确率或植入后门，但我们发现模型置信度校准是一个独特的攻击目标。

我们提出了温度缩放攻击（Temperature Scaling Attack, TSA），这是一种在训练阶段破坏校准同时保持准确率的攻击方法。通过在本地训练中注入带有“学习率-温度耦合”的温度缩放，TSA 能够在保持预测准确率和常见优化信号接近良性训练的同时，改变模型的置信度。

我们在非独立同分布（Non-IID）设置下进行了收敛性分析，结果表明这种耦合控制了主要的更新尺度，同时留下了有界的温度引起残差，从而产生了带有额外残差项的标准非凸联邦学习收敛结构。

在三个基准测试中，TSA 大幅改变了校准（例如在 CIFAR-100 上误差增加了 145%），而准确率变化小于 2%，并且在强聚合和事后校准防御下依然有效。案例研究进一步表明，即便准确率保持不变，它仍会导致医疗验证漏报率激增高达 7.2 倍以及自动驾驶中严重的置信度门控失效。总体而言，我们的研究结果确立了校准完整性作为联邦学习中关键攻击面的地位。

Abstract

Predictive confidence serves as a foundational control signal in mission-critical systems, directly governing risk-aware logic such as escalation, abstention, and conservative fallback. While prior federated learning attacks predominantly target accuracy or implant backdoors, we identify confidence calibration as a distinct attack objective.

We present the Temperature Scaling Attack (TSA), a training-time attack that degrades calibration while preserving accuracy. By injecting temperature scaling with learning rate-temperature coupling during local training, TSA shifts model confidence while keeping predictive accuracy and common optimization signals close to benign training.

We provide a convergence analysis under non-IID settings, showing that the coupling controls the primary update scale while leaving a bounded temperature-induced residual, yielding the standard non-convex FL convergence structure with an additional residual term.

Across three benchmarks, TSA substantially shifts calibration (e.g., 145% error increase on CIFAR-100) with <2% accuracy change, and remains effective under robust aggregation and post-hoc calibration defenses. Case studies further show up to a 7.2x increase in missed verifications in healthcare and severe confidence-gating failures in autonomous driving, even when accuracy is unchanged. Overall, our results establish calibration integrity as a critical attack surface in federated learning.

元数据与分类

license icon

Metadata & Classifications

license icon