AID-H-008: Federated Learning Participant & Aggregation Security
Secure both participant admission and update aggregation in federated-learning architectures. The children independently control confidential aggregation, resistance to malicious or unreliable client updates, and identity/attestation/round admission for participating workloads. Enrollment establishes who may join a round; aggregation controls what accepted participants can learn or influence.
Scope boundary
Owns participant admission, contribution confidentiality, and malicious-update influence control for federated-learning rounds. Enrollment decides who may submit; aggregation controls what accepted participants can reveal or influence.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0018 Manipulate AI Model
- AML.T0018.000 Manipulate AI Model: Poison AI Model
- AML.T0020 Training Data Poisoning
- AML.T0025 Exfiltration via Cyber Means
- AML.T0073 Impersonation
MAESTRO
- Membership Inference Attacks (L1)
- Data Poisoning (Training Phase) (L1)
- Data Poisoning (L2)
- Data Exfiltration (L2)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM05:2026 Data and Model Poisoning
OWASP ML Top 10 2023
- ML02:2023 Data Poisoning Attack
- ML03:2023 Model Inversion Attack
- ML04:2023 Membership Inference Attack
- ML10:2023 Model Poisoning
OWASP Top 10 for Agentic Applications 2026
- N/A
NIST Adversarial Machine Learning 2025
- NISTAML.011 Model Poisoning (Availability)
- NISTAML.013 Data Poisoning
- NISTAML.024 Targeted Poisoning
- NISTAML.026 Model Poisoning (Integrity)
- NISTAML.032 Reconstruction
- NISTAML.033 Membership Inference
- NISTAML.034 Property Inference
Cisco Integrated AI Security and Safety Framework
- AITech-6.1 Training Data Poisoning
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-10.2 Model Inversion
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-10.2.1 Model Inversion
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- DP: Data Poisoning
Databricks AI Security Framework 3.0
- Datasets 3.1: Data poisoning